PowerDuck: A GOOSE Data Set of Cyberattacks in Substations

A recorded GOOSE data set as described in 

Sven Zemanek, Immanuel Hacker, Konrad Wolsing, Eric Wagner, Martin Henze, and Martin Serror. 2022. PowerDuck: A GOOSE Data Set of Cyberattacks in Substations. In Cyber Security Experimentation and Test Workshop (CSET ’22), August 8, 2022, Virtual, CA, USA. ACM, New York, NY, USA, 5 pages. https://doi.org/10.1145/3546096.3546102

The data set contains network traces of GOOSE communication recorded in a physical substation testbed. Further, it includes recordings of various scenarios with and without the presence of attacks. All network packets originating from the attacker are clearly labeled as such to facilitate their identification using the Industrial Protocol Abstraction Layer (IPAL) format. We thus envision PowerDuck improving and complementing existing data sets of substations, which are often generated synthetically, and thus aim to enhance the security of power grids.