Benign and malicious behaviours of the simulated SASs testbed

The datasets were collected by operating the testbed (simulation of small-scale of IEC 61850-compliantSASs) under four types of behaviours: 1) normal operation when no unusual events happen; 2) emergency operation when non-malicious events (e.g., short-circuit faults) happen;3)an attack under normal operation to disrupt energy transmission; and 4) an attack under emergency operation to stop protection mechanisms or trigger undesirable protection operations.Based on these four types of behaviours, a total of 31 datasetswere generated. Each dataset consists of network traffic and system logs (simulink). Network traffic contains 5 network PCAP files and 5 CSV files which are converted from those 5 pcap files. System logs (simulink) consists of 4 CSV files record physical features from four IEDs.Note: Since the testbed only models instantaneous overcurrent protection and circuit breaker failure protection, the sensor data only contains circuit current values from sensors at different locations and the operational status of various circuit breakers.