Cyber-Physical Dataset for MiTM attacks in Power Systems

Dataset Directories:

a. Adversary/ : This folder contains the json files for the DNP3 and ARP based packets captured at the attacker machine used for constructing the labels. For example, the UC1_PyDNP3_CORE_Adversary_10_OS_30_dnp3.json file is for the use case 1 described in the RESLab paper with 10 DNP3 outstations monitored at 30-sec polling interval.

b. csvs/ : This folder contains all the processed and encoded files obtained after the merge and extraction process from multiple sources. The sub-directories distributes the files based on the use case. For example, the DS_merged_phy_cyb_10os_30poll.csv file within the use case 1 contains the merged and processed file for the use case 1 described in the RESLab paper with 10 DNP3  outstations monitored at 30-sec polling interval.

c. RawFiles/: This folder contains raw files obtained from different sources. This folder contains sub-directories: DS, master, router, and snort. The snort sub-directory contains snort logs running in the substation router for different use-cases. For example, the UC1_PyDNP3_CORE_Snort_10_OS_30_1017 file is for the use case 1 described in the RESLab paper with 10 DNP3 outstations monitored at 30 sec polling interval. The master, DS, router folder contains csvs/, PickleFiles/, and Raw/ sub-directories.  The csvs/ folders contain the same files present in the csvs folder mentioned in the previous directory. The PickleFiles/ folders contain the pickle files obtained from Pyshark libraries for adding additional features such as Round Trip Time (RTT) and retransmission. The Raw/ folders contain the raw pcap files in JSON format for creating the cyber and raw physical features.