Find research datasets worth reusing

opencc-by-nc-sa-4.0Dec 2021View details →

Kyoushi Log Data Set

This repository contains synthetic log data suitable for evaluation of intrusion detection systems. The logs were collected from a testbed that was built at the Austrian Institute of Technology (AIT) following the approaches by [1], [2], and [3]. Please refer to these papers for more detailed information on the dataset and cite them if the data is used for academic publications. Other than the related <a href="https://zenodo.org/record/4264796">AIT-LDSv1.1</a>, this dataset involves a more complex network structure, makes use of a different attack scenario, and collects log data from multiple hosts in the network. In brief, the testbed simulates a small enterprise network including mail server, file share, WordPress server, VPN, firewall, etc. Normal user behavior is simulated to generate background noise. After some days, two attack scenarios are launched against the network. Note that the <a href="https://zenodo.org/record/5789064">AIT-LDSv2.0</a> extends this dataset with additional attack cases and variations of attack parameters. The archives have the following structure. The gather directory contains the raw log data from each host in the network, as well as their system configurations. The labels directory contains the ground truth for those log files that are labeled. The processing directory contains configurations for the labeling procedure and the rules directory contains the labeling rules. Labeling of events that are related to the attacks is carried out with the <a href="https://github.com/ait-aecid/kyoushi-dataset">Kyoushi Labeling Framework</a>. Each dataset contains traces of a specific attack scenario: <ul> <li>Scenario 1 (see gather/attacker_0/logs/sm.log for detailed attack log): <ul> <li>nmap scan</li> <li>WPScan</li> <li>dirb scan</li> <li>webshell upload through wpDiscuz exploit (CVE-2020-24186)</li> <li>privilege escalation</li> </ul> </li> <li>Scenario 2 (see gather/attacker_0/logs/dnsteal.log for detailed attack log): <ul> <li>DNSteal data exfiltration</li> </ul> </li> </ul> The log data collected from the servers includes <ul> <li>Apache access and error logs (labeled)</li> <li>audit logs (labeled)</li> <li>auth logs (labeled)</li> <li>VPN logs (labeled)</li> <li>DNS logs (labeled)</li> <li>syslog</li> <li>suricata logs</li> <li>exim logs</li> <li>horde logs</li> <li>mail logs</li> </ul> Note that only log files from affected servers are labeled. Label files and the directories in which they are located have the same name as their corresponding log file in the gather directory. Labels are in JSON format and comprise the following attributes: line (number of line in corresponding log file), labels (list of labels assigned to that log line), rules (names of labeling rules matching that log line). Note that not all attack traces are labeled in all log files; please refer to the labeling rules in case that some labels are not clear. Acknowledgements: Partially funded by the FFG projects INDICAETING (868306) and DECEPT (873980), and the EU project GUARD (833456). If you use the dataset, please cite the following publications: [1] <a href="https://ieeexplore.ieee.org/document/9262078">M. Landauer, F. Skopik, M. Wurzenberger, W. Hotwagner and A. Rauber, "Have it Your Way: Generating Customized Log Datasets With a Model-Driven Simulation Testbed," in IEEE Transactions on Reliability, vol. 70, no. 1, pp. 402-415, March 2021, doi: 10.1109/TR.2020.3031317.</a> [2] <a href="https://dl.acm.org/doi/10.1145/3510547.3517924">M. Landauer, M. Frank, F. Skopik, W. Hotwagner, M. Wurzenberger, and A. Rauber, "A Framework for Automatic Labeling of Log Datasets from Model-driven Testbeds for HIDS Evaluation". ACM Workshop on Secure and Trustworthy Cyber-Physical Systems (ACM SaT-CPS 2022), April 27, 2022, Baltimore, MD, USA. ACM.</a> [3] <a href="https://repositum.tuwien.at/handle/20.500.12708/17804">M. Frank, "Quality improvement of labels for model-driven benchmark data generation for intrusion detection systems", Master's Thesis, Vienna University of Technology, 2021. </a>

