Intrusion detection datasets for Cyber–Physical Systems: Taxonomy, challenges, and opportunities

Abstract

Cyber-Physical Systems (CPSs) enable several critical applications that need to be continuously hardened. However, in practice, they often rely on insecure standards (e.g., IEC-61850 [45]) and protocols that prioritize timely delivery over secure communication. Thus, employing Intrusion Detection Systems (IDS) to detect malicious activities is vital. Nevertheless, it is challenging for IDSs to accurately detect CPS cyberattacks since proper domain-specific datasets are scarce. In this work, we propose a taxonomy, review state-of-the-art CPS intrusion datasets with respect to how they provide features that enable intrusion detection, and discuss their challenges and opportunities. Our analysis includes an examination of the sources, types of attacks, and features of these datasets, as well as an in-depth analysis of their number of samples, attacks, and features. We also investigate the system physical characteristics used to extract features from these datasets. Finally, we conduct experiments to validate the taxonomy’s effectiveness in systematically identifying dataset limitations, highlighting gaps in attack coverage, feature representation, and data diversity, which are critical for IDS assessments

The authors' abstract, as published at the source. Computers & Security, 2026 · DOI ↗