1. **Executive Summary**

  

  

The D1.4 Data Management Plan (DMP) is a framework, that describes how to work
with the data and datasets that will be generated during project’s lifecycle,
including access rights management, storage, backups, data ownership and
principles of collaboration within research teams, industrial partners and
public bodies. The DMP includes information about data types, formats of
generated/collected data, and specifies methods for data gathering,
processing, sharing, and archiving. The plan also documents some data
management activities associated with the SPEAR project. A list the various
types of data that SPEAR consortium expect to collect and create is also
represented.

The project will collect the following types of data: network traffic,
operating system shell commands, keystrokes, communications and syslogs
collected from the devices in smart grid, sensors, gateways, etc.;
quantitative data related to day-to-day activity (event data produced after
processing collected raw data); and cyber attacks and threats data for
information sharing through an anonymous channel/repository. Particularly,
data will be obtained from direct observation, industrial enterprises, field
instruments, experiments, and compilations of data from other studies.

The expected data volume will be approximately 150 GB. The document will be
updated regularly aimed to improve the data management life cycle for all data
generated, collected or processed by the SPEAR project.

  2. **Introduction**

  

  

The SPEAR consortium joins the Pilot on Open Research Data project, which is
supported by the European Commission through the Horizon2020 program. The
SPEAR consortium supports the concept of open science, and shares an
optimistic assessment of the prospects of this concept for introducing
innovative solutions to the European economy, with the re-use of scientific
data on a wider scale. Thus, all data obtained during the implementation of
the SPEAR project can be published in open access mode, subject to the
additional conditions and principles described in this document below.

####  2.1 Scope and objectives of the deliverable

The purpose of the Data Management Plan (DMP) deliverable is to provide
relevant information concerning the data that will be collected, used, stored,
and shared by the partners of the SPEAR project.

The SPEAR project aims at developing an integrated solution of methods,
processes, tools and supporting tools for (see Fig. 1):

  1. Timely detection of evolved security attacks such as Threat Advanced Persistent (APT), the Man in the Middle (MiTM) attacks, Denial of Service (DoS) and Distributed DoS (DDoS) attacks using big data source analytics, advanced visual technique for anomaly detection and smart trust security management. 

  

  2. Developing an advanced forensic readiness framework, based on smart honeypot deployment that will collect attack traces and prepare the actionable evidence in court, while also ensuring privacy for the users. 

  

  3. Elaboration and implementation of the anonymous channel for securing smart grid stakeholders during the exchange of sensitive information about cyber-attack incidents and prevent information from leaking. (d) Performing risk analysis and proposing cyber hygiene procedures, while empowering EU-wide consensus by collaborating with European and global security agencies, standardization organizations, industrial partners and smart grid companies across Europe. 

  

  

(e) Exploiting the research outcomes to more critical infrastructures (CIN)
domains and creating competitive business models for utilizing the implemented
security tools in smart grid operators and actors across Europe

**Figure 1 - SPEAR aims diagram**

####  2.2 Structure of the deliverable

The report is structured in 5 chapters:

Chapter 1: Executive summary, including the purpose and the context of this
deliverable.

Chapter 2: Introduction concerning the scope of this deliverable.

Chapter 3: An overview of general principles for participation in the pilot on
open research data, IPR management and security as well as data protection,
ethics and security in SPEAR project.

Chapter 4: An overview of the data management framework along with the
specification of the dataset format, the dataset description methods,
definition of standards and metadata, approaches and policies for data
sharing, archiving and presentation. Datasets list for SPEAR new components is
also enclosed.

Chapter 5: Description of datasets from SPEAR partners.

Chapter 6: Conclusions

####  2.3 Relation to other activities in the project

The following diagram illustrates the relationship between the seven main
activities of the SPEAR project.

  1. Project Management and Coordination 

  

  2. Use Case Preparation 

  

  3. Cyber Attack Detection 

  

  4. Forensic Readiness 

  

  5. EU-Wide Consensus 

  

  6. Integration and Development 

  

  7. Dissemination and Exploitation 

  

  

**Figure 2 - The main activities of the SPEAR project**

**3\. General Principles**

SPEAR project stands for data openness and sharing; hence we are committed to
making all data collected during the project to the best of and immediately
available for use within the limits of personal privacy and commercial
confidentiality following the Fair Data Principles.

####  3.1 Participation in the Pilot on Open Research Data

#####  3.1.1 Data Availability

All the project data will be publicly available. However, different access
levels for different types of data will be allocated. For security reasons,
sensitive data such as personal data regulated by data protection rules, will
be obscured. Recordings and notes from meetings and workshops as well as
survey results will be anonymized. All anonymized data will be available in
open-access mode. Technical details of the attacks, from the anonymous
repository of smart grid incidents, will be available for everyone. The types
of data and rules will be specified in the following sections.

#####  3.1.2 Open Access to Scientific Publications

All Scientific publications will be open, unless there are special
requirements or constraints will force to non-open publications.

#####  3.1.3 Open Access to Research Data

To meet open access policy and be accessible to the research and professional
community research data will be uploaded and stored on the Zenodo, EC
publications and data repository. Research data archiving and availability
will be guaranteed by the Zenodo digital repository.

