A dataset to train intrusion detection systems based on machine learning models for electrical substations

Area of Science:

• Electrical Engineering
• Cybersecurity
• Computer Science

Background:

• Increasing integration of Information and Communication Technology (ICT) in Operational Technology (OT) environments of electrical substations introduces significant cybersecurity vulnerabilities.
• The need for robust cybersecurity measures is paramount to ensure the reliable operation of power distribution networks.

Purpose of the Study:

• To present a comprehensive dataset of electrical substation network traffic for training and benchmarking machine learning-based Intrusion Detection Systems (IDS).
• To provide a valuable resource for advancing cybersecurity in critical infrastructure.

Main Methods:

• Collected and processed raw network captures and traffic flows from real electrical substations.
• Included data on key substation protocols (IEC61850, IEC104, NTP, PTP) and simulated cyberattack traces.
• Developed complementary tools for dataset creation and preprocessing to ensure standardization and reproducibility.

Main Results:

• A diverse dataset comprising real and simulated substation network traffic, including normal operations and cyberattack scenarios.
• The dataset is anonymized and filtered, ensuring privacy and suitability for machine learning model development.
• Included tools facilitate consistent and reproducible data handling for cybersecurity research.

Conclusions:

• The developed dataset addresses the critical need for high-quality, targeted data for tuning IDS in electrical substations.
• This resource will contribute to the development of more effective machine learning models for substation cybersecurity.
• Enhancing IDS capabilities is crucial for securing reliable power distribution networks against evolving cyber threats.