<figure><img src="image_1.png" /></figure>

HAL
open science

# Dataset of Anomalies and Malicious Acts in a Cyber-Physical Subsystem

Pedro Merino Laso, David Brosset, John Puentes

<figure><img src="image_2.png" /></figure>

## ► To cite this version:

Pedro Merino Laso, David Brosset, John Puentes. Dataset of Anomalies and Malicious Acts in a Cyber-Physical Subsystem. Data in Brief, 2017, 14, pp.186 - 191. 10.1016/j.dib.2017.07.038. hal-01597298

HAL Id: hal-01597298

https://hal.science/hal-01597298

Submitted on 27 May 2024

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_3.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_1.png" /></figure>

HAL
open science

# Dataset of Anomalies and Malicious Acts in a Cyber-Physical Subsystem

Pedro Merino Laso, David Brosset, John Puentes

<figure><img src="image_2.png" /></figure>

## To cite this version:

Pedro Merino Laso, David Brosset, John Puentes. Dataset of Anomalies and Malicious Acts in a Cyber-Physical Subsystem. Data in Brief, 2017, 14, pp.186 - 191. 10.1016/j.dib.2017.07.038. hal-01597298

HAL Id: hal-01597298

https://hal.science/hal-01597298v1

Submitted on 27 May 2024

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_3.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_4.png" /></figure>

ELSEVIER

Contents lists available at ScienceDirect

Data in Brief

journal homepage: www.elsevier.com/locate/dib

<figure><img src="image_5.png" /></figure>

Data Article

# Dataset of anomalies and malicious acts in a cyber-physical subsystem

<figure><img src="image_6.png" /></figure>

CrossMark

Pedro Merino Laso a,*, David Brosset a,b,**, John Puentes a,c,**

## ARTICLE INFO

**Article history:**

Received 3 May 2017

Received in revised form

10 July 2017

Accepted 18 July 2017

Available online 20 July 2017

**Keywords:**

Anomaly

Cyber-physical system

Sensor data

Systems security

## ABSTRACT

This article presents a dataset produced to investigate how data and information quality estimations enable to detect aNomalies and malicious acts in cyber-physical systems. Data were acquired making use of a cyber-physical subsystem consisting of liquid containers for fuel or water, along with its automated control and data acquisition infrastructure. Described data consist of temporal series representing five operational scenarios – Normal, aNoma- lies, breakdown, sabotages, and cyber-attacks – corresponding to 15 different real situations. The dataset is publicly available in the . zip file published with the article, to investigate and compare faulty operation detection and characterization methods for cyber- physical systems.

© 2017 The Authors. Published by Elsevier Inc. This is an open access article under the CC BY license (http://creativecommons.org/licenses/by/4.0/).

## Specifications Table

<table><tr><td>Subject area</td><td>Cyber-physical systems</td></tr><tr><td>More specific subject area</td><td>Anomaly detection and security</td></tr></table>

<footnote>a Chair of Naval Cyber Defense, École Navale - CC 600, F29240 Brest Cedex 9, France</footnote>

<footnote>b Naval Academy Research Institute, École Navale - CC 600, F29240 Brest Cedex 9, France</footnote>

<footnote>c Institut Mines-Télécom Atlantique, Lab-STICC CNRS UMR 6285, Equipe DECIDE, F-29238 Brest, France</footnote>

<footnote>* Corresponding author.</footnote>

<footnote>** Corresponding authors at: Chair of Naval Cyber Defense, École Navale - CC 600, F29240 Brest Cedex 9, France.
E-mail addresses: pedro.merino@ecole-navale.fr (P.M. Laso), david.brosset@ecole-navale.fr (D. Brosset), john.puentes@imt-atlantique.fr (J. Puentes).</footnote>
<figure><img src="image_4.png" /></figure>

ELSEVIER

Contents lists available at ScienceDirect

Data in Brief

journal homepage: www.elsevier.com/locate/dib

<figure><img src="image_5.png" /></figure>

Data Article

# Dataset of anomalies and malicious acts in a cyber-physical subsystem

<figure><img src="image_6.png" /></figure>

CrossMark

Pedro Merino Laso a,*, David Brosset a,b,**, John Puentes a,c,**

## ARTICLE INFO

**Article history:**

Received 3 May 2017

Received in revised form

10 July 2017

Accepted 18 July 2017

Available online 20 July 2017

**Keywords:**

Anomaly

Cyber-physical system

Sensor data

Systems security

## ABSTRACT

This article presents a dataset produced to investigate how data and information quality estimations enable to detect aNomalies and malicious acts in cyber-physical systems. Data were acquired making use of a cyber-physical subsystem consisting of liquid containers for fuel or water, along with its automated control and data acquisition infrastructure. Described data consist of temporal series representing five operational scenarios – Normal, aNoma- lies, breakdown, sabotages, and cyber-attacks – corresponding to 15 different real situations. The dataset is publicly available in the . zip file published with the article, to investigate and compare faulty operation detection and characterization methods for cyber- physical systems.

