# Stream Test This repository provides a benchmarking framework for evaluating batch-incremental clustering and anomaly detection on real network traffic data. The main script, `stream_test.py`, processes Parquet datasets incrementally and records both predictive performance and computational resource usage. > **Execution:** See the root `README.md` for instructions on running the experiments locally, with Docker, or on a SLURM cluster using Apptainer. Stream-specific configurations are stored in `code/stream_config/`, while execution infrastructure is configured separately. Aug 2026 --- ## 1) Experiments The framework evaluates multiple clustering and anomaly detection algorithms, including: - SDO / SDOclust - K-Means and MiniBatch K-Means - Isolation Forest Experiments use either the NumPy or Dask backend and may evaluate standard or frozen models. The following metrics are used: | Task | Metrics | |---|---| | Clustering | ARI, AMI | | Anomaly detection | AUC, Average Precision (AP) | Execution time, memory usage, CPU utilization, and thread statistics are also recorded. --- ## 2) Input Data Experiments use real network traffic datasets stored as Parquet files in `packetdata/`. Each JSON file in `code/stream_config/` specifies the input files, selected features, target variable, algorithm, task, backend, and streaming parameters. For example: ```json { "parquet_files": [ "packetdata/tf_a_packets_cluslabeled.parquet", "packetdata/a_day1_packets_cluslabeled.parquet", "packetdata/a_day2_packets_cluslabeled.parquet", "packetdata/tf_s_packets_cluslabeled.parquet", "packetdata/s_day1_packets_cluslabeled.parquet", "packetdata/s_day2_packets_cluslabeled.parquet" ], "features": [ "mode(ipTTL)", "ipTotalLength", "protocolIdentifier_TCP", "protocolIdentifier_UDP", "protocolIdentifier_ICMP", "sourceTransportPort_MODBUS", "sourceTransportPort_MQTT", "destinationTransportPort_MODBUS", "destinationTransportPort_MQTT" ], "target": "Label", "task": "anomaly_detection", "algorithm": "Wp_DaskKMeansAD", "k": 10, "backend": "dask", "distance_backend": "dask", "initial_chunk": 10000000, "batch_size": 1000000, "eval_window_size": 10000000, "output_folder": "results", "metrics": [ "auc", "ap" ], "binarize_target_0class": "BENIGN" } ``` --- ## 3) Streaming Protocol The data are processed in two stages: 1. **Initialization:** the model is initialized or trained using `initial_chunk` samples. 