opencc-by-4.0Dec 2021View details →

Data set on the Higher-Education Pact in Germany, 2007 - 2020

\begin{tabular}{@{\extracolsep{5pt}} ll} \\[-1.8ex]\hline \hline \\[-1.8ex] Variable & Description \\ \hline \\[-1.8ex] HASC\_1 & State name \\ Nb & State number \\ ccluster & 1 = Western Territorial State, 2 = Eastern State, \\ & 3 = City State \\ Ltype & 1 = Western Territorial State, 2 = Eastern State. \\ ZstA.0717 & Additional entrants (sum 2007 – 2017) to 2005-value \\ zStA.U0717 & Additional entrants a traditional universities \\ zStA.F0717 & Additional entrants a UAS \\ zStA.Fratio0717 & Share of entrants at UAS to total entrants. \\ Ant.StA05 & Enrollment rate 2005 \\ Ant.StA18 & Enrollment rate 2018 \\ RelStVZA05 & Adivsing relationship 2005 \\ RelStVZA18 & Adivsing relationship 2018 \\ GW05 & Share of graduates in the humanities 2005 \\ GW18 & Share of graduates in the humanities 2018 \\ NaWi05 & share of graduates in the natural sciences 2005 \\ NaWi18 & share of graduates in the natural sciences 2018 \\ SRW05 & share of graduates in the social sciences 2005 \\ SRW18 & share of graduates in the social sciences 2018 \\ WandS05 & migration balance 2005 \\ WandS18 & migration balance 2017 \\ \hline \\[-1.8ex] BUMI0717 & federal funds received by the HSP-programme \\ & (sum 2007 – 2018) \\ BUMIzStA0717 & BUMI0717 per additional entrant \\ Einw18 & population size 2018 \\ BUMI.GWP16 & federal funds covering all federal grants-in-aid \\ & in the higher-education field \\ STUD18 & number of students in 2018 \\ zstaeinw & additional entrants per capita \\ deltaantsta & relative change in the enrollment rate \\ deltabetrrel & relative change in the adising relationship \\ deltagw & relative change in the humanities \\ deltanw & relative change in the natural sciences \\ deltasrw & relative change in the social sciences \\ bumieinw & Federal funds (HSP) per capita \\ bumigwp16einw & Overall federal funds per capita \\ bumistud & Federal funds (HSP) per student \\ Prof05 & Number of professors 2005 \\ Prof17 & Number of professors 2017 \\ \hline \\[-1.8ex] \end{tabular}

Data set: "North Atlantic cooling is slowing down mass loss of Icelandic glaciers"