© 2017 The Authors. Published by Elsevier Inc. This is an open access article under the CC BY license (http://creativecommons.org/licenses/by/4.0/).

## Specifications Table

<table><tr><td>Subject area</td><td>Cyber-physical systems</td></tr><tr><td>More specific subject area</td><td>Anomaly detection and security</td></tr></table>

<footnote>a Chair of Naval Cyber Defense, École Navale - CC 600, F29240 Brest Cedex 9, France</footnote>

<footnote>b Naval Academy Research Institute, École Navale - CC 600, F29240 Brest Cedex 9, France</footnote>

<footnote>c Institut Mines-Télécom Atlantique, Lab-STICC CNRS UMR 6285, Equipe DECIDE, F-29238 Brest, France</footnote>

<footnote>* Corresponding author.</footnote>

<footnote>** Corresponding authors at: Chair of Naval Cyber Defense, École Navale - CC 600, F29240 Brest Cedex 9, France.
E-mail addresses: pedro.merino@ecole-navale.fr (P.M. Laso), david.brosset@ecole-navale.fr (D. Brosset), john.puentes@imt-atlantique.fr (J. Puentes).</footnote>
<table><tr><td>Type of data</td><td>Raw signal measurements directly collected from a liquid storage and distribution cyber-physical subsystem, composed by one ultrasound depth sensor, four discrete sensors, two pumps, and a communication network</td></tr><tr><td>How data was acquired</td><td>A personal computer sounder recorded all the signals in synchroNous automatic mode, scanning every 0.1 s the system's programmable logic controller (PLC)</td></tr><tr><td>Data format</td><td>Comma separated values (CSV) files</td></tr><tr><td>Experimental factors</td><td>Fifteen situations were recorded separately including – Normal, blocked measures, floating objects on the liquid's surface, sensor failure, denial of service, spoofing, wrong connection, and hit of the tanks with different intensities – to illustrate five factual operational scenarios</td></tr><tr><td>Experimental features</td><td>Relations between dysfunctional components of the cyber-physical subsystem, operational scenario, and systemic effects are represented</td></tr><tr><td>Data source location</td><td></td></tr><tr><td>Data accessibility</td><td>The data are available with this article. To access it open the index.html file included in the published .zip file</td></tr></table>

## Value of the data

* The dataset represents realistic sensors signals of a cyber-physical subsystem impacted by actual risks like aNomalies, sabotages, system breakdown, and cyber-attacks.

* The dataset can be used to validate detection and characterization algorithms for operational surveillance and security applications in cyber-physical systems.

* Included aNomalies and malicious acts can be studied to compare detection and characterization approaches for decision support.

* The dataset can be used to examine algorithms that assess data alteration and service degradation.

## 1. Data

The dataset contains 15 files of temporal series that represent 15 different situations related to 5 operational scenarios. Files' duration varies depending on the situation and dysfunctional component. Accordingly, affected components are two types of depth sensor, the underlying network, or the whole subsystem. These situations can be wrongly understood by a decision maker, or only identified for instance after the malicious act was accomplished. Since wrongly managed situations might have significant adverse operational costs, it is critical to detect and analyze in real time such events. Datasets covering such situations are currently rare, because of the complexity to acquire data from cyber-physical systems. In our case, the principle of reusable experimental platform [1] was applied, to collect diverse datasets for monitoring [2] and categorization of aNomalies [3].

## 2. Experimental design, materials and methods

Two tanks of different volumes that function as storage and distribution device for water or fuel, one ultrasound depth sensor, four discrete sensors, and two pumps, were used to acquire the dataset (Fig. 1). A computer controlled the system with a PLC connected to a monitoring network. The ultrasound depth sensor on the main tank (volume of 7 L) was calibrated relating the tank dimensions to 10,000 equidistant depth steps (0 corresponds to the full tank and 10,000 to the empty tank). Fig. 2 shows the tracked filling and emptying of the main tank. The four floating discrete sensors in the second tank (volume of 9 L), measured levels of liquid corresponding to four volumes: 1.25 L, 3.35 L, 8 L, and 9 L.