2. **Incremental processing:** subsequent data are processed in batches of size `batch_size`. When specified, `eval_window_size` defines the window used for evaluation. --- ## 4) Execution Backends The backend is selected through the stream configuration: - `numpy` for local execution. - `dask` for parallel execution, either locally or through SLURM. The same stream configuration can therefore be executed with different computational infrastructures by changing the separate execution configuration. --- ## 5) Output Results are stored in the directory specified by `output_folder`, typically: ```text results/ ``` Output files contain the configured evaluation metrics together with computational measurements for each streaming step. --- ## 6) Reproducibility The execution environment limits numerical-library multithreading: ```bash OMP_NUM_THREADS=1 MKL_NUM_THREADS=1 OPENBLAS_NUM_THREADS=1 ``` Docker and Apptainer provide the reproducible software environment, while the input data and generated results remain external to the container. --- ## 7) Source Dataset The network traffic data originate from: Brenner, B., Fabini, J., Offermanns, M., Semper, S., and Zseby, T. (2024). *Malware communication in smart factories: A network traffic data set*. Computer Networks, 255, 110804. https://doi.org/10.1016/j.comnet.2024.110804 Associated dataset: Brenner, B., Fabini, J., Offermanns, M., Semper, S., and Zseby, T. (2025). *Dataset of Publication "Malware Communication in Smart Factories: A Network Traffic Data Set"*. TU Wien. https://doi.org/10.48436/ghdc6-45k78 ## 8) Data Preprocessing The original labeled packet data are provided as CSV files and preprocessed into Parquet files for the experiments. The preprocessing consists of: - Converting protocol identifiers and transport-port fields to numeric values, replacing invalid or missing values with `0`. - Assigning source and destination host roles based on their IP addresses. Unknown local and external addresses are assigned to generic categories. - Deriving a clustering label from the source role, destination role, and protocol category (`MODBUS`, `MQTT`, `TCP_OTHER`, `ESP`, or `OTHER`). - Encoding the clustering labels as integer identifiers (`LabelClustCode`). - Adding binary indicator variables for selected protocol and transport-port categories (TCP, UDP, ICMP, MODBUS, and MQTT). - Retaining the original ground-truth label (`Label`) for subsequent evaluation. - Storing the resulting datasets in Parquet format under `packetdata/`. For the experiments, the selected numerical features are subsequently MinMax-scaled before being provided to the unsupervised learning algorithms. For anomaly detection, the ground-truth labels are additionally converted into a binary target, with `BENIGN` treated as the normal class. ### Total PARQUET columns Index(['SequenceNumber', 'flowStartMilliseconds', 'sourceMacAddress', 'destinationMacAddress', 'sourceIPAddress', 'destinationIPAddress', 'sourceTransportPort', 'destinationTransportPort', 'protocolIdentifier', 'mode(ipTTL)', 'ipTotalLength', 'Label', 'LabelClust', 