Search papers, labs, and topics across Lattice.
This paper conducts a systematic meta-review of 83 cybersecurity datasets related to Industrial Control Systems (ICS) across 18 studies, revealing significant structural gaps in dataset coverage and evaluation practices. The analysis shows that a staggering 85.5% of datasets focus solely on late-stage operational technology disruption tactics, with minimal representation of cross-stage IT/OT interactions and a lack of field-device evidence. The findings highlight critical imbalances in dataset architecture and evaluation methodologies, leading to a proposed research agenda aimed at improving dataset construction and benchmarking standards in ICS cybersecurity.
The overwhelming majority of ICS cybersecurity datasets ignore critical early-stage threats, limiting the effectiveness of intrusion detection research.
Intrusion detection research in Industrial Control Systems (ICS) heavily depends on public datasets, yet no prior work has systematically assessed whether the collective dataset corpus supports current evaluation claims. This paper addresses this gap through a meta-review of 18 studies between 2019 and 2026, from which 83 ICS, or ICS directly related, cybersecurity datasets are identified, harmonised, and characterised using a unified five-dimensional taxonomy. The taxonomy reveals that the corpus is structurally skewed: 85.5% of datasets concentrate on late-stage OT Disruption tactics, cross-stage IT/OT progression sequences are present in only 8.4% of cases, field-device evidence at Level 0 of the Purdue hierarchy is effectively absent, and operationally sourced data accounts for only 15.7% of the collection. A parallel audit of evaluation practices shows that zero report streaming evaluation, fewer than half apply disciplined train/test partitioning, and only two satisfy reproducibility requirements. Furthermore, a taxonomy-evaluation coupling analysis shows that dataset imbalances constrain the scope and feasibility of several evaluation practices. Based on these findings, we identify three structural imbalances: i) architectural shallowness, ii) progression compression, and iii) cross-domain substitution, and derive a coordinated research agenda which covers cross-stage corpus construction, temporally structured benchmarking, event-level label standards, and governance frameworks for operational data sharing.
