Traffic and Log Data Captured During a Cyber Defense Exercise

<p>This dataset&nbsp;was acquired during Cyber Czech &ndash; a hands-on cyber defense exercise (Red Team/Blue Team) held in March 2019 at Masaryk University, Brno, Czech Republic. Network traffic flows and a high variety of event logs were captured in an <em>exercise network</em> deployed in the KYPO Cyber Range Platform.</p> <p><strong>Contents</strong></p> <p>The dataset covers two distinct time intervals, which correspond to the official schedule of the exercise. The timestamps provided below are in the ISO 8601 date format.&nbsp;</p> <ul> <li>Day 1, March 19, 2019&nbsp; <ul> <li>Start: 2019-03-19T11:00:00.000000+01:00&nbsp;</li> <li>End: 2019-03-19T18:00:00.000000+01:00&nbsp;</li> </ul> </li> <li>Day 2, March 20, 2019&nbsp; <ul> <li>Start: 2019-03-20T08:00:00.000000+01:00&nbsp;</li> <li>End: 2019-03-20T15:30:00.000000+01:00&nbsp;</li> </ul> </li> </ul> <p>The captured and collected data were normalized into three distinct event types and they are stored as&nbsp;structured JSON. The data are sorted by a timestamp, which represents the time they were observed. Each event type includes a raw payload ready for further processing and analysis. The description of the respective event types and the corresponding data files follows. &nbsp;</p> <ul> <li><em>cz.muni.csirt.IpfixEntry.tgz</em> &ndash; an archive of IPFIX traffic flows enriched with an additional payload of parsed application protocols in raw JSON.&nbsp;</li> <li><em>cz.muni.csirt.SyslogEntry.tgz</em> &ndash; an archive of Linux Syslog entries with the payload of corresponding text-based log messages.&nbsp;</li> <li><em>cz.muni.csirt.WinlogEntry.tgz</em> &ndash; an archive of Windows Event Log entries with the payload of original events in raw XML.&nbsp;</li> </ul> <p>Each archive listed above includes a directory of the same name with the following four files, ready to be processed.&nbsp;</p> <ul> <li><em>data.json.gz </em>&ndash; the actual data entries in a single gzipped JSON file.&nbsp;</li> <li><em>dictionary.yml</em> &ndash; data dictionary for the entries.&nbsp;</li> <li><em>schema.ddl</em> &ndash; data schema for Apache Spark analytics engine.&nbsp;</li> <li><em>schema.jsch</em> &ndash; JSON schema for the entries.&nbsp;</li> </ul> <p>Finally, the exercise network topology is described in a machine-readable NetJSON format and it is a part of a set of auxiliary files archive &ndash; <em>auxiliary-material.tgz</em> &ndash; which includes the following.&nbsp;</p> <ul> <li><em>global-gateway-config.json</em> &ndash; the network configuration of the global gateway in the NetJSON format.&nbsp;</li> <li><em>global-gateway-routing.json</em> &ndash; the routing configuration of the global gateway in the NetJSON format.&nbsp;</li> <li><em>redteam-attack-schedule.{csv,odt}</em> &ndash; the schedule of the Red Team attacks in CSV and ODT format. Source for Table 2.&nbsp;</li> <li><em>redteam-reserved-ip-ranges.{csv,odt}</em> &ndash; the list of IP segments reserved for the Red Team in CSV and ODT format. Source for Table 1. &nbsp;</li> <li><em>topology.{json,pdf,png}</em> &ndash; the topology of the complete Cyber Czech exercise network in the NetJSON, PDF and PNG format.&nbsp;</li> <li><em>topology-small.{pdf,png}</em> &ndash; simplified topology in the PDF and PNG format. Source for Figure 1.&nbsp;</li> </ul> <p>&nbsp;</p>