## 5 Industrial Datasets Analysis
All datasets contain documentation but often do not contain all the necessary information. The analysis shows that the majority of available public datasets are focused on cyber-security issues, while the classification of protocols is minimal. This may also be due to the distinct individuality of individual plants and industries. To this end, it is thus nontrivial to use the available datasets and to use only normal/regular data flow, thus reducing the dataset size considerably. Another aspect is the availability of public datasets, where some datasets are difficult to access, and it is necessary to be a subscriber. In addition, datasets are available from the OT environment that contain only sensory data. Thus, these datasets cannot be directly used for the detection of industrial hazards but only for the detection or classification of security incidents within a given workplace. These datasets may include, among others, those mentioned in [43]. However, signal data cannot be used for protocol classification purposes, and anomaly detection may be strongly associated with a given workplace. It is necessary to train the AI model on just the specific states that can be \"accepted\"/assumed in a given environment. Thus, based on the analysis performed, individual challenges were identified in order to classify the industrial protocols:  
1. create a representative and comprehensive dataset using an industrial protocol,
2. to use real industrial networks and devices to get closer to real applications,
3. to allow modification or change of the industrial protocol (within the dataset)--protocol diversity. Fulfilling these challenges will thus enable research into methods to classify industrial protocols, the protocol versions used, and the cipher suites of encrypted protocol versions used. In the case of using the same workstation with only a change of industrial protocol, it is possible to focus only on the protocol itself, without the influence of the transmitted data on the industrial protocol classification performed (the protocol classification will not be directly influenced by the transmitted data). A total of 28 datasets were compared in the analysis, with most of them focusing only on a specific part and, in particular, on areas of cyber security anomalies. The classification of the protocols themselves is very limited, especially in the OT area. In the case of the use of IT protocols, typical IT protocols such as HTTP, HTTPS, DNS, FTP, ICMP, IMAP, POP3, etc., are often used. In the case of OT protocols, these are typically Modbus, IEC 60870-5-104, and DNP3. There is also a range of sensor data (data obtained from the L0 Purdue model--data obtained from sensors and actuators). However, these data are intended for anomaly detection in terms of the behavior of individual states and do not contain the protocol itself (they are only application data or values of individual variables). In terms of size (records, volume parameter in Table 3), the individual datasets vary considerably, and in the case of the PCAP source, this value is variable depending on what data are parsed. Dataset balance has not been considered in the table because many datasets do not provide predefined training and test sets (separate datasets). It is the train/test split parameter that may be crucial and, as such, it may be a target of research. \begin{table}
\begin{tabular}{l l c c c c c c c c c c c c c} \hline \hline
**Link** & **Name of Dataset** & **Year** & **IT/OT** & **Classes** & **Feature Count** & **Format** & **Time-Series** & **Labched** & **Classification of** & **Cyber-acc. ** & **Source** & **Protocol** & **Volume** & **Docs. ** \\ \hline
[5] & DARFA & 1998 IT & 2 & NR & PCAP & Yes & No & Anomaly & Yes & Real \({}^{*}\) & IT & - & Yes \\ \hline
[4] & KDCP cup 19