The increasing digitization and interconnection of legacy Industrial Control Systems (ICSs) open new vulnerability surfaces, exposing such systems to malicious attackers. Furthermore, since ICSs are often employed in critical infrastructures (e.g., nuclear plants) and manufacturing companies (e.g., chemical industries), attacks can lead to devastating physical damages. In dealing with this security requirement, the research community focuses on developing new security mechanisms such as Intrusion Detection Systems (IDSs), facilitated by leveraging modern machine learning techniques. However, these algorithms require a testing platform and a considerable amount of data to be trained and tested accurately. To satisfy this prerequisite, Academia, Industry, and Government are increasingly proposing testbed (i.e., scaled-down versions of ICSs or simulations) to test the performances of the IDSs. Furthermore, to enable researchers to cross-validate security systems (e.g., security-by-design concepts or anomaly detectors), several datasets have been collected from testbeds and shared with the community. In this paper, we provide a deep and comprehensive overview of ICSs, presenting the architecture design, the employed devices, and the security protocols implemented. We then collect, compare, and describe testbeds and datasets in the literature, highlighting key challenges and design guidelines to keep in mind in the design phases. Furthermore, we enrich our work by reporting the best performing IDS algorithms tested on every dataset to create a baseline in state of the art for this field. Finally, driven by knowledge accumulated during this survey’s development, we report advice and good practices on the development, the choice, and the utilization of testbeds, datasets, and IDSs.

中文翻译：

---

工业控制系统安全研究测试平台和数据集综述


传统工业控制系统 (ICS) 日益数字化和互连带来了新的漏洞面，使此类系统面临恶意攻击者的威胁。此外，由于ICS通常用于关键基础设施（例如核电站）和制造公司（例如化学工业），因此攻击可能会导致毁灭性的物理损害。为了满足这一安全要求，研究社区专注于开发新的安全机制，例如利用现代机器学习技术促进的入侵检测系统 (IDS)。然而，这些算法需要测试平台和大量数据才能准确地进行训练和测试。为了满足这一先决条件，学术界、工业界和政府越来越多地提出测试平台（即 ICS 或模拟的缩小版本）来测试 IDS 的性能。此外，为了使研究人员能够交叉验证安全系统（例如，设计安全概念或异常检测器），已经从测试平台收集了多个数据集并与社区共享。在本文中，我们对 ICS 进行了深入而全面的概述，介绍了其架构设计、所使用的设备以及所实施的安全协议。然后，我们收集、比较和描述文献中的测试台和数据集，强调在设计阶段要记住的关键挑战和设计指南。此外，我们还通过报告在每个数据集上测试的最佳性能 IDS 算法来丰富我们的工作，以创建该领域最先进的基线。 最后，在本次调查开发过程中积累的知识的推动下，我们报告了有关测试台、数据集和 IDS 的开发、选择和使用的建议和良好实践。