Forensic Timeline Dataset for Linux Operating System Reconstruction Based on YAML Data Serialization

This dataset was created as part of the research titled "FORENSIC RECONSTRUCTION OF LINUX OPERATING SYSTEM BASED ON YAML DATA SERIALISATION." It consists of CSV files generated using Plaso (log2timeline) from forensic experiments conducted on a virtualized Ubuntu Linux environment, intended to support timeline-based reconstruction of system activity.

The dataset is structured as follows:

A full version containing all raw logs (over 1.1 million log entries).

Split versions with reduced sizes to support efficient testing or analysis at different scales:

1,000,000 entries

500,000 entries

100,000 entries

50,000 entries

10,000 entries

The dataset includes both normal user behavior and suspicious activities designed to simulate real-world forensic scenarios:

Normal Activity Scenario — Simulates browsing activity using Firefox and Brave, including searches on Google and Bing, website visits, and YouTube streaming.

Suspicious Activity Scenarios — Includes:

User Account Creation: Creation of new local users and privilege escalation via useradd and usermod.

Authentication Attempts: Both valid and invalid logins using su, ssh, and brute-force attacks with Hydra.

Web Shell Execution: A PHP-based backdoor script allowing remote command execution, with logs parsed using Plaso’s text/apache_access parser.

DNS Misconfiguration: Errors from intentionally malformed BIND zone files and configurations.

Disabling Security Tools: Stopping the firewalld service to simulate defense evasion.

Promiscuous Mode Activation: Use of tcpdump to trigger network interface mode change.

FTP Exploitation: Misuse of vsftpd through malformed requests and connection flooding using Netcat.

Crontab Manipulation: Scheduled task injection and removal simulating persistence mechanisms.

Each activity scenario is captured in a dedicated CSV file, providing a clean and reproducible timeline for forensic analysis and event reconstruction using YAML-based rules.