950K-Entry Modbus/OPC-UA/Profinet Dataset - Multi-Protocol ICS/OT Intrusion Detection via Hybrid Threshold-ML Fusion in SDN

Important ** Must Read First ZENODO_V2_ADDENDUM.md DATASET_V2_DOCUMENTATION (1).md What is this dataset? 950,000 labeled network traffic entries covering three industrial protocols (Modbus/TCP, OPC-UA, Profinet) with five attack categories,designed for training ML-based Intrusion Detection Systems in SDN-controlled ICS environments. This is a complete reproducible research package including:- Raw pcap captures- Traffic generation and attack scripts- Feature extraction pipeline- Augmented and corrected processed datasets- Full audit documentation --- What is new in Version 2? Three data quality issues discovered during live SDN deployment were corrected: | Issue | v1 | v2 ||-------|----|----|| IAT feature | Row-order artifact, negative values | Real per-flow inter-arrival time || flow_duration | Constant 0.0 for all rows | Real per-flow elapsed time || IP addresses | All 127.0.0.1 loopback | Randomized realistic per-protocol IPs | **Performance impact:** RF F1 improved from 0.967 (v1) to 0.990 (v2). Version 1 is preserved unchanged for reproducibility of prior work. --- Quick Start **Minimum download for ML research:**Download `augmented_dataset_v2.csv` only. ```pythonimport pandas as pddf = pd.read_csv('augmented_dataset_v2.csv') # Recommended features (no leakage)FEATURES = ['length', 'iat', 'protocol_encoded', 'flow_duration']X = df[FEATURES]y = df['binary_label']``` **Full reproducibility:** Download all files. --- File Contents | File | Description | Size ||------|-------------|------|| `augmented_dataset_v2.csv` | Ready-to-use v2 dataset | ~150MB || `processed_datasets.zip` | v1 + v2 processed CSVs | ~300MB || `raw_csv.zip` | Per-protocol CSVs pre-augmentation | ~50MB || `raw_pcap.zip` | Original network captures | ~1GB || `scripts.zip` | All generation and preprocessing scripts | ~100KB || `DATASET_V2_DOCUMENTATION.md` | Full technical documentation | — || `dataset_v2_report.txt` | v1 vs v2 comparison report | — | --- Dataset Summary | Property | Value ||----------|-------|| Total entries | 950,000 || Protocols | Modbus/TCP, OPC-UA, Profinet || Attack types | Flood, Replay, Injection, Hijack, Timing || Normal entries | 300,000 || Attack entries | 650,000 || Raw unique entries | ~679,000 (before augmentation) || Features | 19 columns (see documentation) | ## Attack × Protocol Coverage | Attack | Modbus | OPC-UA | Profinet ||--------|--------|--------|---------|| Normal | ✅ | ✅ | ✅ || Flood | ✅ | ✅ | ✅ || Replay | ✅ | ✅ | ✅ || Injection | ✅ | ❌ | ❌ || Hijack | ❌ | ✅ | ❌ || Timing | ❌ | ❌ | ✅ | --- Known Limitations - Temporal features (hour, weekday) encode collection time — do not use for training- Single-host loopback collection — not distributed network capture- Attack coverage is protocol-specific (see matrix above)- Augmentation uses oversampling with replacement for underrepresented classes --- Baseline Results (v2, 4 clean features) | Model | F1 | AUC-ROC | Precision | Recall ||-------|-----|---------|-----------|--------|| Random Forest | 0.990 | 0.998 | 0.995 | 0.985 || Autoencoder | 0.835 | 0.874 | 0.970 | 0.733 || Hybrid AND-gate | 0.845 | — | 0.999 | 0.733 | 5-seed stability: F1 = 0.944 ± 0.026 --- Augmentation Methodology Raw captures produced ~679,000 unique entries. To achieve balanced protocol and class representation, files were oversampled with replacement or downsampled to target counts using random_state=42. Raw pre-augmentation CSVs are included for full traceability. --- Citation **Version 2:**Cadi AbderrahmaneMulti-Protocol ICS Dataset for SDN Security — Version 2.Zenodo. DOI: 10.5281/zenodo.20591610 **Version 1 (original):**Cadi, AbderrahmaneMulti-Protocol ICS Dataset for SDN Security.Zenodo. DOI: https://doi.org/10.5281/zenodo.XXXXXXX --- ## Contact DeltaLab Research Group ENSAM Casablanca, Hassan II University [[e-mail]] Key characteristics: ~950,000 labeled flow entries Multi-protocol coverage: Modbus/TCP, OPC-UA, Profinet Includes normal traffic and multiple attack classes Flow-based features derived from OpenFlow statistics Suitable for supervised, unsupervised, and hybrid ML evaluation Designed for controller-integrated SDN IDS research Potential applications: Intrusion Detection Systems (IDS) benchmarking SDN security research in ICS/OT environments Hybrid ML model evaluation (RF, AutoEncoder, ensemble methods) Runtime latency and deployment feasibility analysis