Real-World Generalization of Orthogonal Syscall Anomaly Detection — Attack Capture Datasets

Syscall trace datasets captured from real attack scenarios in an isolated Docker lab environment. Traces are recorded using strace on the victim-side process and converted to ADFA-LD format (i386 syscall numbers). Attack families included: adduser_capture: Unauthorized local user creation cryptominer_capture: Covert cryptocurrency mining process hydra_capture: Hydra brute-force against FTP and SSH daemons java_meterpreter_capture: Java-based Meterpreter reverse shell payload meterpreter_capture: Native Meterpreter reverse shell payload nikto_capture: Nikto web vulnerability scanner reverse_shell_capture: Bash/netcat reverse shell shellshock_capture: Shellshock (CVE-2014-6271) exploitation sqlmap_capture: SQLmap automated SQL injection webshell_capture: PHP web shell upload and execution Each archive contains raw strace logs (raw_strace/), Docker Compose lab setup (docker/), and ADFA-LD formatted syscall number traces (adfa_ld_out/). ADFA-LD format: space-separated i386 syscall numbers per line, one trace per file. Associated code and pre-trained models: GitHub repository