trucyberlab/multimodal-ICS-provenance

ProvICS: A Multimodal Provenance-Aware CPS Intrusion Detection Dataset

ProvICS is a multimodal, provenance-aware intrusion detection dataset for cyber-physical systems (CPS), collected from a hardware-in-the-loop (HIL) ICS testbed built on the Purdue reference model. It jointly provides four time-synchronized modalities — host kernel-level provenance, PLC-edge provenance, decoded Modbus/TCP protocol semantics, and physical-process state telemetry — all aligned on a common UTC timeline to support cross-modal causal analysis and multimodal fusion.

The dataset comprises a 48-hour benign phase and a 22-hour attack phase spanning four adversarial campaigns, with 32 labeled attack events covering 20 unique ICS ATT&CK techniques across 37 distinct technique–campaign pairs.

1. Contents at a Glance

Ground-truth label files (c1_ground_truth.csv … c4_ground_truth.csv) provide per-campaign attack windows mapped to ATT&CK ICS techniques.

2. File Structure

ProvICS/
├── README.md
├── benign48h/                     # 48-hour benign baseline
│   ├── spade-provenance.json          # M1: host provenance
│   ├── rpi-provenance.json            # M2: PLC provenance
│   ├── modbus.jsonl                   # M3: decoded Modbus records
│   ├── physical_state.csv             # M4: physical telemetry
│   └── pcap                           # Network PCAP Optional
├── attack22h/                         # 22-hour attack phase (4 campaigns)
│   ├── spade-provenance.json
│   ├── rpi-provenance.json
│   ├── modbus.jsonl
│   ├── physical_state.csv
│   ├── pcap
│   ├── ground_truth/
│       ├── c1_ground_truth.csv        # Campaign 1: Smash-and-Grab
│       ├── c2_ground_truth.csv        # Campaign 2: Stealthy APT
│       ├── c3_ground_truth.csv        # Campaign 3: Targeted Manipulation
│       └── c4_ground_truth.csv        # Campaign 4: Full-Spectrum APT

The paper reports a 22-hour attack phase; with 4 champaigns, C1, C2, C3 and C4. Those campaigns ground truths are in c1-c4groundtruth.csv. Note on the Dataset Viewer: The raw provenance graphs (spade-provenance.json and rpi-provenance.json) and Modbus protocol capture (modbus.jsonl) are intentionally excluded from the Hugging Face web preview. Because they are massive, nested JSON graphs (the host graph alone contains ~3.7M vertices and ~16M edges), they cannot be parsed by the tabular web viewer. However, they are fully accessible and ready for download in the Files and versions tab.

3. Testbed Configuration

The testbed follows the Purdue reference model across four levels (physical process → basic control → supervisory control → operational control).

Physical compute nodes

• —Raspberry Pi 4 Model B (1 GB RAM, Debian 11 64-bit) — hosts the OpenPLC Runtime v3 as the physical HIL PLC (10.0.1.50).
• —x86-64 workstation (16 GB RAM, Ubuntu 22.04 LTS) — hosts the SCADA stack, physical plant simulator, and data-collection infrastructure.

Network emulation. The CORE network emulator provides an isolated 10.0.1.0/24 subnet. Virtual nodes connect through a central CORE router. A veth-bridge bridges the emulated network to the physical RPi (OpenPLC). Modbus/TCP traffic to 10.0.1.50:502 is transparently forwarded to the physical OpenPLC via a DNAT rule.

Physical plant. A continuous stirred-tank reactor (CSTR) with gas–liquid separation, inspired by the Tennessee Eastman challenge process, implemented as a Node-RED software digital twin (10.0.1.24:1880). It exchanges sensor readings and actuator commands with the PLC exclusively over Modbus/TCP.

Testbed nodes

4. Modality Details & Feature Construction

M1 — Host provenance graph

Whole-system provenance graph G_h = (V_h, E_h) captured on the SCADA host via SPADE over auditd. Vertices are processes, files, sockets, and event-loop FDs; edges are syscall-level data-flow operations (read/write/sendto/recvfrom, etc.).