####  3.2 IPR management and security

The SPEAR consortium consists of industrial partners form both private and
public sector, all of them preserving intellectual property rights on their
technology, technical solutions and data. Given this, the SPEAR consortium
will pay particular attention to the protection of data, and will consult with
the concerned parties prior to data publication.

IPR data management will be conducted within SPEAR PM. The Collection and /or
process of personal data are managed by the Data Protection Officer.

Within the project a number of data models will be created to support the
various SPEAR modules, e.g. for the Visual-based IDS. Of course, these models
will be also populated during the execution of the pilots in SPEAR end-users
Infrastructures. If necessary, anonymized data (except the data models that do
not have any privacy concern) will be exported. In addition, the DMP is
accommodated with a part in the SPEAR website, where the data models /
datasets are uploaded (public versions). This website will be created by CERTH
(M12).

####  3.3 Data Protection, Ethics and Security

No data will be collected or processed prior the finalization of the
respective deliverables and the relevant Consent Forms.

**4\. Data Management Framework**

SPEAR will develop a data management framework for deliverables which are part
of the project and will be shared in the publicly accessible repository
Confluence. This repository will provide to the public, for each dataset that
will become publicly available, a description of the dataset along with a link
to a download section. The portal will be updated each time a new dataset has
been provided by research teams and partners, collected and is ready of public
distribution.

To reach out industrial partners and smart grid companies across Europe, the
anonymous repository of incidents and threats will be developed and anonymous
channel for exchanging sensitive information about cyber-attack incidents will
be launched.

Data lifecycle related to work packages (WP) of SPEAR project is represented
in fig. 3.

**Figure 3 - Project Data lifecycle**

####  4.1 Format of datasets

For each dataset the following characteristics will be specified:

**Table 1 - Format of Datasets**  
  
<table>  
<tr>  
<th>

X PARTNER Name_New Component/Existing Tool Name

</th> </tr>  
<tr>  
<td>

Dataset Information

</td> </tr>  
<tr>  
<td>

Dataset / Name

</td>  
<td>

_ <Mention an indicative reference name for your produced dataset> _

</td> </tr>  
<tr>  
<td>

Dataset Description

</td>  
<td>

_ <Mention the produced datasets with a brief description and if they contain
future subdatasets> _

</td> </tr>  
<tr>  
<td>

Dataset Source

</td>  
<td>

_ <From which device and how the dataset will be collected. Mention also the
position of installation> _

</td> </tr>  
<tr>  
<td>

Beneficiaries services and responsibilities

</td> </tr>  
<tr>  
<td>

Beneficiary owner of the component

</td>  
<td>

_ <Partner Name> _

</td> </tr>  
<tr>  
<td>

Beneficiaries in charge of the data collection (if different)

</td>  
<td>

_ <Partner Name> _

</td> </tr>  
<tr>  
<td>

Beneficiaries in charge of the data analysis (if different)

</td>  
<td>

_ <Partner Name> _

</td> </tr>  
<tr>  
<td>

Beneficiaries in charge of the data storage (if different)

</td>  
<td>

_ <Partner Name> _

</td> </tr>  
<tr>  
<td>

WPs and tasks

</td>  
<td>

_ <e.g. WP3, T3.4> _

</td> </tr>  
<tr>  
<td>

Standards

</td> </tr>  
<tr>  
<td>

Info about metadata (Production and storage dates, places) and documentation?

</td>  
<td>

_ <Provide the status of the metadata, if they are defined and their content>
_

</td> </tr>  
<tr>  
<td>

Standards, Format, Estimated volume of data

</td>  
<td>

_ <Mention the data format if it is available, the potential data volume and
refer also to the standards concerning the communication and the data
transfer> _

</td> </tr>  
<tr>  
<td>

Data exploitation and sharing

</td> </tr>  
<tr>  
<td>

Data exploitation (purpose/use of the data analysis)

</td>  
<td>

_ <Purpose of the data collection/generation and its relation to the
objectives of the project> _

</td> </tr>  
<tr>  
<td>

Data access policy / Dissemination level

(Confidential, only for members of the Consortium and the Commission Services)
/ Public

</td>  
<td>

_ <Access for partners & access for the public _

_(open access >, refer to the data management portal if available and to
dissemination acitivities> _

</td> </tr>  
<tr>  
<td>

Data sharing, re-use and distribution (How?)

</td>  
<td>

_ <Provide if available the data sharing policies, the requirements for data
sharing, how the data will be shared and who will decide for sharing> _

</td> </tr>  
<tr>  
<td>

Embargo periods (if any)

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Archiving and preservation (including storage and backup)

</td> </tr>  
<tr>  
<td>

Data storage (including backup): where? For how long?

</td>  
<td>

_ <Who will be the owner of the collected information, define the adherence to
partner policies and mention any potential limitations> _

</td> </tr> </table>

####  4.2 Description of methods for dataset description

The datasets will be generated by the project research team as well as
industrial partners.

All incident-related data will be entered manually and will be stored in one
anonymous repository.

Folders will be organized in a hierarchical structure.

Files will be supported with identification and number of version by using
such structure: project name, dataset name, ID, place and date.

Keywords will be added by using the thesaurus.