All signals – ultrasound depth sensor, pump 1, pump 2, and the four discrete level sensors – were acquired synchroNously for every situation described in Table 1, independently of the affected
<table><tr><td>Type of data</td><td>Raw signal measurements directly collected from a liquid storage and distribution cyber-physical subsystem, composed by one ultrasound depth sensor, four discrete sensors, two pumps, and a communication network</td></tr><tr><td>How data was acquired</td><td>A personal computer sounder recorded all the signals in synchroNous automatic mode, scanning every 0.1 s the system's programmable logic controller (PLC)</td></tr><tr><td>Data format</td><td>Comma separated values (CSV) files</td></tr><tr><td>Experimental factors</td><td>Fifteen situations were recorded separately including – Normal, blocked measures, floating objects on the liquid's surface, sensor failure, denial of service, spoofing, wrong connection, and hit of the tanks with different intensities – to illustrate five factual operational scenarios</td></tr><tr><td>Experimental features</td><td>Relations between dysfunctional components of the cyber-physical subsystem, operational scenario, and systemic effects are represented</td></tr><tr><td>Data source location</td><td></td></tr><tr><td>Data accessibility</td><td>The data are available with this article. To access it open the index.html file included in the published .zip file</td></tr></table>

## Value of the data

* The dataset represents realistic sensors signals of a cyber-physical subsystem impacted by actual risks like aNomalies, sabotages, system breakdown, and cyber-attacks.

* The dataset can be used to validate detection and characterization algorithms for operational surveillance and security applications in cyber-physical systems.

* Included aNomalies and malicious acts can be studied to compare detection and characterization approaches for decision support.

* The dataset can be used to examine algorithms that assess data alteration and service degradation.

## 1. Data

The dataset contains 15 files of temporal series that represent 15 different situations related to 5 operational scenarios. Files' duration varies depending on the situation and dysfunctional component. Accordingly, affected components are two types of depth sensor, the underlying network, or the whole subsystem. These situations can be wrongly understood by a decision maker, or only identified for instance after the malicious act was accomplished. Since wrongly managed situations might have significant adverse operational costs, it is critical to detect and analyze in real time such events. Datasets covering such situations are currently rare, because of the complexity to acquire data from cyber-physical systems. In our case, the principle of reusable experimental platform [1] was applied, to collect diverse datasets for monitoring [2] and categorization of aNomalies [3].

## 2. Experimental design, materials and methods

Two tanks of different volumes that function as storage and distribution device for water or fuel, one ultrasound depth sensor, four discrete sensors, and two pumps, were used to acquire the dataset (Fig. 1). A computer controlled the system with a PLC connected to a monitoring network. The ultrasound depth sensor on the main tank (volume of 7 L) was calibrated relating the tank dimensions to 10,000 equidistant depth steps (0 corresponds to the full tank and 10,000 to the empty tank). Fig. 2 shows the tracked filling and emptying of the main tank. The four floating discrete sensors in the second tank (volume of 9 L), measured levels of liquid corresponding to four volumes: 1.25 L, 3.35 L, 8 L, and 9 L.

All signals – ultrasound depth sensor, pump 1, pump 2, and the four discrete level sensors – were acquired synchroNously for every situation described in Table 1, independently of the affected
<figure><img src="image_7.png" /><figcaption>Fig. 1. Platform of the used cyber-physical subsystem.</figcaption></figure>

<figure><img src="image_8.png" /><figcaption>Fig. 2. Set example of recorded temporal series for the Normal scenario (abscissas correspond to time in seconds). From top to down: periodic liquid filling and emptying of the main tank as indicated by the ultrasound depth sensor; activation of pump 2 to fill the second tank; state of the four discrete sensors in the second tank; activation of pump 1 to fill the main tank.</figcaption></figure>

component, operational scenario, and duration. The Normal scenario without aNomalies serves as reference. Nine situations focus on the ultrasound depth sensor, since its high resolution makes it more sensitive to show aNomalies (No. 2, No. 3, and No. 4). Also, objects intentionally hidden inside the main tank modify liquid volume measurements depending on the number of pieces (No. 5 and No. 6), while surrounding humidity can block the measure (No. 7). The ultrasound depth sensor
<figure><img src="image_7.png" /><figcaption>Fig. 1. Platform of the used cyber-physical subsystem.</figcaption></figure>

