February 24, 2022 Dataset Open Access

Landauer, Max; Skopik, Florian; Frank, Maximilian; Hotwagner, Wolfgang; Wurzenberger, Markus; Rauber, Andreas

Dublin Core Export

<?xml version='1.0' encoding='utf-8'?>
<oai_dc:dc xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:oai_dc="http://www.openarchives.org/OAI/2.0/oai_dc/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.openarchives.org/OAI/2.0/oai_dc/ http://www.openarchives.org/OAI/2.0/oai_dc.xsd">
  <dc:creator>Landauer, Max</dc:creator>
  <dc:creator>Skopik, Florian</dc:creator>
  <dc:creator>Frank, Maximilian</dc:creator>
  <dc:creator>Hotwagner, Wolfgang</dc:creator>
  <dc:creator>Wurzenberger, Markus</dc:creator>
  <dc:creator>Rauber, Andreas</dc:creator>
  <dc:date>2022-02-24</dc:date>
  <dc:description>AIT Log Data Sets

This repository contains synthetic log data suitable for evaluation of intrusion detection systems, federated learning, and alert aggregation. A detailed description of the dataset is available in [1]. The logs were collected from eight testbeds that were built at the Austrian Institute of Technology (AIT) following the approach by [2]. Please cite these papers if the data is used for academic publications.

In brief, each of the datasets corresponds to a testbed representing a small enterprise network including mail server, file share, WordPress server, VPN, firewall, etc. Normal user behavior is simulated to generate background noise over a time span of 4-6 days. At some point, a sequence of attack steps are launched against the network. Log data is collected from all hosts and includes Apache access and error logs, authentication logs, DNS logs, VPN logs, audit logs, Suricata logs, network traffic packet captures, horde logs, exim logs, syslog, and system monitoring logs. Separate ground truth files are used to label events that are related to the attacks. Compared to the AIT-LDSv1.1, a more complex network and diverse user behavior is simulated, and logs are collected from all hosts in the network. If you are only interested in network traffic analysis, we also provide the AIT-NDS containing the labeled netflows of the testbed networks.

The datasets in this repository have the following structure:


	The gather directory contains all logs collected from the testbed. Logs collected from each host are located in gather/&lt;host_name&gt;/logs/.
	The labels directory contains the ground truth of the dataset that indicates which events are related to attacks. The directory mirrors the structure of the gather directory so that each label files is located at the same path and has the same name as the corresponding log file. Each line in the label files references the log event corresponding to an attack by the line number counted from the beginning of the file ("line"), the labels assigned to the line that state the respective attack step ("labels"), and the labeling rules that assigned the labels ("rules").
	The processing directory contains the source code that was used to generate the labels.
	The rules directory contains the labeling rules.
	The environment directory contains the source code that was used to deploy the testbed and run the simulation using the Kyoushi Testbed Environment.
	The dataset.yml file specifies the start and end time of the simulation.


The following table summarizes relevant properties of the datasets:


	
		
			Dataset
			Simulation time
			Attack time
			Exfiltration visible in DNS logs
			Scan volume
			Password cracking
			Unpacked size
		
	
	
		
			fox
			2022-01-15 00:00 - 2022-01-20 00:00
			2022-01-18 11:59 - 2022-01-18 13:15
			Yes
			High
			Yes
			26 GB
		
		
			harrison
			2022-02-04 00:00 - 2022-02-09 00:00
			2022-02-08 07:07 - 2022-02-08 08:38
			Yes
			High
			Yes
			27 GB
		
		
			russellmitchell
			2022-01-21 00:00 - 2022-01-25 00:00
			2022-01-24 03:01 - 2022-01-24 04:39
			Yes
			Low
			Yes
			14 GB
		
		
			santos
			2022-01-14 00:00 - 2022-01-18 00:00
			2022-01-17 11:15 - 2022-01-17 11:59
			Yes
			Low
			Yes
			17 GB
		