###  4.3 Standards and metadata

For common project data the following standards and metadata will be applied:

**Table 2 - Standards and Metadata**  
  
<table>  
<tr>  
<th>

_**Purpose** _

</th>  
<th>

_**Standard** _

</th>  
<th>

_**Link** _

</th> </tr>  
<tr>  
<td>

_**Recording information about research activity** _

</td>  
<td>

CERIF (Common

European Research

Information Format)

</td>  
<td>

_http://rd-alliance.github.io/metadatadirectory/standards/cerif.html_

</td> </tr>  
<tr>  
<td>

_**Data exchanging** _

</td>  
<td>

Data Package

</td>  
<td>

_http://rd-alliance.github.io/metadatadirectory/standards/cerif.html_

</td> </tr>  
<tr>  
<td>

_**Data citation and retrieval purposes** _

</td>  
<td>

DataCite Matadata Schema

</td>  
<td>

_http://rd-alliance.github.io/metadatadirectory/standards/datacite-
metadataschema.html_

</td> </tr>  
<tr>  
<td>

_**Data authoring, deposit, exchange, visualization, reuse, and preservation**
_

</td>  
<td>

OAI-ORE (Open

Archives Initiative

Object Reuse and

Exchange)

</td>  
<td>

_http://rd-alliance.github.io/metadatadirectory/standards/oai-ore-open-
archivesinitiative-object-reuse-and-exchange.html_

</td> </tr>  
<tr>  
<td>

_**Data registration** _

</td>  
<td>

DOI (Digital Object

Identifier)

</td>  
<td>

_https://fairsharing.org/biodbcore-001020/_

</td> </tr> </table>

###  4.4 Data sharing

All research data will be shared in the publicly accessible repository
Confluence using descriptive metadata as it provided by this repository. To
perform identification and access to citation all research data will be
supported by DOIs.

For all other cases, in accordance with project policy, credentials are needed
in order to obtain information from the repository.

**Table 3 - Data Types and Repositories for Storage and Sharing Data**  
  
<table>  
<tr>  
<th>

_**Data types** _

</th>  
<th>

_**Users** _

</th>  
<th>

_**Repository** _

</th>  
<th>

_**Type of** _

_**Repository** _

</th>  
<th>

_**Link** _

</th>  
<th>

_**Access** _

</th> </tr>  
<tr>  
<td>

_**Research data, e.g. statistics, visualization** _

_**analytics, measurements, survey results, results of experiments available
in digital form** _

</td>  
<td>

_University researchers_

</td>  
<td>

_University of Reading_

_Research Data_

_Archive_

</td>  
<td>

_External_

</td>  
<td>

_http://www.readin_ _g.ac.uk/reas-_

_RDArchive.aspx_

</td>  
<td>

_Open_

</td> </tr>  
<tr>  
<td>

_**Publications** _

</td>  
<td>

_All_

</td>  
<td>

_Zenodo_

</td>  
<td>

External

</td>  
<td>

_https://zenodo.org_

_/_

</td>  
<td>

_Open_

</td> </tr>  
<tr>  
<td>

_**Project documentation** _

</td>  
<td>

_SPEAR_

_Partners_

</td>  
<td>

_Confluence_

</td>  
<td>

External

</td>  
<td>

__https://space.uow_ _ __m.gr/confluence_ _

</td>  
<td>

</td> </tr>  
<tr>  
<td>

_**Security related data, e.g. Network traffic data and syslogs, operating** _

_**system shell commands, Abnormal** _

_**network traffic dataset, database records that tracks the** _

</td>  
<td>

_SPEAR_

_Partners_

</td>  
<td>

_Anonymus_

_repository,_

_SPEAR webcloud_

</td>  
<td>

Internal

</td>  
<td>

</td>  
<td>

_Closed_

</td> </tr>  
<tr>  
<td>

_**changes in reputation and trust of home nodes over time,** _

_**Cyber attacks and threats data** _

</td>  
<td>

</td>  
<td>

</td>  
<td>

</td>  
<td>

</td>  
<td>

</td> </tr> </table>

###  4.5 Archiving and preservation (including storage and backup)

In accordance with EC FAIR (Findable, Accessible, Interoperable, and Re-
usable) Policy and Horizon 2020 Data Management Guidance, SPEAR project data
will be archived and preserved in open formats. For this reason, the data will
remain re-usable until the repository withdraws the data or goes out of
business.

All project-related data will be stored in _Confluence_ repository.

