Research on the Generation Method of an Intrusion Detection Dataset for SCADA Systems in Geothermal Well Scale Inhibitor Injection

In the production phase of geothermal resource development and utilization, the SCADA system for geothermal well scale inhibitor injection plays a critical role in scale prevention. A cyberattack on this SCADA system can result in production data anomalies and equipment damage, triggering a cascading failure: the inhibitor injection may be interrupted, leading to wellbore scaling and a reduction in thermal energy supply. As this impact propagates to the geothermal plant, it can reduce power generation, triggering voltage and frequency fluctuations in the grid that ultimately threaten power supply security. Currently, deep learning-based network security protection technologies have become an effective means to address these threats. However, the lack of high-quality, scenario-specific datasets restricts the effectiveness of this approach. Therefore, this paper aims to develop a method for generating a network intrusion detection dataset for the SCADA system of geothermal well scale inhibitor injection. Specifically, first, a geothermal well SCADA network testbed that closely aligns with the real process was constructed. On this testbed, multi-dimensional network attack experiments—covering scanning, denial-of-service (DoS), ARP spoofing, and man-in-the-middle (MitM) attacks—were systematically conducted to simulate threat scenarios with different origins, stealth levels, and scopes. Subsequently, network traffic data under both normal and attacked conditions were collected. The raw traffic was parsed and subjected to feature engineering, and data labeling was completed based on the alignment between attack logs and timestamps. Ultimately, we generated a dataset that contains over 25 million training samples and 2.5 million test samples. Based on this dataset, we conducted benchmark training and evaluation on four mainstream deep learning models: DNN, CNN, LSTM, and Transformer. The experimental results demonstrate that the generated dataset exhibits good learnability and can effectively support the training of different deep learning models. This study not only addresses the scarcity of specialized datasets in this field but also provides a reliable experimental foundation and evaluation benchmark for subsequent cybersecurity research in geothermal energy systems.