发表机构
Josef Ressel Centre for Intelligent and Secure Industrial Automation, Salzburg University of Applied Sciences; Paris Lodron University Salzburg（约瑟夫·雷塞尔智能与安全工业自动化中心，萨尔茨堡应用科学大学; 巴黎·洛德龙萨尔茨堡大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本文提出ISIA-AF模块化攻击框架，通过协调分布式客户端和采集多源数据，在ISIA测试平台上实现可复现的OT攻击执行与自动化数据集生成，为入侵检测研究提供实用基础。
AI 中文摘要
运营技术（OT）环境需要真实、可复现的安全数据集，然而现有方法往往缺乏自动化、多源数据捕获以及足够的文档支持以便复用。本文提出了ISIA-AF，一个模块化攻击框架，用于在工业系统上编排可复现的攻击执行和自动化数据集生成。该框架协调分布式攻击客户端，记录网络流量和运营数据，最终生成多源数据集。我们从先前工作和利益相关者讨论中推导出功能性和非功能性需求，并采用设计科学研究方法实现该框架。在ISIA测试平台（包含一个真实工业系统和一个模拟过程）上的案例研究表明，该框架支持集中控制、低通信开销以及跨网络段的灵活部署。其成果为生成可扩展、多源的OT安全数据集提供了实用基础，以用于入侵检测研究。
英文摘要
Operational Technology (OT) environments require realistic, reproducible security datasets, yet existing approaches often lack automation, multi-source data capture, and sufficient documentation for reuse. This paper presents ISIA-AF, a modular attack framework for orchestrating reproducible attack execution and automated dataset generation on industrial systems. The framework coordinates distributed attack clients, records network traffic and operational data, ultimately leading to a multi-source dataset. We derive functional and non-functional requirements from prior work and stakeholder discussions, and realise the framework following a design science research approach. A case study on the ISIA testbed, comprising a real industrial system and a simulated process, demonstrates how the framework supports centralised control, low communication overhead, and flexible deployment across network segments. The result is a practical basis for generating extensible, multi-source OT security datasets for intrusion detection research.
Comments8 pages, 1 Figure, 1 Table, submitted version to Euromicro Software Engineering and Advanced Applications (SEAA)
Journal refThe Version of Record of this contribution is published in Software Engineering and Advanced Applications, SEAA 2026. Lecture Notes in Computer Science, vol 16863
DOI：10.1007/978-3-032-36590-3_2