###  4.6 Datasets List

**Table 4 - Datasets List for SPEAR New Components**  
  
<table>  
<tr>  
<th>

_**SPEAR** _

_**New** _

_**Component** _

_**Name** _

</th>  
<th>

_**Subcomponents Name** _

</th>  
<th>

_**Related Task** _

</th>  
<th>

_**Partner** _

</th>  
<th>

_**SPEAR Pilot** _

</th>  
<th>

_**Produced Datasets** _

</th> </tr>  
<tr>  
<td>

_**SPEAR - SIEM** _

</td>  
<td>

_**OSSIM** _

_**SIEM SIEM** _

_**Basis (Data collector)** _

</td>  
<td>

_**T 3.1** _

</td>  
<td>

_**TEC** _

</td>  
<td>

_UC1- The_

_Hydro Power_

_Plant Scenario_

_UC2- The_

_Substation_

_Scenario UC3- The combined IAN_

_and HAN scenario_

_UC4- The_

_Smart Home_

_Scenario_

</td>  
<td>

**OSSIM is an open-source**

**SIEM,**

**_https://www.alienvault.com/pr_ ** **_oducts/ossim_ **

_Network traffic data and syslogs from the devices in Smart grid scenarios._

_Event data produced after processing collected raw data (Network traffic data
and syslogs)_

</td> </tr>  
<tr>  
<td>

_**SPEAR - SIEM** _

</td>  
<td>

_**BDAC** _

</td>  
<td>

_**T 3.2** _

</td>  
<td>

_**SURREY** _

_**UOWM** _

_**CERTH** _

</td>  
<td>

_ALL_

</td>  
<td>

_Normal and abnormal network_

_traffic dataset, including different types of modern attacks, application
layer attacks and several network traffic features._

</td> </tr>  
<tr>  
<td>

_**SPEAR - SIEM** _

</td>  
<td>

_**Visualbased IDS** _

</td>  
<td>

_**T 3.3** _

</td>  
<td>

_**CERTH** _

</td>  
<td>

_ALL_

</td>  
<td>

_Visualization of multiple attributes of network traffic as well as common
attributes among the records, the features extracted from the data, the
(dis-)similarities among them and the combination of multiple types of
features in clusters._

</td> </tr>  
<tr>  
<td>

_**SPEAR - SIEM** _

</td>  
<td>

_**GTM** _

</td>  
<td>

_**T 3.4** _

</td>  
<td>

_**SURREY CERTH** _

</td>  
<td>

_ALL_

</td>  
<td>

_A set of database records that tracks the change in reputation and trust of
home nodes over time._

_A set of database records that tracks the change in reputation and trust of
nodes over time._

</td> </tr>  
<tr>  
<td>

_**SPEAR - FRF** _

</td>  
<td>

_**AMI** _

_**HONEYP** _

_**OTS** _

</td>  
<td>

_**T 4.3** _

</td>  
<td>

_**TEC** _

</td>  
<td>

_UC2- The_

_Substation_

_Scenario_

</td>  
<td>

_Network traffic data, operating system shell commands, keystrokes,
communications and syslogs._

</td> </tr>  
<tr>  
<td>

_**SPEAR - FRF** _

</td>  
<td>

_**PIA framework** _

</td>  
<td>

_**T 4.4** _

</td>  
<td>

_**ED** _

</td>  
<td>

</td>  
<td>

</td> </tr>  
<tr>  
<td>

_**SPEAR - FRF** _

</td>  
<td>

_**Forensic** _

_**Database** _

_**Services** _

</td>  
<td>

_**T 4.5** _

</td>  
<td>

_**ED** _

</td>  
<td>

</td>  
<td>

</td> </tr>  
<tr>  
<td>

_**SPEAR - CHF** _

</td>  
<td>

_**SPEAR-RI** _

</td>  
<td>

_**T 5.1** _

</td>  
<td>

_**TEC** _

</td>  
<td>

</td>  
<td>

_Cyber attacks and threats data_

</td> </tr> </table>

##  5\. Description of Datasets

The SPEAR data management repository will enable project partners and research
teams to manage and distribute their public datasets through a common cloud
infrastructure in secure and efficient manner. The datasets on repository will
provide a holistic list of data resources, generic and easy to handle
datasets, and ability to move to industrial datasets. Datasets are to be
identifiable, with allowance to segregate access rights and with accessible
backups.

###  5.1 Datasets for SPEAR-SIEM

#####  5.1.1 Datasets for OSSIM SIEM

**Table 5 - TEC-SIEM Basis (Data Collector)**  
  
<table>  
<tr>  
<th>

**TEC-_SIEM Basis (Data collector)_ **

</th>  
<th>

</th> </tr>  
<tr>  
<td>

**Dataset Information**

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Dataset / Name

</td>  
<td>

_network traffic, syslog and event dataset for BDAC and Visual IDS_

</td> </tr>  
<tr>  
<td>

Dataset Description

</td>  
<td>

_The dataset includes network traffic data and syslogs from the devices in
Smart grid scenarios, and also event data produced after processing collected
raw data (network traffic data and syslogs)._

</td> </tr>  
<tr>  
<td>

Dataset Source

</td>  
<td>

  * _In: Smart grid systems of the use case scenarios_

  

  * _How: Wireshark, Suricata, AlienVault OSSIM, syslog protocol (RFC5424_ ) 

  

</td> </tr>  
<tr>  
<td>

**Beneficiaries services and responsibilities**

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Beneficiary owner of the component

</td>  
<td>

_TEC_

</td> </tr>  
<tr>  
<td>

Beneficiaries in charge of the data collection (if different)

</td>  
<td>

_TEC_

</td> </tr>  
<tr>  
<td>

Beneficiaries in charge of the data analysis (if different)

</td>  
<td>

_SURREY, UOWM, CERTH, 0INF, TEC, SH_

</td> </tr>  
<tr>  
<td>

Beneficiaries in charge of the data storage (if different)

</td>  
<td>

_TEC_

</td> </tr>  
<tr>  
<td>

WPs and tasks

</td>  
<td>

_WP3, T3.1_

</td> </tr>  
<tr>  
<td>

**Standards**

</td> </tr>  
<tr>  
<td>

Info about metadata (Production and storage dates, places) and documentation?