'LabelClustCode', 'protocolIdentifier_TCP', 'protocolIdentifier_UDP', 'protocolIdentifier_ICMP', 'sourceTransportPort_MODBUS', 'sourceTransportPort_MQTT', 'destinationTransportPort_MODBUS', 'destinationTransportPort_MQTT'], ### Total clustering classes {'ATTACKER__ATTACKER__ESP': 0, 'ATTACKER__ATTACKER__MODBUS': 1, 'ATTACKER__ATTACKER__MQTT': 2, 'ATTACKER__ATTACKER__OTHER': 3, 'ATTACKER__ATTACKER__TCP_OTHER': 4, 'ATTACKER__EXTERNAL__ESP': 5, 'ATTACKER__EXTERNAL__MODBUS': 6, 'ATTACKER__EXTERNAL__MQTT': 7, 'ATTACKER__EXTERNAL__OTHER': 8, 'ATTACKER__EXTERNAL__TCP_OTHER': 9, 'ATTACKER__FW_EXT__ESP': 10, 'ATTACKER__FW_EXT__MODBUS': 11, 'ATTACKER__FW_EXT__MQTT': 12, 'ATTACKER__FW_EXT__OTHER': 13, 'ATTACKER__FW_EXT__TCP_OTHER': 14, 'ATTACKER__IDS__ESP': 15, 'ATTACKER__IDS__MODBUS': 16, 'ATTACKER__IDS__MQTT': 17, 'ATTACKER__IDS__OTHER': 18, 'ATTACKER__IDS__TCP_OTHER': 19, 'ATTACKER__NCU__ESP': 20, 'ATTACKER__NCU__MODBUS': 21, 'ATTACKER__NCU__MQTT': 22, 'ATTACKER__NCU__OTHER': 23, 'ATTACKER__NCU__TCP_OTHER': 24, 'ATTACKER__OTHER_HOST__ESP': 25, 'ATTACKER__OTHER_HOST__MODBUS': 26, 'ATTACKER__OTHER_HOST__MQTT': 27, 'ATTACKER__OTHER_HOST__OTHER': 28, 'ATTACKER__OTHER_HOST__TCP_OTHER': 29, 'ATTACKER__PCU__ESP': 30, 'ATTACKER__PCU__MODBUS': 31, 'ATTACKER__PCU__MQTT': 32, 'ATTACKER__PCU__OTHER': 33, 'ATTACKER__PCU__TCP_OTHER': 34, 'ATTACKER__SENSOR__ESP': 35, 'ATTACKER__SENSOR__MODBUS': 36, 'ATTACKER__SENSOR__MQTT': 37, 'ATTACKER__SENSOR__OTHER': 38, 'ATTACKER__SENSOR__TCP_OTHER': 39, 'ATTACKER__TRUSTED_HOST__ESP': 40, 'ATTACKER__TRUSTED_HOST__MODBUS': 41, 'ATTACKER__TRUSTED_HOST__MQTT': 42, 'ATTACKER__TRUSTED_HOST__OTHER': 43, 'ATTACKER__TRUSTED_HOST__TCP_OTHER': 44, 'ATTACKER__UNKNOWN_LOCAL__ESP': 45, 'ATTACKER__UNKNOWN_LOCAL__MODBUS': 46, 'ATTACKER__UNKNOWN_LOCAL__MQTT': 47, 'ATTACKER__UNKNOWN_LOCAL__OTHER': 48, 'ATTACKER__UNKNOWN_LOCAL__TCP_OTHER': 49, 'EXTERNAL__ATTACKER__ESP': 50, 'EXTERNAL__ATTACKER__MODBUS': 51, 'EXTERNAL__ATTACKER__MQTT': 52, 'EXTERNAL__ATTACKER__OTHER': 53, 'EXTERNAL__ATTACKER__TCP_OTHER': 54, 'EXTERNAL__EXTERNAL__ESP': 55, 'EXTERNAL__EXTERNAL__MODBUS': 56, 'EXTERNAL__EXTERNAL__MQTT': 57, 'EXTERNAL__EXTERNAL__OTHER': 58, 'EXTERNAL__EXTERNAL__TCP_OTHER': 59, 'EXTERNAL__FW_EXT__ESP': 60, 'EXTERNAL__FW_EXT__MODBUS': 61, 'EXTERNAL__FW_EXT__MQTT': 62, 'EXTERNAL__FW_EXT__OTHER': 63, 'EXTERNAL__FW_EXT__TCP_OTHER': 64, 'EXTERNAL__IDS__ESP': 65, 'EXTERNAL__IDS__MODBUS': 66, 'EXTERNAL__IDS__MQTT': 67, 'EXTERNAL__IDS__OTHER': 68, 'EXTERNAL__IDS__TCP_OTHER': 69, 'EXTERNAL__NCU__ESP': 70, 'EXTERNAL__NCU__MODBUS': 71, 'EXTERNAL__NCU__MQTT': 72, 'EXTERNAL__NCU__OTHER': 73, 'EXTERNAL__NCU__TCP_OTHER': 74, 'EXTERNAL__OTHER_HOST__ESP': 75, 'EXTERNAL__OTHER_HOST__MODBUS': 76, 'EXTERNAL__OTHER_HOST__MQTT': 77, 