This data set includes the materials required to reproduce the figures and tables presented in the study: "North Atlantic cooling is slowing down mass loss of Icelandic glaciers". The data consist of: 1. Maps of annual surface mass balance (SMB) of Icelandic glaciers and ice caps (ICL) from RACMO2.3 at 500 m spatial resolution in NetCDF format. <ul> <li>smb_rec.1958-2019.RACMO2.3-ERA.ICL-0.5km.YY.nc: annual cumulative SMB of Icelandic glaciers and ice caps (kg m-2 or mm w.e. per year) from RACMO2.3 forced by ERA reanalyses for the period 1958-2019, and further statistically downscaled to 500 m spatial resolution. Forcing includes ERA-40 (1958-1978), ERA-Interim (1979-2018) and ERA5 (2019) reanalyses.</li> <li>smb_rec.1958-2099.RACMO2.3-CESM2-SSP85.ICL-0.5km.YY.nc: annual cumulative SMB of Icelandic glaciers and ice caps (kg m-2 or mm w.e. per year) from RACMO2.3 forced by CESM2 for the historical period 1958-2014 and by CESM2 under a high-end warming scenario SSP5-8.5 for the period 2015-2099, further statistically downscaled to 500 m spatial resolution.</li> <li>Topo_icemask_lsm_lon_lat_ICL-0.5km.nc: mask file including an ice mask, land/sea mask and surface topography derived from the ArcticDEM, and longitude/latitude coordinates on the 500 m grid.</li> </ul> NB: the NetCDF files above use a Polar Stereographic North (EPSG:3413) projection with a horizontal resolution of 500 m x 500 m. The reference point is located at 45ºW longitude and 70ºN latitude. 2. Time series of annual ICL-integrated SMB components (Gigatons or Gt per year), annual mean 2 m air temperature above Icelandic glaciers and ice caps (T2m; K), annual mean sea surface temperature (SST) in the Northern Blue Blob. These time series are available in ASCII format for the RACMO2.3 simulation forced by ERA reanalyses (1958-2019) and the RACMO2.3 projection forced by CESM2 under a high-end warming scenario SSP5-8.5 (1958-2099). RACMO2.3-ERA <ul> <li>SMB-components-RACMO2.3-ERA-1958-2019.txt: time series of annual integrated SMB, snowfall, rainfall, runoff, total melt, refreezing and retention (Gt per year) from the ERA-forced RACMO2.3 simulation (1958-2019).</li> <li>T2m-glacier-RACMO2.3-ERA-1958-2019.txt: time series of annual mean glacier T2m and anomalies relative to the period 1958-1994 (K) from the ERA-forced RACMO2.3 simulation (1958-2019).</li> <li>SST-Northern-Blue-Blob-RACMO2.3-ERA-1958-2019.txt: time series of annual mean Northern Blue Blob SST and anomalies relative to the period 1958-1994 (K) derived from the ERA reanalyses (1958-2019).The reanalyses include ERA-40 (1958-1978), ERA-Interim (1979-2018) and ERA5 (2019).</li> </ul> RACMO2.3-CESM2 <ul> <li>SMB-components-RACMO2.3-CESM2-SSP85-1958-2099.txt: time series of annual integrated SMB, snowfall, rainfall, runoff, total melt, refreezing and retention (Gt per year) from the CESM2-forced RACMO2.3 projection under a SSP5-8.5 scenario (1958-2099).</li> <li>T2m-glacier-RACMO2.3-CESM2-SSP85-1958-2099.txt: time series of annual mean glacier T2m and anomalies relative to the period 1958-1994 (K) from the CESM2-forced RACMO2.3 projection under a SSP5-8.5 scenario (1958-2099).</li> <li>SST-Northern-Blue-Blob-RACMO2.3-CESM2-SSP85-1958-2099.txt: time series of annual mean Northern Blue Blob SST and anomalies relative to the period 1958-1994 (K) derived from the CESM2 projection under a SSP5-8.5 scenario (1958-2099).</li> </ul> 3. Time series of monthly ICL-integrated SMB (Gt per month) for the period 1958-2099.  <ul> <li>SMB-monthly-RACMO2.3-1958-2099.txt: time series of monthly integrated SMB (Gt per month) combining RACMO2.3-ERA (January 1958 - December 2019) with RACMO2.3-CESM2 under a SSP5-8.5 scenario (January 2020 - December 2099) at 500 m horizontal resolution.</li> </ul> The daily downscaled SMB data sets from the ERA-forced RACMO2.3 simulation and the CESM2-forced RACMO2.3 projection under a SSP5-8.5 scenario are freely available from the authors upon request and without conditions (contact: b.p.y.noel@uu.nl). Besides SMB, the data sets include daily total precipitation (snow and rain), snowfall, total melt (snow and ice), runoff, refreezing and retention, total sublimation (surface and drifting snow), snow drift erosion, as well as 2 m air temperature at 500 m horizontal resolution.  Abstract: Icelandic glaciers have been losing mass since the Little Ice Age in the mid-to-late 1800s, with higher mass loss rates in the early 21st century, followed by a slowdown since 2011. As of yet, it remains unclear whether this mass loss slowdown will persist in the future. By reconstructing the contemporary (1958-2019) surface mass balance of Icelandic glaciers, we show that the post-2011 mass loss slowdown coincides with the development of the Blue Blob, an area of regional cooling in the North Atlantic Ocean to the south of Greenland. This regional cooling signal mitigates atmospheric warming in Iceland since 2011, in turn decreasing glacier mass loss through reduced meltwater runoff. In a future high-end warming scenario, North Atlantic cooling is projected to mitigate mass loss of Icelandic glaciers until the mid-2050s. High mass loss rates resume thereafter as the regional cooling signal weakens.

opencc-by-4.0Dec 2020View details →

Quantum stochastic resonance of individual Fe atoms. Open data sets.

Data sets for publication: Quantum Stochastic Resonance of individual Fe atoms Max Hänze, Gregory McMurtrie, Susanne Baumann, Luigi Malavolti, Susan N. Coppersmith, Sebastian Loth

Application of Mass Multivariate Analysis on Neuroimaging Data Sets for Precision Diagnosis of Depression: Data and code

