Hardware Performance Counter Dataset for Intrusion Detection

Hardware Performance Counter (HPC) dataset is a real-world, high-fidelity microarchitectural dataset designed for empirical security and performance analysis in cloud environments. Collected on a virtual machine node powered by an AMD EPYC Turin processor running Ubuntu 22.04 LTS (Linux kernel 5.15) under full KVM hypervisor virtualization, the dataset captures low-level processor execution dynamics across 29,994 high-frequency samples. Data collection was performed using the Linux perf stat subsystem with a 300 ms sampling window and randomized anti-aliasing inter-measurement jitter. To simulate diverse execution environments, synthetic workload stressors were generated via stress-ng pinned to CPU Core 0, reserving Core 1 for profiler logging to prevent measurement bias. The workload matrix comprises normal operational baseline activity alongside seven distinct attack and stressor categories,cache, cpu, memory, branch, tlb, io, and mixed each executed across three intensity levels (low, medium, and high). The dataset is structured around five core hardware performance counter features: cache_misses (L1/L2/L3 miss events), cache_references (total cache access attempts), instructions (retired CPU instructions), cycles (elapsed CPU clock cycles), and branch_misses (mispredicted branch instructions). Ground-truth binary labels are categorized as 0 for Normal baseline traffic (15,000 samples, 50.01%) and 1 for Attack workloads (14,994 samples, 49.99%), establishing a perfectly balanced 50/50 class distribution. This dataset is explicitly curated to serve as a benchmark for training and evaluating Hardware-based Intrusion Detection Systems (HIDS), supervised Machine Learning classifiers, unsupervised Anomaly Detection models, and microarchitectural Cross-VM Generalization and domain-shift research.