Dataset Open Access
Landauer, Max; Skopik, Florian; Frank, Maximilian; Hotwagner, Wolfgang; Wurzenberger, Markus; Rauber, Andreas
AIT Log Data Sets
This repository contains synthetic log data suitable for evaluation of intrusion detection systems, federated learning, and alert aggregation. A detailed description of the dataset is available in . The logs were collected from eight testbeds that were built at the Austrian Institute of Technology (AIT) following the approach by . Please cite these papers if the data is used for academic publications.
In brief, each of the datasets corresponds to a testbed representing a small enterprise network including mail server, file share, WordPress server, VPN, firewall, etc. Normal user behavior is simulated to generate background noise over a time span of 4-6 days. At some point, a sequence of attack steps are launched against the network. Log data is collected from all hosts and includes Apache access and error logs, authentication logs, DNS logs, VPN logs, audit logs, Suricata logs, network traffic packet captures, horde logs, exim logs, syslog, and system monitoring logs. Separate ground truth files are used to label events that are related to the attacks. Compared to the AIT-LDSv1.1, a more complex network and diverse user behavior is simulated, and logs are collected from all hosts in the network. If you are only interested in network traffic analysis, we also provide the AIT-NDS containing the labeled netflows of the testbed networks.
The datasets in this repository have the following structure:
The following table summarizes relevant properties of the datasets:
|Dataset||Simulation time||Attack time||Exfiltration visible in DNS logs||Scan volume||Password cracking||Unpacked size|
|fox||2022-01-15 00:00 - 2022-01-20 00:00||2022-01-18 11:59 - 2022-01-18 13:15||Yes||High||Yes||26 GB|
|harrison||2022-02-04 00:00 - 2022-02-09 00:00||2022-02-08 07:07 - 2022-02-08 08:38||Yes||High||Yes||27 GB|
|russellmitchell||2022-01-21 00:00 - 2022-01-25 00:00||2022-01-24 03:01 - 2022-01-24 04:39||Yes||Low||Yes||14 GB|
|santos||2022-01-14 00:00 - 2022-01-18 00:00||2022-01-17 11:15 - 2022-01-17 11:59||Yes||Low||Yes||17 GB|
|shaw||2022-01-25 00:00 - 2022-01-31 00:00||2022-01-29 14:37 - 2022-01-29 15:21||No||Low||Yes||27 GB|
|wardbeck||2022-01-19 00:00 - 2022-01-24 00:00||2022-01-23 12:10 - 2022-01-23 12:56||Yes||Low||Yes||26 GB|
|wheeler||2022-01-26 00:00 - 2022-01-31 00:00||2022-01-30 07:35 - 2022-01-30 17:53||Yes||High||No||30 GB|
|wilson||2022-02-03 00:00 - 2022-02-09 00:00||2022-02-07 10:57 - 2022-02-07 11:49||Yes||High||Yes||39 GB|
The following attacks are launched in the network:
Note that attack parameters and their execution orders vary in each dataset. Labeled log files are trimmed to the simulation time to ensure that their labels (which reference the related event by the line number in the file) are not misleading. Other log files, however, also contain log events generated before or after the simulation time and may therefore be affected by testbed setup or data collection. It is therefore recommended to only consider logs with timestamps within the simulation time for analysis.
Beside the attack labels, a general overview of the exact times when specific attack steps are launched are available in gather/attacker_0/logs/attacks.log. An enumeration of all hosts and their IP addresses is stated in processing/config/servers.yml. Moreover, configurations of each host are provided in gather/<host_name>/configs/ and gather/<host_name>/facts.json.
Acknowledgements: Partially funded by the FFG projects INDICAETING (868306) and DECEPT (873980), and the EU projects GUARD (833456) and PANDORA (SI2.835928).
If you use the dataset, please cite the following publications:
 M. Landauer, F. Skopik, M. Frank, W. Hotwagner, M. Wurzenberger, and A. Rauber. "Maintainable Log Datasets for Evaluation of Intrusion Detection Systems". Under Review. arXiv:2203.08580 [PDF]
 M. Landauer, F. Skopik, M. Wurzenberger, W. Hotwagner and A. Rauber, "Have it Your Way: Generating Customized Log Datasets With a Model-Driven Simulation Testbed," in IEEE Transactions on Reliability, vol. 70, no. 1, pp. 402-415, March 2021, doi: 10.1109/TR.2020.3031317. [PDF]
|All versions||This version|
|Data volume||148.9 TB||148.9 TB|