Sherlock: A Dataset for Process-aware Intrusion Detection Research on Power Grid Networks

Sherlock is a dataset developed for research into, among others, process-aware intrusion detection in power grid networks. It is created with the power grid co-simulator Wattson. The dataset was initially presented in the ACM CODASPY’25 paper “Sherlock: A Dataset for Process-aware Intrusion Detection Research on Power Grid Networks” and a detailed documentation is available at https://sherlock.wattson.it/.

Sherlock contains 3 scenarios, namely 01_Basic, 02_Semiurban, and 03_Rural. All scenarios are of realistically-sized networks, but 01_Basic is smaller and therefore recommended for initial prototyping. 01_Basic and 02_Semiurban contain a train set without attacks, and a test set with attacks. 03_Rural only contains a test set to motivate research into transferability of results into new networks.

Each scenarios contains:

• network captures of primarily IEC 60870-5-104 from different vantage points
• accurate labels for attacks, recoveries from attacks, benign events, and normal operation
• ground truth data
• device logs
• captures transcibed into the Intrustrial Protocol Abstraction Layer (IPAL) format for easy processing

Changelog:

Version v3 – fixed errors in the ipal representations in 01-Basic and 02-Semiurban 
Version v2 – renamed train.n402.state.gz to test.n402.state.gz in 03-Rural
Version v1 – initial dataset