<figure><img src="image_8.png" /><figcaption>Fig. 2. Set example of recorded temporal series for the Normal scenario (abscissas correspond to time in seconds). From top to down: periodic liquid filling and emptying of the main tank as indicated by the ultrasound depth sensor; activation of pump 2 to fill the second tank; state of the four discrete sensors in the second tank; activation of pump 1 to fill the main tank.</figcaption></figure>

component, operational scenario, and duration. The Normal scenario without aNomalies serves as reference. Nine situations focus on the ultrasound depth sensor, since its high resolution makes it more sensitive to show aNomalies (No. 2, No. 3, and No. 4). Also, objects intentionally hidden inside the main tank modify liquid volume measurements depending on the number of pieces (No. 5 and No. 6), while surrounding humidity can block the measure (No. 7). The ultrasound depth sensor
<table><caption>**Table 1**
List of log files that compose the dataset.</caption><thead><tr><th>No.</th><th>Situation</th><th>Affected component</th><th>Operational scenario</th><th>Duration (hh:mm:ss)</th><th>Size</th></tr></thead><tbody><tr><td>1</td><td>Normal</td><td>None</td><td>Normal</td><td>02:01:47</td><td>7.3 MB</td></tr><tr><td>2</td><td>Plastic bag</td><td>Ultrasound sensor</td><td>Accident/Sabotage</td><td>00:33:20</td><td>4.2 MB</td></tr><tr><td>3</td><td>Blocked measure 1</td><td>Ultrasound sensor</td><td>Breakdown/Sabotage</td><td>00:00:25</td><td>74 KB</td></tr><tr><td>4</td><td>Blocked measure 2</td><td>Ultrasound sensor</td><td>Breakdown/Sabotage</td><td>00:00:17</td><td>48 KB</td></tr><tr><td>5</td><td>Floating objects in main tank (2 objects)</td><td>Ultrasound sensor</td><td>Accident/Sabotage</td><td>00:01:35</td><td>272 KB</td></tr><tr><td>6</td><td>Floating objects in main tank (7 objects)</td><td>Ultrasound sensor</td><td>Accident/Sabotage</td><td>00:01:22</td><td>234 KB</td></tr><tr><td>7</td><td>Humidity</td><td>Ultrasound sensor</td><td>Breakdown</td><td>00:00:18</td><td>52 KB</td></tr><tr><td>8</td><td>Discrete sensor failure</td><td>Discrete sensor 1</td><td>Breakdown</td><td>00:13:55</td><td>1.8 MB</td></tr><tr><td>9</td><td>Discrete sensor failure</td><td>Discrete sensor 2</td><td>Breakdown</td><td>00:03:40</td><td>610 KB</td></tr><tr><td>10</td><td>Denial of service attack</td><td>Network</td><td>Cyber-attack</td><td>00:01:37</td><td>102 KB</td></tr><tr><td>11</td><td>Spoofing</td><td>Network</td><td>Cyber-attack</td><td>00:34:33</td><td>3.2 MB</td></tr><tr><td>12</td><td>Wrong connection</td><td>Network</td><td>Breakdown/Sabotage</td><td>00:15:33</td><td>1.7 MB</td></tr><tr><td>13</td><td>Person hitting the tanks (low intensity)</td><td>Whole subsystem</td><td>Sabotage</td><td>00:00:39</td><td>112 KB</td></tr><tr><td>14</td><td>Person hitting the tanks (medium intensity)</td><td>Whole subsystem</td><td>Sabotage</td><td>00:00:32</td><td>91 KB</td></tr><tr><td>15</td><td>Person hitting the tanks (high intensity)</td><td>Whole subsystem</td><td>Sabotage</td><td>00:00:33</td><td>95 KB</td></tr></tbody></table>

<figure><img src="image_9.png" /><figcaption>**Fig. 3.** Left: Environmental aNomaly detected in the reference scenario (No. 1). Right: Noise produced by a plastic film over the sensor (No. 2).</figcaption></figure>

measurements also change incorrectly when the tanks are hit with different intensities (No. 13, No. 14, and No. 15). Some examples of signal alterations are represented in Figs. 3–5.

