
Due to the limited understanding of Industrial Control Systems (ICSs), device identification has become increasingly vital for threat detection and security defense in ICS environments. However, the narrow range of device types and models in the existing datasets has significantly hindered the effectiveness and scalability of current device identification methods. To address this gap, we introduce a novel data collection framework specifically designed for ICS devices and present the resulting dataset, ICSLibrary, which we have made publicly available. To the best of the authors' knowledge, ICSLibrary is the first dataset dedicated to device identification in ICS security. It encompasses the most extensive range of device types, models and instances from 27 industrial vendors, collected across two countries over a 21-month period. Furthermore, we use ICSLibrary as a benchmark to evaluate several typical device fingerprinting methods, revealing a notable 16% drop in accuracy in the device model identification task, which highlights the unique challenges posed by ICSLibrary.
Industrial Control System, device identification, device fingerprinting, network traffic, machine learning
Industrial Control System, device identification, device fingerprinting, network traffic, machine learning
| selected citations These citations are derived from selected sources. This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | 0 | |
| popularity This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network. | Average | |
| influence This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | Average | |
| impulse This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network. | Average |
