Cyber Attack Evaluation Dataset for Deep Packet Inspection and Analysis

To determine the effectiveness of any defense mechanism, there is a need for comprehensive real-time network data that solely references various attack scenarios based on older software versions or unprotected ports, and so on. This presented dataset has entire network data at the time of several cyber attacks to enable experimentation on challenges based on implementing defense mechanisms on a larger scale. For collecting the data, we captured the network traffic of configured virtual machines using Wireshark and tcpdump. To analyze the impact of several cyber attack scenarios, this dataset presents a set of ten computers connected to Router1 on VLAN1 in a Docker Bridge network, that try and exploit each other. It includes browsing the web and downloading foreign packages including malicious ones. Also, services like FTP and SSH were exploited using several attack mechanisms. The presented dataset shows the importance of updating and patching systems to protect themselves to a greater extent, by following attack tactics on older versions of packages as compared to the newer and updated ones. This dataset also includes an Apache Server hosted on the different subset on VLAN2 which is connected to the VLAN1 to demonstrate isolation and cross-VLAN communication. The services on this web server were also exploited by the previously stated ten computers. The attack types include: Distributed Denial of Service, SQL Injection, Account Takeover, Service Exploitation (SSH, FTP), DNS and ARP Spoofing, Scanning and Firewall Searching and Indexing (using Nmap), Hammering the services to brute-force passwords and usernames, Malware attack, Spoofing and Man-in-the-Middle Attack. The attack scenarios also show various scanning mechanisms and the impact of Insider Threats on the entire network.

若要评估各类防御机制的有效性，亟需获取覆盖基于老旧软件版本、未防护端口等多种攻击场景的全面实时网络数据。本数据集收录了多起网络攻击发生时的完整网络流量数据，可支撑大规模部署防御机制相关的实验研究与挑战验证。数据采集阶段，我们通过Wireshark与tcpdump工具捕获了配置完成的虚拟机的网络流量。为分析多类网络攻击场景的影响，本数据集构建了基于Docker桥接网络（Docker Bridge network）的实验环境：10台计算机接入VLAN1（虚拟局域网1，Virtual Local Area Network 1）下的Router1，彼此间会开展漏洞利用操作。实验场景涵盖网页浏览、下载包括恶意软件在内的外部软件包，同时通过多种攻击手段对FTP、SSH等服务实施漏洞利用。本数据集通过对比老旧软件包与新版已打补丁软件包的攻击利用效果，凸显了系统更新与漏洞修复对提升网络防护能力的重要性。此外，本数据集还包含部署于VLAN2（虚拟局域网2，Virtual Local Area Network 2）子网的Apache服务器（Apache Server），该服务器通过链路与VLAN1相连，用于演示网络隔离与跨VLAN通信场景。前述10台计算机同样会对该Web服务器上的服务发起漏洞利用攻击。本次实验涵盖的攻击类型包括：分布式拒绝服务（Distributed Denial of Service, DDoS）、SQL注入（SQL Injection）、账号接管（Account Takeover）、服务漏洞利用（针对SSH、FTP服务）、DNS与ARP欺骗（DNS and ARP Spoofing）、扫描与防火墙搜索及索引（使用Nmap工具）、暴力破解账号密码服务、恶意软件攻击（Malware attack）、欺骗与中间人攻击（Man-in-the-Middle Attack, MITM）。本数据集的攻击场景还涵盖了多种扫描手段，以及内部威胁（Insider Threats）对整个网络的影响。