IEC 60870-5-104 Intrusion Detection Dataset — Smart Grid Cyberattacks [1.1 GB]
Catalog Summary
"Smart-grid IDS dataset with labelled IEC 60870-5-104 and TCP/IP flow statistics plus PCAP files across 12 cyberattack scenarios. CSV and PCAP formats."
Catalog Notes
Overview
The IEC 60870-5-104 Intrusion Detection Dataset is an industrial IoT and smart-grid cybersecurity dataset for AI-based intrusion detection. It focuses on a legacy industrial protocol widely used in critical infrastructures.
The dataset contains labelled TCP/IP network flow statistics and IEC 60870-5-104 protocol flow statistics in CSV format. Packet Capture files are also provided for deeper traffic analysis.
The testbed used seven industrial entities, one Human Machine Interface, and three cyberattackers. The recorded cyberattacks include unauthorised command injection, Denial of Service activity, and a Man-in-the-Middle packet filtering and dropping scenario.
Column Schema
| Column | Description |
|---|---|
| src_ip | Source IP address in TCP/IP flow statistics. |
| dst_ip | Destination IP address in TCP/IP flow statistics. |
| src_port | Source TCP port. |
| dst_port | Destination TCP port used by the flow. |
| protocol | Network protocol represented in the flow statistics. |
| flow_duration | Duration of the extracted network flow. |
| iec104_features | Protocol-aware IEC 60870-5-104 flow statistics. |
| label | Normal or cyberattack class label. |
Key Statistics
- Total Records: Multiple labelled attack archives and balanced train/test CSV files
- Features: TCP/IP flow statistics and IEC 60870-5-104 protocol flow statistics
- File Format: CSV, PCAP, 7z archives
- File Size: 1.1 GB total files; balanced CSV archive 11.4 MB
- Time Period: Attacks executed April-June 2020; dataset published 2022
- Attack Scenarios: 12 IEC 60870-5-104 cyberattack scenarios
Use Cases
- Industrial IoT intrusion detection
- Smart-grid cyberattack classification
- Protocol-aware anomaly detection for IEC 60870-5-104
- Benchmarking machine-learning and deep-learning IDS models
Source & Attribution
Created by Panagiotis Radoglou-Grammatikis, Konstantinos Rompolos, Thomas Lagkas, Vasileios Argyriou, and Panagiotis Sarigiannidis. Published on Zenodo by the ITHACA Laboratory, University of Western Macedonia, with DOI 10.21227/fj7s-f281.
View Data Structure
To explore column names, data types, and sample rows, visit the official dataset page on Zenodo.
Preview on ZenodoCite This Dataset
Radoglou-Grammatikis, P., Rompolos, K., Lagkas, T., Argyriou, V., & Sarigiannidis, P. (2022). IEC 60870-5-104 Intrusion Detection Dataset. [Dataset]. Zenodo. https://doi.org/10.21227/fj7s-f281
Source metadata: Zenodo (2022) · DOI: 10.21227/fj7s-f281
Indexed by IoTDataset.com on Jun 02, 2026
Review the Source Record
Confirm the licence, version, access conditions, file format, and provenance at the source before use.