SECURE-CLAIM attack and baseline data

SECURE-CLAIM Network Traffic Datasets This dataset contains anonymised and synthetic network-traffic captures generated in the production-like Co-Assess and PHIdelity test environment for the SECURE-CLAIM pilot. It includes one baseline traffic capture representing normal platform activity and four attack-specific datasets covering ransomware, volumetric denial of service, coordinated fraud-ring submissions, and progressive AI-model data poisoning. The datasets support the evaluation of intrusion detection, anomaly detection, incident-management workflows, dynamic risk analysis, forensic investigation, and response orchestration. They contain network-observable traffic generated during controlled attack simulations and do not include real patient, customer, or insurer data. Dataset contents baseline_.zip. Contains baseline network traffic, i.e., normal Co-Assess and PHIdelity activity captured during attack-free operation, including API interactions, service-to-service communication, database traffic, monitoring activity, and other background flows. It provides the benign reference for comparison with the attack datasets. attack1_ransomware_.pcap. Contains network traffic for a ransomware attack via compromised TPA i.e., network traffic representing a multi-stage ransomware intrusion through a third-party integration path, including exploit activity, command-and-control communication, lateral movement, and database-access behaviour. attack2_dos_5_.pcap. Contains network traffic for a volumetric DoS against claim APIs, i.e., network traffic representing a denial-of-service attack against claim submission and decisioning APIs, including high-volume requests, concurrent connections, and TCP pressure. attack3_fraud_ring_.pcap. Contains network traffic for a coordinated fraud-ring submissions, i.e., network traffic representing automated and repeated fraudulent claim submissions, associated login activity, repeated source characteristics, and clustered submission behaviour. attack4_poisoning_.7z. Contains networ traffic for a progressive AI-model data poisoning, i.e., network traffic representing a gradual poisoning attempt against the fraud-detection model through staged claim submissions with progressively anomalous characteristics. All datasets were generated for cybersecurity validation using anonymised or synthetic data and are intended for research, benchmarking, detection-model evaluation, and reproducible analysis of cybersecurity monitoring and incident-response techniques. The four attack datasets are associated with documented scenario ground truth and can be compared with the baseline traffic to evaluate detection performance under different threat conditions.