Over the past few decades, Industrial Control Systems (ICSs) have been
targeted by cyberattacks and are becoming increasingly vulnerable as more ICSs
are connected to the internet. Using Machine Learning (ML) for Intrusion
Detection Systems (IDS) is a promising approach for ICS cyber protection, but
the lack of suitable datasets for evaluating ML algorithms is a challenge.
Although there are a few commonly used datasets, they may not reflect realistic
ICS network data, lack necessary features for effective anomaly detection, or
be outdated. This paper presents the 'ICS-Flow' dataset, which offers network
data and process state variables logs for supervised and unsupervised ML-based
IDS assessment. The network data includes normal and anomalous network packets
and flows captured from simulated ICS components and emulated networks. The
anomalies were injected into the system through various attack techniques
commonly used by hackers to modify network traffic and compromise ICSs. We also
proposed open-source tools, `ICSFlowGenerator' for generating network flow
parameters from Raw network packets. The final dataset comprises over
25,000,000 raw network packets, network flow records, and process variable
logs. The paper describes the methodology used to collect and label the dataset
and provides a detailed data analysis. Finally, we implement several ML models,
including the decision tree, random forest, and artificial neural network to
detect anomalies and attacks, demonstrating that our dataset can be used
effectively for training intrusion detection ML models.

本文介绍了一种新的 ICF 网络数据集 ICS-Flow，旨在为机器学习算法提供更加真实，有效的数据，作者通过实现决策树、随机森林和神经网络等多个模型来检测 ICSs 的安全隐患与攻击，并证明了该数据集可用于训练入侵检测的机器学习模型。