Dataset: Behavior of Participants in Hands-on Cybersecurity Training Suitable for Process Mining

This repository contains supplementary materials for the following journal paper: Radek Ošlejšek, Martin Macák, Karolína Dočkalová Burská. Hands-on cybersecurity training behavior data for process mining. In Elsevier Data in Brief. 2023. Available as open-access article on https://doi.org/10.1016/j.dib.2023.109956 Contents Datasets store event logs of trainees participating in hands-on cybersecurity exercises organized in the KYPO Cyber Range. The data includes training scenarios (expected behavior), raw event logs in the JSON format, and aggregated behavioral data suitable for process mining analysis. Data1: A dataset of 52 trainees participating in the Locust 3302 exercise adapted an insider attack scenario. No time restrictions were posed on playtime. The data file is structured as follows: training_definition.json: The exercise content – cybersecurity tasks and hints. The training is based on the Locust 3302 game adapted to an insider attack scenario. training_events: Recorded progress of trainees within the exercise, i.e., the status of completing tasks. command_histories: Recorded commands executed on network hosts. process_mining.csv: Complete PM-ready dataset suitable for process discovery or conformance analysis. process_mining_simplified.csv : Reduced PM-ready dataset with semantically identical events being removed. Data2: A dataset of 48 trainees participating in the original Locust 3302 exercise. Three supervised training sessions were restricted to two hours of playtime. The structure follows the structure of Data1. Tool: A Java application used to aggregate raw JSON data and transform them into a CSV format suitable for process mining techniques. How to cite If you use or build upon the materials, please use the BibTeX entry below to cite the original work. @article{Oslejsek2023dataset, author = {Radek O\v{s}lej\v{s}ek and Martin Mac\'{a}k and Karol\'{i}na {Do\v{c}kalov\'{a} Bursk\'{a}}}, title = {Hands-on cybersecurity training behavior data for process mining}, journal = {{Data in Brief}}, publisher = {Elsevier}, issn = {2352-3409}, year = {2023}, volume = {52}, doi = {10.1016/j.dib.2023.109956}, url = {https://www.sciencedirect.com/science/article/pii/S2352340923009873} }本仓库包含下述期刊论文的补充材料：Radek Ošlejšek、Martin Macák、Karolína Dočkalová Burská。《面向流程挖掘（process mining）的实战网络安全训练行为数据》。发表于爱思唯尔（Elsevier）旗下《Data in Brief》期刊，2023年。该开源文章可通过https://doi.org/10.1016/j.dib.2023.109956 获取。 【数据集内容】 本数据集存储了参与KYPO网络靶场（KYPO Cyber Range）组织的实战网络安全演练的受训者事件日志（event logs）。数据涵盖训练场景（预期行为）、JSON（JavaScript Object Notation）格式的原始事件日志，以及适用于流程挖掘分析的聚合行为数据。 数据集1：包含52名受训者参与改造为内网攻击场景的Locust 3302演练的数据集。本次演练未对游戏时长设置任何限制。数据文件结构如下： training_definition.json：演练内容——网络安全任务与提示信息。本次训练基于适配内网攻击场景的Locust 3302游戏改造而来。 training_events：受训者在演练中的进度记录，即任务完成状态。 command_histories：在网络主机上执行的已记录命令历史。 process_mining.csv：适用于流程发现或一致性分析的完整流程挖掘就绪数据集。 process_mining_simplified.csv：简化版流程挖掘就绪数据集，已移除语义重复的事件。 数据集2：包含48名受训者参与原始Locust 3302演练的数据集。本次演练设置了三场监督式训练课程，且单场游戏时长限制为两小时。其文件结构与数据集1一致。 工具：一款Java应用程序，用于聚合原始JSON数据并将其转换为适用于流程挖掘技术的CSV（Comma-Separated Values）格式。 引用说明 若您使用或基于本补充材料进行二次开发，请使用下述BibTeX条目引用原论文： @article{Oslejsek2023dataset, author = {Radek Ošlejšek and Martin Macák and Karolína Dočkalová Burská}, title = {面向流程挖掘的实战网络安全训练行为数据}, journal = {{Data in Brief}}, publisher = {Elsevier}, issn = {2352-3409}, year = {2023}, volume = {52}, doi = {10.1016/j.dib.2023.109956}, url = {https://www.sciencedirect.com/science/article/pii/S2352340923009873} }