Dataset Open Access

AIT Log Data Set V2.0

Landauer, Max; Skopik, Florian; Frank, Maximilian; Hotwagner, Wolfgang; Wurzenberger, Markus; Rauber, Andreas

AIT Log Data Sets

This repository contains synthetic log data suitable for evaluation of intrusion detection systems, federated learning, and alert aggregation. A detailed description of the dataset is available in [1]. The logs were collected from eight testbeds that were built at the Austrian Institute of Technology (AIT) following the approach by [2]. Please cite these papers if the data is used for academic publications.

In brief, each of the datasets corresponds to a testbed representing a small enterprise network including mail server, file share, WordPress server, VPN, firewall, etc. Normal user behavior is simulated to generate background noise over a time span of 4-6 days. At some point, a sequence of attack steps are launched against the network. Log data is collected from all hosts and includes Apache access and error logs, authentication logs, DNS logs, VPN logs, audit logs, Suricata logs, network traffic packet captures, horde logs, exim logs, syslog, and system monitoring logs. Separate ground truth files are used to label events that are related to the attacks. Compared to the AIT-LDSv1.1, a more complex network and diverse user behavior is simulated, and logs are collected from all hosts in the network.

The datasets have the following structure:

  • The gather directory contains all logs collected from the testbed. Logs collected from each host are located in gather/<host_name>/logs/.
  • The labels directory contains the ground truth of the dataset that indicates which events are related to attacks. The directory mirrors the structure of the gather directory so that each label files is located at the same path and has the same name as the corresponding log file. Each line in the label files references the log event corresponding to an attack by the line number counted from the beginning of the file ("line"), the labels assigned to the line that state the respective attack step ("labels"), and the labeling rules that assigned the labels ("rules").
  • The processing directory contains the source code that was used to generate the labels.
  • The rules directory contains the labeling rules.
  • The environment directory contains the source code that was used to deploy the testbed and run the simulation using the Kyoushi Testbed Environment.
  • The dataset.yml file specifies the start and end time of the simulation.

The following table summarizes relevant properties of the datasets:

Dataset Simulation time Attack time Exfiltration visible in DNS logs Scan volume Password cracking Unpacked size
fox 2022-01-15 00:00 - 2022-01-20 00:00 2022-01-18 11:59 - 2022-01-18 13:15 Yes High Yes 26 GB
harrison 2022-02-04 00:00 - 2022-02-09 00:00 2022-02-08 07:07 - 2022-02-08 08:38 Yes High Yes 27 GB
russellmitchell 2022-01-21 00:00 - 2022-01-25 00:00 2022-01-24 03:01 - 2022-01-24 04:39 Yes Low Yes 14 GB
santos 2022-01-14 00:00 - 2022-01-18 00:00 2022-01-17 11:15 - 2022-01-17 11:59 Yes Low Yes 17 GB
shaw 2022-01-25 00:00 - 2022-01-31 00:00 2022-01-29 14:37 - 2022-01-29 15:21 No Low Yes 27 GB
wardbeck 2022-01-19 00:00 - 2022-01-24 00:00 2022-01-23 12:10 - 2022-01-23 12:56 Yes Low Yes 26 GB
wheeler 2022-01-26 00:00 - 2022-01-31 00:00 2022-01-30 07:35 - 2022-01-30 17:53 Yes High No 30 GB
wilson 2022-02-03 00:00 - 2022-02-09 00:00 2022-02-07 10:57 - 2022-02-07 11:49 Yes High Yes 39 GB

The following attacks are launched in the network:

  • Scans (nmap, WPScan, dirb)
  • Webshell upload (CVE-2020-24186)
  • Password cracking (John the Ripper)
  • Privilege escalation
  • Remote command execution
  • Data exfiltration (DNSteal)

Note that attack parameters and their execution orders vary in each dataset. Labeled log files are trimmed to the simulation time to ensure that their labels (which reference the related event by the line number in the file) are not misleading. Other log files, however, also contain log events generated before or after the simulation time and may therefore be affected by testbed setup or data collection. It is therefore recommended to only consider logs with timestamps within the simulation time for analysis.

Beside the attack labels, a general overview of the exact times when specific attack steps are launched are available in gather/attacker_0/logs/attacks.log. An enumeration of all hosts and their IP addresses is stated in processing/config/servers.yml. Moreover, configurations of each host are provided in gather/<host_name>/configs/ and gather/<host_name>/facts.json.

Version history:

  • AIT-LDS-v1.x: Four datasets, logs from single host, fine-granular audit logs, mail/CMS.
  • AIT-LDS-v2.0: Eight datasets, logs from all hosts, system logs and network traffic, mail/CMS/cloud/web.

Acknowledgements: Partially funded by the FFG projects INDICAETING (868306) and DECEPT (873980), and the EU projects GUARD (833456) and PANDORA (SI2.835928).

If you use the dataset, please cite the following publications:

[1] M. Landauer, F. Skopik, M. Frank, W. Hotwagner, M. Wurzenberger, and A. Rauber. "Maintainable Log Datasets for Evaluation of Intrusion Detection Systems". Under Review. arXiv:2203.08580 [PDF]

[2] M. Landauer, F. Skopik, M. Wurzenberger, W. Hotwagner and A. Rauber, "Have it Your Way: Generating Customized Log Datasets With a Model-Driven Simulation Testbed," in IEEE Transactions on Reliability, vol. 70, no. 1, pp. 402-415, March 2021, doi: 10.1109/TR.2020.3031317. [PDF]

M. Landauer, F. Skopik, M. Frank, W. Hotwagner, M. Wurzenberger, and A. Rauber. "Maintainable Log Datasets for Evaluation of Intrusion Detection Systems". arXiv:2203.08580
Files (130.6 GB)
Name Size
fox.zip
md5:b6cd133398fbed6f3e7434dafbc45756
15.8 GB Download
harrison.zip
md5:4fbe3dd17a194776b2851116f8b51380
16.8 GB Download
russellmitchell.zip
md5:78e9b7d169b438f03816019b52ab3ff7
7.1 GB Download
santos.zip
md5:fbd2663a41c83f345aa08a7fb11a6c6c
10.0 GB Download
shaw.zip
md5:872bbec7ffe12f14e06364e328a96088
17.6 GB Download
wardbeck.zip
md5:ff524634e64c7779def2eb804e8c52ac
17.2 GB Download
wheeler.zip
md5:e3f5605d867fcc644f93ae6c736cdb30
19.6 GB Download
wilson.zip
md5:952dd37cb262ef0054ad6d5371bdbe70
26.5 GB Download
257
9,224
views
downloads
All versions This version
Views 257257
Downloads 9,2249,224
Data volume 146.2 TB146.2 TB
Unique views 209209
Unique downloads 470470

Share

Cite as