</td>  
<td>

_Metadata not yet defined._

</td> </tr>  
<tr>  
<td>

Standards, Format, Estimated volume of data

</td>  
<td>

 _Proprietary format using common data model of SPEAR_

</td> </tr>  
<tr>  
<td>

**Data exploitation and sharing**

</td> </tr>  
<tr>  
<td>

Data exploitation (purpose/use of the data analysis)

</td>  
<td>

_The dataset will be used for the anomaly detection algorithms of the big data
analytics component (T3.2) and visual IDS component (T3.3)_

</td> </tr>  
<tr>  
<td>

Data access policy / Dissemination level

(Confidential, only for members of the Consortium and the Commission Services)
/ Public

</td>  
<td>

_The datasets will be confidential and only for the members of the
consortium._

</td> </tr>  
<tr>  
<td>

Data sharing, re-use and distribution (How?)

</td>  
<td>

_The datasets can be shared to support other WP and tasks as defined in the
DoA._

</td> </tr>  
<tr>  
<td>

Embargo periods (if any)

</td>  
<td>

</td> </tr>  
<tr>  
<td>

**Archiving and preservation (including storage and backup)**

</td> </tr>  
<tr>  
<td>

Data storage (including backup): where? For how long?

</td>  
<td>

_Data will be stored in a suitable form (e.g. security mechanisms will be
studied since the collected data needs to fulfil forensics requirements) in
servers indicated by the pilots or the technology providers._

</td> </tr> </table>

#####  5.1.2 Datasets for BDAC

**Table 6 - CERTH – Big Data Analytics Component**  
  
<table>  
<tr>  
<th>

**CERTH-Big Data Analytics Component**

</th>  
<th>

</th> </tr>  
<tr>  
<td>

**Dataset Information**

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Dataset / Name

</td>  
<td>

_Smart Home network traffic dataset for anomaly detection_

</td> </tr>  
<tr>  
<td>

Dataset Description

</td>  
<td>

_The dataset includes both normal and abnormal network traffic and several
network traffic features to be used for anomaly detection._

</td> </tr>  
<tr>  
<td>

Dataset Source

</td>  
<td>

  * _In: Smart devices, gateways and sensors of the smarthouse_

  

  * _How: Wireshark, AlienVault OSSIM_

  

</td> </tr>  
<tr>  
<td>

**Beneficiaries services and responsibilities**

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Beneficiary owner of the component

</td>  
<td>

_SURREY_

</td> </tr>  
<tr>  
<td>

Beneficiaries in charge of the data collection (if different)

</td>  
<td>

_CERTH_

</td> </tr>  
<tr>  
<td>

Beneficiaries in charge of the data analysis (if different)

</td>  
<td>

_SURREY, CERTH_

</td> </tr>  
<tr>  
<td>

Beneficiaries in charge of the data storage (if different)

</td>  
<td>

_CERTH_

</td> </tr>  
<tr>  
<td>

WPs and tasks

</td>  
<td>

_WP3, T3.2_

</td> </tr>  
<tr>  
<td>

**Standards**

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Info about metadata (Production and storage dates, places) and documentation?

</td>  
<td>

_Metadata not yet defined._

</td> </tr>  
<tr>  
<td>

Standards, Format, Estimated volume of data

</td>  
<td>

 _Proprietary format using common data model_

</td> </tr>  
<tr>  
<td>

</td>  
<td>

_of SPEAR_

 _Data volume In = number of smart devices x time duration of capture x type
of network traffic_

</td> </tr>  
<tr>  
<td>

**Data exploitation and sharing**

</td> </tr>  
<tr>  
<td>

Data exploitation (purpose/use of the data analysis)

</td>  
<td>

_The dataset will be used for the anomaly detection algorithms of the big data
analytics component_

</td> </tr>  
<tr>  
<td>

Data access policy / Dissemination level (Confidential, only for members of
the Consortium and the Commission Services) / Public

</td>  
<td>

_The datasets will be confidential and only for the members of the
consortium._

</td> </tr>  
<tr>  
<td>

Data sharing, re-use and distribution (How?)

</td>  
<td>

_The datasets can be shared to support other WP and tasks as defined in the
DoA._

</td> </tr>  
<tr>  
<td>

Embargo periods (if any)

</td>  
<td>

</td> </tr>  
<tr>  
<td>

**Archiving and preservation (including storage and backup)**

</td> </tr>  
<tr>  
<td>

Data storage (including backup): where? For how long?

