A Roadmap to Available ICS Datasets and Testbeds for Cybersecurity Research

• URL: http://arxiv.org/abs/2608.30332v1
• Date: Mon, 31 Aug 2026 06:48:24 GMT
• Title: A Roadmap to Available ICS Datasets and Testbeds for Cybersecurity Research
• Abstract summary: Industrial Control Systems (ICS) are the backbone of many critical infrastructure sectors.<n>The merging of Operational Technology (OT) and IT along with the deployment of Industry 4.0 technologies increases the attack surface of ICS environments.<n>Many researchers have shown interest in the field of cybersecurity of ICS.
• Score: 1.8385321286452745
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Industrial Control Systems (ICS) are the backbone of many critical infrastructure sectors; however, their growing level of connectivity, long lifespan and integration with the Information Technology (IT) environment introduces numerous cybersecurity challenges. The merging of Operational Technology (OT) and IT along with the deployment of Industry 4.0 technologies increases the attack surface of ICS environments, which in turn makes them more vulnerable to advanced cyber threats. Therefore, many researchers have shown interest in the field of cybersecurity of ICS. The topics of intrusion detection, anomaly detection, threat intelligence, attack simulation and resilience assessment of ICS have received much attention. Nevertheless, the development and testing of cybersecurity solutions for ICS remains to be challenging due to the lack of appropriate datasets and experimental environment. The main objective of this paper is to provide the roadmap of existing ICS cybersecurity datasets, testbeds and digital twins. This paper presents various taxonomies along with systematic analysis of architecture, characteristics, capabilities, pros and cons of these tools. The results of the analysis demonstrate the presence of persistent problems such as lack of standardized benchmarking datasets, lack of modern attack scenarios, insufficient number of datasets based on real operational traffic and difficulty in validating artificial intelligence-driven cybersecurity solutions. In addition to summarizing current research on ICS cybersecurity datasets and testbeds, this roadmap provides the identification of research gaps and recommendations on creation of new tools.

