Security-Gym Dataset: Labeled Linux Log and eBPF Streams for Continual Learning Research

Ground-truth-labeled Linux server log and eBPF kernel event streams for cybersecurity continual learning research. Contains 11.2M benign events (7.9M server logs + 3.24M eBPF kernel events from 3 servers) mixed with 60K scripted attack events across 5 types (SSH brute force, credential stuffing, port scanning, Log4Shell CVE-2021-44228, Redis CVE-2022-0543) executed against a purpose-built vulnerable server. Includes 4 pre-composed experiment streams from 4.9M events (7-day) to 257.7M events (365-day), ready for use with the security-gym Gymnasium environment. All events are timestamped, parsed, and labeled with ground truth including attack type and MITRE ATT&CK stage. Version note: This version corrects a publication defect in the previous version (DOI 10.5281/zenodo.19482383). The 7-day, 30-day, and 90-day stream archives in that deposit were stale snapshots of an incomplete composition containing 2.9-5.1% of the intended events (140,315 / 1,103,255 / 1,996,031 instead of 4,891,541 / 21,511,208 / 63,212,997). All six archives in this version were verified against the canonical databases by decompression and event count before upload. The 90-day stream was renamed from exp01_90d_v4.db.zst to exp_90d_v4.db.zst for naming consistency. benign_v4.db.zst and campaigns_v2.db.zst are byte-identical to the previous version. Full evidence and remediation record: data/provenance/V4_ARCHIVE_STALENESS_20260726.md in the project repository (github.com/j-klawson/security-gym). Files: DATASET_README.md — Full documentation, schema, quick start, and baselines benign_v4.db.zst — 11,159,241 benign events from 4 personal Linux servers (auth.log, syslog, nginx, eBPF). PII-scrubbed. campaigns_v2.db.zst — 60,468 attack events from 10 campaigns across 5 attack types, with log + eBPF kernel events exp_7d_brute_v4.db.zst — 7-day experiment stream (4,891,541 events, SSH brute force only, 1 campaign/day) exp_30d_heavy_v4.db.zst — 30-day experiment stream (21,511,208 events, all 5 attack types, heavy attack rate) exp_90d_v4.db.zst — 90-day experiment stream (63,212,997 events, all 5 attack types, moderate rate) exp_365d_realistic_v4.db.zst — 365-day experiment stream (257,654,256 events, all 5 attack types, realistic rate) All databases are SQLite with WAL mode. Decompress with zstd -d <file>.zst. Experiment streams are composed from benign + attack data with Poisson-scheduled campaigns and 24.2% eBPF downsampling.