{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,30]],"date-time":"2026-07-30T14:02:46Z","timestamp":1785420166319,"version":"3.56.0"},"reference-count":20,"publisher":"MDPI AG","issue":"11","license":[{"start":{"date-parts":[[2026,6,2]],"date-time":"2026-06-02T00:00:00Z","timestamp":1780358400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"German Federal Ministry for Economic Affairs and Energy","award":["KK5189606RG4"],"award-info":[{"award-number":["KK5189606RG4"]}]},{"award":["KK5189606RG4"],"award-info":[{"award-number":["KK5189606RG4"]}],"id":[{"id":"https:\/\/ror.org\/02vgg2808","id-type":"ROR","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Evaluating intrusion detection methods at the level of individual MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&amp;CK) for Industrial Control System techniques requires Operational Technology traffic in which each attack sequence carries its MITRE technique identifier as ground truth. Publicly available Industrial Control System datasets either provide coarse attack-versus-benign labels (SWaT, WADI, CIC-APT-IIoT) or require ex-post technique reconstruction from CALDERA operation logs, and therefore do not support per-technique benchmarking. We describe one primary contribution and two supporting contributions, demonstrated on one Modbus\/Raspberry-Pi programmable logic controller\/CALDERA\/convolutional bidirectional Long Short-Term Memory autoencoder (CNN-BiLSTM-AE) use case. The primary contribution is an in-orchestrator labelling methodology for per-technique-labelled Industrial Control System attack capture. Its single load-bearing property is that the campaign orchestrator owns the label primitive and writes each per-sequence technique identifier into the capture artefact at injection time, eliminating ex-post log-to-packet alignment. The first supporting contribution is a protocol-aware detection pipeline. Its load-bearing architectural choice is a priority-ordered protocol router that dispatches each labelled flow to a per-protocol detector plug-in (protocol-aware features here, with generic-flow features admissible as an alternative plug-in policy on the same router). The second supporting contribution is a suite of four reproducible CALDERA chains (three Information-Technology-to-Operational-Technology kill chains plus one enterprise-side control) that exercise the labelling methodology end-to-end and the detection pipeline along complementary detection paths. All three contributions are platform-independent: any ATT&amp;CK-aligned emulator and any fieldbus protocol can host the labelling methodology, and any detector trained on an admissible feature space can plug into the router. The dataset contains 40,000 benign and 9997 attack Modbus sequences spanning four ATT&amp;CK techniques (T0802 Automated Collection, T0831 Manipulation of Control, T0836 Modify Parameter, T0846 Remote System Discovery). On this dataset, the CNN-BiLSTM-AE reaches a 100% true-positive rate (TPR) at the 98th-percentile benign threshold across all four techniques and a 99.7% overall TPR at the tighter 99.5th-percentile threshold, with per-technique TPR between 96.1% (T0836 Modify Parameter) and 100% (T0802 Automated Collection, T0846 Remote System Discovery). Across the four CALDERA chains, the Modbus autoencoder produces 234 protocol-layer detections and the Security Information and Event Management (SIEM) rule set produces 30 alerts, with per-chain tactic coverage between 0.714 and 0.786 and CALDERA-ability success rates between 0.800 and 0.857.<\/jats:p>","DOI":"10.3390\/s26113514","type":"journal-article","created":{"date-parts":[[2026,6,2]],"date-time":"2026-06-02T11:25:31Z","timestamp":1780399531000},"page":"3514","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["An Integrated Testbed for MITRE-Mapped Attack Emulation in Industrial Control Networks"],"prefix":"10.3390","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0009-0008-0975-2301","authenticated-orcid":false,"given":"Jaafer","family":"Rahmani","sequence":"first","affiliation":[{"name":"Institute of Reliable Embedded Systems and Communication Electronics (ivESK), Offenburg University of Applied Sciences, 77652 Offenburg, Germany"},{"name":"Faculty of Engineering, University of Freiburg, 79110 Freiburg, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Kai Oliver","family":"Detken","sequence":"additional","affiliation":[{"name":"DECOIT GmbH & Co. KG, 28359 Bremen, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0878-2919","authenticated-orcid":false,"given":"Axel","family":"Sikora","sequence":"additional","affiliation":[{"name":"Institute of Reliable Embedded Systems and Communication Electronics (ivESK), Offenburg University of Applied Sciences, 77652 Offenburg, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,6,2]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"101677","DOI":"10.1016\/j.cose.2019.101677","article-title":"Cybersecurity for industrial control systems: A survey","volume":"89","author":"Bhamare","year":"2020","journal-title":"Comput. Secur."