ICS Spoofing Detection Framework

Project for the course of Cyber Physical Systems and IoT Security, University of Padua (A.Y. 2025/26)

Study based on DAICS (Abdelaty et al.) and SimProcess (Donadel et al.).

End-to-end pipeline for generating and detecting spoofed sensor data in Industrial Control Systems (ICS), built on the SWaT dataset.

Structure

.
├── src/
│   ├── generator/       # Generative models (VRAE, GAN) & attack script
│   ├── classifier/      # Multi-classifier comparison pipeline
│   ├── visualization/   # Plotting tools
│   ├── data_loader.py   # Kalman filter, windowing, scaling
│   └── config.py        # Sensor columns & tsfresh settings
├── data/archive/        # Raw dataset
├── models/              # Saved model checkpoints (.pth, .pkl)
└── *.sh                 # Convenience shell scripts

Setup

pip install -r requirements.txt

To download the SWaT dataset automatically, install kagglehub and run the provided script:

pip install kagglehub
python download_dataset.py

This copies normal.csv, attack.csv, and merged.csv into data/archive/. Authentication is handled via browser on the first run — no API key needed. See data/archive/CREDITS.md for dataset credits and license.

Quick Start

1. Train generative models

./train_vrae.sh   # Trains VRAE on data/archive/normal.csv
./train_gan.sh    # Trains TimeGAN on data/archive/normal.csv

2. Generate attack datasets

./generate_attack.sh  # Generates all 4 attack types (VRAE, GAN, flat, gaussian)

Or generate standalone synthetic data (no attack labels):

./generate_vrae.sh
./generate_gan.sh

3. Compare classifiers

./compare_classifiers.sh  # Runs all 6 classifiers on all 4 attack datasets

Results are saved to models/comparison/comparison_results.csv.

Configuration

Edit src/config.py to change:

• TRAINING_COLUMNS — which sensor columns to use
• TSFRESH_EXTRACTION_SETTINGS: Which features to extract for detection.