# SCADA System Testbed for Cybersecurity Research Using Machine Learning Approach
## 5 Attack Scenarios, Features Selection, and Evaluation Scenarios
### Features Selection  
Once the network traffic is captured, the next step is to select potential features which can distinguish the anomalous traffic from the normal traffic. The authors in [19] selected 12 useful features for ML-based network security monitoring in the ICS networks. In Ref. [32], the authors study the potential features presented in [19]. In our work, we analyzed the variation of the features during the normal and attack traffic, and we analyzed those features that did not vary during the normal and attack traffic. Based on these prior works and our studies, Table 6 shows the features selected for our dataset.  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Features** & **Descriptions** \\ \hline Total Packets (TotPkts) & Total transaction packet count \\ Total Bytes (TotBytes) & Total transaction bytes \\ Source packets (SrcPkts) & Source/Destination packet count \\ Destination Packets (DstPkts) & Destination/Source packet count \\ Source Bytes (SrcBytes) & Source/Destination transaction bytes \\ Source Port (Sport) & Port number of the source \\ \hline \hline \end{tabular}
\end{table}
Table 6: Features selected to create the dataset.  
\begin{table}
\begin{tabular}{l l} \hline \hline
**Attack Name** & **Attack Description** \\ \hline Port Scanner [29] & This attack is used to identify common SCADA protocols on the network. Using Nmap tool, packets are sent to the target at intervals which vary from 1 to 3 s. \\  & The TCP connection is not fully established so that the attack is difficult to detect by rules. \\ \hline Address Scan Attack [29] & This attack is used to scan network addresses and identify the Modbus server \\ Address Scan Attack [29] & address. Each system has only one Modbus server and disabling this device \\  & would collapse the whole SCADA system. Thus, this attack tries to find the \\  & unique address of the Modbus server so that it can be used for further attacks. \\ \hline Device Identification & This attack is used to enumerate the SCADA Modbus slave IDs on the network \\ Attack [29] & and to collect additional information such as vendor and firmware from the first slave ID found. \\ \hline Device Identification & This attack is similar to the previous attack. However, the scanning uses an \\ Attack (Aggressive Mode) [29] & aggressive mode, which means that the additional information about all slave IDs \\ \hline Exploit [30] & Exploit is used to read the coil values of the SCADA devices. The coils represent \\  & the ON/OFF status of the devices controlled by the PLC, such as motors, valves, and sensors [29]. \\ \hline \hline \end{tabular}
\end{table}
Table 4: Reconnaissance attacks carried out against our testbed [29; 30].  
\begin{table}
\begin{tabular}{l c} \hline \hline
**Measurement** & **Value** \\ \hline Duration of capture (h) & 25 \\ Dataset length (GB) & 1.27 \\ Number of observations & 7,049,989 \\ Average data rate (kbit/s) & 419 \\ Average packet size (bytes) & 76.75 \\ Percentage of scanner attack & \(3\times 10^{-4}\) \\ Percentage of address scan attack & \(75\times 10^{-4}\) \\ Percentage of device identification attack & \(1\times 10^{-4}\) \\ Percentage of device identification attack (aggressive mode) & 4.93 \\ Percentage of exploit attack & 1.13 \\ Percentage of all attacks (total) & 6.07 \\ Percentage of normal traffic & 93.93 \\ \hline \hline \end{tabular}
\end{table}
Table 5: Statistical information on the captured traffic.