DEDALE: Dataset for Evaluating Detection of APT among Logs and Events

DEDALE is a dataset focused on the detection of APT attacks. It contains both network and host data from the different computers in the emulated IT system. The dataset lasts 4 weeks to reproduce the long lasting characteristics of such attack type. The first two weeks contain only benign activity. From the beginning of the third week, an APT-like attack starts and lasts 8 days. The attack scenario is rather stealthier and there are no brute force or noisy attack types. The dataset is reproducible. All the scripts and configuration files are available here: https://gitlab.inria.fr/mlanvin/rescousse More details on the dataset are given here: https://dedale.inria.fr IMPORTANT NOTE Some zip containing pcap files are corrupted for now. We are trying to resolve the issue as soon as possible. Here is the list of corrupted files: green_internal_week1.zip green_internal_week2.zip green_internal_week3.zip green_internal_week4.zip orange_dmz_week3.zip router1_green_week3.zip router1_orange_week3.zip router1_red_week1.zip router1_red_week2.zip router1_red_week3.zip