UC2 - Cybersecurity Situation Awareness

Cyber attackers evolve rapidly, outpacing traditional SIEM and IDS tools. AI aids threat classification but lacks transparency and handles data scarcity poorly. This dataset addresses key challenges in attacker behavior analysis: Datasets are outdated or limited; we include synthetic data from simulated attacks. Automation limits: ML/DL works on subsets but needs parameterization. Context gaps: IOCs change easily; focus on persistent attacker footprints. Tool limitations: SIEMs are costly and expertise-heavy. Time criticality: Delays risk business assets. Objectives and Methods: Synthetic data mimicking traffic/logs. Multimodal threat detection in realistic environments. Behavior-based classification with concept-based explainability for operator awareness. Supports a SIEM demonstrator using ExtremeXP framework for affordable, MSSP-independent defense. Ideal for SMEs training transparent AI models. Part of the ExtremeXP project, co-funded by the European Union Horizon Program HORIZON CL4-2022-DATA-01-01 under Grant Agreement No. 101093164. Project website: https://extremexp.eu/