In the archive are the datasets and code used to create the results in article "Application of Mass Multivariate Analysis on Neuroimaging Data Sets fo Precision Diagnosis of Depression". The methods is based on the Multivariate Linear toolbox mad F. Kherif’s lab and available on GitHub. <a href="https://github.com/LREN-CHUV/MLM">https://github.com/LREN-CHUV/MLM</a>.    A total of 44 patients with a current psychotic (n=19) or depressive (n=25) episode were analyzed by MLM (details can be found in the article itself) utilizing resting sate fMRI, tasks fMRI, and anatomical T1w images.  The data results are provided in MATLAB format, in a matrix called MLM.mat. The matrix includes the canonical variables for each of the three imaging modalities, chi-square statistics, and p-values for each brain region.  Additionally, we provided a function MLM_plot_fun that allows mapping the statistics results to a canonical three-dimensional brain as per the article.

opencc-by-4.0Aug 2021View details →

Cryo 4D-STEM Data Set: isotactic Polypropylene/ Ethylene-Octene Copolymer Interface

Sample: Data is taken of a iPP/EO (DOW ENGAGETM 8540) blend interface. The blend was cryo-microtomed to a nominal slice thickness of 50nm. Transmission electron microscopy was performed using the TEAM I microscope at the Lawrence Berkeley National Laboratory using a Gatan K3 detector and Continuum spectrometer. Data Set 12: This work was performed at -185°C under liquid nitrogen cooling with a 300kV accelerating voltage and a semi-convergence angle of 0.5mrad which yielded a diffraction-limited probe with a full-width half-max of 2nm. The beam was rastered with a step size of 5nm over a 505 × 500nm2 field of view. The electron dose per sample area over the entire scan is 20 e-/Å2. However, 4D-STEM is a converged probe technique in which ~80% of the beam fluence is contained within 1.74 × the FWHM of the probe. Using 1.74 × the FWHM of the probe as the diameter to calculate the irradiated sample area yields a dose of 60 e-/Å2 for this data set.  Gold nanoparticles were used to calibrate the reciprocal space pixel size as well as measure the elliptical distortion present in the data set. Data Set 18: This data was taken at -185°C under liquid nitrogen cooling with a 300kV accelerating voltage and a semi-convergence angle of 0.14mrad which yielded a diffraction-limited probe with a full-width half-max of 10nm. The beam was rastered with a step size of 10nm over a 1.4 × 1.4μm2 field of view. The electron dose per sample area over the entire scan was 0.50 e-/Å2 while the dose per probe area was 0.64 e-/Å2. Gold nanoparticles were used to calibrate the reciprocal space pixel size. Data Set 19: This data was taken over the exact same area as Data Set 18 to give a comparison under larger dose accumulation. The data was obtained with the exact same parameters and under the same experimental conditions as Data Set 18.

Data set for "Relaxation time asymmetry in stator dynamics of the bacterial flagellar motor"

Zipped file containing three python Dictionaries pertaining to the Science Advances publication "Relaxation time asymmetry in stator dynamics of the bacterial flagellar motor," authored by  Ruben Perez-Carrasco, María-José Franco-Oñate, Jean-Charles Walter, Jérôme Dorignac, Fred Geniet, John Palmeri, Andrea Parmeggiani, Nils-Ole Walliser, and Ashley L Nord.

Data set: Land use and land cover change in a tropical mountain landscape of northern Ecuador: altitudinal patterns and driving forces

Tropical mountain ecosystems are threatened by land use pressures, compromising their capacity to provide multiple ecosystem services. The analysis of landscape changes and their proximate driving forces is often qualitative and sectorial oriented, although local patterns and numerous interactions among socio-economic, demographic, and biophysical factors shape these socio-ecological systems. We characterized land use land cover (LULC) dynamics using Markov-chain probabilities by elevation and geographic settings and then, implementing the DPSIR holistic approach, we integrated them with a variety of freely available geospatial and temporal data into a Generalized Additive Model (GAM) to uncover the factors driving such landscape dynamics in a sensitive region of the northern Ecuadorian Andes. Our results demonstrated a dynamic and clear geographical pattern of distinct LULC transitions through time, explained by different combination of socio-economic factors, demographic and infrastructure variables and environmental parameters, from which topographic variables were the main drivers of change in this landscape. We found that deforestation of remnant native forest and agricultural expansion still occur in higher elevations, while land conversion toward anthropic environments, particularly significant expansion of floriculture and urban areas were observed in lower elevations to the east of the studied territory. Our findings also revealed an unexpected stability trend of paramo and a successional recovery of previous agricultural land to the west and center of the territory, which could be explained by agricultural land abandonment. However, the very low probability of persistence of montane forests found overall, highlights the greater threat to permanently lose the already vulnerable mountain native biodiversity. The methodological approach and our findings, demonstrating dynamic patterns through space and time and their explanatory drivers, could help local authorities and stakeholder to improve sustainably resource land management in vulnerable landscapes such as the tropical Andes in northern Ecuador.