'EXTERNAL__OTHER_HOST__OTHER': 78, 'EXTERNAL__OTHER_HOST__TCP_OTHER': 79, 'EXTERNAL__PCU__ESP': 80, 'EXTERNAL__PCU__MODBUS': 81, 'EXTERNAL__PCU__MQTT': 82, 'EXTERNAL__PCU__OTHER': 83, 'EXTERNAL__PCU__TCP_OTHER': 84, 'EXTERNAL__SENSOR__ESP': 85, 'EXTERNAL__SENSOR__MODBUS': 86, 'EXTERNAL__SENSOR__MQTT': 87, 'EXTERNAL__SENSOR__OTHER': 88, 'EXTERNAL__SENSOR__TCP_OTHER': 89, 'EXTERNAL__TRUSTED_HOST__ESP': 90, 'EXTERNAL__TRUSTED_HOST__MODBUS': 91, 'EXTERNAL__TRUSTED_HOST__MQTT': 92, 'EXTERNAL__TRUSTED_HOST__OTHER': 93, 'EXTERNAL__TRUSTED_HOST__TCP_OTHER': 94, 'EXTERNAL__UNKNOWN_LOCAL__ESP': 95, 'EXTERNAL__UNKNOWN_LOCAL__MODBUS': 96, 'EXTERNAL__UNKNOWN_LOCAL__MQTT': 97, 'EXTERNAL__UNKNOWN_LOCAL__OTHER': 98, 'EXTERNAL__UNKNOWN_LOCAL__TCP_OTHER': 99, 'FW_EXT__ATTACKER__ESP': 100, 'FW_EXT__ATTACKER__MODBUS': 101, 'FW_EXT__ATTACKER__MQTT': 102, 'FW_EXT__ATTACKER__OTHER': 103, 'FW_EXT__ATTACKER__TCP_OTHER': 104, 'FW_EXT__EXTERNAL__ESP': 105, 'FW_EXT__EXTERNAL__MODBUS': 106, 'FW_EXT__EXTERNAL__MQTT': 107, 'FW_EXT__EXTERNAL__OTHER': 108, 'FW_EXT__EXTERNAL__TCP_OTHER': 109, 'FW_EXT__FW_EXT__ESP': 110, 'FW_EXT__FW_EXT__MODBUS': 111, 'FW_EXT__FW_EXT__MQTT': 112, 'FW_EXT__FW_EXT__OTHER': 113, 'FW_EXT__FW_EXT__TCP_OTHER': 114, 'FW_EXT__IDS__ESP': 115, 'FW_EXT__IDS__MODBUS': 116, 'FW_EXT__IDS__MQTT': 117, 'FW_EXT__IDS__OTHER': 118, 'FW_EXT__IDS__TCP_OTHER': 119, 'FW_EXT__NCU__ESP': 120, 'FW_EXT__NCU__MODBUS': 121, 'FW_EXT__NCU__MQTT': 122, 'FW_EXT__NCU__OTHER': 123, 'FW_EXT__NCU__TCP_OTHER': 124, 'FW_EXT__OTHER_HOST__ESP': 125, 'FW_EXT__OTHER_HOST__MODBUS': 126, 'FW_EXT__OTHER_HOST__MQTT': 127, 'FW_EXT__OTHER_HOST__OTHER': 128, 'FW_EXT__OTHER_HOST__TCP_OTHER': 129, 'FW_EXT__PCU__ESP': 130, 'FW_EXT__PCU__MODBUS': 131, 'FW_EXT__PCU__MQTT': 132, 'FW_EXT__PCU__OTHER': 133, 'FW_EXT__PCU__TCP_OTHER': 134, 'FW_EXT__SENSOR__ESP': 135, 'FW_EXT__SENSOR__MODBUS': 136, 'FW_EXT__SENSOR__MQTT': 137, 'FW_EXT__SENSOR__OTHER': 138, 'FW_EXT__SENSOR__TCP_OTHER': 139, 'FW_EXT__TRUSTED_HOST__ESP': 140, 'FW_EXT__TRUSTED_HOST__MODBUS': 141, 'FW_EXT__TRUSTED_HOST__MQTT': 142, 'FW_EXT__TRUSTED_HOST__OTHER': 143, 'FW_EXT__TRUSTED_HOST__TCP_OTHER': 144, 'FW_EXT__UNKNOWN_LOCAL__ESP': 145, 'FW_EXT__UNKNOWN_LOCAL__MODBUS': 146, 'FW_EXT__UNKNOWN_LOCAL__MQTT': 147, 'FW_EXT__UNKNOWN_LOCAL__OTHER': 148, 'FW_EXT__UNKNOWN_LOCAL__TCP_OTHER': 149, 'IDS__ATTACKER__ESP': 150, 'IDS__ATTACKER__MODBUS': 151, 'IDS__ATTACKER__MQTT': 152, 'IDS__ATTACKER__OTHER': 153, 'IDS__ATTACKER__TCP_OTHER': 154, 'IDS__EXTERNAL__ESP': 155, 'IDS__EXTERNAL__MODBUS': 156, 'IDS__EXTERNAL__MQTT': 157, 'IDS__EXTERNAL__OTHER': 158, 'IDS__EXTERNAL__TCP_OTHER': 159, 'IDS__FW_EXT__ESP': 160, 'IDS__FW_EXT__MODBUS': 161, 'IDS__FW_EXT__MQTT': 162, 'IDS__FW_EXT__OTHER': 163, 'IDS__FW_EXT__TCP_OTHER': 164, 