IEC104-IDS-2025: Labeled Network Traffic Dataset for Intrusion Detection in IEC 60870-5-104 SCADA Communication

IEC104-IDS-2025 is a labeled network traffic dataset for intrusion detection system (IDS) research on IEC 60870-5-104 (IEC-104) SCADA communication. The dataset was captured from a laboratory SCADA testbed consisting of a SCADA Master, RTU, attacker node, and monitoring node. The dataset comprises three attack scenarios:1. SYN Flood (Layer 4 DoS) — 1,003 records (580 attack, 423 normal)2. APDU Flood (Layer 7 DoS) — 3,114,860 records3. Control Command Injection Attack/CCIA (MitM integrity attack) — 38,102 records Features were extracted using TShark, combining transport-layer indicators (frame length, TCP ports, flags, inter-arrival timestamps) with IEC-104-aware attributes (APDU length, I/S/U frame type, ASDU Type ID, Cause of Transmission, IOA). Labels are assigned as Normal (0) or Attack (1). This dataset accompanies the paper: "Comparative Study of Machine Learning Models for Intrusion Detection in SCADA Communication Based on IEC 60870-5-104," submitted to ISITIA 2026.