</td>  
<td>

_Data will be stored in a suitable form (e.g. encrypted) in servers indicated
by the pilots or the technology providers._

</td> </tr> </table>

**Table 7 - SURREY – Big Data Analytics Component**  
  
<table>  
<tr>  
<th>

**SURREY - Big Data Analytics Component**

</th>  
<th>

</th> </tr>  
<tr>  
<td>

**Dataset Information**

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Dataset / Name

</td>  
<td>

_network traffic dataset for anomaly detection_

</td> </tr>  
<tr>  
<td>

Dataset Description

</td>  
<td>

_The dataset includes both normal and abnormal network traffic and several
network traffic features to be used for anomaly detection._

</td> </tr>  
<tr>  
<td>

Dataset Source

</td>  
<td>

  * _In: Use case devices, gateways and sensors from the pilots_

  

  * _How: Wireshark, AlienVault OSSIM_

  

</td> </tr>  
<tr>  
<td>

**Beneficiaries services and responsibilities**

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Beneficiary owner of the component

</td>  
<td>

_UOWM_

</td> </tr>  
<tr>  
<td>

Beneficiaries in charge of the data collection (if different)

</td>  
<td>

_CERTH_

</td> </tr>  
<tr>  
<td>

Beneficiaries in charge of the data analysis (if different)

</td>  
<td>

_UOWM, SURREY, CERTH_

</td> </tr>  
<tr>  
<td>

Beneficiaries in charge of the data storage (if different)

</td>  
<td>

_CERTH_

</td> </tr>  
<tr>  
<td>

WPs and tasks

</td>  
<td>

_WP3, T3.2_

</td> </tr>  
<tr>  
<td>

**Standards**

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Info about metadata (Production and storage dates, places) and documentation?

</td>  
<td>

_Metadata not yet defined._

</td> </tr>  
<tr>  
<td>

Standards, Format, Estimated volume of data

</td>  
<td>

  * _Proprietary format using common data model of SPEAR_

  

  * _Data volume In = number of devices x time duration of capture x type of network traffic_

  

</td> </tr>  
<tr>  
<td>

**Data exploitation and sharing**

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Data exploitation (purpose/use of the data analysis)

</td>  
<td>

_The dataset will be used for the anomaly detection algorithms of the big data
analytics component_

</td> </tr>  
<tr>  
<td>

Data access policy / Dissemination level

(Confidential, only for members of the Consortium and the Commission Services)
/ Public

</td>  
<td>

_The datasets will be confidential and only for the members of the
consortium._

</td> </tr>  
<tr>  
<td>

Data sharing, re-use and distribution (How?)

</td>  
<td>

_The datasets can be shared to support other WP and tasks as defined in the
DoA._

</td> </tr>  
<tr>  
<td>

Embargo periods (if any)

</td>  
<td>

</td> </tr>  
<tr>  
<td>

**Archiving and preservation (including storage and backup)**

</td> </tr>  
<tr>  
<td>

Data storage (including backup): where? For how long?

</td>  
<td>

_Data will be stored in a suitable form (e.g. encrypted) in servers indicated
by the pilots or the technology providers._

</td> </tr> </table>

#####  5.1.3 Datasets for Visual-Based IDS

**Table 8 - CERTH – Visual-based IDS**  
  
<table>  
<tr>  
<th>

**CERTH_Visual-based IDS**

</th> </tr>  
<tr>  
<td>

**Dataset Information**

</td> </tr>  
<tr>  
<td>

Dataset / Name

</td>  
<td>

_Smart Home clustered network traffic dataset_

</td> </tr>  
<tr>  
<td>

Dataset Description

</td>  
<td>

  * _In: Real-time network traffic capture_

  

  * _Out: Visualization points and coordinates_

  

</td> </tr>  
<tr>  
<td>

Dataset Source

</td>  
<td>

  * _In: Smart devices, sensors, gateways_

  

  * _How: Wireshark, AlienVault OSSIM_

  

</td> </tr>  
<tr>  
<td>

**Beneficiaries services and responsibilities**

</td> </tr>  
<tr>  
<td>

Beneficiary owner of the component

</td>  
<td>

_SH_

</td> </tr>  
<tr>  
<td>

Beneficiaries in charge of the data collection (if different)

</td>  
<td>

_CERTH_

</td> </tr>  
<tr>  
<td>

Beneficiaries in charge of the data analysis (if different)

</td>  
<td>

_SH, CERTH_

</td> </tr>  
<tr>  
<td>

Beneficiaries in charge of the data storage (if different)

</td>  
<td>

_CERTH_

</td> </tr>  
<tr>  
<td>

WPs and tasks

</td>  
<td>

_WP3, T3.3_

</td> </tr>  
<tr>  
<td>

**Standards**

</td> </tr>  
<tr>  
<td>

Info about metadata (Production and storage dates, places) and documentation?

</td>  
<td>

_Graph coordinates, timestamp_

</td> </tr>  
<tr>  
<td>

Standards, Format, Estimated volume of data

</td>  
<td>

  * _Proprietary format using common data model of SPEAR_

  

  * _Data volume In = number of smart devices x time duration of capture x type of network traffic_

  

  * _Data volume Out = number of nodes x graph space dimensions x frequency and amount of communications_

  

</td> </tr>  
<tr>  
<td>

**Data exploitation and sharing**

</td> </tr>  
<tr>  
<td>

Data exploitation (purpose/use of the data analysis)

</td>  
<td>

_The datasets will be used for the visual identification of normal/abnormal
activities in the network in the pilot sites._

</td> </tr>  
<tr>  
<td>

Data access policy / Dissemination level

(Confidential, only for members of the Consortium and the Commission Services)
/ Public

</td>  
<td>

_The datasets will be confidential and only for the members of the
consortium._

</td> </tr>  
<tr>  
<td>

Data sharing, re-use and distribution (How?)

