Longitudinal Cyber-Physical Anomaly Detection Dataset (LCPADD)

LCPADD is a longitudinal cyber-physical dataset captured from five operational secondary substations in Southern Sweden over a six-month period. The dataset addresses the scarcity of real, high-fidelity operational data for smart grid cybersecurity research, which often relies on synthetic traffic or short-duration testbeds. LCPADD comprises approximately 650 million network packets and 353 million process measurements, providing a synchronized view of the cyber layer (packet-level network flows) and physical layer (electrical telemetry). The collection environment reflects a heterogeneous multi-vendor architecture, featuring legacy IEC 60870-5-104 SCADA control and modern MQTT-based Industrial IoT telemetry, alongside SNMP device monitoring. Data integrity was verified through forensic timestamp analysis, achieving over 99% measurement availability for primary nodes. The dataset includes documented operational artifacts such as commissioning instability, daylight saving time adjustments, and a hardware event, offering realistic scenarios for algorithm evaluation. Fully anonymized and structured for interoperability, LCPADD supports research in anomaly detection, concept drift modeling, cross-domain intrusion detection, and predictive maintenance strategies.