Maintainable Log Datasets for Evaluation of Intrusion Detection Systems

Abstract

Intrusion detection systems (IDS) monitor system logs and network traffic to recognize malicious activities in computer networks. Evaluating and comparing IDSs with respect to their detection accuracies is thereby essential for their selection in specific use-cases. Despite a great need, hardly any labeled intrusion detection datasets are publicly available. As a consequence, evaluations are often carried out on datasets from real infrastructures, where analysts cannot control system parameters or generate a reliable ground truth, or private datasets that prevent reproducibility of results. As a solution, we present a collection of maintainable log datasets collected in a testbed representing a small enterprise. Thereby, we employ extensive state machines to simulate normal user behavior and inject a multi-step attack. For scalable testbed deployment, we use concepts from model-driven engineering that enable automatic generation and labeling of an arbitrary number of datasets that comprise repetitions of attack executions with variations of parameters. In total, we provide 8 datasets containing 20 distinct types of log files, of which we label 8 files for 10 unique attack steps. We publish the labeled log datasets and code for testbed setup and simulation online as open-source to enable others to reproduce and extend our results.

Knowledge graph reasoning for cyber attack detection

“…This section details the setup of our experiment, designed to assess the efficacy of our knowledge graph-based inference method for detecting network attacks. We utilized the AIT Log Dataset [57,58], an extensive repository of recorded data primarily comprising log files that offer valuable insights into artificial intelligence and technology-related phenomena. The dataset encompasses a substantial volume of authentic log data from diverse network systems, including web servers, intrusion detection systems (IDS), and user hosts.…”

“…This section details the setup of our experiment, designed to assess the efficacy of our knowledge graph‐based inference method for detecting network attacks. We utilized the AIT Log Dataset [57, 58], an extensive repository of recorded data primarily comprising log files that offer valuable insights into artificial intelligence and technology‐related phenomena.…”

Blockchain-Enabled Secure Distributed Event Logging in the Industrial Internet of Things

“…These events include the uploading measurements, executing commands and login access to various devices. The primary objective of these audit logs are to support real-time functions for intrusion detection systems [2]. Furthermore, they play a vital role in data forensic [3] and identification of any misuse of the system carried out by the adversary.…”