Cloud Supply-Chain Dataset

This dataset contains real-time, multi-source cloud supply-chain telemetry collected from a live, production-scale multi-cloud environment spanning August 2021 to September 2025. The data was recorded from distributed compute nodes, CI/CD pipelines, container registries, API gateways, identity providers, and security monitoring subsystems operating across hybrid cloud deployments. The dataset represents authentic operational behaviour, including workload fluctuations, dependency updates, routing shifts, and security-driven events that naturally occur in modern software supply-chain ecosystems. All telemetry is sampled at a fixed 15-minute interval, ensuring consistent temporal resolution for anomaly detection, provenance validation, and federated learning research. The dataset captures both normal operational patterns and real-world attack scenarios, including data-injection attempts, routing manipulation, API misuse, DoS pressure, credential abuse, and exfiltration behaviour. The dataset includes the following feature categories: 1. Cloud Infrastructure Metrics Cloud Provider, Region, Service Type — operational metadata identifying the execution environment. CPU Usage, Memory Usage, Disk I/O, Network In/Out — continuous measurements reflecting workload intensity, resource stress, and system anomalies. Baseline Deviation Score — deviation from long-term performance baselines computed inside the monitoring pipeline. 2. Dependency and Software Integrity Indicators Dependency Depth, Version Mismatch Count — structural and update-related characteristics of software components. Checksum Deviation, Unsigned Binary Count — integrity and trust indicators relevant to detecting tampering or poisoned dependencies. Repository Trust Score — confidence signal derived from release history and registry metadata. External Script Execution — event flag indicating unverified or unusual script activations. 3. Network and API Behaviour Inbound/Outbound Connection Count — network load and communication patterns. Failed or Unauthorized API Calls — signs of misuse, credential replay, or enumeration attempts. Encrypted Traffic Ratio — proportion of encrypted flows over total observed traffic. 4. Access and Identity Signals Failed Login Attempts, Privilege Escalation Flag, Access Token Reuse — identity and authentication-related indicators used to detect abuse or lateral movement. 5. Process and Execution Activity Process Creation Count, Dynamic Library Loads, Code Injection Flag — runtime behaviour that reflects execution anomalies or malware-like patterns. Malicious Signature Match — detection outcomes from integrated security engines. 6. Event Logs and Policy Compliance Error Log Count, Policy Breach Count, Unauthorized Access Events — system-level and administrative event markers. 7. Threat Intelligence and Incident Indicators Threat Intel Hits, Security Alerts, Critical Alert Ratio — threat-feed correlation and severity assessment. Incident Response Time — operational responsiveness under different incident conditions. 8. Temporal and Statistical Properties Burstiness Index, Change Rate Per Hour — temporal volatility descriptors suited for detecting drift, unusual bursts, or stealthy anomalies. 9. Labels and Target Variables Attack_Type — one of six real attack categories:Normal Operation, Data Injection, Routing Manipulation, DoS, Credential Abuse, Data Exfiltration. Attack_Label — binary (0 = normal, 1 = attack). Severity Score — real-time severity estimation derived from security alerts and behavioral deviation. Data Integrity and Preprocessing Before release, the dataset underwent a comprehensive quality-assurance pipeline that included: Timestamp normalization and deduplication Removal of corrupted or partially logged records Standardization of categorical fields Scaling of continuous features using empirical operating ranges Preservation of temporal ordering and original heterogeneity本数据集包含2021年8月至2025年9月期间，从处于生产运行状态的规模化多云环境中采集的实时多源云供应链遥测数据。该数据采集自混合云部署环境中的分布式计算节点、持续集成/持续交付（CI/CD）流水线、容器镜像仓库、API网关、身份提供商以及安全监控子系统。 本数据集真实反映了现代软件供应链生态系统中自然产生的各类运行行为，包括工作负载波动、依赖项更新、路由变更以及安全相关事件。 所有遥测数据均以固定15分钟的间隔进行采样，确保了一致的时间分辨率，可用于异常检测、溯源验证以及联邦学习（Federated Learning）相关研究。本数据集同时包含正常运行模式与真实攻击场景数据，涵盖数据注入尝试、路由篡改、API滥用、拒绝服务（DoS）攻击压力、凭据滥用以及数据泄露行为等类型。 本数据集包含以下特征类别： 1. 云基础设施指标 - 云服务商、区域、服务类型：用于标识执行环境的运行元数据。 - CPU使用率、内存使用率、磁盘I/O、网络入/出流量：反映工作负载强度、资源压力与系统异常的连续测量值。 - 基准偏差得分：监控流水线中计算得出的与长期性能基准的偏差值。 2. 依赖项与软件完整性指标 - 依赖项深度、版本不匹配计数：软件组件的结构与更新相关特征。 - 校验和偏差、未签名二进制文件计数：用于检测篡改或恶意依赖项的完整性与信任度指标。 - 仓库信任得分：基于发布历史与仓库元数据得出的置信度信号。 - 外部脚本执行：用于标识未验证或异常脚本激活的事件标记。 3. 网络与API行为 - 入站/出站连接数：反映网络负载与通信模式的指标。 - 失败或未授权的API调用：标识滥用、凭据重放或枚举尝试的迹象。 - 加密流量占比：加密流量在总观测流量中的占比。 4. 访问与身份信号 - 失败登录尝试次数、权限提升标记、访问令牌复用：用于检测滥用或横向移动的身份与认证相关指标。 5. 进程与执行活动 - 进程创建次数、动态库加载次数、代码注入标记：反映执行异常或恶意软件类行为的运行时特征。 - 恶意特征匹配：集成安全引擎的检测结果。 6. 事件日志与策略合规性 - 错误日志数、策略违规次数、未授权访问事件：系统级与管理级事件标记。 7. 威胁情报与事件指标 - 威胁情报命中数、安全警报数、严重警报占比：威胁源关联与严重性评估指标。 - 事件响应时间：不同事件场景下的运营响应速度。 8. 时间与统计属性 - 突发性指数、每小时变化率：用于检测漂移、异常突发或隐秘异常的时间波动性描述符。 9. 标签与目标变量 - 攻击类型（Attack_Type）：共6类真实攻击类别，包括正常运行、数据注入、路由篡改、拒绝服务（DoS）、凭据滥用、数据泄露。 - 攻击标签（Attack_Label）：二分类变量（0代表正常，1代表攻击）。 - 严重性得分（Severity Score）：基于安全警报与行为偏差得出的实时严重性评估值。 数据完整性与预处理 在发布前，本数据集经过了涵盖以下环节的全面质量保证流程： - 时间戳标准化与去重 - 移除损坏或记录不完整的条目 - 分类字段标准化 - 基于经验运行范围对连续特征进行归一化 - 保留时间顺序与原始异质性