For the purpose of attack analysis in smart grid network, I am trying to locate a traffic capture or PCAP data set with various attack types. Data set should be related to smart grid implementation in the power industry using DNP3 protocol. The environment could be real or it could be a large testbed setup.
Thanks,,
Hi Ihab,
I am not sure about what you call a "large" dataset but here are some pcaps: https://github.com/ITI/ICS-Security-Tools/tree/master/pcaps
What kind of attacks are you interested in finding in your pcaps?
Cheers,
Maxime
Thanks Maxime for the info!
The link provides few packet exchanges, but actually I am looking for much larger data set that contains normal and abnormal traffic capture. I will be using some data mining techniques to improve the detection process. Therefore, I will looking for thousands of transactions in the capture. It will be great if you can help?
Regards,
Ihab
Hi Ihab,
I don't have such large dataset and it is also a problem for us.
A possible workaround I can propose is to combine https://github.com/jseidl/virtuaplant with https://github.com/gec/dnp3 to generate your own dataset.
Although it is not a "real" one, it may answer your demand of a large dataset containing normal and abnormal traffic.
Cheers,
Maxime
Thanks Maxime! I have checked the virtuaplant, and it does not support DNP3. Did you use it before for DNP3 traffic?
Thx
I know virtualplant works for MODBUS however, this fork started to separate the process part from the MODBUS server so you may be able to plug it onto a python DNP3 server such as the link in my previous message.
Maxime
If you have done it before could you please send me the steps involved related DNP3? My email address is [email protected]
Thx
Ihab
I haven't, I don't study DNP3 but more OPC-UA (and I still din'to do it for OPC-UA neither).
I forgot to link the right fork : https://github.com/daviddiallo/virtuaplant/tree/master/plants/bottle-filling.
Part of the world.py file have been separated in a modbus.py file so I guess you need to implement a DNP3.py file that reproduces the same behavior.
Seems a dedicated client/server will run on localhost for each sensor/actuator though.
For anyone following this question, I have made publicly available a DNP3 Wireshark .pcap file which was used by myself and Ihab Darwish for our paper Deterministic Dendritic Cell Algorithm Application to Smart Grid Cyber-Attack Detection https://www.researchgate.net/publication/316701640_Deterministic_Dendritic_Cell_Algorithm_Application_to_Smart_Grid_Cyber-Attack_Detection .This .pcap file can be found at https://github.com/igbe/DNP3-Dataset-Plus-SnortRules
it can also be found here in researchGate at https://www.researchgate.net/publication/318041810_DNP3_packet_capture_in_pcap_format_and_Extracted_Dataset_in_csv
Conference Paper Deterministic Dendritic Cell Algorithm Application to Smart ...
Data DNP3 packet capture in .pcap format and Extracted Dataset in .csv
You can request access to SCADA data from Steppa Cyber (steppa.ca) security lab. The team has built a platform to provide real-time SCADA intelligence, you can download feeds on a daily basis and in different format (e.g., pcaps, json, logs, etc.). Several SCADA services are included including DNP, DNP3 and Modbus. The data comes from hundreds of countries, the sensors are deployed in at least 7 countries. It is real stuff. A free version for academia is available and you can get access within 24 hours. Contact Steppa Cyber if you want to learn more. There are already several research and operation institutions involved in this project. I hope this can help.
Thanks Claude for this great information! I will be definitely in touch with them!
Regards,
Ihab
Obinna Igbe How did you extract the dataset into CSV from the pcap?
Dear Obinna Igbe does your DNP3 wireshark pcap file contain attacks against DNP3? If yes can you please specify which ones? Thank you
Dear Obinna Igbe Ihab Darwish Claude Fachkha Is there a mitm attack in the modbus and dnp3 protocol for the scada system?
- Badges
- Science topic
- Similar topics
- Engineering
- Control Theory
- Control Systems
- Control Systems Engineering