Preprocessing Pipelines for OT Network Traffic Capture Data in AI Cybersecurity Applications

Digitalisation is driving a new level of focus on Cybersecurity in Industrial Internet of Things (IIoT) and Operationsal Technology (OT) environments. Various techniques to detect malicious activity in OT networks based on network traffic monitoring have been developed. These often use Aritficial Intelligence (AI), or rather Machine Learning (ML), algorithms to identify and classify the traffic as potentially malicious. Training and testing of these algorithms requires data in ML-processable formats; however, network traffic capture files are typically not ML-ready, i.e., they are usually not readily usable for the training of ML classifiers. This paper reviews the procedures for building current state-of-the-art OT network traffic datasets. By considering 17 different datasets, we discuss approaches used for dataset creation, attack simulation, and labelling, respectively. On this basis, this work proposes a new pipeline for processing PCAP files into ML-ready formats. The pipeline leverages currently available open source tools and includes a set of options to enable the pipeline to be tailored to specific ML/AI algorithms, OT protocols and attack types. While PCAP files can capture malicious traffic, there are no inherent labels present in PCAPs. Thus, a particular focus is on the different types of labelling strategies available for the pipeline. The pipeline provides a useful overview of the available network traffic data preprocessing options. It also supports a broader range of ML and cybersecurity practitioners when using raw network traffic datasets for ML learning purposes in OT environments. The practicability of the proposed pipeline is demonstrated by relabeling network traffic capture data of a publicly available PCAP dataset in two ways and by comparing the results to original labels.