A paired dataset of plaintext and TLS-encrypted Modbus/TCP traffic from an identical industrial source, supporting machine learning-based network intrusion detection research.
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.
Using this work? Please cite as:
Lawrence, H., Zhuang, Y., Bloom, G., Evaluating the Resilience of Flow-Based Machine Learning Classifiers on Encrypted ICS Traffic, IEEE Transactions on Industrial Informatics, 2026.
SUMMIT provides the first high-fidelity, paired dataset of plaintext Modbus/TCP and TLS-encrypted Modbus/TCP Security traffic from an identical source. The data was generated on a simulated water treatment plant (WTP) testbed running in Kubernetes, following the Purdue Enterprise Reference Architecture. Traffic was captured over cleartext Modbus (TCP port 502) and Modbus/TCP Security (TCP port 802) to enable direct comparative analysis of machine learning classifiers on encrypted ICS traffic.
All pcap files are hosted on DigitalOcean Spaces. Downloads are organized by protocol (NON-TLS / TLS) and scenario type (normal / attack).
| Scenario | File | Description |
|---|---|---|
| Normal | normal_non-tls_90000s (19.6 MB) | Baseline benign traffic — 2026-02-02 |
| Normal | normal_non-tls_90000s (19.7 MB) | Baseline benign traffic — 2026-02-04 |
| Reconnaissance | recon (58.5 MB) | Network scanning followed by flood DoS |
| C2 | c2 (14.8 MB) | DNS beaconing to attacker-controlled domain |
| Write Coil | write_coil (5.3 MB) | Unauthorized WRITE_COIL command injection |
| Replay | replay (1.4 MB) | Stateful replay of legitimate control command |
| Flood | flood (247.0 MB) | High-volume flood attack |
| Coordinated Attack | coordinated (0.2 MB) | Distributed command injection from multiple agents |
| Scenario | File | Description |
|---|---|---|
| Normal | normal_tls_90000s (21.6 MB) | Baseline benign traffic — 2026-02-02 |
| Normal | normal_tls_90000s (21.7 MB) | Baseline benign traffic — 2026-02-04 |
| Reconnaissance | recon (85.8 MB) | Network scanning followed by flood DoS |
| C2 | c2 (17.1 MB) | DNS beaconing to attacker-controlled domain |
| Write Coil | write_coil (7.0 MB) | Unauthorized WRITE_COIL command injection |
| Replay | replay (2.0 MB) | Stateful replay of legitimate control command |
| Flood | flood (244.5 MB) | High-volume flood attack |
| Coordinated Attack | coordinated (0.7 MB) | Distributed command injection from multiple agents |
Raw packet captures were processed using NFStream to extract flow-based features, producing bidirectional network flows. Each row represents a single flow with columns corresponding to extracted features (flow duration, packet/byte counts, TCP flags, IP addresses, ports, and protocol metadata). No payload data is included. The resulting parquet files contain label-encoded categorical features (IP addresses) for direct compatibility with machine learning pipelines.
Pipeline code (GitHub)
| Metric | SUMMIT-NON-TLS | SUMMIT-TLS |
|---|---|---|
| Total Flows | 200,639 | 201,235 |
| Attack Flows | 160,105 | 160,740 |
| Normal Flows | 40,534 | 40,495 |
| Imbalance Ratio | 0.798 | 0.799 |
| Feature File Size | 274 MB | 282 MB |
SUMMIT dataset — Secure University Modbus Middleware Infrastructure Testbed