High-quality data is required to design and evaluate Intrusion Detection Systems (IDSes). However, the currently publicly available datasets are often considered unrealistic and unrepresentative of advanced attacks. Moreover, many errors were recently identified in some network intrusion detection datasets. Even well-known and widely used datasets such as CICIDS2017 have recently been criticized for their poor quality. Another issue with those datasets is that they tend to become quickly outdated. In this work, we propose and share a new testbed named RESCOUSSE and a new dataset named DEDALE. RESCOUSSE can be used to generate new datasets; it is based on an existing testbed that we improved deeply. In particular, we fix the errors and biases we identified in the currently available datasets. DEDALE is a new dataset generated with RESCOUSSE. The dataset lasts one month: the first two weeks contain only benign activities, a discrete APT attack is spread over eight days from the third week, and the remaining six days are free of attacks and can be used to evaluate the false positive rate. The dataset contains both network and system logs, which allows the design and evaluation of Host and Network IDSes, as well as correlation techniques. We label both the system and network logs and check that no obvious biases exist in the network logs. Since RESCOUSSE is open source, it allows other researchers to replicate DEDALE and correct some errors that they may find if needed.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Get Out of DEDALE with RESCOUSSE: A New Dataset and Testbed for Evaluating the Detection of APT Attacks Among Network and System Logs

  • Maxime Lanvin,
  • Frédéric Majorczyk

摘要

High-quality data is required to design and evaluate Intrusion Detection Systems (IDSes). However, the currently publicly available datasets are often considered unrealistic and unrepresentative of advanced attacks. Moreover, many errors were recently identified in some network intrusion detection datasets. Even well-known and widely used datasets such as CICIDS2017 have recently been criticized for their poor quality. Another issue with those datasets is that they tend to become quickly outdated. In this work, we propose and share a new testbed named RESCOUSSE and a new dataset named DEDALE. RESCOUSSE can be used to generate new datasets; it is based on an existing testbed that we improved deeply. In particular, we fix the errors and biases we identified in the currently available datasets. DEDALE is a new dataset generated with RESCOUSSE. The dataset lasts one month: the first two weeks contain only benign activities, a discrete APT attack is spread over eight days from the third week, and the remaining six days are free of attacks and can be used to evaluate the false positive rate. The dataset contains both network and system logs, which allows the design and evaluation of Host and Network IDSes, as well as correlation techniques. We label both the system and network logs and check that no obvious biases exist in the network logs. Since RESCOUSSE is open source, it allows other researchers to replicate DEDALE and correct some errors that they may find if needed.