M2 — PLC-edge provenance graph

Analogous provenance graph G_plc = (V_plc, E_plc) captured on the Raspberry Pi PLC.

M3 — Protocol semantic capture

Sequence of application-layer records S = {s_1, …, s_n}, where each s_i = (t_i, fc_i, addr_i, val_i) encodes timestamp, function code, register address, and payload of a Modbus/TCP transaction. Built into per-window Modbus semantic graphs (register/function-code adjacency) for the graph encoder.

M4 — Physical process state

Multivariate time series X(t) = [x_1(t), …, x_k(t)]ᵀ of k process variables sampled at frequency f_s (1 Hz), capturing the plant's dynamic response to legitimate control and adversarial manipulation.

5. Model Architectures

The baseline detectors are benign-trained autoencoders. Each detector produces a per-window reconstruction error, which is z-normalized using benign windows and then combined through late score-level fusion. All autoencoders are trained with MSE reconstruction loss using the Adam optimizer.

Provenance — `GraphSAGE_AE` (M1 + M2, shared model)

• —Encoder: SAGEConv(4 → 64, aggr="mean") → ReLU → dropout(p=0.1) → SAGEConv(64 → 32, aggr="mean")
• —Decoder: Linear(32 → 64) → ReLU → Linear(64 → 4)
• —The model uses 2 GraphSAGE message-passing layers with hidden size 64 and latent size 32.
• —Per-window score = mean node reconstruction MSE over the unique nodes incident to edges active in that window.

Physical — `PhysAE` (M4)

• —Encoder: Linear(in → 64) → ReLU → Linear(64 → 64) → ReLU → Linear(64 → 16)
• —Decoder: Linear(16 → 64) → ReLU → Linear(64 → 64) → ReLU → Linear(64 → in)
• —A window-level MLP autoencoder with three Linear layers in the encoder and three in the decoder (hidden size 64, latent size 16). in is the physical feature width, determined by the number of physical-state features extracted from the data.
• —Per-window score = reconstruction MSE over the standardized physical feature vector for that window (averaged over the feature dimensions).

Modbus — `ModbusGraphAE` (M3, when `--modbus-encoder graph`)

• —Node encoder: SAGEConv(16 → 32, aggr="mean") → ReLU → SAGEConv(32 → 16, aggr="mean")
• —Mean-pool node embeddings to obtain a graph latent vector z_graph with 16 dimensions.
• —Decoder: concatenate each node latent with the graph latent, [z_node ‖ z_graph], then Linear(16+16 → 32) → ReLU → Linear(32 → 16).
• —The model uses 2 GraphSAGE message-passing layers with hidden size 32 and latent size 16.
• —Per-window score = mean node reconstruction MSE across the nodes in the Modbus communication graph.

All three GNN/MLP encoders use ReLU activations and mean neighbor aggregation. Alternative Modbus encoders (mlp, lstm) and alternative provenance encoders exist in the code but are not used in the headline run.

6. Hyperparameters

All values below are read directly from the code and the reproduction command; where a value comes from a hardcoded default rather than a CLI flag, that is noted.

Optimization (identical across all three models)

Per-model settings

Note the defaults differ from the command: the script defaults to --epochs 50 and --modbus-encoder mlp, but the headline command overrides these to --epochs 15 and --modbus-encoder graph.

Fusion & thresholds

Fusion rules (as implemented)

• —sum-z (`--fusion sum`): per-modality z-scores added: fused = p_z + q_z + m_z. Single threshold. Primary reported detector.
• —max-z (`--fusion max`): element-wise max over the three modality z-scores.
• —max3 (`--fusion max3`): max(max-z, sum-z).
• —OR-calibrated (`--fusion or-calibrated`): each modality gets an independently calibrated threshold via a joint quantile sweep; an alert fires if any modality crosses its threshold. The sweep maximizes recall subject to the benign-FP budget.

