Collecting Industrial Control System Device Data on the Internet: A Dataset for Domain Benchmark

Identifying Internet-facing industrial control system (ICS) devices is important for asset inventory, vulnerability assessment, exposure measurement, and security monitoring. This dataset release supports research on network traffic fingerprinting for Internet-facing ICS devices under realistic measurement conditions. The dataset is constructed from Internet-scale ICS service discovery followed by protocol-specific probing across three commonly deployed ICS protocols: Modbus/TCP, EtherNet/IP, and S7comm. It contains anonymized network traffic, scanning logs, device information records, and protocol-specific scanner code used to document the measurement logic. The release covers 13,002 responsive Internet-facing ICS endpoints, including 2,205 labeled endpoints spanning 20 vendors, 8 device types, and 165 device models. The measurements are organized across three collections and 60 scanning rounds for each protocol. The dataset captures Internet-facing measurement characteristics that are rarely represented in testbed datasets, including long-tailed label distributions, response variability across scanning rounds, temporal variation, and scanner-location effects. These characteristics support empirical studies of device fingerprint generation, vendor/type/model identification, and robustness to Internet-facing measurement variability. All released IP addresses are anonymized using a consistent prefix-preserving transformation, allowing cross-file linkage across device information, packet captures, and scanning logs without exposing the original public endpoints.