{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,22]],"date-time":"2026-05-22T20:09:21Z","timestamp":1779480561374,"version":"3.53.1"},"publisher-location":"New York, NY, USA","reference-count":27,"publisher":"ACM","license":[{"start":{"date-parts":[[2026,5,31]],"date-time":"2026-05-31T00:00:00Z","timestamp":1780185600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"name":"Israel Ministry of Energy and Infrastructure","award":["224-11-027"],"award-info":[{"award-number":["224-11-027"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2026,6]]},"DOI":"10.1145\/3775042.3807883","type":"proceedings-article","created":{"date-parts":[[2026,5,22]],"date-time":"2026-05-22T19:50:03Z","timestamp":1779479403000},"page":"63-76","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["ICS-MMOC3: Exploring Operational Faults and Cyber Attacks with a Realistic Multi-Modal Power Generation ICS Dataset"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-9223-9021","authenticated-orcid":false,"given":"Lior","family":"Shafir","sequence":"first","affiliation":[{"name":"Tel Aviv University, Tel Aviv, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0918-0146","authenticated-orcid":false,"given":"Aviad","family":"Elyashar","sequence":"additional","affiliation":[{"name":"Ben Gurion University of the Negev, Shamoon College of Engineering, Beer Sheva, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-5505-9601","authenticated-orcid":false,"given":"Jonathan","family":"Cohen","sequence":"additional","affiliation":[{"name":"Ben Gurion University of the Negev, Beer Sheva, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-3529-7961","authenticated-orcid":false,"given":"Mickael","family":"Zeitoun","sequence":"additional","affiliation":[{"name":"Ben Gurion University of the Negev, Beer Sheva, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-7562-065X","authenticated-orcid":false,"given":"Miroslav","family":"Holipsky","sequence":"additional","affiliation":[{"name":"ICNL, Beer Sheva, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-1518-8896","authenticated-orcid":false,"given":"Barak","family":"Yaakov","sequence":"additional","affiliation":[{"name":"ICNL, Beer Sheva, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-2708-5599","authenticated-orcid":false,"given":"Eli","family":"Aliev","sequence":"additional","affiliation":[{"name":"ICNL, Beer Sheva, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7229-3899","authenticated-orcid":false,"given":"Rami","family":"Puzis","sequence":"additional","affiliation":[{"name":"Ben Gurion University of the Negev, Beer Sheva, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9067-3708","authenticated-orcid":false,"given":"Yaniv","family":"Harel","sequence":"additional","affiliation":[{"name":"Tel Aviv University, Tel Aviv, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8371-4759","authenticated-orcid":false,"given":"Avishai","family":"Wool","sequence":"additional","affiliation":[{"name":"Tel Aviv University, Tel Aviv, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,5,31]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","unstructured":"1984. ISO Transport Protocol specification ISO DP 8073. RFC 905. doi:10.17487\/RFC0905","DOI":"10.17487\/RFC0905"},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","unstructured":"1987. ISO Transport Service on top of the TCP Version: 3. RFC 1006. doi:10.17487\/RFC1006","DOI":"10.17487\/RFC1006"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/3055366.3055375"},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICIT46573.2021.9453483"},{"key":"e_1_3_2_1_5_1","volume-title":"Black Hat USA 2019","author":"Biham Eli","year":"2019","unstructured":"Eli Biham, Sara Bitan, Aviad Carmel, Alon Dankner, Uriel Malin, and Avishai Wool. 2019. Rogue7: Rogue engineering-station attacks on s7 simatic plcs. Black Hat USA 2019 (2019)."},{"key":"e_1_3_2_1_6_1","volume-title":"Analysis of the cyber attack on the Ukrainian power grid. Electricity information sharing and analysis center (E-ISAC) 388, 1\u201329","author":"Case Defense Use","year":"2016","unstructured":"Defense Use Case. 2016. Analysis of the cyber attack on the Ukrainian power grid. Electricity information sharing and analysis center (E-ISAC) 388, 1\u201329 (2016), 3."},{"key":"e_1_3_2_1_7_1","unstructured":"Cisco. 2011. NetFlow Version 9 Flow-Record Format. https:\/\/www.cisco.com\/en\/US\/technologies\/tk648\/tk362\/technologies_white_paper09186a00800a3db9.html"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1080\/18335330.2012.653198"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/CSR57506.2023.10224927"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijcip.2015.05.001"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3109465"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2024.3395991"},{"key":"e_1_3_2_1_13_1","volume-title":"International conference on critical information infrastructures security. Springer, 88\u201399","author":"Goh Jonathan","year":"2016","unstructured":"Jonathan Goh, Sridhar Adepu, Khurum Nazir Junejo, and Aditya Mathur. 