# Anomaly Detection Dataset for Industrial Control Systems

arXiv: https://arxiv.org/abs/2305.09678 · HTML: https://mlsanity.com/paper/2305.09678/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 10 of its 58 references that are in the map.
- First posted on arXiv 11 May 2023.

## Builds on (most cited first, 10 of 10)

- [A Survey of Network-based Intrusion Detection Data Sets](https://mlsanity.com/paper/1903.02460/) (2019)
- [Deep Learning-Based Anomaly Detection in Cyber-Physical Systems: Progress and Opportunities](https://mlsanity.com/paper/2003.13213/) (2020)
- [Machine Learning Based Network Vulnerability Analysis of Industrial Internet of Things](https://mlsanity.com/paper/1911.05771/) (2019)
- [Datasets are not Enough: Challenges in Labeling Network Traffic](https://mlsanity.com/paper/2110.05977/) (2021)
- [A Survey on Industrial Control System Testbeds and Datasets for Security Research](https://mlsanity.com/paper/2102.05631/) (2021)
- [Machine Learning for Intrusion Detection in Industrial Control Systems: Applications, Challenges, and Recommendations](https://mlsanity.com/paper/2202.11917/) (2022)
- [Comprehensive Survey and Taxonomies of False Injection Attacks in Smart Grid: Attack Models, Targets, and Impacts](https://mlsanity.com/paper/2103.10594/) (2021)
- [MiniCPS: A toolkit for security research on CPS Networks](https://mlsanity.com/paper/1507.04860/) (2015)
- [ICSSIM-A Framework for Building Industrial Control Systems Security Simulation Testbeds](https://mlsanity.com/paper/2210.13325/) (2022)
- [Digital Twin-based Intrusion Detection for Industrial Control Systems](https://mlsanity.com/paper/2207.09999/) (2022)

## Abstract (arXiv)

Over the past few decades, Industrial Control Systems (ICSs) have been targeted by cyberattacks and are becoming increasingly vulnerable as more ICSs are connected to the internet. Using Machine Learning (ML) for Intrusion Detection Systems (IDS) is a promising approach for ICS cyber protection, but the lack of suitable datasets for evaluating ML algorithms is a challenge. Although there are a few commonly used datasets, they may not reflect realistic ICS network data, lack necessary features for effective anomaly detection, or be outdated. This paper presents the 'ICS-Flow' dataset, which offers network data and process state variables logs for supervised and unsupervised ML-based IDS assessment. The network data includes normal and anomalous network packets and flows captured from simulated ICS components and emulated networks. The anomalies were injected into the system through various attack techniques commonly used by hackers to modify network traffic and compromise ICSs. We also proposed open-source tools, `ICSFlowGenerator' for generating network flow parameters from Raw network packets. The final dataset comprises over 25,000,000 raw network packets, network flow records, and process variable logs. The paper describes the methodology used to collect and label the dataset and provides a detailed data analysis. Finally, we implement several ML models, including the decision tree, random forest, and artificial neural network to detect anomalies and attacks, demonstrating that our dataset can be used effectively for training intrusion detection ML models.