An Integrated Testbed for MITRE-Mapped Attack Emulation in Industrial Control Networks

Area of Science:

• Cybersecurity
• Industrial Control Systems (ICS)
• Network Intrusion Detection

Background:

• Existing Industrial Control System (ICS) datasets lack per-technique labels for evaluating intrusion detection.
• Reconstructing MITRE ATT&CK technique information post-capture is complex and error-prone.
• There is a need for accurate ground truth in Operational Technology (OT) traffic for robust security assessments.

Purpose of the Study:

• To develop and demonstrate a methodology for capturing Industrial Control System (ICS) attack traffic with in-orchestrator, per-technique MITRE ATT&CK labeling.
• To create a protocol-aware detection pipeline for processing labeled OT traffic.
• To provide reproducible attack chains and a labeled dataset for benchmarking intrusion detection systems.

Main Methods:

• An in-orchestrator labeling methodology was implemented, embedding MITRE technique identifiers directly into traffic captures.
• A protocol-aware detection pipeline with a priority-ordered router was designed to dispatch traffic to specific detector plug-ins.
• Four CALDERA chains were developed to automate attacks and test the labeling and detection pipeline.

Main Results:

• A dataset of 40,000 benign and 9,997 attack Modbus sequences across four MITRE ATT&CK techniques was generated.
• The CNN-BiLSTM-AE model achieved a 100% true-positive rate (TPR) at the 98th-percentile benign threshold for all techniques.
• The system demonstrated high detection rates, with per-technique TPRs ranging from 96.1% to 100%.

Conclusions:

• The proposed in-orchestrator labeling methodology effectively provides per-technique ground truth for ICS attack traffic.
• The protocol-aware detection pipeline and labeled dataset enable accurate benchmarking of intrusion detection systems.
• This approach enhances the evaluation of cybersecurity defenses in Operational Technology (OT) environments.