ICS Dataset for Smart Grid Anomaly Detection

The dataset comprises of several files that contain smart grid communication, namely protocols IEC 60870-104 (IEC 104) and IEC 61850 (MMS) in form of CSV traces. The traces were generated from PCAP files using IPFIX flow probe or an extraction script. CSV traces include the timestamp, IP addresses and ports of communicating devices, and selected IEC 104 and MMS headers that are interesting for security monitoring and anomaly detection. Datasets were by obtained partly by monitoring communication of real ICS devices and partly by monitoring communication of virtual ICS applications. Datasets contain both normal traffic within a few days and traffic with attack like scanning, switching, command blocking, etc.

本数据集包含多个存储智能电网通信流量的文件，所涉协议包括IEC 60870-104（IEC 104）与IEC 61850（MMS），数据格式为CSV流量记录。此类CSV流量记录由数据包捕获（PCAP）文件通过IPFIX流量探针或提取脚本生成。CSV流量记录包含通信设备的时间戳、IP地址与端口，以及用于安全监控与异常检测的精选IEC 104及MMS协议头部字段。本数据集的采集来源分为两部分：部分来自真实工业控制系统（ICS）设备的通信监控，部分来自虚拟工业控制系统应用的通信监控。数据集涵盖数日内的正常通信流量，以及包含扫描、切换、命令阻断等各类攻击的异常流量。

搜集汇总

背景与挑战

背景概述

该数据集包含智能电网通信协议IEC 104和MMS的CSV跟踪数据，用于安全监控和异常检测研究。数据来源于真实和虚拟ICS设备，包含正常流量及多种攻击类型（如扫描、阻断命令等），适用于工业网络安全分析。