		
			shaw
			2022-01-25 00:00 - 2022-01-31 00:00
			2022-01-29 14:37 - 2022-01-29 15:21
			No
			Low
			Yes
			27 GB
		
		
			wardbeck
			2022-01-19 00:00 - 2022-01-24 00:00
			2022-01-23 12:10 - 2022-01-23 12:56
			Yes
			Low
			Yes
			26 GB
		
		
			wheeler
			2022-01-26 00:00 - 2022-01-31 00:00
			2022-01-30 07:35 - 2022-01-30 17:53
			Yes
			High
			No
			30 GB
		
		
			wilson
			2022-02-03 00:00 - 2022-02-09 00:00
			2022-02-07 10:57 - 2022-02-07 11:49
			Yes
			High
			Yes
			39 GB
		
	


The following attacks are launched in the network:


	Scans (nmap, WPScan, dirb)
	Webshell upload (CVE-2020-24186)
	Password cracking (John the Ripper)
	Privilege escalation
	Remote command execution
	Data exfiltration (DNSteal)


Note that attack parameters and their execution orders vary in each dataset. Labeled log files are trimmed to the simulation time to ensure that their labels (which reference the related event by the line number in the file) are not misleading. Other log files, however, also contain log events generated before or after the simulation time and may therefore be affected by testbed setup or data collection. It is therefore recommended to only consider logs with timestamps within the simulation time for analysis.

Beside the attack labels, a general overview of the exact times when specific attack steps are launched are available in gather/attacker_0/logs/attacks.log. An enumeration of all hosts and their IP addresses is stated in processing/config/servers.yml. Moreover, configurations of each host are provided in gather/&lt;host_name&gt;/configs/ and gather/&lt;host_name&gt;/facts.json.

Version history:


	AIT-LDS-v1.x: Four datasets, logs from single host, fine-granular audit logs, mail/CMS.
	AIT-LDS-v2.0: Eight datasets, logs from all hosts, system logs and network traffic, mail/CMS/cloud/web.


Acknowledgements: Partially funded by the FFG projects INDICAETING (868306) and DECEPT (873980), and the EU projects GUARD (833456) and PANDORA (SI2.835928).

If you use the dataset, please cite the following publications:

[1] M. Landauer, F. Skopik, M. Frank, W. Hotwagner, M. Wurzenberger, and A. Rauber. "Maintainable Log Datasets for Evaluation of Intrusion Detection Systems". Under Review. arXiv:2203.08580 [PDF]

[2] M. Landauer, F. Skopik, M. Wurzenberger, W. Hotwagner and A. Rauber, "Have it Your Way: Generating Customized Log Datasets With a Model-Driven Simulation Testbed," in IEEE Transactions on Reliability, vol. 70, no. 1, pp. 402-415, March 2021, doi: 10.1109/TR.2020.3031317. [PDF]</dc:description>
  <dc:description>M. Landauer, F. Skopik, M. Frank, W. Hotwagner, M. Wurzenberger, and A. Rauber. "Maintainable Log Datasets for Evaluation of Intrusion Detection Systems". arXiv:2203.08580</dc:description>
  <dc:identifier>https://zenodo.org/record/5789064</dc:identifier>
  <dc:identifier>10.5281/zenodo.5789064</dc:identifier>
  <dc:identifier>oai:zenodo.org:5789064</dc:identifier>
  <dc:relation>info:eu-repo/grantAgreement/EC/H2020/833456/</dc:relation>
  <dc:relation>doi:10.5281/zenodo.5789063</dc:relation>
  <dc:rights>info:eu-repo/semantics/openAccess</dc:rights>
  <dc:rights>https://creativecommons.org/licenses/by-nc-sa/4.0/legalcode</dc:rights>
  <dc:subject>log data</dc:subject>
  <dc:subject>intrusion detection</dc:subject>
  <dc:title>AIT Log Data Set V2.0</dc:title>
  <dc:type>info:eu-repo/semantics/other</dc:type>
  <dc:type>dataset</dc:type>
</oai_dc:dc>