OT system attack framework enables reproducible multi-source data collection
ISIA-AF: Orchestrating Reproducible Attacks and Multi-Source Data Collection for OT Systems
Cryptography and Security
Summary
It is hard to create repeatable and well-documented data about cyberattacks on industrial control systems, which are important for research and defense. The authors developed ISIA-AF, a tool that automates attacking industrial setups while collecting data from several sources. This helps create consistent datasets needed to test and improve security methods. They tested the tool on a combined real and simulated industrial system to show it works efficiently and flexibly.
What this means in practice
- •For industrial network security teams: Generate detailed and reusable attack datasets to enhance industrial intrusion detection systems.
- •For cybersecurity tool developers: Develop and test attack simulation tools using coordinated multi-source data collection across industrial networks.
Authors
Stefan Manfred Haratzmüller, Thomas Rosenstatter, Olaf Saßnick, Dalibor Sain, Stefan Huber
Abstract
Operational Technology (OT) environments require realistic, reproducible security datasets, yet existing approaches often lack automation, multi-source data capture, and sufficient documentation for reuse. This paper presents ISIA-AF, a modular attack framework for orchestrating reproducible attack execution and automated dataset generation on industrial systems. The framework coordinates distributed attack clients, records network traffic and operational data, ultimately leading to a multi-source dataset. We derive functional and non-functional requirements from prior work and stakeholder discussions, and realise the framework following a design science research approach. A case study on the ISIA testbed, comprising a real industrial system and a simulated process, demonstrates how the framework supports centralised control, low communication overhead, and flexible deployment across network segments. The result is a practical basis for generating extensible, multi-source OT security datasets for intrusion detection research.