The Data Set for the Publication "Laboratory Testing of Small Scale Solar Facade Module with Phase Change Material and Adjustable Insulation Layer"

In the scope of the ambitious EU goals of carbon neutrality in 2050, building energy efficiency is one of the crucial segments. To ensure a faster energy transition process, innovations are needed at various built environment-related sectors - starting from building components up to urban level energy management advancements. Phase change material (PCM) enriched building components allow to shift the existing paradigm - to make a switch from the static building components to dynamic ones able to take an active part in building energy balance by ensuring energy storage in the building thermal envelope. The data set presented here supports the paper "Laboratory Testing of Small Scale Solar Facade Module with Phase Change Material and Adjustable Insulation Layer". The design of the façade module, experimental setup, used equipment, the plan of the experiment, and obtained results are described in the paper. The provided data set provides heat-flux and average temperature (in PCM) measurements.

opencc-by-4.0Oct 2021View details →

Annotated images from yeast cell lifespans - Training & Test sets - DetecDiv (id01)

This dataset has been generated by manual annotation from timelapse images of yeast cells dividing using the DetecDiv software (see below). It contains ~250 000 images from 250 cellular lifespans (each lifespan is made of between 700 and 1000 images). Each image is classified between 6 classes: "1. unbudded", "2. small", "3. large", "4. dead", "5. empty", "6. clog", according to the subfolder of the image. Besides, this folder also contains a .mat file containing 250 timeseries of classes corresponding to the lifespan of the 200 cells.   The dataset used for training (200 cellular lifespans) is in the folder /trainingset, while the dataset used for testing (50cellular lifespans) is in the folder /testset It has been used to train the network <a href="https://doi.org/10.5281/zenodo.5553862">doi.org/10.5281/zenodo.5553862</a> from the software DetecDiv: <a href="https://github.com/gcharvin/DetecDiv">github.com/gcharvin/DetecDiv</a> <a href="https://biorxiv.org/content/10.1101/2021.10.05.463175v1">biorxiv.org/content/10.1101/2021.10.05.463175v1</a>   Data type: 3D microscopy images (3 stacks brightfield) (.tif) + annotation (.mat) Microscopy data type: Brightfield images with 3 stacks, each stack representing a color of RGB. Imaging: 20x 0.45 NA brightfield, 6.5µm*6.5µm sCMOS Cell type: Budding yeast wild type cell (BY4742) File format: .tif (16-bit RGB, 1 color per z-stack) + .mat Image size: 60x60x1 (Pixel size: x,y: 325 nm, 3*z: 3*1325 nm)   Author(s): Théo, ASPERT Contact email: theo.aspert@gmail.com Affiliation: IGBMC, Université de Strasbourg Funding bodies: This work was supported by the Agence Nationale pour la Recherche, the grant ANR-10-LABX-0030-INRT, a French State fund managed by the Agence Nationale de la Recherche under the frame program Investissements d'Avenir ANR-10-IDEX-0002-02.

Data set for "Low-Power Artificial Neural Network Perceptron Based on Monolayer MoS2"

Data sets for the publication "Low-Power Artificial Neural Network Perceptron Based on Monolayer MoS2", doi:10.1021/acsnano.1c07065

Data set - Practical teacher-training program on STEAM activity planning

Data set of answers of 14 Brazilian teachers who took part in a practical teacher-training program on STEAM activity planning.

opencc-by-4.0Mar 2021View details →

Data set for publication: Extended SINDICOMP: Characterizing MV Voltage Transformers with Sine Waves

This is dataset for paper published: Crotti, G.; D’Avanzo, G.; Giordano, D.; Letizia, P.S.; Luiso, M. Extended SINDICOMP: Characterizing MV Voltage Transformers with Sine Waves. Energies 2021, 14, 1715. https://doi.org/10.3390/en14061715   Excel file provides data for Table 2, Table 4 and Figure 10 a.

opencc-by-4.0Jul 2021View details →

Data set for publication: A New Industry-Oriented Technique for the Wideband Characterization of Voltage Transformers

This is dataset for paper published: G. Crotti, D. Giordano, G. D'Avanzo, P.S. Letizia, M. Luiso, "A New Industry-Oriented Technique for the Wideband Characterization of Voltage Transformers", Measurement, Volume 182, 2021, 109674, ISSN 0263-2241, https://doi.org/10.1016/j.measurement.2021.109674.   Excel file provides data for Figure 3, 4, 6 and 7.