'IDS__IDS__ESP': 165, 'IDS__IDS__MODBUS': 166, 'IDS__IDS__MQTT': 167, 'IDS__IDS__OTHER': 168, 'IDS__IDS__TCP_OTHER': 169, 'IDS__NCU__ESP': 170, 'IDS__NCU__MODBUS': 171, 'IDS__NCU__MQTT': 172, 'IDS__NCU__OTHER': 173, 'IDS__NCU__TCP_OTHER': 174, 'IDS__OTHER_HOST__ESP': 175, 'IDS__OTHER_HOST__MODBUS': 176, 'IDS__OTHER_HOST__MQTT': 177, 'IDS__OTHER_HOST__OTHER': 178, 'IDS__OTHER_HOST__TCP_OTHER': 179, 'IDS__PCU__ESP': 180, 'IDS__PCU__MODBUS': 181, 'IDS__PCU__MQTT': 182, 'IDS__PCU__OTHER': 183, 'IDS__PCU__TCP_OTHER': 184, 'IDS__SENSOR__ESP': 185, 'IDS__SENSOR__MODBUS': 186, 'IDS__SENSOR__MQTT': 187, 'IDS__SENSOR__OTHER': 188, 'IDS__SENSOR__TCP_OTHER': 189, 'IDS__TRUSTED_HOST__ESP': 190, 'IDS__TRUSTED_HOST__MODBUS': 191, 'IDS__TRUSTED_HOST__MQTT': 192, 'IDS__TRUSTED_HOST__OTHER': 193, 'IDS__TRUSTED_HOST__TCP_OTHER': 194, 'IDS__UNKNOWN_LOCAL__ESP': 195, 'IDS__UNKNOWN_LOCAL__MODBUS': 196, 'IDS__UNKNOWN_LOCAL__MQTT': 197, 'IDS__UNKNOWN_LOCAL__OTHER': 198, 'IDS__UNKNOWN_LOCAL__TCP_OTHER': 199, 'NCU__ATTACKER__ESP': 200, 'NCU__ATTACKER__MODBUS': 201, 'NCU__ATTACKER__MQTT': 202, 'NCU__ATTACKER__OTHER': 203, 'NCU__ATTACKER__TCP_OTHER': 204, 'NCU__EXTERNAL__ESP': 205, 'NCU__EXTERNAL__MODBUS': 206, 'NCU__EXTERNAL__MQTT': 207, 'NCU__EXTERNAL__OTHER': 208, 'NCU__EXTERNAL__TCP_OTHER': 209, 'NCU__FW_EXT__ESP': 210, 'NCU__FW_EXT__MODBUS': 211, 'NCU__FW_EXT__MQTT': 212, 'NCU__FW_EXT__OTHER': 213, 'NCU__FW_EXT__TCP_OTHER': 214, 'NCU__IDS__ESP': 215, 'NCU__IDS__MODBUS': 216, 'NCU__IDS__MQTT': 217, 'NCU__IDS__OTHER': 218, 'NCU__IDS__TCP_OTHER': 219, 'NCU__NCU__ESP': 220, 'NCU__NCU__MODBUS': 221, 'NCU__NCU__MQTT': 222, 'NCU__NCU__OTHER': 223, 'NCU__NCU__TCP_OTHER': 224, 'NCU__OTHER_HOST__ESP': 225, 'NCU__OTHER_HOST__MODBUS': 226, 'NCU__OTHER_HOST__MQTT': 227, 'NCU__OTHER_HOST__OTHER': 228, 'NCU__OTHER_HOST__TCP_OTHER': 229, 'NCU__PCU__ESP': 230, 'NCU__PCU__MODBUS': 231, 'NCU__PCU__MQTT': 232, 'NCU__PCU__OTHER': 233, 'NCU__PCU__TCP_OTHER': 234, 'NCU__SENSOR__ESP': 235, 'NCU__SENSOR__MODBUS': 236, 'NCU__SENSOR__MQTT': 237, 'NCU__SENSOR__OTHER': 238, 'NCU__SENSOR__TCP_OTHER': 239, 'NCU__TRUSTED_HOST__ESP': 240, 'NCU__TRUSTED_HOST__MODBUS': 241, 'NCU__TRUSTED_HOST__MQTT': 242, 'NCU__TRUSTED_HOST__OTHER': 243, 'NCU__TRUSTED_HOST__TCP_OTHER': 244, 'NCU__UNKNOWN_LOCAL__ESP': 245, 'NCU__UNKNOWN_LOCAL__MODBUS': 246, 'NCU__UNKNOWN_LOCAL__MQTT': 247, 'NCU__UNKNOWN_LOCAL__OTHER': 248, 'NCU__UNKNOWN_LOCAL__TCP_OTHER': 249, 'OTHER_HOST__ATTACKER__ESP': 250, 'OTHER_HOST__ATTACKER__MODBUS': 251, 'OTHER_HOST__ATTACKER__MQTT': 252, 'OTHER_HOST__ATTACKER__OTHER': 253, 'OTHER_HOST__ATTACKER__TCP_OTHER': 254, 'OTHER_HOST__EXTERNAL__ESP': 255, 'OTHER_HOST__EXTERNAL__MODBUS': 256, 'OTHER_HOST__EXTERNAL__MQTT': 257, 'OTHER_HOST__EXTERNAL__OTHER': 258, 