רמי פוזיס

This paper introduces ICS-MMOC3, a multi-modal dataset collected from a physical power-generation testbed operated by a national ICS laboratory. The dataset emulates a combined-cycle power plant and exposes over one thousand process tags, including sensors, actuators, and control variables. Data were recorded during extended periods of normal operation and subjected to a wide range of controlled operational faults and diverse cyberattack scenarios. While the number of public ICS datasets is limited, existing repositories often reflect a practical and organizational separation between network-centric and process-centric views. ICS-MMOC3 addresses this gap by providing a rich, cross-layer dataset where all components are semantically connected and temporally aligned. In addition to raw IP and SCADA network traffic, specifically S7Comm and Modbus, the dataset includes a comprehensive set of physical process historian records, IDS alerts, system event logs, SCADA-to-NetFlow statistics with over 70 features, and a mapping between industrial variables and their representation in SCADA messages. This multi-modal approach enables directly correlating network behavior, SCADA protocol activity, and physical process dynamics. Beyond releasing the dataset, we present a systematic cross-layer analysis, empirically demonstrating the inherent interconnectedness of ICS environments, showing how even small digital deviations propagate across subsystems to produce observable physical effects.