rypow/dendroaspis-tetragon-hids

Dendroaspis Tetragon HIDS数据集是一个基于代理驱动的攻击数据集，专注于主机入侵检测和网络安全。该数据集包含来自单个Linux LXC容器的行为事件语料库，在受控的Atomic Red Team（ART）活动下收集，并通过Tetragon原生管道进行解析和特征工程。数据集用于主机异常检测研究、序列建模（如Mamba、Transformers等）、ATT&CK技术可检测性研究以及自主攻击者行为分析。测试集包含由AI代理完全编排的受控渗透测试活动生成的事件，体现了自主攻击者的行为足迹，包括观察、侦察、规划、工具使用、执行和迭代的端到端自主攻击循环。数据集还包括一个模拟恶意npm供应链攻击的顶石场景（CHAIN.CAP01），结合了执行、发现、凭证访问、防御规避和外泄行为。数据集分为训练集（16,951,950行，攻击率为0.0%）和测试集（2,349,965行，攻击率为30.0%），收集窗口为6天。数据集包含22种技术ID（21种ATT&CK技术和1种供应链顶石技术），总计1930万事件。数据集已通过深度别名化进行匿名处理，确保无个人身份信息泄露。数据集适用于防御性研究，遵循CC BY 4.0许可。The Dendroaspis Tetragon HIDS dataset is an agent-driven attack dataset focused on host intrusion detection and cybersecurity. It consists of a behavioral-event corpus collected from a single Linux LXC container under a controlled Atomic Red Team (ART) campaign, parsed and feature-engineered with a Tetragon-native pipeline. The dataset is intended for host-anomaly-detection research, sequence modeling (e.g., Mamba, Transformers), ATT&CK-technique-detectability studies, and autonomous-attacker behavioral analysis. The test set includes events generated during a controlled penetration-testing campaign fully orchestrated by an AI agent, capturing the behavioral footprint of an autonomous attacker through an end-to-end autonomous attack loop: observation, reconnaissance, planning, tooling, execution, and iteration. The dataset also features a capstone scenario simulating a malicious npm supply-chain attack (CHAIN.CAP01), combining execution, discovery, credential access, defense evasion, and exfiltration behaviors. It is split into a training set (16,951,950 rows, 0.0% attack rate) and a test set (2,349,965 rows, 30.0% attack rate), with a 6-day collection window. The dataset includes 22 technique IDs (21 ATT&CK techniques + 1 supply-chain capstone) and 19.3 million events. It has been fully anonymized via a component-first deep aliasing pass to eliminate personally identifiable information. The dataset is intended for defensive research only and is licensed under CC BY 4.0.