A network attack detection dataset collected from multiple real-world industrial control systems

In the context of Industry 4.0, with the gradual shift of Industrial Control Systems (ICSs) from physical isolation to partial openness, they face severe threats from increasing network attacks. Effective detection requires high-quality ICS datasets, yet existing options remain limited in quantity and quality. In this paper, we present the ICS-NAD dataset collected in real-world ICS scenarios with three well-known ICS brands. It contains two attack traffic sample patterns and covers 20 common ICS attack types. Through feature extraction and labeling, the ICS-NAD dataset provides 60 features with complete labels. We validate its utility using 10 machine learning (ML) and deep learning (DL) classification models. The dataset comprises 245.96 GB data files, including raw ICS network traffic (PCAP format) and extracted features with labels (CSV format). It is publicly available on this website to support ICS network attack detection research in academic and engineering contexts.