The Sherlock dataset is generated with the help the Wattson simulator. Wattson is an open-source power grid co-simulator, i.e., it emulates realistic network traffic among power grid devices while simulating the power grid.
Wattson uses PowerOwl to model the power grid, which offers steady-state power flow calculations based on pandapower, and emulates its communication network supporting switches, routers and hosts with lightweight namespaces, based on Docker containers, and with virtual machines in Linux. For network links, Wattson allows for traffic control with the help of tc, enabling delay, jitter, bandwidth and packet-loss settings for each individual link. The communication between the control center, Remote Terminal Unit (RTU) and Master Terminal Unit (MTU) is performed with the IEC 60870-5-104 (IEC 104) protocol.
The Sherlock scenarios focus on future-oriented settings with a significant fraction of substations being digitized, i.e., they digitally transmit measurements and—if applicable—support the remote execution of control commands. Each scenario includes load and optional generation profiles to control the behavior of these assets. Wattson performs a real-time co-simulation with a 21x accelerated power profile, i.e., evaluating 8 hours of network traffic reflects the power generation and usage patterns over an entire week.
Sherlock contains network captures from mirror ports at switches that were identified as key vantage points, enriched with logs from individual hosts and services, additional context information, process ground-truth information, control center events, and documentation. Sherlock thus passive data collection strategy to avoid the drawbacks of active polling. All relevant information is extracted passively, ensuring a minimally invasive deployment strategy well-suited for real-world power grid networks. Given that the centralized control center typically serves as a data sink, it provides an ideal vantage point, offering a comprehensive overview of the network. Additional vantage points can be incorporated to gain further insights when necessary.
In total, Sherlock contains simulation results from over 30 days of power grid behavior, split into training and test set for a total of 3 different scenarios.