},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Chen, B., Pattanaik, N., Goulart, A., Butler-purry, K.L., and Kundur, D. (2015, January 12\u201314). Implementing attacks for modbus\/TCP protocol in a real-time cyber physical system test bed. Proceedings of the 2015 IEEE International Workshop Technical Committee on Communications Quality and Reliability (CQR), Charleston, SC, USA.","DOI":"10.1109\/CQR.2015.7129084"},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Ferst, M.K., de Figueiredo, H.F.M., Denardin, G., and Lopes, J. (2018, January 12\u201314). Implementation of Secure Communication with Modbus and Transport Layer Security protocols. Proceedings of the 2018 13th IEEE International Conference on Industry Applications (INDUSCON), S\u00e3o Paulo, Brazil.","DOI":"10.1109\/INDUSCON.2018.8627306"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"100568","DOI":"10.1016\/j.ijcip.2022.100568","article-title":"Launch of denial of service attacks on the modbus\/TCP protocol and development of its protection mechanisms","volume":"39","author":"Rahman","year":"2022","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"key":"ref_5","unstructured":"MITRE Corporation (2026, April 01). MITRE ATT&CK for Industrial Control Systems. Available online: https:\/\/attack.mitre.org\/matrices\/ics\/."},{"key":"ref_6","unstructured":"MITRE Corporation (2026, April 01). MITRE ATT&CK Caldera Framework. Available online: https:\/\/github.com\/mitre\/caldera."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Rahmani, J., Detken, K.O., and Sikora, A. (2025, January 4\u20136). A Testbed for Cyber Attack Emulation and AI-Driven Anomaly Detection in Industrial IoT- and OT-Networks. Proceedings of the 13th IEEE International Conference on Intelligent Data Acquisition and Advanced Computing Systems (IDAACS 2025), Gliwice, Poland.","DOI":"10.1109\/IDAACS68557.2025.11322367"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"847","DOI":"10.1109\/TSG.2012.2226919","article-title":"Cyber-Physical Security Testbeds: Architecture, Application, and Evaluation for Smart Grid","volume":"4","author":"Hahn","year":"2013","journal-title":"IEEE Trans. Smart Grid"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"de Brito, I.B., and de Sousa, R.T. (2022). Development of an Open-Source Testbed Based on the Modbus Protocol for Cybersecurity Analysis of Nuclear Power Plants. Appl. Sci., 12.","DOI":"10.3390\/app12157942"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Mustafa, H.M., Basumallik, S., Kidder, S., and Srivastava, A. (2023, January 9). CPGrid-OT: Cyber-Power Data Generation Using Real-Time Reconfigurable Testbed for Resiliency. Proceedings of the 2023 11th Workshop on Modelling and Simulation of Cyber-Physical Energy Systems (MSCPES), San Antonio, TX, USA.","DOI":"10.1109\/MSCPES58582.2023.10123420"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"103906","DOI":"10.1016\/j.compind.2023.103906","article-title":"ICSSIM\u2014A framework for building industrial control systems security testbeds","volume":"148","author":"Balador","year":"2023","journal-title":"Comput. Ind."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"16239","DOI":"10.1109\/ACCESS.2021.3053135","article-title":"A Cyber-Security Methodology for a Cyber-Physical Industrial Control System Testbed","volume":"9","author":"Noorizadeh","year":"2021","journal-title":"IEEE Access"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Goh, J., Adepu, S., Junejo, K.N., and Mathur, A. (2017). A Dataset to Support Research in the Design of Secure Water Treatment Systems. Proceedings of the 11th International Conference on Critical Information Infrastructures Security (CRITIS), Springer. Lecture Notes in Computer Science.","DOI":"10.1007\/978-3-319-71368-7_8"},{"key":"ref_14","unstructured":"Ghiasvand, E., Ray, S., Iqbal, S., Dadkhah, S., and Ghorbani, A.A. (2024). CICAPT-IIOT: A provenance-based APT attack dataset for IIoT environment. arXiv."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Al-Naimi, M.M., and Belhi, A. (2024, January 4\u20135). Deep Learning-Based Anomaly Detection in Industrial Control System Network Traffic. Proceedings of the ICT for Intelligent Systems, Ahmedabad, India.","DOI":"10.1007\/978-981-97-5810-4_11"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Mirsky, Y., Doitshman, T., Elovici, Y., and Shabtai, A. (2018, January 18\u201321). Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection. Proceedings of the Network and Distributed System Security Symposium (NDSS), San Diego, CA, USA.","DOI":"10.14722\/ndss.2018.23204"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"442","DOI":"10.47839\/ijc.19.3.1893","article-title":"Intrusion Detection in Computer Networks Using Latent Space Representation and Machine Learning","volume":"19","author":"Hamolia","year":"2020","journal-title":"Int. J. Comput."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"2435","DOI":"10.1016\/S1389-1286(99)00112-7","article-title":"Bro: A System for Detecting Network Intruders in Real-Time","volume":"31","author":"Paxson","year":"1999","journal-title":"Comput. Netw."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Rahmani, J., Sisinni, E., Ferrari, P., Detken, K.O., and Sikora, A. (2026, January 21\u201324). Characterizing Domain Shift in PROFINET Intrusion Detection: A Multi-Site Ground-Truth Evaluation. Proceedings of the 2026 IEEE 22nd International Conference on Factory Communication Systems (WFCS), Offenburg, Germany.","DOI":"10.1109\/WFCS67029.2026.11511604"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Rahmani, J., \u00c7akmak, S.D., Detken, K.O., and Sikora, A. (2026). An Operational Hybrid SIEM Framework for OT Anomaly Detection. Sensors, 26.","DOI":"10.3390\/s26103155"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/11\/3514\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,2]],"date-time":"2026-06-02T11:34:59Z","timestamp":1780400099000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/11\/3514"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6,2]]},"references-count":20,"journal-issue":{"issue":"11","published-online":{"date-parts":[[2026,6]]}},"alternative-id":["s26113514"],"URL":"https:\/\/doi.org\/10.3390\/s26113514","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,6,2]]}}}