SEVIRI derived ET data sets

There are two relevant SEVIRI derived ET data sets distributed by the EUMETSAT Satellite Application Facility on Land Surface Analysis (LSA SAF) (<a href="https://landsaf.ipma.pt/en/data/">https://landsaf.ipma.pt/en/data/</a>; last access: 1 December 2021); (i) SEVIRI- actual ET (SEVIRI-ETa) that accounts for the water evaporated from the soil surface, vegetation canopy and water bodies, and (ii) SEVIRI- &lrm;reference ET (SEVIRI-ET0) that accounts for the (local) atmospheric demand and corresponds to the ET from a hypothetical well-watered green grass having 12 cm height and 0.23 albedo under the given down-welling short-wave radiation (Allen et al., 1998). These data sets are being provided in near real-time through the LSA SAF operational system and we used them in the GEOEssential project for water stress workflow development. For more information, please contact Dr. Bagher Bayat (bagher.bayat@gmail.com and b.bayat@fz-juelich.de).

SEVIRI derived ET data sets V2

This data set is SEVIRI derived ET distributed by the EUMETSAT Satellite Application Facility on Land Surface Analysis (LSA SAF) (<a href="https://landsaf.ipma.pt/en/data/">https://landsaf.ipma.pt/en/data/</a>; last access: 1 December 2021).  There are two relevant SEVIRI derived ET data sets (i) SEVIRI- actual ET (SEVIRI-ETa) that accounts for the water evaporated from the soil surface, vegetation canopy and water bodies, and (ii) SEVIRI- &lrm;reference ET (SEVIRI-ET0) that accounts for the (local) atmospheric demand and corresponds to the ET from a hypothetical well-watered green grass having 12 cm height and 0.23 albedo under the given down-welling short-wave radiation (Allen et al., 1998). These data sets are being provided in near real-time through the LSA SAF operational system and we used them in the GEOEssential project for water stress workflow development. For more information, please contact Dr. Bagher Bayat (bagher.bayat@gmail.com and b.bayat@fz-juelich.de).

