Most of the intrusion detection datasets to research machine learning-based intrusion detection systems (IDSs) are devoted to cyber-only systems, and they typically collect data from one architectural layer. Additionally, often the attacks are generated in dedicated attack sessions, without reproducing the realistic alternation and overlap of normal and attack actions. We present a dataset for intrusion detection by performing penetration testing on an embedded cyber-physical system built over Robot Operating System 2 (ROS2). Features are monitored from three architectural layers: the Linux operating system, the network, and the ROS2 services. The dataset is structured as a time series and describes the expected behavior of the system and its response to ROS2-specific attacks: it repeatedly alternates periods of attack-free operation with periods when a specific attack is being performed. Noteworthy, this allows measuring the time to detect an attacker and the number of malicious activities performed before detection. Also, it allows training an intrusion detector to minimize both, by taking advantage of the numerous alternating periods of normal and attack operations.

翻译：当前用于研究基于机器学习的入侵检测系统（IDS）的大多数数据集均专注于纯网络系统，且通常仅从单一架构层采集数据。此外，攻击行为往往在独立的攻击会话中生成，未能复现正常行为与攻击行为交替重叠的真实场景。本文通过对基于机器人操作系统2（ROS2）构建的嵌入式网络物理系统进行渗透测试，提出一个入侵检测数据集。该数据集从三个架构层（Linux操作系统层、网络层和ROS2服务层）采集特征信息，以时间序列形式组织，描述系统的预期行为及其对ROS2特定攻击的响应：其中反复交替出现无攻击运行时段与特定攻击执行时段。值得注意的是，该结构允许测量检测攻击者的时间以及检测前发生的恶意活动数量，同时支持训练入侵检测器通过利用正常与攻击操作的大量交替时段，将上述两个指标最小化。