ICSLibrary: A Dataset and Benchmark for Identifying Internet-Facing Industrial Control System Devices

Identifying Internet-facing industrial control system (ICS) devices is essential for asset inventory, vulnerability assessment, exposure measurement, and security monitoring. These tasks require information about the vendors, types, and models of exposed ICS devices beyond the presence of an industrial protocol. However, developing and evaluating device identification methods remains constrained by the scarcity of labeled traffic from Internet-facing ICS devices. Existing public ICS datasets are largely collected from testbeds or designed for intrusion detection, providing limited support for studying identification across diverse device instances and changing Internet measurement conditions. We present ICSLibrary, a dataset and benchmark covering 2,205 labeled endpoints and 165 models across three industrial protocols: Modbus/TCP, EtherNet/IP, and S7comm. We construct the dataset through Internet-facing ICS service discovery followed by repeated protocol-specific probing at different times and scanner locations, collecting network traffic and device information. These measurements capture response variability under Internet measurement conditions, and we derive paired traffic views to examine the contributions of instance information and explicit model identifiers. Experiments reveal that accurate recognition of previously observed endpoints does not consistently translate into effective identification of new endpoints of the same model. Performance varies across protocols and collection conditions, and explicit model identifiers can contribute to identification even through statistical traffic features. A complementary response-based case study finds that limited identity information mostly leads to abstention, but can also result in unsupported model confirmations. ICSLibrary provides a foundation for developing and evaluating ICS device identification methods for asset inventory and exposure monitoring.