A Network Intrusion Detection Dataset for Geothermal Well Scale inhibitor Injection Control Systems

This repository contains a network intrusion detection dataset collected from a semi-physical SCADA testbed for geothermal well scale-inhibitor injection systems. The dataset includes raw packet-capture files in .pcapng format and final labeled data files in .csv format, organized into training and testing subsets. The raw files preserve the original network traffic captured from communication among programmable logic controllers, the operator station, the engineering station, and the traffic collection node. The final data files provide analysis-ready samples derived from the captured traffic, together with labels indicating whether a sample is malicious and, if applicable, whether it belongs to scanning, denial-of-service, ARP spoofing, man-in-the-middle, or unknown attack traffic. A feature index workbook is also provided to describe the meaning of each feature in the final dataset. This dataset is intended to support research on industrial intrusion detection, attack analysis, and machine-learning-based security analytics in geothermal well SCADA environments.