'OTHER_HOST__EXTERNAL__TCP_OTHER': 259, 'OTHER_HOST__FW_EXT__ESP': 260, 'OTHER_HOST__FW_EXT__MODBUS': 261, 'OTHER_HOST__FW_EXT__MQTT': 262, 'OTHER_HOST__FW_EXT__OTHER': 263, 'OTHER_HOST__FW_EXT__TCP_OTHER': 264, 'OTHER_HOST__IDS__ESP': 265, 'OTHER_HOST__IDS__MODBUS': 266, 'OTHER_HOST__IDS__MQTT': 267, 'OTHER_HOST__IDS__OTHER': 268, 'OTHER_HOST__IDS__TCP_OTHER': 269, 'OTHER_HOST__NCU__ESP': 270, 'OTHER_HOST__NCU__MODBUS': 271, 'OTHER_HOST__NCU__MQTT': 272, 'OTHER_HOST__NCU__OTHER': 273, 'OTHER_HOST__NCU__TCP_OTHER': 274, 'OTHER_HOST__OTHER_HOST__ESP': 275, 'OTHER_HOST__OTHER_HOST__MODBUS': 276, 'OTHER_HOST__OTHER_HOST__MQTT': 277, 'OTHER_HOST__OTHER_HOST__OTHER': 278, 'OTHER_HOST__OTHER_HOST__TCP_OTHER': 279, 'OTHER_HOST__PCU__ESP': 280, 'OTHER_HOST__PCU__MODBUS': 281, 'OTHER_HOST__PCU__MQTT': 282, 'OTHER_HOST__PCU__OTHER': 283, 'OTHER_HOST__PCU__TCP_OTHER': 284, 'OTHER_HOST__SENSOR__ESP': 285, 'OTHER_HOST__SENSOR__MODBUS': 286, 'OTHER_HOST__SENSOR__MQTT': 287, 'OTHER_HOST__SENSOR__OTHER': 288, 'OTHER_HOST__SENSOR__TCP_OTHER': 289, 'OTHER_HOST__TRUSTED_HOST__ESP': 290, 'OTHER_HOST__TRUSTED_HOST__MODBUS': 291, 'OTHER_HOST__TRUSTED_HOST__MQTT': 292, 'OTHER_HOST__TRUSTED_HOST__OTHER': 293, 'OTHER_HOST__TRUSTED_HOST__TCP_OTHER': 294, 'OTHER_HOST__UNKNOWN_LOCAL__ESP': 295, 'OTHER_HOST__UNKNOWN_LOCAL__MODBUS': 296, 'OTHER_HOST__UNKNOWN_LOCAL__MQTT': 297, 'OTHER_HOST__UNKNOWN_LOCAL__OTHER': 298, 'OTHER_HOST__UNKNOWN_LOCAL__TCP_OTHER': 299, 'PCU__ATTACKER__ESP': 300, 'PCU__ATTACKER__MODBUS': 301, 'PCU__ATTACKER__MQTT': 302, 'PCU__ATTACKER__OTHER': 303, 'PCU__ATTACKER__TCP_OTHER': 304, 'PCU__EXTERNAL__ESP': 305, 'PCU__EXTERNAL__MODBUS': 306, 'PCU__EXTERNAL__MQTT': 307, 'PCU__EXTERNAL__OTHER': 308, 'PCU__EXTERNAL__TCP_OTHER': 309, 'PCU__FW_EXT__ESP': 310, 'PCU__FW_EXT__MODBUS': 311, 'PCU__FW_EXT__MQTT': 312, 'PCU__FW_EXT__OTHER': 313, 'PCU__FW_EXT__TCP_OTHER': 314, 'PCU__IDS__ESP': 315, 'PCU__IDS__MODBUS': 316, 'PCU__IDS__MQTT': 317, 'PCU__IDS__OTHER': 318, 'PCU__IDS__TCP_OTHER': 319, 'PCU__NCU__ESP': 320, 'PCU__NCU__MODBUS': 321, 'PCU__NCU__MQTT': 322, 'PCU__NCU__OTHER': 323, 'PCU__NCU__TCP_OTHER': 324, 'PCU__OTHER_HOST__ESP': 325, 'PCU__OTHER_HOST__MODBUS': 326, 'PCU__OTHER_HOST__MQTT': 327, 'PCU__OTHER_HOST__OTHER': 328, 'PCU__OTHER_HOST__TCP_OTHER': 329, 'PCU__PCU__ESP': 330, 'PCU__PCU__MODBUS': 331, 'PCU__PCU__MQTT': 332, 'PCU__PCU__OTHER': 333, 'PCU__PCU__TCP_OTHER': 334, 'PCU__SENSOR__ESP': 335, 'PCU__SENSOR__MODBUS': 336, 'PCU__SENSOR__MQTT': 337, 'PCU__SENSOR__OTHER': 338, 'PCU__SENSOR__TCP_OTHER': 339, 'PCU__TRUSTED_HOST__ESP': 340, 'PCU__TRUSTED_HOST__MODBUS': 341, 'PCU__TRUSTED_HOST__MQTT': 342, 'PCU__TRUSTED_HOST__OTHER': 343, 'PCU__TRUSTED_HOST__TCP_OTHER': 344, 'PCU__UNKNOWN_LOCAL__ESP': 345, 'PCU__UNKNOWN_LOCAL__MODBUS': 