# A Survey on Industrial Control System Testbeds and Datasets for Security Research

arXiv: https://arxiv.org/abs/2102.05631 · HTML: https://mlsanity.com/paper/2102.05631/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 10 Feb 2021.

## Built on by (most cited first, 10 of 10)

- [SoK: Pragmatic Assessment of Machine Learning for Network Intrusion Detection](https://mlsanity.com/paper/2305.00550/) (2023)
- [Cyber-Physical Systems Security: A Comprehensive Review of Anomaly Detection Techniques](https://mlsanity.com/paper/2502.13256/) (2025)
- [On the Elements of Datasets for Cyber Physical Systems Security](https://mlsanity.com/paper/2208.08255/) (2022)
- [A Generative Model Based Honeypot for Industrial OPC UA Communication](https://mlsanity.com/paper/2410.21574/) (2024)
- [MALF: A Multi-Agent LLM Framework for Intelligent Fuzzing of Industrial Control Protocols](https://mlsanity.com/paper/2510.02694/) (2025)
- [Anomaly Detection Dataset for Industrial Control Systems](https://mlsanity.com/paper/2305.09678/) (2023)
- [Explainable Online Unsupervised Anomaly Detection for Cyber-Physical Systems via Causal Discovery from Time Series](https://mlsanity.com/paper/2404.09871/) (2024)
- [SimProcess: High Fidelity Simulation of Noisy ICS Physical Processes](https://mlsanity.com/paper/2505.22638/) (2025)
- [Spatio-Temporal Attention Graph Neural Network: Explaining Causalities With Attention](https://mlsanity.com/paper/2603.10676/) (2026)
- [IstGPT: LLM-based Anomaly Detection for Spatial-Temporal Graph in Industrial Systems](https://mlsanity.com/paper/2606.01691/) (2026)

## Abstract (arXiv)

The increasing digitization and interconnection of legacy Industrial Control Systems (ICSs) open new vulnerability surfaces, exposing such systems to malicious attackers. Furthermore, since ICSs are often employed in critical infrastructures (e.g., nuclear plants) and manufacturing companies (e.g., chemical industries), attacks can lead to devastating physical damages. In dealing with this security requirement, the research community focuses on developing new security mechanisms such as Intrusion Detection Systems (IDSs), facilitated by leveraging modern machine learning techniques. However, these algorithms require a testing platform and a considerable amount of data to be trained and tested accurately. To satisfy this prerequisite, Academia, Industry, and Government are increasingly proposing testbed (i.e., scaled-down versions of ICSs or simulations) to test the performances of the IDSs. Furthermore, to enable researchers to cross-validate security systems (e.g., security-by-design concepts or anomaly detectors), several datasets have been collected from testbeds and shared with the community. In this paper, we provide a deep and comprehensive overview of ICSs, presenting the architecture design, the employed devices, and the security protocols implemented. We then collect, compare, and describe testbeds and datasets in the literature, highlighting key challenges and design guidelines to keep in mind in the design phases. Furthermore, we enrich our work by reporting the best performing IDS algorithms tested on every dataset to create a baseline in state of the art for this field. Finally, driven by knowledge accumulated during this survey's development, we report advice and good practices on the development, the choice, and the utilization of testbeds, datasets, and IDSs.