Additionally, two of the discrete sensors (1 and 2) were disrupted by keeping each one at a blocked position, i.e. up when the liquid has Not reached that level yet (No. 8) and pushing randomly down once liquid overflowed it (No. 9), leaving the tank almost empty or filling up to the security aperture, respectively. Network intrusions were carried out making use of the Modbus Penetration Testing Framework, Smod,<fnref n="1" /> to execute a denial of service attack (No. 10) and a spoofing attack (No. 11). Finally, aNomalies can also be the result of unintentional human errors as a wrong system connection (No. 12) and more generally incorrect maintenance. Technical data sheets of the ultrasound sensor and the PLC, the network schema, the transmitted information between components, a script written in Python to read and display files, and additional details are provided with the dataset.

<footnote n="1">¹ Smod project. Available in: https://github.com/enddo/smod.</footnote>
<table><caption>**Table 1**
List of log files that compose the dataset.</caption><thead><tr><th>No.</th><th>Situation</th><th>Affected component</th><th>Operational scenario</th><th>Duration (hh:mm:ss)</th><th>Size</th></tr></thead><tbody><tr><td>1</td><td>Normal</td><td>None</td><td>Normal</td><td>02:01:47</td><td>7.3 MB</td></tr><tr><td>2</td><td>Plastic bag</td><td>Ultrasound sensor</td><td>Accident/Sabotage</td><td>00:33:20</td><td>4.2 MB</td></tr><tr><td>3</td><td>Blocked measure 1</td><td>Ultrasound sensor</td><td>Breakdown/Sabotage</td><td>00:00:25</td><td>74 KB</td></tr><tr><td>4</td><td>Blocked measure 2</td><td>Ultrasound sensor</td><td>Breakdown/Sabotage</td><td>00:00:17</td><td>48 KB</td></tr><tr><td>5</td><td>Floating objects in main tank (2 objects)</td><td>Ultrasound sensor</td><td>Accident/Sabotage</td><td>00:01:35</td><td>272 KB</td></tr><tr><td>6</td><td>Floating objects in main tank (7 objects)</td><td>Ultrasound sensor</td><td>Accident/Sabotage</td><td>00:01:22</td><td>234 KB</td></tr><tr><td>7</td><td>Humidity</td><td>Ultrasound sensor</td><td>Breakdown</td><td>00:00:18</td><td>52 KB</td></tr><tr><td>8</td><td>Discrete sensor failure</td><td>Discrete sensor 1</td><td>Breakdown</td><td>00:13:55</td><td>1.8 MB</td></tr><tr><td>9</td><td>Discrete sensor failure</td><td>Discrete sensor 2</td><td>Breakdown</td><td>00:03:40</td><td>610 KB</td></tr><tr><td>10</td><td>Denial of service attack</td><td>Network</td><td>Cyber-attack</td><td>00:01:37</td><td>102 KB</td></tr><tr><td>11</td><td>Spoofing</td><td>Network</td><td>Cyber-attack</td><td>00:34:33</td><td>3.2 MB</td></tr><tr><td>12</td><td>Wrong connection</td><td>Network</td><td>Breakdown/Sabotage</td><td>00:15:33</td><td>1.7 MB</td></tr><tr><td>13</td><td>Person hitting the tanks (low intensity)</td><td>Whole subsystem</td><td>Sabotage</td><td>00:00:39</td><td>112 KB</td></tr><tr><td>14</td><td>Person hitting the tanks (medium intensity)</td><td>Whole subsystem</td><td>Sabotage</td><td>00:00:32</td><td>91 KB</td></tr><tr><td>15</td><td>Person hitting the tanks (high intensity)</td><td>Whole subsystem</td><td>Sabotage</td><td>00:00:33</td><td>95 KB</td></tr></tbody></table>

<figure><img src="image_9.png" /></figure>

<figure><img src="image_10.png" /><figcaption>**Fig. 3.** Left: Environmental aNomaly detected in the reference scenario (No. 1). Right: Noise produced by a plastic film over the sensor (No. 2).</figcaption></figure>

measurements also change incorrectly when the tanks are hit with different intensities (No. 13, No. 14, and No. 15). Some examples of signal alterations are represented in Figs. 3–5.