2016. A dataset to support research in the design of secure water treatment systems. In International conference on critical information infrastructures security. Springer, 88\u201399."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/3057729"},{"key":"e_1_3_2_1_15_1","first-page":"1","article-title":"German steel mill cyber attack","volume":"30","author":"Lee Robert M","year":"2014","unstructured":"Robert M Lee, Michael J Assante, and Tim Conway. 2014. German steel mill cyber attack. Industrial Control Systems 30, 62 (2014), 1\u201315.","journal-title":"Industrial Control Systems"},{"key":"e_1_3_2_1_16_1","volume-title":"9th Workshop on Cyber Security Experimentation and Test (CSET 16)","author":"Lemay Antoine","year":"2016","unstructured":"Antoine Lemay and Jos\u00e9 M Fernandez. 2016. Providing {SCADA} network data sets for intrusion detection research. In 9th Workshop on Cyber Security Experimentation and Test (CSET 16)."},{"key":"e_1_3_2_1_17_1","volume-title":"The Register","author":"Leyden John","year":"2016","unstructured":"John Leyden. [n. d.]. Water treatment plant hacked, chemical mix changed for tap supplies. The Register, Mar. 24, 2016. https:\/\/www.theregister.com\/2016\/03\/24\/water_utility_hacked\/ Accessed: 2025-11-22."},{"key":"e_1_3_2_1_18_1","volume-title":"The Hacker News","author":"News The Hacker","year":"2018","unstructured":"The Hacker News. [n. d.]. TSMC Chip Maker Blames WannaCry Malware for Production Halt. The Hacker News, Aug. 2018. https:\/\/thehackernews.com\/2018\/08\/tsmc-wannacry-ransomware-attack.html Accessed: 2025-11-22."},{"key":"e_1_3_2_1_19_1","volume-title":"Suricata: Open Source IDS\/IPS\/NSM Engine. https:\/\/suricata.io. Accessed: 2025-01-14.","author":"Security Foundation Open Information","year":"2024","unstructured":"Open Information Security Foundation. 2024. Suricata: Open Source IDS\/IPS\/NSM Engine. https:\/\/suricata.io. Accessed: 2025-01-14."},{"key":"e_1_3_2_1_20_1","volume-title":"Aug. 18","author":"Roberts Paul F.","year":"2005","unstructured":"Paul F. Roberts. [n.d.]. Zotob, PnP Worms Slam 13 DaimlerChrysler Plants. eWEEK, Aug. 18, 2005. https:\/\/www.eweek.com\/security\/zotob-pnp-worms-slam-13-daimlerchrysler-plants\/ Accessed: 2025-02-16."},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","unstructured":"Lior Shafir Aviad Elyashar Jonathan Cohen Mickael Zeitoun Miroslav Holipsky Barak Yaakov Eli Aliev Rami Puzis Yaniv Harel and Avishai Wool. 2026. ICS-MMOC3: Realistic Multi-Modal Power Generation ICS Dataset. doi:10.5281\/zenodo.19510939","DOI":"10.5281\/zenodo.19510939"},{"key":"e_1_3_2_1_22_1","volume-title":"Communication Manual. Siemens AG","author":"Siemens AG","unstructured":"Siemens AG 2011. SIMATIC S7-300\/400: Communication Manual. Siemens AG, Nuremberg, Germany. https:\/\/support.industry.siemens.com\/ Describes the communication interfaces and services used by S7-300\/400 PLCs, including the S7 Communication (S7Comm) protocol."},{"key":"e_1_3_2_1_23_1","volume-title":"Security Concept and Secure Communication. Siemens AG","author":"Siemens AG","unstructured":"Siemens AG 2022. SIMATIC S7-1200\/S7-1500: Security Concept and Secure Communication. Siemens AG, Nuremberg, Germany. https:\/\/support.industry.siemens. com\/ Describes the S7CommPlus (S7+) protocol, secure communication, and protection mechanisms."},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2010.032210.00054"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2017.05.009"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/CPRE.2017.8090056"},{"key":"e_1_3_2_1_27_1","volume-title":"Black Hat Europe.","author":"Zaltzman Amir","unstructured":"Amir Zaltzman and Avishai Wool. 2024. From Pass-the-Hash to Code Execution on Schneider Electric 340 PLCs. In Black Hat Europe. London. http:\/\/i.blackhat.com\/EU-24\/Presentations\/EU-24-Zaltzman-From-Pass-the-Hash-to-Code-Execution-wp.pdf."}],"event":{"name":"ASIA CCS '26: ACM Asia Conference on Computer and Communications Security","location":"Bangalore India","acronym":"CPSS '26","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 12th ACM Cyber-Physical System Security Workshop"],"original-title":[],"deposited":{"date-parts":[[2026,5,22]],"date-time":"2026-05-22T19:50:25Z","timestamp":1779479425000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3775042.3807883"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,31]]},"references-count":27,"alternative-id":["10.1145\/3775042.3807883","10.1145\/3775042"],"URL":"https:\/\/doi.org\/10.1145\/3775042.3807883","relation":{},"subject":[],"published":{"date-parts":[[2026,5,31]]},"assertion":[{"value":"2026-05-31","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}