"Dataset of a Smart Digital Substation for Simultaneous Cyberattack and Disturbance Detection and Classification "

"Smart Digital Substations (SDSs) are a key component of modern Smart Grids. However, the integration of digital devices with networks leave SDSs vulnerable to cyber threats. Notably, the global communication standard IEC 61850 lacks encryption for critical GOOSE messages due to timing requirements. There has been significant research into the development of attack detection systems, and such systems are mainly developed using datasets containing SDS behaviour during normal scenarios and attacks. Several types of attacks exist to target the vulnerable GOOSE messages. These attacks can also occur alongside power-quality disturbance events due to faults. As the system\u2019s behaviour changes during disturbance events, attacks that occur at this time can have different signatures and manifest differently to detection systems. Existing publicly-available cybersecurity datasets for SDSs lack a wider variety of attack types, and notably, there is a lack of thorough test cases regarding the interactions of simultaneous attacks and disturbances. Such datasets also are generated by purely synthetic means. This results in the data gathered not being as representative of actual substations using physical networks.This dataset contains preprocessed cyber and physical data from an experimental SDS testbed. It contains labelled test cases of several popular attack types, as well as test cases from scenarios of simultaneous attacks and disturbances. Real-time simulation using OPAL-RT has been used to model a 66kV\/11kV substation containing IEDs that monitor for faults and control circuit breakers. The IEDs transmit real GOOSE messages to a physical network and receive the messages for control of the model. Disturbance scenarios including faults, and attack scenarios including False Data Injection (FDI), Replay, Message Suppression (MS), and Denial of Service (DoS) are implemented at the IEDs. Simultaneous attack-disturbance scenarios are also included. The GOOSE messages were collected using Wireshark. The collected cyber-physical features were processed using sliding windows into the presented dataset, so that temporal data in the features could be utilized by the detection algorithm."