stratosphere/immune-risk-sft-dataset

Slips IDS免疫风险SFT数据集是一个用于大型语言模型（LLM）监督微调的训练数据集，专注于双任务安全事件分析：Slips IDS警报的原因分析和风险评估。每条记录包含一个用户回合（事件DAG + 任务提示）和一个助手回合（最佳N选一响应）。数据集涵盖两种交错的任务类型：原因分析（识别事件是恶意活动、配置错误还是合法行为，并提供结构化推理和替代假设）和风险评估（生成校准的风险级别、业务影响、恶意活动可能性和调查优先级）。数据集通过从四个模型（GPT-4o、GPT-4o-mini、Qwen2.5 3B和Qwen2.5 1.5B）中选择最佳响应创建，基于30分评分标准。数据集分为训练集（1328条记录）和评估集（148条记录），源数据来自826个经过质量过滤的真实Slips IDS网络捕获。

The Slips IDS Immune Risk SFT Dataset is a training dataset for supervised fine-tuning of LLMs on dual-task security incident analysis: cause analysis and risk assessment of Slips IDS alerts. Each record contains a conversation with one user turn (the incident DAG + task prompt) and one assistant turn (the best-of-N selected response). The dataset covers two interleaved task types: Cause Analysis (identifying whether an incident is malicious activity, misconfiguration, or legitimate behavior, with structured reasoning and alternative hypotheses) and Risk Assessment (producing a calibrated risk level, business impact, likelihood of malicious activity, and investigation priority). The dataset was created by selecting the best response from four models (GPT-4o, GPT-4o-mini, Qwen2.5 3B, and Qwen2.5 1.5B) based on a 30-point rubric. The dataset is split into train (1328 records) and eval (148 records) sets, with source data from 826 real Slips IDS network captures filtered by quality.