346, 'PCU__UNKNOWN_LOCAL__MQTT': 347, 'PCU__UNKNOWN_LOCAL__OTHER': 348, 'PCU__UNKNOWN_LOCAL__TCP_OTHER': 349, 'SENSOR__ATTACKER__ESP': 350, 'SENSOR__ATTACKER__MODBUS': 351, 'SENSOR__ATTACKER__MQTT': 352, 'SENSOR__ATTACKER__OTHER': 353, 'SENSOR__ATTACKER__TCP_OTHER': 354, 'SENSOR__EXTERNAL__ESP': 355, 'SENSOR__EXTERNAL__MODBUS': 356, 'SENSOR__EXTERNAL__MQTT': 357, 'SENSOR__EXTERNAL__OTHER': 358, 'SENSOR__EXTERNAL__TCP_OTHER': 359, 'SENSOR__FW_EXT__ESP': 360, 'SENSOR__FW_EXT__MODBUS': 361, 'SENSOR__FW_EXT__MQTT': 362, 'SENSOR__FW_EXT__OTHER': 363, 'SENSOR__FW_EXT__TCP_OTHER': 364, 'SENSOR__IDS__ESP': 365, 'SENSOR__IDS__MODBUS': 366, 'SENSOR__IDS__MQTT': 367, 'SENSOR__IDS__OTHER': 368, 'SENSOR__IDS__TCP_OTHER': 369, 'SENSOR__NCU__ESP': 370, 'SENSOR__NCU__MODBUS': 371, 'SENSOR__NCU__MQTT': 372, 'SENSOR__NCU__OTHER': 373, 'SENSOR__NCU__TCP_OTHER': 374, 'SENSOR__OTHER_HOST__ESP': 375, 'SENSOR__OTHER_HOST__MODBUS': 376, 'SENSOR__OTHER_HOST__MQTT': 377, 'SENSOR__OTHER_HOST__OTHER': 378, 'SENSOR__OTHER_HOST__TCP_OTHER': 379, 'SENSOR__PCU__ESP': 380, 'SENSOR__PCU__MODBUS': 381, 'SENSOR__PCU__MQTT': 382, 'SENSOR__PCU__OTHER': 383, 'SENSOR__PCU__TCP_OTHER': 384, 'SENSOR__SENSOR__ESP': 385, 'SENSOR__SENSOR__MODBUS': 386, 'SENSOR__SENSOR__MQTT': 387, 'SENSOR__SENSOR__OTHER': 388, 'SENSOR__SENSOR__TCP_OTHER': 389, 'SENSOR__TRUSTED_HOST__ESP': 390, 'SENSOR__TRUSTED_HOST__MODBUS': 391, 'SENSOR__TRUSTED_HOST__MQTT': 392, 'SENSOR__TRUSTED_HOST__OTHER': 393, 'SENSOR__TRUSTED_HOST__TCP_OTHER': 394, 'SENSOR__UNKNOWN_LOCAL__ESP': 395, 'SENSOR__UNKNOWN_LOCAL__MODBUS': 396, 'SENSOR__UNKNOWN_LOCAL__MQTT': 397, 'SENSOR__UNKNOWN_LOCAL__OTHER': 398, 'SENSOR__UNKNOWN_LOCAL__TCP_OTHER': 399, 'TRUSTED_HOST__ATTACKER__ESP': 400, 'TRUSTED_HOST__ATTACKER__MODBUS': 401, 'TRUSTED_HOST__ATTACKER__MQTT': 402, 'TRUSTED_HOST__ATTACKER__OTHER': 403, 'TRUSTED_HOST__ATTACKER__TCP_OTHER': 404, 'TRUSTED_HOST__EXTERNAL__ESP': 405, 'TRUSTED_HOST__EXTERNAL__MODBUS': 406, 'TRUSTED_HOST__EXTERNAL__MQTT': 407, 'TRUSTED_HOST__EXTERNAL__OTHER': 408, 'TRUSTED_HOST__EXTERNAL__TCP_OTHER': 409, 'TRUSTED_HOST__FW_EXT__ESP': 410, 'TRUSTED_HOST__FW_EXT__MODBUS': 411, 'TRUSTED_HOST__FW_EXT__MQTT': 412, 'TRUSTED_HOST__FW_EXT__OTHER': 413, 'TRUSTED_HOST__FW_EXT__TCP_OTHER': 414, 'TRUSTED_HOST__IDS__ESP': 415, 'TRUSTED_HOST__IDS__MODBUS': 416, 'TRUSTED_HOST__IDS__MQTT': 417, 'TRUSTED_HOST__IDS__OTHER': 418, 'TRUSTED_HOST__IDS__TCP_OTHER': 419, 'TRUSTED_HOST__NCU__ESP': 420, 'TRUSTED_HOST__NCU__MODBUS': 421, 'TRUSTED_HOST__NCU__MQTT': 422, 'TRUSTED_HOST__NCU__OTHER': 423, 'TRUSTED_HOST__NCU__TCP_OTHER': 424, 'TRUSTED_HOST__OTHER_HOST__ESP': 425, 'TRUSTED_HOST__OTHER_HOST__MODBUS': 426, 'TRUSTED_HOST__OTHER_HOST__MQTT': 427, 'TRUSTED_HOST__OTHER_HOST__OTHER': 