A Reproducible Pure-Python Cyber Range for Generating Labelled Modbus/TCP Datasets and Benchmarking Machine-Learning Intrusion Detection in Electrical Substations

Electrical substations increasingly depend on industrial control systems that communicate over legacy protocols, such as Modbus/TCP, which offer no authentication or integrity protection, and yet progress in machine-learning intrusion detection is constrained by a scarcity of labelled data. We developed a fully reproducible cyber range that simulates a 110 kV substation controlled over Modbus/TCP entirely in the Python standard library, requiring no virtualisation, container runtime, or third-party dependency. Six attack scenarios spanning the industrial cyber kill chain were executed, and seventy-two independent campaigns, each initialised at a random point of the diurnal load cycle, produced 3256 one-second observation windows spanning the full daily load curve with automatic ground-truth labels. Classifiers were evaluated with campaign-grouped repeated holdouts and 95% confidence intervals, so that all windows of a campaign fell entirely in either the training or test partition and no information leaked between them. Attack detection reached approximately 96% accuracy, with a random forest reaching an ROC-AUC of 0.967 and a sequence-aware autoencoder reaching 0.984, all while attack-type classification reached approximately 92% accuracy. A feature-set ablation, used as the primary evidence, showed that fusing network and physical-process features raised the binary F1-score from 0.891 to 0.934 and the multi-class macro F1-score from 0.589 to 0.770, and a window-size analysis justified the one-second resolution. Process-derived features contributed little to detect when an attack is occurring but were decisive for identifying which attack it is, and the released, regenerable testbed and dataset provide an extensible foundation for reproducible research in industrial intrusion detection.