</td>  
<td>

_The datasets can be shared to support other WP and tasks as defined in the
DoA._

</td> </tr>  
<tr>  
<td>

Embargo periods (if any)

</td>  
<td>

</td> </tr>  
<tr>  
<td>

**Archiving and preservation (including storage and backup)**

</td> </tr>  
<tr>  
<td>

Data storage (including backup): where? For how long?

</td>  
<td>

_Data will be stored in a suitable form (e.g._

_encrypted) in servers indicated by the pilots or the technology providers._

</td> </tr> </table>

#####  5.1.4 Datasets for GTM

**Table 9 - CERTH – GTM**  
  
<table>  
<tr>  
<th>

**CERTH_GTM**

</th> </tr>  
<tr>  
<td>

**Dataset Information**

</td> </tr>  
<tr>  
<td>

Dataset / Name

</td>  
<td>

_Smart home’s nodes reputation over time_

</td> </tr>  
<tr>  
<td>

Dataset Description

</td>  
<td>

_A set of database records which capture the change of reputation and trust of
smart home’s devices, sensors and gateways over time._

</td> </tr>  
<tr>  
<td>

Dataset Source

</td>  
<td>

_Smart devices, sensors, gateways_

</td> </tr>  
<tr>  
<td>

**Beneficiaries services and responsibilities**

</td> </tr>  
<tr>  
<td>

Beneficiary owner of the component

</td>  
<td>

_SURREY_

</td> </tr>  
<tr>  
<td>

Beneficiaries in charge of the data collection (if different)

</td>  
<td>

_CERTH_

</td> </tr>  
<tr>  
<td>

Beneficiaries in charge of the data analysis (if different)

</td>  
<td>

_SURREY_

</td> </tr>  
<tr>  
<td>

Beneficiaries in charge of the data storage (if different)

</td>  
<td>

_SURREY, CERTH_

</td> </tr>  
<tr>  
<td>

WPs and tasks

</td>  
<td>

_WP3, T3.4_

</td> </tr>  
<tr>  
<td>

**Standards**

</td> </tr>  
<tr>  
<td>

Info about metadata (Production and storage dates, places) and documentation?

</td>  
<td>

_Type of device, timestamp of reputation change_

</td> </tr>  
<tr>  
<td>

Standards, Format, Estimated volume of data

</td>  
<td>

 _Proprietary format using common data model of SPEAR_

</td> </tr>  
<tr>  
<td>

**Data exploitation and sharing**

</td> </tr>  
<tr>  
<td>

Data exploitation (purpose/use of the data analysis)

</td>  
<td>

_The dataset will be used for the validation of GTM component in the smart
home scenario._

</td> </tr>  
<tr>  
<td>

Data access policy / Dissemination level

(Confidential, only for members of the Consortium and the Commission Services)
/ Public

</td>  
<td>

_The datasets will be confidential and only for the members of the
consortium._

</td> </tr>  
<tr>  
<td>

Data sharing, re-use and distribution (How?)

</td>  
<td>

_The datasets can be shared to support other WP and tasks as defined in the
DoA._

</td> </tr>  
<tr>  
<td>

Embargo periods (if any)

</td>  
<td>

</td> </tr>  
<tr>  
<td>

**Archiving and preservation (including storage and backup)**

</td> </tr>  
<tr>  
<td>

Data storage (including backup): where? For how long?

</td>  
<td>

_Data will be stored in a suitable form (e.g._

_encrypted) in servers indicated by the pilots or the technology providers._

</td> </tr> </table>

###  5.2 Datasets for SPEAR-FRF

#####  5.2.1 Datasets for AMI Honeypots

**Table 10 - TEC-AMI HONEYPOTS**  
  
<table>  
<tr>  
<th>

**TEC-_AMI HONEYPOTS_ **

</th>  
<th>

</th> </tr>  
<tr>  
<td>

**Dataset Information**

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Dataset / Name

</td>  
<td>

_System activity_

</td> </tr>  
<tr>  
<td>

Dataset Description

</td>  
<td>

_The dataset includes network traffic data, operating system shell commands,
keystrokes, communications and syslogs._

</td> </tr>  
<tr>  
<td>

Dataset Source

</td>  
<td>

  * _In: UC2- The Substation Scenario_

  

  * _How: As a basis open-source honeypots can be used (conpot,_ _CryPLH…)_

  

</td> </tr>  
<tr>  
<td>

**Beneficiaries services and responsibilities**

</td> </tr>  
<tr>  
<td>

Beneficiary owner of the component

</td>  
<td>

_TEC, SCH_

</td> </tr>  
<tr>  
<td>

Beneficiaries in charge of the data collection (if different)

</td>  
<td>

_TEC_

</td> </tr>  
<tr>  
<td>

Beneficiaries in charge of the data analysis (if different)

</td>  
<td>

_TEC_

</td> </tr>  
<tr>  
<td>

Beneficiaries in charge of the data storage (if different)

</td>  
<td>

_TEC_

</td> </tr>  
<tr>  
<td>

WPs and tasks

</td>  
<td>

_WP4, T4.3_

</td> </tr>  
<tr>  
<td>

**Standards**

</td> </tr>  
<tr>  
<td>

Info about metadata (Production and storage dates, places) and documentation?

