Industrial network and OT security

Synthetic IIoT network traffic datasets for security research

IIoT Network records model protocol-labelled traffic, operational-technology roles, and attack scenarios for research on industrial intrusion detection and traffic analysis.

Generate a dataset Explore original records

Experimental Engine — Under Scientific Review

This domain is an early-stage research prototype. Its models, units, temporal behaviour, and event semantics are being audited. Outputs should not be treated as empirically validated observations.

engine 3.2.0 · maturity experimental · validation audit_pending

Research scope

The generator produces synthetic behavioural data. It does not reproduce packet-level artifacts from a named deployment, botnet, or incident.

Modbus, OPC UA, DNP3, PLC, HMI, SCADA, and RTU-labelled traffic

Research scenarios for intrusion detection, replay, false-data injection, and denial of service

Column schema

Every record in this domain emits the same 16 columns . Types and ranges below are read from the generator itself, so they cannot drift from the files it produces.

Column	Type	Range
Timestamp	datetime	—
Source_IP	string	—
Dest_IP	string	—
Source_Port	integer	1, 65535
Dest_Port	integer	1, 65535
Protocol	categorical	—
Packet_Size	integer	20, 1500
Connection_Duration	float	0, 60
Packets_Sent	integer	1, 5000
Bytes_Transferred	integer	—
Flow_Rate	float	—
Device_Role	categorical	—
Function_Code	integer	0, 255
Attack_Type	categorical	—
Attack_Phase	categorical	—
Label	categorical	—

Generative models

Values come from explicit equations, not from a trained generative model. Each component below is documented in the methodology.

Protocols

Modbus, OPC UA and DNP3 flow synthesis.

Device roles

PLC, HMI, SCADA and RTU role assignment.

Attack scenarios

Operational-technology attacks: man-in-the-middle, replay and false data injection, each labelled.

Traffic process

Arrival and volume processes per device role and protocol.

Research uses

The common thread is known ground truth: the generator records the true state alongside the observation of it, which a real deployment cannot supply.

Industrial intrusion-detection benchmarking with labelled attacks

Protocol-aware traffic classification

Evaluating detectors under controllable attack prevalence

Teaching operational-technology security without a live plant

Measured datasets in this area remain the reference for site realism. A generator answers a different question: what a method does when the true state is known and the scenario can be set deliberately. These are complements, not substitutes.

Measured dataset	What it provides	What a generated record adds
Edge-IIoTset	IoT and IIoT cyber-security dataset with many attack types.	Attack prevalence you set deliberately, for class-imbalance studies.
TON_IoT	Telemetry, network and operating-system data with attack labels.	OT protocol semantics with PLC, HMI, SCADA and RTU role labels.
CICIoT2023	Large-scale IoT attack traffic across many devices.	Generated labels with exact ground truth rather than post-capture labelling.

Scope and limits

What is currently established

— The generator runs and emits its declared column contract.
— Output is deterministic for a given domain, parameter set and seed.
— Scientific audit of its models, units, temporal behaviour and event semantics is still outstanding.

What it does not establish

— Site realism, or transfer to any specific real deployment.
— Calibration against a named site, sensor network, fleet or population.

Read the full research record →

Browse IIoT Network generated records

Each card links to the original citable record. IoTSyn keeps that URL, its dataset file, and its citation guidance unchanged.

Open the full library