Power Distribution Substation Dataset for Cybersecurity IoE

Dataset for the paper 'Stealth AI-Enabled MitM Attacks in Power Distribution SCADA Systems' (2025).

Data from the behavior of the monitored variables of a Voltage Transformer in a power substation. Voltage step-down unit.

Variable Description

Trigonometric transform of day and hour

Phase currents A, B, and C

Ambient temperature

Oil temperature

Winding temperature H

Winding temperature X

Winding temperature Y

TAP position

Data Collection Methodology

The data collection was performed by an industrial computer running Ubuntu 24.04.1 LTS, configured exclusively for datalogger function. The device was connected to the local network switches of the substation, whose ports were configured with mirroring (port mirroring), allowing the replication of the target traffic. The industrial computer operated with an Ethernet interface (eth1), a 3G modem for remote maintenance, and a 1 TB internal hard drive for temporary storage of the captured files. 

Packet capture was performed using the dumpcap tool, generating files in .pcapng} format with approximately 100~MB each, corresponding to around 4 minutes of traffic. The file names follow the pattern arc\_SSSSS\_AAAAMMDDhhmmss.pcapng, indicating the date and time of capture. After collection, the .pcapng files were grouped by hour and compressed using the 7-Zip tool, forming .7z files with around 15 packets each. These files are later transferred manually or via automated scripts to a server, where they are renamed following the pattern ARC\_AAAAMMDDhhmmss.pcapng and stored in directories organized by year, month, and day.

The extraction of the variables of interest for the models was done in two steps. First, the .7z files were decompressed using the 7-Zip command line utility. Then, the .pcapng packets were processed using the dnp3\_analog\_parser tool, developed to identify and extract analog data from DNP3 packets. This tool uses the libpcap library and is compiled in C with support for the DNP3 protocol. The extracted data were organized into .csv files containing the variables in tabular format, with temporally synchronized records for later training and validation of the models.

Units of Measurement

Current: A (Amperes)

Temperature: °C (Celsius)