Security-Gym Dataset: Labeled Linux Log Streams for Continual Learning Research

Ground-truth-labeled Linux server log and eBPF kernel event streams (19.5M total events) for cybersecurity continual learning research. Contains real benign server traffic mixed with scripted attack campaigns (SSH brute force, credential stuffing, port scanning, Log4Shell CVE-2021-44228, Redis CVE-2022-0543) executed against a purpose-built vulnerable server. Includes 4 pre-composed experiment streams (7-day to 365-day) ready for use with the security-gym Gymnasium environment. All events are timestamped, parsed, and labeled with ground truth including attack type and MITRE ATT&CK stage.