Reproducibility Artifacts for "How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection"

This record contains the reproducibility package for the paper "How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection". The package provides the source code, cached graph and data products, model checkpoints, retained baseline artifacts, and sanitized evaluation logs needed to reconstruct or rerun the reported experiments. Reproduction instructions are provided in the repository README. Source repository: https://github.com/lorenzo9uerra/theseus The upload contains five archives: theseus-source.tar.gz: source snapshot at Git commit 73fda59b8513273d8779a868a7b7d2638ee6302e, including Theseus, the adapted MAGIC and PIDSMaker evaluation code, reproduction scripts, tests, configuration files, and the optional container recipe. theseus_artifacts.tar.gz: graph caches, model checkpoints, and canonical evaluation logs for Theseus on the DARPA TC E3 datasets. magic_artifacts.tar.gz: processed MAGIC graph products, model checkpoints, and canonical evaluation logs. pidsmaker_artifacts.tar.gz: retained PIDSMaker artifacts and evaluation logs used to produce the reported results for the Orthrus and Velox baselines. atlasv2_artifacts.tar.gz: processed ATLASv2 tables, UUID-based process labels, Theseus and Velox evaluation artifacts, and canonical secondary-evaluation outputs. The processed DARPA TC E3 node and event tables used with these artifacts are available separately at https://doi.org/10.5281/zenodo.18450778. The released materials use REAPr labels from commit e726c01, and adapted versions of MAGIC and PIDSMaker based on commits aa0b647 and 2a73886, respectively. The adaptations are documented in the included READMEs.