Language selection

Government of Canada / Gouvernement du Canada

Search

Resilience against APTs: a provenance-based IIoT dataset for cybersecurity research

Download
  1. Will be available here on January 2, 2027
DOIResolve DOI: https://doi.org/10.1007/978-3-032-10554-7_7
AuthorSearch for: 1; Search for: 1; Search for: 2ORCID identifier: https://orcid.org/0000-0001-7819-5715; Search for: 1; Search for: 1ORCID identifier: https://orcid.org/0000-0001-9189-6268
Affiliation
  1. University of New Brunswick
  2. National Research Council Canada. Digital Technologies
FormatText, Article
Conference21st EAI International Conference on Mobile and Ubiquitous Systems: Computing, Networking and Services (EAI MobiQuitous 2024), November 12-14, 2024, Oslo, Norway
Subjectindustrial IoT; advanced persistent threats; data provenance; self-supervised learning
Abstract
The Industrial Internet of Things (IIoT) is a transformative paradigm that integrates smart sensors, advanced analytics, and robust connectivity within industrial processes, enabling real-time data-driven decision-making and enhancing operational efficiency across diverse sectors, including manufacturing, energy, and logistics. IIoT is susceptible to various attack vectors, with Advanced Persistent Threats (APTs) posing a particularly grave concern due to their stealthy, prolonged, and targeted nature. The effectiveness of machine learning-based intrusion detection systems in APT detection has been documented in the literature. However, existing cybersecurity datasets often lack crucial attributes for APT detection in IIoT environments. Incorporating insights from prior research on APT detection using provenance data and intrusion detection within IoT systems, we present the CICAPT-IIoT dataset. The main goal of this paper is to propose a novel APT dataset in the IIoT setting that includes essential information for the APT detection task. In order to achieve this, a testbed for IIoT is developed, and over 20 attack techniques frequently used in APT campaigns are included. The performed attacks create some of the invariant phases of the APT cycle, including Data Collection and Exfiltration, Discovery and Lateral Movement, Defense Evasion, and Persistence. By integrating network logs and provenance logs with detailed attack information, the CICAPT-IIoT dataset presents foundation for developing holistic cybersecurity measures. Additionally, a comprehensive dataset analysis is provided, presenting cybersecurity experts with a strong basis on which to build innovative and efficient security solutions.
Date published
PublisherSpringer Nature
European Alliance for Innovation
In
  • Mobile and Ubiquitous Systems: Computing, Networking and Services. MobiQuitous 2024: 121–144.
Series
  • Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering 634.
LanguageEnglish
Peer reviewedYes
Export citationExport as RIS
Report a correctionReport a correction (opens in a new tab)
Record identifiere09dd108-5c42-479e-a8a0-6acdd09487c2
Record created2026-05-22
Record modified2026-05-25

Page details

From:

Date modified: