# Exploiting Autoencoder-Based Anomaly Detection to Enhance Cybersecurity in Power Grids
## 4 Threat Scenarios and Results
### Buit-Iec104-I Dataset  
The BUT-IEC104-I dataset provides a valuable resource for cybersecurity research, particularly for assessing the anomaly detection methods within the context of the IEC 60870-5-104 (IEC 104) communication protocols. Developed by [PERSON] et al. [47; 48] from Brno University of Technology, this dataset consists of network traffic traces collected from a real-world smart grid environment that conforms to the industrial network standard, IEC 608705-104. It simulates the realistic scenarios encountered in power grid operations. The traffic was monitored using an IFIX sniffer, capturing IFIIX flow and application protocol headers. The dataset includes various traffic characteristics, such as IP addresses, ports, object IDs, as well as attributes like start and end times and data exchange quantity. Each line in the dataset captures a range of headers extracted from the IEC 104 packet, totaling 16 features. These include the timestamp (absolute time) and relative time (in seconds from the start of capturing), as well as source and destination IP addresses, ports, IP length (from the IP header), and APDU length (from the IEC 104 header). Additionally, features such as the APDU format type, u-format type (including start data transfer, stop data transfer, test frame activation, test frame confirmation, stop data transfer action, and stop data transfer confirmation), and ASDU type identification (e.g., single point information, interrogation command) are recorded. These headers provide detailed information on the ASDU packet, including the number of Information Objects within it, the cause of transmission (e.g., periodic, spontaneous), originator address, ASDU address field, and Information Object Address--a list of addresses of Information Objects present in the ASDU. It covers a range of benign and malicious activities, including denial-of-service (DoS) attacks, injection attacks, connloss attacks, and rogue device attacks. For further details about the BUT-IEC104-I dataset, see [47; 48]. Each instance in the dataset consists of a sequence of network packets exchanged between the different components of the smart grid, such as substations and control centers, encoded according to the IEC 104 protocol standards. The packets contain information about the command and data exchanges, status updates, and control signals, reflecting the operational activities typical in power grid systems. To facilitate the evaluation of the anomaly detection methods, the dataset is annotated with labels indicating the presence or absence of malicious activity in each network traffic instance. This annotation enables researchers to assess the performance of the anomaly detection algorithms in accurately distinguishing between normal and malicious behaviors. Furthermore, the dataset includes metadata providing additional contextual information, such as timestamps, source and destination addresses, packet sizes, and communication patterns. This metadata enhances the understanding of the underlying network dynamics and aids in analyzing the detected anomalies. The dataset contains not only normal traffic but also various types of attack events, including DOS attacks, switching attacks, injection command attacks, and connection loss attacks. All attacks were intentionally generated at the L7 layer, also known as the application layer, of the OSI (Open Systems Interconnection) model. The application layer is the topmost layer in the OSI model and provides network services directly to user applications. Attacks at this layer can exploit the vulnerabilities in the specific applications or protocols running on top of the network stack. By generating attacks at the application layer, the aim was to simulate realistic cyber threats that target smart grid networks. These attacks include various forms of malicious activities, such as denial-of-service (DoS) attacks, injection attacks, command blocking, switching attacks, and other network intrusions.