Dataset for "A Knowledge-Based Multi-Agent Framework for Security Control Recommendation"

Dataset for "A Knowledge-Based Multi-Agent Framework for Security Control Recommendation" Authors: Carolina Fernández-Martínez (i2CAT / UPF), Shuaib Siddiqui (i2CAT), Vanesa Daza (UPF) This contains the dataset and its generating code, as used in Section 3 of the article "A Knowledge-Based Multi-Agent Framework for Security Control Recommendation", published in Elsevier's Knowledge-Based Systems in 2026. It provides a security control selection based on NIST SP 800-53 rev5 extended catalogue, Multi-Agent Influence Diagram, Game Theory and No-Regret-based utilities. Besides the dataset itself, the scripts used to correlate and curate this data from InfoSec and academic sources are provided, along with such sources and the links to their original sources. The main repository for the dataset and its code used in Section 3 as well as the code used in Section 4 can be found in GitHub. Section overview This work is structured as follows: .├── dataset_analysis.py├── dataset_contribution.py├── dataset_curation.py├── dataset_helpers.py├── ground_truth│ ├── manual│ │ ├── csftools_stridelm.csv│ │ └── gemini3pro_secdims_impl.csv│ ├── papers│ │ ├── doi_10_1007_impl_control.csv│ │ ├── doi_10_1016_jisa_2025_104056│ │ │ ├── doi_10_1016_jisa_2025_104056_raw.csv│ │ │ └── generation_scripts│ │ │ ├── controls_summary.xlsx│ │ │ ├── controls.xlsx│ │ │ ├── domain.py│ │ │ ├── groups.xlsx│ │ │ ├── main.py│ │ │ ├── patterns.gml│ │ │ ├── README.md│ │ │ ├── requirements.txt│ │ │ ├── software.xlsx│ │ │ ├── technique.xlsx│ │ │ ├── ttp-control.xlsx│ │ │ ├── ttps.xlsx│ │ │ └── utils.py│ │ ├── doi_10_1093_cybsec_tyaf020_mapping.csv│ │ └── doi_10_1093_cybsec_tyaf020_scores.csv│ └── standards│ ├── Cybersecurity_Framework_v2-0_Concept_Crosswalk_800-53_5_2_0_draft.csv│ └── NIST_SP-800-53_rev5_catalog.json├── output│ └── dataset_curated.csv└── README.md The ground truth contains both manual mappings, academic papers and InfoSec standardised data: ground_truth: hosts sources used for the data curation. manual: data extracted manually, whether directly checking sources or iteratively requested to an LLM. csftools_stridelm.csv: manually extracted data from CSF tools indicating the contribution of each control subfamily to mitigate a given STRIDE-LM threat. Each value follows a comma-separated format (e.g. "0,2,3,4,8,12") or use -1 if there is no contribution. gemini3pro_secdims_impl.csv: LLM-parsed data from CSF tools, requesting Gemini 3 Pro to extract data on the security control subfamilies: (1) whether these can be SW-implementable, (2) their coverage to the different Security Dimensions and (3) a text-based justification regarding such coverage. papers: doi_10_1007_impl_control.csv: dataset post-processed from that provided by paper with DOI:10.1007/s10664-025-10649-7. Basically, this CSV assigns numeric codes to the column "Related to implementation-level feature? (yes/no)" from the tab "SP800 53 rev. 3 (technical cont" of the "2) Systematic Review - Security Standards.xlsx" file in that dataset. This can tabke the following values: 0 (if not SW-implementable), 1 (if SW-implementable), -1 (if undefined in the original dataset) or -2 (if the security control subfamily is not even present in the original dataset). doi_10_1016_jisa_2025_104056: dataset provided by paper with DOI:10.1016/j.jisa.2025.104056. generation_scripts: minor modifications to the original scripts to generate their dataset. See README.md inside. doi_10_1093_cybsec_tyaf020_mapping.csv: dataset post-processed from that provided by paper with DOI:10.1093/cybsec/tyaf020. This CSV contains the table from "Appendix A" of the "Appendix A - D.docx". doi_10_1093_cybsec_tyaf020_scores.csv: dataset post-processed from that provided by paper with DOI:10.1093/cybsec/tyaf020. This CSV contains the table from "Appendix C" of the "Appendix A - D.docx". standards: Cybersecurity_Framework_v2-0_Concept_Crosswalk_800-53_5_2_0_draft.csv: NIST resource that maps CSF 2.0 subcategories to security control subfamilies from SP 800-53 rev5. NIST_SP-800-53_rev5_catalog.json: NIST SP 800-53 rev5 catalogue of security control subfamilies as obtained from the full catalogue in JSON format. The output folder contains the generated, curated dataset by default. Upon running the scripts below, more files will follow. Generating the dataset and ancillary files 1. Curated dataset The curated dataset is generated under "output/dataset_curated.csv" after running the following script.This file is required for the other scripts. python3 dataset_curation.py 2. Summaries, statistics and figures The analysis on the dataset extracts statistics (in .csv and .tex files) and generates figures (in .pdf and .png) from the dataset: output dataset_curated_ciatunp.