K8s Cross-Service Attack Testbed Dataset

# K8s Cross-Service Attack Testbed Dataset (v1.0) Labelled telemetry from a Kubernetes microservice testbed: distributed traces, Kubernetes audit events and egress records, with one-minute windows labelled as normal operation, benign change (load spikes, rolling deployments, operator secret reads) or one of three cross-service attacks (lateral movement, service-account token misuse, data exfiltration). Companion data for the paper *"Trustworthy by Design: An Explainable, Autonomy-Bounded LLM Framework for Cross-Service Attack Detection in Kubernetes Microservices"* (ISDIA 2027, submitted). ## Testbed - Single-node Minikube cluster; four Spring Boot (Java 21) services: frontend, auth, order, payment; PostgreSQL 16 as the database with 200,000 synthetic records (~40 MB). No real user data.- Normal call graph: frontend→auth, frontend→order, order→payment, order→db, payment→db, auth→db; payment calls an external payment gateway.- Deliberate weaknesses: the order service account may read secrets/configmaps; order exposes a debug export endpoint.- Telemetry: OpenTelemetry Java agent (100% sampling) → collector file exporter; API-server audit log at Metadata level for secrets, configmaps, service accounts and deployments in namespace `shop`; nginx access logs of two simulated external hosts (`pay-gateway`, attacker `sink`); pod-IP snapshots every 10 s.- Background load: k6, ~10 requests/s with a ±35% sinusoidal swing (2-hour period), 2% invalid tokens.