Comparative analysis shows that ProvICS is among the few existing ICS/CPS benchmarks with multi-host kernel-level provenance, real PLC hardware-in-the-loop execution, decoded Modbus traffic, physical process-state measurements, and auxiliary raw PCAP traces in a time-synchronized collection.
Abstract
The convergence of Information Technology and Operational Technology has exposed Industrial Control Systems (ICS) to multi-stage cyberattacks that traverse software, network, and physical process layers simultaneously. Although Provenance-based Intrusion Detection Systems (PIDS) are effective in Information Technology (IT) environments, their applicability to Industrial Cyber-Physical Systems (CPS) remains largely unexplored because of the absence of datasets that jointly capture host-level causal behavior, industrial network semantics, and physical process state. To address this gap, we design an open-source, Hardware-in-the-Loop (HIL) CPS testbed that replicates an industrial chemical reactor control architecture across the Purdue model layers. Using this testbed, we propose ProvICS, a multimodal provenance dataset purpose-built for CPS intrusion detection, which synchronously captures four streams: whole-system provenance graphs from the supervisory host and the resource-constrained PLC, decoded Modbus deep-packet inspection records, and physical process telemetry. The collection comprises a 48-hour benign phase and a 22-hour attack phase across four campaigns covering 20 ICS ATT&CK techniques over 32 attack events, ranging from reconnaissance to physical process manipulation. Comparative analysis shows that ProvICS is among the few existing ICS/CPS benchmarks with multi-host kernel-level provenance, real PLC hardware-in-the-loop execution, decoded Modbus traffic, physical process-state measurements, and auxiliary raw PCAP traces in a time-synchronized collection. Baseline detection further confirms that cross-modal fusion can detect all 32 labeled attack events (F1 = 0.913, false-positive rate (FPR) = 1.40%), demonstrating the dataset's ability to expose complementary attack signals across modalities and addressing a gap not covered by prior benchmarks.
This article presents DAYPSCI, an event-based dataset generated using an industrial cyber-physical system (CPS) testbed based on a PLC-controlled part marking station with Siemens S7-1200 and S7-1500 devices. The system integrates real industrial hardware with digital twin technologies, enabling controlled and repeatable experiments. Data acquisition follows an event-based logging approach, where only changes in system variables are recorded rather than using fixed sampling rates, and each event is associated with its corresponding inter-event time (Δt), enabling precise temporal characterization of system dynamics. The dataset also includes scan-level identifiers (scan_id) and event ordering (event_order), preserving the logical execution order within PLC scan cycles. It contains time-stamped records of digital sensors, solenoid valve control signals, and process states under both normal operation and controlled fault injection scenarios affecting sensors, actuators, or both. Ground truth is generated through a hybrid approach combining externally defined labels from the experimental configuration and labels derived at runtime from control system signals (e.g., GEMMA states), ensuring a clear separation between CPS execution and the labeling layer while enabling traceability between injected faults (cause) and observable system behavior (effect), and allowing differentiation between fault activation and observable anomaly manifestation, which may be temporally decoupled. The dataset is organized into independent experimental batches, each including processed data (CSV), network traffic captures (PCAPNG) from a Profinet-based industrial communication network, and detailed documentation, facilitating sequence-based analysis and reproducibility. The dataset supports the development and evaluation of machine learning methods for anomaly detection and fault classification in industrial CPS.
Juan V. Martín-Fraile, Nuño Basurto Hornillos, Jesús Enrique Sierra-García et al.· Data in Brief· 0 citations
Industrial health management increasingly relies on heterogeneous information sources, including condition monitoring systems, supervisory control and data acquisition systems, maintenance records, inspection results, and prognostic models. Although large language models provide new opportunities for cross-source reasoning, industrial data and analytical outputs differ substantially in structure, temporal resolution, physical meaning, and reliability. Directly integrating such heterogeneous information into a monolithic model may reduce interpretability, traceability, and adaptability to equipment and data changes. This paper introduces Industrial Tokenization, a conceptual interface for transforming source-specific analytical outputs into structured and machine-interpretable units of industrial evidence, termed Industrial Tokens. Unlike numerical tokens used to encode raw time-series data, Industrial Tokens represent domain-grounded evidence together with source, temporal scope, operating context, analytical meaning, quality or confidence information, and provenance. Based on this concept, a federated industrial architecture is proposed, where heterogeneous analytical subsystems retain autonomy while exposing standardized Industrial Tokens to a central reasoning layer. As an initial implementation, this study presents an end-to-end DiagnosisToken pathway based on vibration-diagnostic outputs, rule-based event aggregation, structured textual token generation, and LLM-based interpretation. Other Industrial Tokens, including SCADA-based condition-monitoring tokens, maintenance tokens, and prognostic tokens, are reserved as future extensions. The proposed framework positions Industrial Tokenization as a semantic interface between domain-specific industrial intelligence and LLM- or agent-based reasoning, rather than another method for encoding raw industrial data.