TQH-C2: An Encrypted Command-and-Control Traffic Dataset Across Protocols and Encryption Layers

Version 1.2.4: Scripts-only update. Added merlin_patch/agent_repository_rwmutex.patch, recording a third local modification of the Merlin v2.1.4 server used for Testbeds B and D (sync.RWMutex in the in-memory agent repository). All data records are unchanged from v1.2.0–v1.2.3.Version 1.2.3: Documentation-only correction to the README (Testbed D service-tag share in §5; per-testbed F₁ seed description in §9). Reported values and all data records are unchanged from v1.2.0–v1.2.2.Version 1.2.2: Added the feature-table builder `build_features_v3.py` to `TQH-C2_scripts.zip`, so the released Parquet feature tables (including JA4/JA4S/JA4H columns) are fully reproducible from the conn.log/labeled.jsonl records. Data records are unchanged from v1.2.0/v1.2.1.Version 1.2.1: Added the Testbed D (Merlin / HTTP-2-over-TLS) collection drivers `run_cell_h2.sh` and `run_D_all.sh` to `TQH-C2_scripts.zip`, completing the released collection code for all four testbeds. Dataset records (pcap, labels, features) are unchanged from v1.2.0. TQH-C2 (TLS + QUIC + HTTP Command-and-Control) is a labeled network-traffic dataset for research on decryption-free detection of encrypted C2 channels. Its defining property is a controlled comparison across encryption profiles: the same MITRE ATT&CK kill-chain is executed identically over four encryption profiles — Sliver over TLS (Testbed A), Merlin over HTTP/3/QUIC (Testbed B), Mythic over HTTP with AES-encrypted body (Testbed C), and Merlin over HTTP/2-over-TLS (Testbed D) — so that the only systematically varied factor is the encryption/transport profile. Testbeds B and D share the same Merlin framework and differ only in transport, forming a controlled pair for isolating the transport. The dataset is organized as a 48-cell grid: 4 encryption profiles × 4 beacon intervals (30/300/1800/3600 s) × 3 jitter levels (0/30/70%), with concurrent benign background traffic in every cell. The release includes raw PCAPs per cell, Zeek logs, per-flow ATT&CK labels (labeled.jsonl), extracted feature tables (Parquet) with JA4/JA4S/JA4H fingerprint columns, sanitized collection/labeling/feature-extraction code for reproducibility, and SHA-256 checksums. See README_v124.md for full documentation.