428, 'TRUSTED_HOST__OTHER_HOST__TCP_OTHER': 429, 'TRUSTED_HOST__PCU__ESP': 430, 'TRUSTED_HOST__PCU__MODBUS': 431, 'TRUSTED_HOST__PCU__MQTT': 432, 'TRUSTED_HOST__PCU__OTHER': 433, 'TRUSTED_HOST__PCU__TCP_OTHER': 434, 'TRUSTED_HOST__SENSOR__ESP': 435, 'TRUSTED_HOST__SENSOR__MODBUS': 436, 'TRUSTED_HOST__SENSOR__MQTT': 437, 'TRUSTED_HOST__SENSOR__OTHER': 438, 'TRUSTED_HOST__SENSOR__TCP_OTHER': 439, 'TRUSTED_HOST__TRUSTED_HOST__ESP': 440, 'TRUSTED_HOST__TRUSTED_HOST__MODBUS': 441, 'TRUSTED_HOST__TRUSTED_HOST__MQTT': 442, 'TRUSTED_HOST__TRUSTED_HOST__OTHER': 443, 'TRUSTED_HOST__TRUSTED_HOST__TCP_OTHER': 444, 'TRUSTED_HOST__UNKNOWN_LOCAL__ESP': 445, 'TRUSTED_HOST__UNKNOWN_LOCAL__MODBUS': 446, 'TRUSTED_HOST__UNKNOWN_LOCAL__MQTT': 447, 'TRUSTED_HOST__UNKNOWN_LOCAL__OTHER': 448, 'TRUSTED_HOST__UNKNOWN_LOCAL__TCP_OTHER': 449, 'UNKNOWN_LOCAL__ATTACKER__ESP': 450, 'UNKNOWN_LOCAL__ATTACKER__MODBUS': 451, 'UNKNOWN_LOCAL__ATTACKER__MQTT': 452, 'UNKNOWN_LOCAL__ATTACKER__OTHER': 453, 'UNKNOWN_LOCAL__ATTACKER__TCP_OTHER': 454, 'UNKNOWN_LOCAL__EXTERNAL__ESP': 455, 'UNKNOWN_LOCAL__EXTERNAL__MODBUS': 456, 'UNKNOWN_LOCAL__EXTERNAL__MQTT': 457, 'UNKNOWN_LOCAL__EXTERNAL__OTHER': 458, 'UNKNOWN_LOCAL__EXTERNAL__TCP_OTHER': 459, 'UNKNOWN_LOCAL__FW_EXT__ESP': 460, 'UNKNOWN_LOCAL__FW_EXT__MODBUS': 461, 'UNKNOWN_LOCAL__FW_EXT__MQTT': 462, 'UNKNOWN_LOCAL__FW_EXT__OTHER': 463, 'UNKNOWN_LOCAL__FW_EXT__TCP_OTHER': 464, 'UNKNOWN_LOCAL__IDS__ESP': 465, 'UNKNOWN_LOCAL__IDS__MODBUS': 466, 'UNKNOWN_LOCAL__IDS__MQTT': 467, 'UNKNOWN_LOCAL__IDS__OTHER': 468, 'UNKNOWN_LOCAL__IDS__TCP_OTHER': 469, 'UNKNOWN_LOCAL__NCU__ESP': 470, 'UNKNOWN_LOCAL__NCU__MODBUS': 471, 'UNKNOWN_LOCAL__NCU__MQTT': 472, 'UNKNOWN_LOCAL__NCU__OTHER': 473, 'UNKNOWN_LOCAL__NCU__TCP_OTHER': 474, 'UNKNOWN_LOCAL__OTHER_HOST__ESP': 475, 'UNKNOWN_LOCAL__OTHER_HOST__MODBUS': 476, 'UNKNOWN_LOCAL__OTHER_HOST__MQTT': 477, 'UNKNOWN_LOCAL__OTHER_HOST__OTHER': 478, 'UNKNOWN_LOCAL__OTHER_HOST__TCP_OTHER': 479, 'UNKNOWN_LOCAL__PCU__ESP': 480, 'UNKNOWN_LOCAL__PCU__MODBUS': 481, 'UNKNOWN_LOCAL__PCU__MQTT': 482, 'UNKNOWN_LOCAL__PCU__OTHER': 483, 'UNKNOWN_LOCAL__PCU__TCP_OTHER': 484, 'UNKNOWN_LOCAL__SENSOR__ESP': 485, 'UNKNOWN_LOCAL__SENSOR__MODBUS': 486, 'UNKNOWN_LOCAL__SENSOR__MQTT': 487, 'UNKNOWN_LOCAL__SENSOR__OTHER': 488, 'UNKNOWN_LOCAL__SENSOR__TCP_OTHER': 489, 'UNKNOWN_LOCAL__TRUSTED_HOST__ESP': 490, 'UNKNOWN_LOCAL__TRUSTED_HOST__MODBUS': 491, 'UNKNOWN_LOCAL__TRUSTED_HOST__MQTT': 492, 'UNKNOWN_LOCAL__TRUSTED_HOST__OTHER': 493, 'UNKNOWN_LOCAL__TRUSTED_HOST__TCP_OTHER': 494, 'UNKNOWN_LOCAL__UNKNOWN_LOCAL__ESP': 495, 'UNKNOWN_LOCAL__UNKNOWN_LOCAL__MODBUS': 496, 'UNKNOWN_LOCAL__UNKNOWN_LOCAL__MQTT': 497, 'UNKNOWN_LOCAL__UNKNOWN_LOCAL__OTHER': 498, 'UNKNOWN_LOCAL__UNKNOWN_LOCAL__TCP_OTHER': 499}