Daniel Pérez

The increasing industrial digitalization associated with the Industry 4.0 paradigm has promoted the emergence of new technologiesfocused on the integration of physical and virtual systems, with digital twins standing out among them. In this context,there is a growing need to adapt engineering and automation education to new technological requirements. This work presentsa practical teaching experience focused on the development of an industrial digital twin using Unity over an industrial infrastructurebelonging to the IoT ULE–Schneider Electric Classroom at the University of Le´on. The hands-on task is structured intodifferent functional blocks that progressively develop the capabilities required for building a functional industrial digital twin.Furthermore, the developed architecture allows an integrated approach to concepts related to industrial automation, digitalization,and data-driven modeling within an environment close to real industrial applications.

The existence of industrial datasets is limited by confidentiality issues and the risk of disrupting critical systems when performing certain operations. This paper presents a dataset which contains communication traffic from a laboratory-emulated traction substation environment using real industrial devices and protocols. It includes both raw packet captures (PCAP) and preprocessed records (CSV format), providing multi-level access to the network activity. The data were collected using passive monitoring probes, deployed in two segmented substation networks implementing IEC 61850, IEC 60870-5-104, PTP and SNTP protocols, and capturing a comprehensive range of operational behaviors and attack vectors. The dataset is labelled with precise timestamps and event tags, covering both normal control operations and malicious activities including Denial-of-Service (DoS), Man-in-the-Middle (MitM), replay attacks, fuzzing, and time synchronization disruptions. During two independent 4-hour sessions, network traffic was captured, generating datasets suitable for cybersecurity evaluation, anomaly detection, communication optimization, and protocol analysis. This resource enables the reproducible experimentation and model validation for security solutions in critical industrial infrastructures, addressing the scarcity of publicly available industrial network traffic datasets with real protocol implementations.

En este artículo se presenta una metodología orientada a la adquisición de conjuntos de datos de tráfico de red, tanto normal como anómalo, en sistemas de automatización y control de subestaciones eléctricas digitales. El enfoque se centra en los protocolos comúnmente utilizados en estas plataformas --IEC61850 GOOSE y SV, PTP, IEC60870-5-104 y SNTP-- y se desarrolla en un entorno controlado con dispositivos representativos, como un controlador de bahía, relés de protección, sistema SCADA, etc. Sobre esta infraestructura se ejecuta un conjunto de experiencias planificadas que reproducen el funcionamiento normal de una subestación y se introducen ataques específicos para analizar su impacto. Finalmente, los datos recopilados se analizan mediante la extracción y selección de características y se organizan en flujos de datos útiles para el posterior entrenamiento de modelos.

Energy management requires reliable tools to support decisions aimed at optimising consumption. Advances in data-driven models provide techniques like Non-Intrusive Load Monitoring (NILM), which estimates the energy demand of appliances from total consumption. Common single-target NILM approaches perform energy disaggregation by using separate learned models for each device. However, the use of single-target systems in real scenarios is computationally expensive and can obscure the interpretation of the resulting feedback. This study assesses a conditioned deep neural network built upon a Fully Convolutional Denoising AutoEncoder (FCNdAE) as multi-target NILM model. The network performs multiple disaggregations using a conditioning input that allows the specification of the target appliance. Experiments compare this approach with several single-target and multi-target models using public residential data from households and non-residential data from a hospital facility. Results show that the multi-target FCNdAE model enhances the disaggregation accuracy compared to previous models, particularly in non-residential data, and improves computational efficiency by reducing the number of trainable weights below 2 million and inference time below 0.25 s for several sequence lengths. Furthermore, the conditioning input helps the user to interpret the model and gain insight into its internal behaviour when predicting the energy demand of different appliances.

The connectivity advances in industrial control systems have also increased the possibility of cyberattacks in industry. Thus, security becomes crucial in critical infrastructures, whose services are considered essential in fields such as manufacturing, energy or public health. Although theoretical and formal approaches are often proposed to advance in the field of industrial cybersecurity, more experimental efforts in realistic scenarios are needed to understand the impact of incidents, assess security technologies or provide training. In this paper, an approach for cybersecurity experimentation is proposed for several industrial areas. Aiming at a high degree of flexibility, the Critical Infrastructure Cybersecurity Laboratory (CICLab) is designed to integrate both real physical equipment with computing and networking infrastructure. It provides a platform for performing security experiments in control systems of diverse sectors such as industry, energy and building management. They allow researchers to perform security experimentation in realistic environments using a wide variety of technologies that are common in these control systems, as well as in the protection or security analysis of industrial networks. Furthermore, educational developments can be made to meet the growing demand of security-related professionals.