ISIA-AF: Orchestrating Reproducible Attacks and Multi-Source Data Collection for OT Systems

Motivation

• Increasing OT interconnectivity and complexity expand attack surfaces, as illustrated by the 2017 Triton attempt against Triconex safety systems.Source: §1 · p. 1

Dataset gap

• OT security datasets are needed for IDS training and evaluation, but datasets using newer protocols such as OPC UA are scarce.Only two OPC UA datasets are identified; both use Raspberry Pi networks, and only Pinto is publicly available.Source: §1 · pp. 1–2
• Reproducibility, realism, and extensibility are key dataset properties, yet incomplete automation documentation makes datasets difficult to reproduce or extend.X-IIoTID is public, but its traffic-generation automation and attack-scenario details are not released.Source: §1 · p. 2

Related work

• Existing attack and workflow frameworks are not designed for reproducible dataset generation, while stochastic attack chains or remote-execution overhead can hinder reproducibility.MITRE Caldera introduces stochasticity, and Ansible uses SSH-based execution that may add overhead and timing artefacts.Source: §1 · p. 2

Contributions

• ISIA-AF enables reproducible attack runs, automated dataset generation from network traffic and operational data, modular attack development, and public availability.The framework is demonstrated on an industrial testbed representative of a real-world environment.Source: §1 · p. 2

2 Attack Framework Design

• ISIA-AF addresses the lack of systematic, automated execution, coordination, and documentation of OT attack scenarios for reproducible, enriched datasets.The design follows Wieringa’s Design Science Research cycle of problem investigation, treatment design, and treatment validation.Source: §2 · pp. 2–3

2.1 Architecture

• The framework combines an orchestrator, distributed attack clients, capture modules, a logger, feature extractor, and storage transfer module for control, recording, enrichment, and archiving.Requirements were derived from literature and stakeholder discussions.Source: §2 · p. 3
• Attack clients can be placed across network segments, while the suggested industrial-DMZ placement for the orchestrator and capture module provides a proxy location for IT–OT traffic capture.Mirrored switchports allow the capture module to observe network traffic.Source: §2 · p. 4, Figure 1 · p. 4
• The orchestrator sends timed scenario directives to registered clients and records their status, while clients dynamically load attack scripts and support a no-attack baseline.Components communicate via LCM, and scenarios can be manually triggered or scheduled from JSON definitions.Source: §2.1 · p. 5
• The logger’s execution record labels network and operational data; currently, all data during attack periods receives the single label “under attack.”More granular labels for attack traffic, system reaction or recovery, and normal traffic are future work, as recommended by Conti et al..Source: §2.1 · pp. 5–6

2.2 Attack Scenarios

• Attack scenarios comprise ordered actions with targets, action types, absolute or relative times, blocking behavior, and optional parameters.Actions can prepare the environment as well as execute attacks, including starting or stopping capture.Source: §2.2 · p. 6

Case Study

• The three phases prepare attack agents and capture, record the scan and attack, then stop capture and collect network, operational, and PLC data for labeling and storage.Source: §3 · pp. 6–7
• The scenario models an attacker who accesses a poorly secured monitoring system, discovers OPC UA servers and manufacturing PLCs, then launches a chunk flood attack.The attack runs from a DMZ device after an nmap scan of port 4840 and OPC UA server exploration.Source: §3 · p. 7
• The case-study scenario coordinates attacks and traffic capture, automatically labels network flows as under attack or benign, and runs scripts to enrich the dataset.Source: §3 · p. 7

• Following Wieringa’s DSR methodology, the authors derived requirements from prior work and stakeholder discussions and realised a modular framework for reproducible, documented, multi-source dataset generation.Its components include a centralised orchestrator, distributed attack clients, passive capture, a logger, and a feature extractor.Source: §4 · p. 7
• ISIA-AF supports flexible, multi-segment attack deployment with minimal communication overhead and produces datasets combining network traffic and OPC UA operational data.Source: §4 · p. 7
• To the authors’ knowledge, ISIA-AF is the first attack framework targeting a real-world OT environment with OPC UA as the main communication protocol.Source: §4 · p. 8
• Future work will refine labels to distinguish attack traffic, system reaction, and normal traffic, and expand the library with additional OT-specific attack scenarios.Source: §4 · p. 8