Datasets

Critical infrastructures encompass a wide range of process control systems, each with unique security needs. Securing diverse systems is a challenge since they require custom defenses. To address the gap, this study describes a process-aware anomaly detection framework that can automatically baseline the behavior of the process. Utilizing a sliding window Granger causality method, the framework detects time-varying dependencies, allowing it to capture stable and transient causal links across different operational states. Additionally, the anomaly detection framework considers the criticality of various components. The study evaluates the framework on a hardware-in-the-loop (HIL) water tank testbed. The framework successfully identified four sensors and actuator spoofing scenarios on the water tank system.List of Variables in PLC Memory<b>Variable name</b><b>Variable address</b><b>Variable Functionality</b>I_PbFillIX100.0Push button to manually fill the tankI_PbDischargeIX100.1Push button to manually discharge the tankI_Level_MeterIW100Display the level of water in the tankI_ModeSelector%IX100.2Switches between auto and manual processQ_Fill_Valve%QW101Pumps water into the tankQ_Discharge_Valve%QW102Discharge water from the tankQ_Display%QW100Shows the numerical current tank water levelQ_Fill_Light%QX100.0Lights when the filling process is on.Q_Discharge_Light%QX100.2Lights when the discharging process is on.I_Flow_Meter%IW101Shows the current diameter of the discharge valve nozzleLowSetpoint%MW1Used to actuate the automatic filling processHighSetpoint%MW2Used to actuate the automatic discharging processTankLevel%MW0Used to calibrate the water level and control the LowSetpoint/HighSetpointI_PbSet%MX0.1Used to set the Q_Fill_LightI_PbReset%MX0.2Used to set the Q_Discharge_LightQ_Discharge_Valve_M%MW3Used to set the manual discharging processQ_Fill_Valve_M%MW4Used to set the manual filling process<br>To investigate variable dependencies, we capture multivariate time series data from the OpenPLC’s hardware layer. In a physical system, the hardware layer represents the wired connection between the PLC, sensor, and actuator network. By capturing data from the hardware layer, we can track the state of the sensors, actuators, and the MODBUS memory map. The memory map includes discrete output coils, discrete input contacts, analog input registers, and holding registers. Table I shows the list of variables in the Water tank simulation.During data collection, the water tank is set to auto mode. A network-connected Python program writes random low and high setpoint values at a random interval. The Python program also randomly opens and closes the valve. The normal capture spans over 15 hours and has 893,795 entries of data. Table II provides details on the datasets.For abnormal data, we simulate four spoofing scenarios involving the level, flow sensor, fill valve, and Display interface. The level sensor measures the water level in the tank, the flow sensor measures the outgoing flow, and the fill valve controls the water inflow. The display interface is a digital meter showing the current water level in the tank.<br><b><i>Decription of the Datasets</i></b><b>Data Type</b><b>Duration</b><b>Total Sample size</b><b>Notes</b>Dataset 1: Normal Operation [monitor_data_randomized_setpoints]15 hours, 34 minutes, and 32 seconds893795Normal operation. Data used for baselining Water Tank using Frequency-Based Causal Structure AnalysisDataset 2: Level sensor spoof. [monitor_data_levelmeter]1 hour, 6 minutes, and 3 seconds64156Data captures during level sensor spoofing scenarioDataset 3: Flow meter sensor spoof [monitor_data_flowmeter]55 minutes and 1 second52439Data captures during flow meter spoofing scenarioDataset 4: Fill valve spoof. [monitor_data_fillvalve_march21st]1 hour, 21 minutes, and 54 seconds79224Data captures during fill valve spoofing scenarioDataset 5: Display interface anomaly. [monitor_data_Display]1 hour, 26 minutes, and 51 seconds84680Data captures during display interface spoofing scenarioDataset 6: Normal Operation [monitor_data_normal_march21st]1 hour, 24 minutes, and 23 seconds.81348Testing data for outlining creates normal thresholdFeel free to contact Dr. Rishabh Das for additional details.<b><i>[Email:- [e-mail] ]</i></b>or<b><i>[Email:- [e-mail]]</i></b><br>If you use this dataset, Please cite the following research paper.<b><i>"R. Das and G. Agendia, "Process-Aware Anomaly Detection in Industrial Control Systems Using Frequency-Based Causal Structure Analysis,"</i></b><b><i> </i></b><b><i>2025 IEEE World AI IoT Congress (AIIoT)</i></b><b><i>, Seattle, WA, USA, 2025, pp. 0228-0234, doi: 10.1109/AIIoT65859.2025.11105316."</i></b><br>