Los Alamos National Labs (LANL) Intrusion Detection Dataset

该数据集来自LANL实验室，记录了内部计算机网络活动长达58天的日志，涵盖了12,425名用户和17,684台计算机之间的1.6亿次认证事件，其中识别出了恶意认证事件。该数据集以图模型的形式构建，旨在检测认证事件中的恶意边。此外，该数据集极度不平衡，在4500万条边中仅包含518条恶意边，它被用于进行转导和归纳异常检测任务。其规模涉及12,425名用户、17,684台计算机以及160亿次认证事件。该数据集的任务是进行认证事件中的异常检测。

This dataset is sourced from LANL Laboratories, capturing 58 consecutive days of internal computer network activity logs. It covers 160 million authentication events occurring between 12,425 users and 17,684 computers, with malicious authentication events having been identified within the logs. Constructed as a graph model, this dataset is designed for detecting malicious edges in authentication events. Furthermore, this dataset is highly imbalanced, containing only 518 malicious edges out of 45 million total edges. It has been utilized for transductive and inductive anomaly detection tasks. In terms of scale, this dataset involves 12,425 users, 17,684 computers, and 1.6 billion authentication events. The core task of this dataset is anomaly detection in authentication events.

搜集汇总

背景与挑战

背景概述

该数据集是洛斯阿拉莫斯国家实验室（LANL）收集的综合性网络安全事件数据集，涵盖58天内从五个来源（包括认证、进程、DNS、网络流和红队事件）的去标识化数据，总计约12GB压缩大小和超过16亿个事件。其特点在于多源数据整合，提供了真实内部网络环境中的用户、计算机和进程行为记录，并包含红队事件作为已知恶意行为的基准，适用于入侵检测和网络安全研究。