I am currently doing my thesis in the topic "Anomaly Detection System for SCADA".
My work is focused on finding malicious data in Modbus/TCP packets that can cause a failure in a Power Plant (SCADA system).
From my understanding, Master and Slaves devices in SCADA systems communicate through Modbus/TCP protocol,
e.g. Master sends to Slave: Query -> Write single Coil(5)
Slave to Master: Response -> Write single Coil(5)
Since I would like to use this dataset to train Machine Learning algorithms, I should need a big amount of data composed of benign and malicious Modbus/TCP packets (pcap files for example).
Does somebody knows where could I get this testbeds pcap filas?
Dear Rocio,
I am able o find some MODBUS dataset (plus other industrial protocols) at the address http://www.pcapr.net/browse?q=modbus. However, given the fact that you aim to machine learning algorithms I fear that it will be too few data. In our case, we rely on model checking to find attacks on modeled industrial systems. Thus we dot not require large amount of data.
It is really easy to generate benign MODBUS packages (even in large amount), however they will contain most likely contain similar data. When you seek for malicious data, I guess that you mean that it is the payload (e.g.: Write single Coil(5)) that is malicious in the context of your industrial system and not actual corrupted MODBUS headers.
If so you may look at this simulator: https://github.com/jseidl/virtuaplant
Again data may not be really varied but that may be a start for your experiments.
Kind regards,
Maxime
Does anyone know a dataset for industrial network security?. Available from: https://www.researchgate.net/post/Does_anyone_know_a_dataset_for_industrial_network_security#592025f396b7e45f216bc483 [accessed May 20, 2017].
The Modbus /TCP is the Modbus message transfer service on the TCP/IP, using master-slave communication. This means that you can use any intrusion dataset that contains TCP/IP traffic.
Dear everyone,
As per my previous comments on similar posts, you can request access to SCADA data from Steppa Cyber (steppa.ca) security lab. The team has built a platform to provide real-time SCADA intelligence, you can download feeds on a daily basis and in different format (e.g., pcaps, json, logs, etc.). Several SCADA services are included including DNP, DNP3 and Modbus. The data comes from hundreds of countries, the sensors are deployed in at least 7 countries. It is real stuff. A free version for academia is available and you can get access within 24 hours. Contact Steppa Cyber if you want to learn more. There are already several research and operation institutions involved in this project. I hope this can help.
- Badges
- Science method