7. Training & Validation Strategy

• —Unsupervised, benign-trained. All autoencoders are trained only on the 48-hour benign phase; no attack data is seen during training.
• —Validation / thresholding split. A held-out portion of the benign phase is used to fit each modality's z-normalization statistics and to calibrate detection thresholds. The 22-hour attack phase is used exclusively for evaluation and is never used for model fitting or threshold selection.
• —No label leakage. Ground-truth attack windows (c*_ground_truth.csv) are used only to score events and to count false positives; they do not inform training.

8. Threshold Selection

Z-normalization. Each modality's per-window reconstruction error is converted to a z-score using the mean and standard deviation of the benign windows only (z = (score − μ_benign) / (σ_benign + 1e-8)), computed in main at fusion time. This is a standard mean/std z-score, not a robust median/MAD statistic.

Threshold sweep. Thresholds are selected on the benign window distribution to satisfy a benign false-positive budget rather than tuned on attack data. The calibration routines sweep candidate thresholds over a quantile grid — linspace(0.50, 0.95) for the lower half and linspace(0.95, 1.0) for the upper half of each modality's z-distribution — and pick the combination that maximizes recall subject to the target FPR budget:

• —sum-z (primary): single threshold on the summed z-score, reported at the operating point giving a 1.40% benign-window FPR.
• —OR-calibrated: per-modality thresholds jointly swept; --or-fpr-sweep traces targets from 0.5% to 10% (--or-fpr-targets 0.005,0.01,0.02,0.05,0.10) for the recall/FPR trade-off.

9. Evaluation Protocol

Event-level evaluation. Each of the 32 labeled attack phases is treated as one event and counted detected if at least one 60-second anomalous window overlaps its time interval. Alerts outside labeled attack phases are counted as false positives and remain penalized.

Window-level false positives. In addition to event-level scoring, false positives are measured at the level of 60-second benign windows, reported as the benign-window FPR (see below).

Detection latency (time-to-detect, TTD). The script computes per-event TTD (seconds from labeled attack-phase start to the first overlapping anomalous window) and reports median and max TTD over detected events, plus a per-campaign median-TTD table (ttd_median_s). Because detection windows are 60 s, TTD is at 60-second resolution.

Window-level false positives. The script reports the raw count of false-positive benign windows out of total benign windows, and the resulting window-level FPR (fp_windows / benign_windows) — i.e., false positives are surfaced at window granularity, not only via the event-level view.

10. Baseline Results

Event-level detection over 32 labeled attack phases across four campaigns:

Headline: No single modality detects all 32 attack phases (provenance 24, physical 17, Modbus 22). Three-modality sum-z fusion detects all 32 phases at 100% event-level recall, 0.9133 F1, and a 1.40% benign-window FPR. The fusion gain reflects complementary coverage rather than data volume — each modality is structurally blind to certain attacks, and single-layer data cannot recover events that leave no trace in that layer.

11. Computational Cost

12. License

This dataset is licensed under CC BY-NC 4.0 (Creative Commons Attribution-NonCommercial 4.0 International). You are free to use, share, and adapt this dataset for non-commercial research purposes, provided you give appropriate credit by citing the paper below. Attack traffic and exploit artifacts are provided solely for defensive intrusion-detection research and must not be deployed against systems without authorization.

13. Limitations & Scope

The current testbed is a single-PLC, digital-twin HIL environment and is representative rather than large-scale. Planned future work includes real-time PIDS for CPS, multi-PLC and multi-host scaling, real physical-plant integration beyond the Node-RED simulator, and support for wireless ICS protocols (e.g., WirelessHART) and encrypted industrial traffic.

14. Acknowledgement

This material is based upon work supported by the National Science Foundation under Grant No. 2239609.

14. Citation

If you use ProvICS in your research, please cite:

@misc{shibbir2026provicsprovenancebasedintrusiondetection,
      title={ProvICS: A Provenance-based Intrusion Detection for Industrial Control Systems}, 
      author={Md Neyamul Islam Shibbir and Deepak K Tosh},
      year={2026},
      eprint={2607.05989},
      archivePrefix={arXiv},
      primaryClass={cs.CR},
      url={https://arxiv.org/abs/2607.05989}, 
}