# Enhancing Security in Smart Robot Digital Twins Through Intrusion Detection Systems
## 4 Test Architecture and System Implementation
### CIC Modbus  
CIC Modbus is a dataset designed specifically for industrial control systems (ICSs), focusing on network traffic using the Modbus protocol, which is widely used in industrial automation. It includes both normal communication patterns and various cyberattacks targeting ICS environments, such as Denial-of-Service (DoS), Man-in-the-Middle (MitM), and reconnaissance attacks. The dataset aims to support research in anomaly detection and cybersecurity for critical infrastructure, providing labeled traffic that helps in training and evaluating intrusion detection systems. We followed the same procedure as with the previously presented datasets, namely, analyzing the traffic with Zeek and converting the files into CSV format. Figure 3 illustrates the simulated network architecture to create the CIC Modbus Database. The CIC Modbus dataset was created using Wireshark captures from a simulated Docker-based environment, where containers simulated IEDsand SCADA HMIs exchanging data over the Modbus protocol. While secure devices had detection agents that sent security scores, insecure ones operated solely with scripts, lacking protection mechanisms.  
Having the datasets properly prepared, after undergoing all stages of preprocessing, cleaning, and splitting into training and testing subsets, the next step is the actual evaluation of the cyber-attack detection models. For this purpose, we will use classifiers based on SVM and RF to analyze and identify attack patterns present in the CICIDS2017, CIC Modbus, and 4 SICS 2015 datasets. Through this approach, we aim to compare the performance of these two methods based on relevant metrics such as the accuracy, F1-score, and attack  
\begin{table}
\begin{tabular}{c c} \hline
**Feature Name** & **Description** \\ \hline Label & 0 for normal and 1 for attack records \\ s\_retrans & Source segments retransmitted (TCP) \\ d\_retrans & Destination segments retransmitted (TCP) \\ m\_int\_s & For each connection, the mean interval between two packets (Source—in mSec) \\ m\_int\_d & For each connection, the mean interval between two packets (Destination—in mSec) \\ http\_post & No. of flows that have the method Post in HTTP service \\ user\_ftp & User FTp if requested \\ pwd\_ftp & Password FTp if captured \\ uid & A unique identifier of the connection \\ local\_orig & If the connection is originated locally, this value will be T. If it originated remotely, it will be F \\ local\_resp & If the connection is responded to locally, this value will be T. If it was responded to remotely, it \\  & will be F \\ history & Records the state history of connections as a string of letters \\ tunnel\_parents & If this connection was over a tunnel, indicate the uid values for any encapsulating parent \\  & connections used over the lifetime of this inner connection \\ orig\_bytes & The number of payload bytes the originator sent \\ resp\_bytes & The number of payload bytes the responder sent \\ \hline \end{tabular}
\end{table}
Table 2: Extracted features from the dataset, using zeek [33].  
Figure 3: Simulated network architecture to create the CIC Modbus Database [34].  
detection rate, to determine the most effective classification solution in the context of industrial cybersecurity.