Dataset of Advanced Persistent Threat (APT) alerts

Due to the lack of publicly available data of Advanced Persistent Threat (APT) traffic, we built a synthetic dataset which contains APT alerts. This dataset contains 3676 APT alerts that belong to 1000 APT campaigns. The APT alerts were generated to simulate APT scenarios targeting a university campus network. Each APT scenario takes into consideration the following steps of APT life cycle:1- Intelligence gathering2- Point of entry3- Command and control communication4- Lateral movement5- Asset discovery6- Data exfiltration<br>The dataset contains the following columns:[1] Alert type[2] Timestamp[3] Source IP address[4] Source port[5] Destination IP address[6] Destination port[7] Infected machine<br>The database can be opened in software such as SQLite.<br>For more details about generating the dataset, please refer to our work in: https://www.sciencedirect.com/science/article/pii/S0167739X18307532.

由于公开可获取的高级持续性威胁（Advanced Persistent Threat，APT）流量数据匮乏，我们构建了一个包含APT告警的合成数据集。该数据集共包含3676条APT告警，隶属于1000个APT攻击活动。本数据集生成的APT告警用于模拟针对大学校园网络的APT攻击场景，每个APT攻击场景均覆盖APT生命周期的以下阶段：1. 情报搜集；2. 入侵入口；3. 命令与控制通信；4. 横向移动；5. 资产发现；6. 数据外泄。该数据集包含以下字段：[1] 告警类型；[2] 时间戳；[3] 源IP地址；[4] 源端口；[5] 目的IP地址；[6] 目的端口；[7] 受感染主机。该数据集可通过SQLite等软件打开。如需了解该数据集生成的更多细节，请参阅我们的相关研究：https://www.sciencedirect.com/science/article/pii/S0167739X18307532。