IIoT Network Traffic - 21% Attacks [4K rows] #6a63

Overview

This dataset provides synthetic Industrial Internet of Things (IIoT) network traffic captured within a simulated SCADA/ICS environment. It reproduces communications across six Operational Technology (OT) protocols: Modbus TCP, OPC UA, DNP3, MQTT, BACnet, and EtherNet/IP. Traffic originates from heterogeneous ICS devices including PLCs, HMIs, RTUs, SCADA servers, Engineering Workstations, and simulated External attackers, representing a realistic industrial network topology with an internal subnet of 10.0.1.x/24.

The dataset contains 4,000 labeled network flow records across 16 features. A controlled attack injection rate of 21% (approximately 840 malicious flows) simulates real-world threat scenarios targeting OT infrastructure, while the remaining 79% (approximately 3,160 flows) represents legitimate industrial communications. Each attack scenario follows a structured four-phase lifecycle: reconnaissance, escalation, peak, and cooldown, aligned with adversarial campaign models observed in ICS threat intelligence.

Dataset Statistics

• Total records: 4,000 labeled flow entries
• Features (columns): 16
• Normal traffic: approximately 3,160 records (79%)
• Malicious traffic: approximately 840 records (21%)
• Sampling interval: 5 seconds per record
• OT Protocols covered: Modbus TCP (port 502), OPC UA (port 4840), DNP3 (port 20000), MQTT (port 1883), BACnet (port 47808), EtherNet/IP (port 44818)
• Attack types: Man-in-the-Middle (MitM), Replay, False Data Injection, Denial of Service (DoS), Reconnaissance
• Device roles: PLC, HMI, RTU, SCADA Server, Engineering Workstation, External
• License: CC0 1.0 Universal (Public Domain)

Column Schema

Attack Taxonomy

• False Data Injection (FDI): Manipulated sensor readings or counterfeit control commands injected into the SCADA data stream to mislead operators and automated safety systems. Dominant attack type in this dataset, targeting Modbus TCP and DNP3 channels.
• Man-in-the-Middle (MitM): The attacker intercepts and optionally alters OT protocol messages between ICS nodes across OPC UA, DNP3, Modbus TCP, and MQTT sessions.
• Replay Attack: Previously captured legitimate OT commands retransmitted to trigger unauthorized state changes in PLCs or RTUs; detectable through sequence number anomalies and timing inconsistencies.
• Denial of Service (DoS): High-frequency traffic directed at ICS devices to exhaust processing capacity and disrupt availability of critical control functions.
• Reconnaissance: Systematic low-volume scanning of the ICS network to enumerate active devices, open OT service ports, and supported function codes.

Attack Lifecycle Model

Each attack scenario follows a structured four-phase progression consistent with observed adversarial campaigns against ICS environments:

• Recon: Low-intensity probing phase; attacker maps network topology and enumerates supported OT protocols and function codes
• Escalation: Attacker establishes an active foothold and increases interaction frequency with target devices
• Peak: Maximum attack intensity; highest observed packet rates, byte volumes, and flow rates
• Cooldown: Gradual reduction in malicious activity as the attacker withdraws or pivots to new targets

Normal Traffic Model

Legitimate traffic is generated using protocol-specific periodic polling patterns characteristic of industrial automation systems. OPC UA sessions use subscription-based data exchange; Modbus TCP follows cyclic read/write request cycles; DNP3 implements unsolicited response messaging and integrity polls; MQTT uses publish/subscribe broker communication at regular telemetry intervals; EtherNet/IP and BACnet flows reflect typical controller and building automation communications.

Use Cases

• Training and evaluation of Intrusion Detection Systems (IDS) for SCADA and ICS environments
• Benchmarking supervised classifiers including Random Forest, XGBoost, LSTM, GRU, and Transformer-based models
• False Data Injection detection research targeting DNP3 and Modbus TCP industrial protocols
• OT protocol traffic analysis, feature engineering, and anomaly detection research
• Federated learning experiments for distributed ICS threat detection
• Class imbalance benchmarking on a 79/21 split using SMOTE or cost-sensitive learning
• Feature importance and explainability studies (SHAP, LIME) for network flow-based detection models

Limitations

• Data is fully synthetic; real-world traffic may exhibit additional variability in timing jitter, TCP retransmissions, and vendor-specific protocol extensions
• Attack scenarios represent common OT threat vectors but do not model APTs, firmware exploits, or zero-day vulnerabilities
• The 79%/21% class distribution introduces moderate imbalance; resampling or threshold-tuning strategies are advised before training classifiers

Reproducibility

Seed: 1695713840. Applying the same seed and generation parameters in IoTSyn will produce an identical dataset, ensuring full experimental reproducibility. Generated by IoTSyn v3.2.