# SCADA System Testbed for Cybersecurity Research Using Machine Learning Approach
## 1 Introduction  
Supervisory Control and Data Acquisition (SCADA) systems are Industrial Control Systems (ICS) widely used by industries to monitor and control different processes such as oil and gas pipelines, water distribution, electrical power grids, etc. These systems provide automated control and remote monitoring of services being used in daily life. For example, states and municipalities use SCADA systems to monitor and regulate water levels in reservoirs, pipe pressure, and water distribution.  
A typical SCADA system includes components like computer workstations, Human Machine Interface (HMI), Programmable Logic Controllers (PLCs), sensors, and actuators [1]. Historically, these systems had private and dedicated networks. However, due to the wide-range deployment of remote management, open IP networks (e.g., Internet) are now used for SCADA systems communication [2]. This exposes SCADA systems to the cyberspace and makes them vulnerable to cyber-attacks using the Internet.  
Machine learning (ML) and artificial intelligence techniques have been widely used to constitute an intelligent and efficient Intrusion Detection System (IDS) dedicated to ICS. However, researchersgenerally develop and train their ML-based security system using network traces obtained from publicly available datasets. Due to malware evolution and changes in the attack strategies, these datasets fail to protect the system from new types of attacks, and consequently, the benchmark datasets should be updated periodically.  
This paper presents the deployment of a SCADA system testbed for cybersecurity research and investigates the feasibility of using ML algorithms to detect cyber-attacks in real time. The testbed was built using equipment deployed in real industrial settings. Sophisticated attacks were conducted on the testbed to develop a better understanding of the attacks and their consequences in SCADA environments. The network traffic was captured, including both abnormal and normal traffic. The behavior of both types of traffic (abnormal and normal) was analyzed, and features were extracted to build a new SCADA-IDS dataset. This dataset was then used for training and testing ML models which were further deployed in the network. The performance of the ML model depends highly on the available datasets. One of the main contributions of this paper is building a new dataset updated with recent and more sophisticated attacks. We argue that IDS using ML models trained with a dataset generated at the process control level could be more efficient, less complicated, and more cost-effective as compared to traditional protection techniques. Five traditional machine learning algorithms were trained to detect the attacks: Random Forest, Decision Tree, Logistic Regression, Naive Bayes and KNN. Once trained and tested, the ML models were deployed in the network, where real network traffic was used to analyze the effectiveness and efficiency of the ML models in a real-time environment. We compared the performance obtained during the training and test phase of the ML models with the performance obtained during the online deployment of these models in the network. The online deployment is another contribution of this paper since most of the published papers present the performance of the ML models obtained during the training and test phases. We conducted this research to build an IDS software based on ML models to be deployed in the ICS/SCADA systems.  
The remainder of the paper is organized as follows. Section 2 presents a brief background of the ICS-SCADA system reference model and the related works. Section 3 describes the developed SCADA system testbed. Section 4 describes the ML algorithms and the performance measurements used in this work. Section 5 shows the scenario of the conducted attacks and the main features of the dataset used to train the algorithms. Section 6 discusses our results and the interoperations behind them. Finally, Section 7 concludes the paper with a summary of the main points and outcomes.