Data4Cyber: A Labeled Cyber-Physical Dataset for Distribution-Grid Management Systems Under Representative OT Attacks
Ömer Sen, Lennart Bader, Marawan Emara, Martin Serror, Benedikt Schwalm, Junichi Tsurumi, Tatsumi Oba, Tomohiro Izawa, Yoshihiro Ujiie:
In International Conference on Cyber Security and Resilience (IEEE CSR 2026), IEEE, 2026
@dataset{sbe+26,
author = {Sen, Ömer and Bader, Lennart and Emara, Marawan and Serror, Martin and Schwalm, Benedikt and Tsurumi, Junichi and Oba, Tatsumi and Izawa, Tomohiro and Ujiie, Yoshihiro},
title = {{Data4Cyber: A Labeled Cyber-Physical Dataset for Distribution-Grid Management Systems Under Representative OT Attacks}},
month = may,
year = 2026,
publisher = {Zenodo},
doi = {10.5281/zenodo.19965384}
}
Abstract
Cyberattacks against power systems increasingly exploit industrial communication and control dependencies arising from distributed energy resources, remote management, and market-based incentives.
Although intrusion detection and resilience mechanisms are actively researched, progress is constrained by a lack of public, well-documented datasets that align network telemetry with physical measurements and control context in realistic operational settings.
This paper presents Data4Cyber, a suite of labeled datasets recorded in a cyberphysical testbed emulating a distribution-grid management system for self-consumption optimization with photovoltaic generation, battery storage, controllable loads, and substation/feeder metering.
The release combines synchronized (i) time-series electrical measurements, (ii) controller-relevant context including price incentives, and (iii) packet captures of OT communication (Modbus/TCP and MQTT).
It covers one benign baseline (S0) and six attack scenarios (S1–S6), including protocol-semantic Modbus manipulation, man-in-the-middle false-data injection, and MQTT supply-chain-style price manipulation.
Data4Cyber is provided in machine-learning-friendly formats with fixed time alignment (default: 1 s), phase-resolved attack annotations, and standalone metadata describing scenario context, experiment setup, and testbed infrastructure.