Data4Cyber publishes labeled OT attack data for a lab distribution grid
Original title: Data4Cyber: Labeled Cyber-Physical Datasets for Distribution-Grid Management Systems Under Representative OT Attacks
The lab DMS dataset pairs 1-second process data with Modbus/TCP and MQTT captures across one benign run and six attacks.
Researchers introduce Data4Cyber, a labeled cyber-physical dataset from a laboratory distribution management system used for self-consumption optimization. The setup includes photovoltaic generation, battery storage, controllable loads, and substation metering, with synchronized measurements, controller context, price incentives, and packet captures. Scenarios cover protocol-semantic Modbus manipulation, man-in-the-middle false-data injection, and MQTT price manipulation. Baseline detectors often reach high recall through alarm saturation, and the authors say context-driven attacks need process-aware detection.
Unconfirmed: Detector findings are the authors' baseline results on this laboratory dataset, not field incidents.
- The recording uses a fixed 1-second time base and phase-resolved labels.
- Traffic includes Modbus/TCP and MQTT.
- Six attack scenarios accompany one benign baseline.
- Authors report that sensitivity can come from alarm saturation.
From the original article
1 min read at arxiv.orgCyberattacks against power systems increasingly exploit industrial communication and control dependencies arising from distributed energy resources (DER), remote management, and market-based incentives. Progress on intrusion detection is constrained by a lack of public datasets that align operational technology (OT) network telemetry with physical measurements and control context.
By Ömer Sen · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.