Cybersecurity dataset of water distribution plant communications under MITM attacks

This dataset contains MQTT communication records from a water distribution level control system subjected to Man-in-the-Middle (MITM) cyberattacks. The system is composed of multiple level plants (physical and virtual) exchanging control commands and process measurements through an MQTT broker. MITM attacks target both communication directions: Control commands (…/consigna), sent from a supervisory PC to the plants Process parameters (…/parametros), sent from the plants to the PC During an attack campaign, message payloads are selectively modified depending on the message source. For control commands, pump and/or valve setpoints are altered according to predefined probabilities. For process messages, sensor readings and/or control signals are manipulated. Value modifications follow realistic constraints, introducing moderate (5–20%) or severe (up to 80%) deviations relative to the original value. Each record includes both original and modified messages, linked through a shared UUID, allowing direct comparison and integrity analysis. Attack campaigns have variable durations and are separated by cooldown periods to emulate realistic intrusion behavior. Acknowledgements This activity is carried out in execution of the Strategic Project "Critical infrastructures cybersecure through intelligent modeling of attacks, vulnerabilities and increased security of their IoT devices for the water supply sector" (C061/23), the result of a collaboration agreement signed between the National Institute of Cybersecurity (INCIBE) and the University of A Coruña. This initiative is carried out within the framework of the funds of the Recovery, Transformation and Resilience Plan, financed by the European Union (Next Generation), the project of the Government of Spain that outlines the roadmap for the modernization of the Spanish economy, the recovery of economic growth and job creation, for the solid, inclusive and resilient economic reconstruction after the COVID19 crisis, and to respond to the challenges of the next decade.