Additionally, two of the discrete sensors (1 and 2) were disrupted by keeping each one at a blocked position, i.e. up when the liquid has Not reached that level yet (No. 8) and pushing randomly down once liquid overflowed it (No. 9), leaving the tank almost empty or filling up to the security aperture, respectively. Network intrusions were carried out making use of the Modbus Penetration Testing Framework, Smod,<fnref n="1" /> to execute a denial of service attack (No. 10) and a spoofing attack (No. 11). Finally, aNomalies can also be the result of unintentional human errors as a wrong system connection (No. 12) and more generally incorrect maintenance. Technical data sheets of the ultrasound sensor and the PLC, the network schema, the transmitted information between components, a script written in Python to read and display files, and additional details are provided with the dataset.

<footnote n="1">¹ Smod project. Available in: https://github.com/enddo/smod.</footnote>
<figure><img src="image_10.png" /><figcaption>Fig. 4. Left: Blocked sensor (No. 3). Right: Perturbations produced by floating objects (No. 5).</figcaption></figure>

<figure><img src="image_11.png" /><figcaption>Fig. 5. Left: Signal of the wet sensor (No. 7). Right: Perturbations caused while hitting the tanks (No. 14).</figcaption></figure>

**Acknowledgements**

The authors would like to thank the Chair of Naval Cyber Defense funded and supported by École Navale, Institut Mines-Telecom Atlantique Bretagne Pays de la Loire, Thales and DCNS.

**Transparency document. Supporting information**

Transparency data associated with this article can be found in the online version at http://dx.doi.org/10.1016/j.dib.2017.07.038.

**Appendix A. Supporting information**

Supplementary data associated with this article can be found in the online version at http://dx.doi.org/10.1016/j.dib.2017.07.038.
<figure><img src="image_11.png" /><figcaption>**Fig. 4.** Left: Blocked sensor (No. 3). Right: Perturbations produced by floating objects (No. 5).</figcaption></figure>

<figure><img src="image_12.png" /><figcaption>**Fig. 5.** Left: Signal of the wet sensor (No. 7). Right: Perturbations caused while hitting the tanks (No. 14).</figcaption></figure>

**Acknowledgements**

The authors would like to thank the Chair of Naval Cyber Defense funded and supported by École Navale, Institut Mines-Telecom Atlantique Bretagne Pays de la Loire, Thales and DCNS.

**Transparency document. Supporting information**

Transparency data associated with this article can be found in the online version at http://dx.doi.org/10.1016/j.dib.2017.07.038.

**Appendix A. Supporting information**

Supplementary data associated with this article can be found in the online version at http://dx.doi.org/10.1016/j.dib.2017.07.038.
References

[1] H. Gao, Y. Peng, Z. Dai, T. Wang, X. Han, H. Li, An industrial control system testbed based on emulation, physical devices and simulation, in: J. Butts, S. SheNoi (Eds.), Critical Infrastructure Protection VIII. IFIP Advances in Information and Communication TechNology, 441, 2014, pp. 79–91.

[2] P. Merino Laso, D. Brosset, J. Puentes, Monitoring approach of cyber-physical systems by quality measures, in: Proceedings of the 7th International Conference on Sensor Systems and Software, European Alliance for Innovation. LNICST, 205, 9, 2016, pp. 1–13. http://dx.doi.org/10.1007/978-3-319-61563-9

[3] P. Merino Laso, D. Brosset, J. Puentes, Analysis of quality measurements to categorize anomalies in sensor systems, in: Proceedings of Computing Conference, 2017, pp. 1330–1338. ISBN: 978-1-5090-5443-5.
References

[1] H. Gao, Y. Peng, Z. Dai, T. Wang, X. Han, H. Li, An industrial control system testbed based on emulation, physical devices and simulation, in: J. Butts, S. SheNoi (Eds.), Critical Infrastructure Protection VIII. IFIP Advances in Information and Communication TechNology, 441, 2014, pp. 79–91.

[2] P. Merino Laso, D. Brosset, J. Puentes, Monitoring approach of cyber-physical systems by quality measures, in: Proceedings of the 7th International Conference on Sensor Systems and Software, European Alliance for Innovation. LNICST, 205, 9, 2016, pp. 1–13. http://dx.doi.org/10.1007/978-3-319-61563-9

[3] P. Merino Laso, D. Brosset, J. Puentes, Analysis of quality measurements to categorize anomalies in sensor systems, in: Proceedings of Computing Conference, 2017, pp. 1330–1338. ISBN: 978-1-5090-5443-5.