Processed DARPA TC E3 Provenance Data for "How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection"

This record contains the processed provenance data derived from the DARPA Transparent Computing Engagement 3 (E3) release and used in the paper "How Benchmarks and Evaluation Protocols Shape Conclusions in Provenance-Based Intrusion Detection", accepted at NDSS 2027. The data are provided in two formats: Parquet: Recommended for efficient loading and preservation of column types. CSV: Provided for accessibility and manual inspection. This archive also includes a generated Parquet cache used by the build_graphs tasks to avoid repeatedly scanning the complete event tables during temporal graph construction. License and source data The underlying DARPA Transparent Computing Engagement 3 data were released by DARPA into the public domain. The authors’ original contributions to the processing, selection, organization, and documentation of the materials in this record are licensed under the Creative Commons Attribution 4.0 International license. This license does not restrict reuse of the underlying public-domain data.