</td>  
<td>

_Metadata not yet defined._

</td> </tr>  
<tr>  
<td>

Standards, Format, Estimated volume of data

</td>  
<td>

 _Proprietary format using common data model of SPEAR_



</td> </tr>  
<tr>  
<td>

**Data exploitation and sharing**

</td> </tr>  
<tr>  
<td>

Data exploitation (purpose/use of the data analysis)

</td>  
<td>

_The dataset will be used for the identification of cyber attacks, collection
of intelligence about attack strategies and possible countermeasures needed
and also as deception technology against attackers._

</td> </tr>  
<tr>  
<td>

Data access policy / Dissemination level (Confidential, only for members of
the Consortium and the Commission Services) / Public

</td>  
<td>

_The datasets will be confidential and only for the members of the
consortium._

</td> </tr>  
<tr>  
<td>

Data sharing, re-use and distribution (How?)

</td>  
<td>

_The datasets can be shared to support other WP and tasks as defined in the
DoA._

</td> </tr>  
<tr>  
<td>

Embargo periods (if any)

</td>  
<td>

</td> </tr>  
<tr>  
<td>

**Archiving and preservation (including storage and backup)**

</td> </tr>  
<tr>  
<td>

Data storage (including backup): where? For how long?

</td>  
<td>

_Data will be stored in a suitable form (e.g. security mechanisms will be
studied since the collected data needs to fulfil forensics requirements) in
servers indicated by the pilots or the technology providers._

</td> </tr> </table>

###  5.3 Datasets for SPEAR-CHF

#####  5.3.1 Datasets for SPEAR-RI

**Table 11 - TEC-AMI HONEYPOTS**  
  
<table>  
<tr>  
<th>

**TEC-_SPEAR-RI_ **

</th>  
<th>

</th> </tr>  
<tr>  
<td>

**Dataset Information**

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Dataset / Name

</td>  
<td>

_Cyber attacks and threats data_

</td> </tr>  
<tr>  
<td>

Dataset Description

</td>  
<td>

_The dataset includes Cyber attacks and threats data for information sharing
through an anonymous channel/repository._

</td> </tr>  
<tr>  
<td>

Dataset Source

</td>  
<td>

 _In: Smart grid systems of the use case scenarios_

</td> </tr>  
<tr>  
<td>

</td>  
<td>

 _How: to be defined. There are different options: to be filled by a system
operator/administrator or automatically by the IDS system and confirmed
manually by a system operator/administrator_

</td> </tr>  
<tr>  
<td>

**Beneficiaries services and responsibilities**

</td> </tr>  
<tr>  
<td>

Beneficiary owner of the component

</td>  
<td>

_TEC (UOWM, 8BL – to be defined)_

</td> </tr>  
<tr>  
<td>

Beneficiaries in charge of the data collection (if different)

</td>  
<td>

_TEC, UOWM, 8BL_

</td> </tr>  
<tr>  
<td>

Beneficiaries in charge of the data analysis (if different)

</td>  
<td>

_TEC, UOWM, 8BL_

</td> </tr>  
<tr>  
<td>

Beneficiaries in charge of the data storage (if different)

</td>  
<td>

_TEC, UOWM, 8BL_

</td> </tr>  
<tr>  
<td>

WPs and tasks

</td>  
<td>

_WP5, T5.1_

</td> </tr>  
<tr>  
<td>

**Standards**

</td> </tr>  
<tr>  
<td>

Info about metadata (Production and storage dates, places) and documentation?

</td>  
<td>

_Metadata not yet defined._

</td> </tr>  
<tr>  
<td>

Standards, Format, Estimated volume of data

</td>  
<td>

 _Proprietary format using common data model of SPEAR_

</td> </tr>  
<tr>  
<td>

**Data exploitation and sharing**

</td> </tr>  
<tr>  
<td>

Data exploitation (purpose/use of the data analysis)

</td>  
<td>

_The dataset will be used for the threat intelligence information sharing
among industrial partners._

</td> </tr>  
<tr>  
<td>

Data access policy / Dissemination level

(Confidential, only for members of the Consortium and the Commission Services)
/ Public

</td>  
<td>

_The datasets will be confidential and only for the members of the
consortium._

</td> </tr>  
<tr>  
<td>

Data sharing, re-use and distribution (How?)

</td>  
<td>

_The datasets can be shared to support other WP and tasks as defined in the
DoA._

</td> </tr>  
<tr>  
<td>

Embargo periods (if any)

</td>  
<td>

</td> </tr>  
<tr>  
<td>

**Archiving and preservation (including storage and backup)**

</td> </tr>  
<tr>  
<td>

Data storage (including backup): where? For how long?

</td>  
<td>

_Data will be stored in a suitable form in servers indicated by the pilots or
the technology providers._

</td> </tr> </table>