Automated Execution of Attack Chains to Train Data-Driven IDS in Cyber-Physical Systems

The rapid expansion of Cyber-Physical Systems (CPS), their extensiveness, and their wide range of applications have introduced several new security challenges, particularly in critical infrastructures such as smart grids or vehicles. The growing attack techniques, diversity of devices, and network technologies are becoming more sophisticated, making the infrastructure more vulnerable. Meanwhile, machine learning-based intrusion detection systems (IDS) for CPS have struggled to keep up due to the lack of datasets and limited variability in attack types and system architectures. Therefore, it is essential to improve the diversity, quality, and representativeness of datasets used to train CPS IDSs. This work aims to present a framework capable of automatically execute attack chains in simulated CPS environments, producing datasets to aid the development of effective IDSs. The framework leverages an ontology that allows the tool to interpret attack paths and be easily extensible.