{csv,tex}: table with number of control families contribute to each Security Dimension. dataset_curated_stridelm.{csv,tex}: table with number of control families contribute to each STRIDE-LM threat. dataset_curated_score_summary.{csv,tex}: statistics for minimum, average, mode, maximum, standard deviation and inter-quartile range per control family. figures: dataset_curated_ciatunp_contribution_implementable_cats_ids.{pdf,png}: distribution of the contribution of SW-implementable control families (axis Z) and subfamilies (axis Y) towards security dimensions (axis X). dataset_curated_ciatunp_contribution_total_cats_ids.{pdf,png}: distribution of the contribution of all kinds of control families (axis Z) and sub families (axis Y) towards security dimensions (axis X). dataset_curated_score_contribution_total_cats_ids.{pdf,png}: distribution of the score (axis X, in deciles) for all kinds of control families (axis Z) and subfamilies (axis Y). dataset_curated_stridelm_contribution_implementable_cats_ids.{pdf,png}: distribution of the contribution of SW-implementable control families (axis Z) and subfamilies (axis Y) towards mitigating types of STRIDE-LM threats (axis X). dataset_curated_stridelm_contribution_total_cats_ids.{pdf,png}: distribution of the contribution of all kinds of control families (axis Z) and subfamilies (axis Y) towards mitigating types of STRIDE-LM threats (axis X). python3 dataset_analysis.py Besides this, the following script quantifies the contribution of the academic datasets and sources used during the process, generating these files: output dataset_curated_score_summary_contribution_ds_imp_{all,top}.tex: table comparing the score of each of the top SW-implementable control subfamilies across the curated dataset ("Total" column) and the datasets used from academic papers (other columns). dataset_curated_score_summary_contribution_ds_tot_{all,top}.tex: table comparing the score of each of the top control subfamilies of all kinds across the curated dataset ("Total" column) and the datasets used from academic papers (other columns). dataset_curated_score_stats_imp_{all,top}.tex: table with statistics on the amount and average score for both all and top SW-implementable control subfamilies. dataset_curated_score_stats_mt0_imp_{all,top}.tex: table with statistics on the amount and average score for both all and the top SW-implementable control subfamilies whose score is more than 0. dataset_curated_score_stats_tot_{all,top}.tex: table with statistics on the amount and average score for both all and top control subfamilies of all kinds. dataset_curated_score_stats_mt0_tot_{all,top}.tex: table with statistics on the amount and average score for both all and the top control subfamilies of all kinds whose score is more than 0. dataset_curated_summary_{all,top}.xlsx: sheet files with multiple tabs to determine grouping and statistical data, such as the score of the top security control subfamilies and the score of their counterparts in the used datasets. Tabs "contribution_ds_tot" and "contribution_ds_imp" are the most relevant, performing these calculation for all kinds and SW-implementable security control subfamilies, respectively. In all cases, the first file considers all control subfamilies, whereas the second considers the top 20 ones. Note that this script has a specific pre-requirement that must be installed to generate the excel file. sudo apt install python3-openpyxlpython3 dataset_contribution.py Licence This work is dual-licenced according to the type of resource: Datasets: CC BY-NC 4.0 Code: GNU AGPL 3.0 Funding This work was supported by the grants COALESCE-6G PID2024-163028OB-I00, funded by MICIU/AEI/10.13039/501100011033/FEDER, EU; and AEI-PID2021-128521OB-I00, funded by the Spanish Recovery, Transformation and Resilience Plan through the European Union (Next Generation).