Related papers

• Bridging the Smart City Cybersecurity Data Gap Through AI-Driven Synthetic Dataset Generation [0.0]
  Smart cities rely on interconnected cyber-physical systems that integrate sensors, IoT devices, cloud platforms, and AI-driven services and decision-making.<n>These systems also introduce complex cybersecurity challenges due to their large attack surfaces, heterogeneous data flows, and evolving threat vectors.<n>This research proposes an AI-based synthetic data generation framework designed specifically for smart city cybersecurity research.
  arXiv  Detail & Related papers  (2026-06-10T15:36:31Z)
• Explainable AI-Driven Cyber Risk Analytics and Model Reliability Assessment for Intelligent Governance of U.S. Critical Infrastructure: An XGBoost and SHAP-Based Intrusion Detection Framework [0.8496907566303933]
  This study is based on the CICIDS 2017 dataset for the development and testing of intrusion detection system models and cyber risk prediction models based on machine learning.<n>The proposed framework presents the reliability and resilience of the model by having various performance measures such as accuracy, precision, recall, F1 score, ROC-AUC, and false positive rate.
  arXiv  Detail & Related papers  (2026-06-04T05:05:14Z)
• Impact of Intelligent Technologies on IoV Security: Integrating Edge Computing and AI [43.101093203101776]
  This paper surveys the role of Edge Computing (EC), Machine Learning (ML), and Deep Learning (DL) in strengthening IoV security frameworks.<n>It examines the synergy between these technologies, highlighting their individual capabilities and their collective impact on enhancing threat detection, response times, and adaptive security.<n>The paper also identifies key research gaps and future directions for further advancements in IoV security, including the need for scalable, privacy preserving solutions and robust defense mechanisms against emerging cyber threats.
  arXiv  Detail & Related papers  (2026-04-11T06:25:38Z)
• An Evidence-Driven Analysis of Threat Information Sharing Challenges for Industrial Control Systems and Future Directions [3.9521601446679964]
  We review the challenges that disturb the sharing of usable threat information to critical infrastructure operators within the ICS domain.<n>We analyze three major incidents: Stuxnet, Industroyer, and Triton.<n>We identify four important limitations in the ICS threat information sharing ecosystem.
  arXiv  Detail & Related papers  (2025-12-21T12:22:07Z)
• PACEbench: A Framework for Evaluating Practical AI Cyber-Exploitation Capabilities [42.61805002268063]
  We introduce PACEbench, a practical AI cyber-exploitation benchmark.<n>PACEbench comprises four scenarios spanning single, blended, chained, and defense vulnerability exploitations.<n>We propose PACEagent, a novel agent that emulates human penetration testers by supporting multi-phase reconnaissance, analysis, and exploitation.
  arXiv  Detail & Related papers  (2025-10-13T17:50:25Z)
• Signals and Symptoms: ICS Attack Dataset From Railway Cyber Range [8.612455964786049]
  We conduct two ICS cyberattack simulations to showcase the impact of trending ICS cyberattacks on a railway cyber range that resembles the railway infrastructure.<n>The resulting evidence is collected as datasets, serving as an essential resource for cyberattack analysis.
  arXiv  Detail & Related papers  (2025-07-02T14:47:31Z)
• AI and Remote Sensing for Resilient and Sustainable Built Environments: A Review of Current Methods, Open Data and Future Directions [0.0]
  Critical infrastructure, such as transport networks, underpins economic growth by enabling mobility and trade.<n>Climate change impacts, extreme weather, rising sea levels, and hybrid threats pose growing risks to their resilience and functionality.<n>This review paper explores how emerging digital technologies, specifically Artificial Intelligence (AI), can enhance damage assessment and monitoring of transport infrastructure.
  arXiv  Detail & Related papers  (2025-07-02T09:59:23Z)
• Cyber Defense Reinvented: Large Language Models as Threat Intelligence Copilots [36.809323735351825]
  CYLENS is a cyber threat intelligence copilot powered by large language models (LLMs)<n>CYLENS is designed to assist security professionals throughout the entire threat management lifecycle.<n>It supports threat attribution, contextualization, detection, correlation, prioritization, and remediation.
  arXiv  Detail & Related papers  (2025-02-28T07:16:09Z)
• EARBench: Towards Evaluating Physical Risk Awareness for Task Planning of Foundation Model-based Embodied AI Agents [53.717918131568936]
  Embodied artificial intelligence (EAI) integrates advanced AI models into physical entities for real-world interaction.<n>Foundation models as the "brain" of EAI agents for high-level task planning have shown promising results.<n>However, the deployment of these agents in physical environments presents significant safety challenges.<n>This study introduces EARBench, a novel framework for automated physical risk assessment in EAI scenarios.
  arXiv  Detail & Related papers  (2024-08-08T13:19:37Z)
• Artificial Intelligence in Industry 4.0: A Review of Integration Challenges for Industrial Systems [45.31340537171788]
  Cyber-Physical Systems (CPS) generate vast data sets that can be leveraged by Artificial Intelligence (AI) for applications including predictive maintenance and production planning.<n>Despite the demonstrated potential of AI, its widespread adoption in sectors like manufacturing remains limited.
  arXiv  Detail & Related papers  (2024-05-28T20:54:41Z)
• Graph Mining for Cybersecurity: A Survey [61.505995908021525]
  The explosive growth of cyber attacks nowadays, such as malware, spam, and intrusions, caused severe consequences on society. Traditional Machine Learning (ML) based methods are extensively used in detecting cyber threats, but they hardly model the correlations between real-world cyber entities. With the proliferation of graph mining techniques, many researchers investigated these techniques for capturing correlations between cyber entities and achieving high performance.
  arXiv  Detail & Related papers  (2023-04-02T08:43:03Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.