a large dataset of 609,934 real Modbus packets

a large dataset of 609,934 real Modbus packetsIn industrial control systems (ICS), the Modbus protocol remains a cornerstone for communication between field devices and supervisory systems. However, limited availability of diverse and realistic datasets for Modbus TCP traffic hinders the development of advanced cybersecurity solutions. In this study, we present a novel approach to synthesize Modbus TCP packet data using a Wasserstein Generative Adversarial Network (WGAN) augmented with Gumbel-Softmax sampling. Our system learns from a large dataset of 609,934 real Modbus packets, replicating their structure, byte distribution, and variability to produce synthetic yet protocol-valid packet data. We design and implement a generator-critic architecture, optimizing training with gradient penalties and leveraging PyTorch for scalability. Evaluation of the generated packets demonstrates a 93.92% Test System Reception Rate (TSRR) when interacting with a Modbus server, confirming their validity and realism. Furthermore, statistical comparisons between real and generated packet byte distributions reveal significant alignment, while diversity metrics and structural conformity ensure utility in anomaly detection and robustness testing. This synthetic data solution has promising implications for training intrusion detection systems (IDS) in resource-constrained or privacy-sensitive environments, providing a secure, scalable, and high-fidelity alternative to raw packet captures.

搜集汇总

背景与挑战

背景概述

该数据集包含609,934个真实的Modbus TCP数据包，采集自工业控制系统环境，涵盖完整的通信字节级结构，旨在解决工业网络安全研究中真实Modbus流量稀缺的问题。它作为基于Wasserstein GANs和Gumbel-Softmax采样的合成数据生成模型的训练基础，合成数据包在实时服务器上达到93.92%的接收率，适用于入侵检测、异常检测和协议模糊测试等应用。