SDN-MG25: A Comprehensive Dataset for Cybersecurity Analysis in Software Defined Networking-Enabled Microgrid Systems

Software Defined Network (SDN) has been widely used in modern network architecture. The integration of SDN into microgrid communication infrastructures offers enhanced flexibility, yet also introduces attack surfaces. As critical components of the Internet of Things (IoT) for energy systems, microgrid systems interact with numerous distributed sensors and controllers, making secure and reliable communications essential. It is well known that a labeled security dataset is indispensable for the community to validate the security solutions, in particular to the SDN intrusion detection systems. This study presents the SDN-MG25 dataset based on a realistic microgrid-SDN testbed, which is the first of its kind. This dataset contains benign network traffic generated from enterprise-level user activities, network flow records of microgrid communications, SDN activities, system call traces, and microgrid power measurements from an integrated SDN-based microgrid system. Additionally, a variety of SDN-related attack scenarios, such as fake link injection, flow rule tampering, and packet-in flooding, are implemented. A preliminary analysis is presented to evaluate the SDN-MG25 dataset. The SDN-MG25 dataset is publicly available for research in SDN-based microgrid and IoT energy environments. This dataset is publicly available for research purposes at SDN-MG25 dataset.