opencc-by-nc-sa-4.0Feb 2022View details →

AIT Log Data Set V2.0

AIT Log Data Sets This repository contains synthetic log data suitable for evaluation of intrusion detection systems, federated learning, and alert aggregation. A detailed description of the dataset is available in [1]. The logs were collected from eight testbeds that were built at the Austrian Institute of Technology (AIT) following the approach by [2]. Please cite these papers if the data is used for academic publications. In brief, each of the datasets corresponds to a testbed representing a small enterprise network including mail server, file share, WordPress server, VPN, firewall, etc. Normal user behavior is simulated to generate background noise over a time span of 4-6 days. At some point, a sequence of attack steps is launched against the network. Log data is collected from all hosts and includes Apache access and error logs, authentication logs, DNS logs, VPN logs, audit logs, Suricata logs, network traffic packet captures, horde logs, exim logs, syslog, and system monitoring logs. Separate ground truth files are used to label events that are related to the attacks. Compared to the <a href="../record/4264796">AIT-LDSv1.1</a>, a more complex network and diverse user behavior is simulated, and logs are collected from all hosts in the network. If you are only interested in network traffic analysis, we also provide the <a href="../record/6610489">AIT-NDS</a> containing the labeled netflows of the testbed networks. We also provide the <a href="../records/8263181">AIT-ADS</a>, an alert data set derived by forensically applying open-source intrusion detection systems on the log data. The datasets in this repository have the following structure: <ul> <li>The gather directory contains all logs collected from the testbed. Logs collected from each host are located in gather/<host_name>/logs/.</li> <li>The labels directory contains the ground truth of the dataset that indicates which events are related to attacks. The directory mirrors the structure of the gather directory so that each label files is located at the same path and has the same name as the corresponding log file. Each line in the label files references the log event corresponding to an attack by the line number counted from the beginning of the file ("line"), the labels assigned to the line that state the respective attack step ("labels"), and the labeling rules that assigned the labels ("rules"). An example is provided below.</li> <li>The processing directory contains the source code that was used to generate the labels.</li> <li>The rules directory contains the labeling rules.</li> <li>The environment directory contains the source code that was used to deploy the testbed and run the simulation using the <a href="https://github.com/ait-aecid/kyoushi-environment">Kyoushi Testbed Environment</a>.</li> <li>The dataset.yml file specifies the start and end time of the simulation.</li> </ul> The following table summarizes relevant properties of the datasets: <ul> <li>fox <ul> <li>Simulation time: 2022-01-15 00:00 - 2022-01-20 00:00</li> <li>Attack time: 2022-01-18 11:59 - 2022-01-18 13:15</li> <li>Scan volume: High</li> <li>Unpacked size: 26 GB</li> </ul> </li> <li>harrison <ul> <li>Simulation time: 2022-02-04 00:00 - 2022-02-09 00:00</li> <li>Attack time: 2022-02-08 07:07 - 2022-02-08 08:38</li> <li>Scan volume: High</li> <li>Unpacked size: 27 GB</li> </ul> </li> <li>russellmitchell <ul> <li>Simulation time: 2022-01-21 00:00 - 2022-01-25 00:00</li> <li>Attack time: 2022-01-24 03:01 - 2022-01-24 04:39</li> <li>Scan volume: Low</li> <li>Unpacked size: 14 GB</li> </ul> </li> <li>santos <ul> <li>Simulation time: 2022-01-14 00:00 - 2022-01-18 00:00</li> <li>Attack time: 2022-01-17 11:15 - 2022-01-17 11:59</li> <li>Scan volume: Low</li> <li>Unpacked size: 17 GB</li> </ul> </li> <li>shaw <ul> <li>Simulation time: 2022-01-25 00:00 - 2022-01-31 00:00</li> <li>Attack time: 2022-01-29 14:37 - 2022-01-29 15:21</li> <li>Scan volume: Low</li> <li>Data exfiltration is not visible in DNS logs</li> <li>Unpacked size: 27 GB</li> </ul> </li> <li>wardbeck <ul> <li>Simulation time: 2022-01-19 00:00 - 2022-01-24 00:00</li> <li>Attack time: 2022-01-23 12:10 - 2022-01-23 12:56</li> <li>Scan volume: Low</li> <li>Unpacked size: 26 GB</li> </ul> </li> <li>wheeler <ul> <li>Simulation time: 2022-01-26 00:00 - 2022-01-31 00:00</li> <li>Attack time: 2022-01-30 07:35 - 2022-01-30 17:53</li> <li>Scan volume: High</li> <li>No password cracking in attack chain</li> <li>Unpacked size: 30 GB</li> </ul> </li> <li>wilson <ul> <li>Simulation time: 2022-02-03 00:00 - 2022-02-09 00:00</li> <li>Attack time: 2022-02-07 10:57 - 2022-02-07 11:49</li> <li>Scan volume: High</li> <li>Unpacked size: 39 GB</li> </ul> </li> </ul> The following attacks are launched in the network: <ul> <li>Scans (nmap, WPScan, dirb)</li> <li>Webshell upload (CVE-2020-24186)</li> <li>Password cracking (John the Ripper)</li> <li>Privilege escalation</li> <li>Remote command execution</li> <li>Data exfiltration (DNSteal)</li> </ul> Note that attack parameters and their execution orders vary in each dataset. Labeled log files are trimmed to the simulation time to ensure that their labels (which reference the related event by the line number in the file) are not misleading. Other log files, however, also contain log events generated before or after the simulation time and may therefore be affected by testbed setup or data collection. It is therefore recommended to only consider logs with timestamps within the simulation time for analysis. The structure of labels is explained using the audit logs from the intranet server in the russellmitchell data set as an example in the following. The first four labels in the labels/intranet_server/logs/audit/audit.log file are as follows: <blockquote> {"line": 1860, "labels": ["attacker_change_user", "escalate"], "rules": {"attacker_change_user": ["attacker.escalate.audit.su.login"], "escalate": ["attacker.escalate.audit.su.login"]}} {"line": 1861, "labels": ["attacker_change_user", "escalate"], "rules": {"attacker_change_user": ["attacker.escalate.audit.su.login"], "escalate": ["attacker.escalate.audit.su.login"]}} {"line": 1862, "labels": ["attacker_change_user", "escalate"], "rules": {"attacker_change_user": ["attacker.escalate.audit.su.login"], "escalate": ["attacker.escalate.audit.su.login"]}} {"line": 1863, "labels": ["attacker_change_user", "escalate"], "rules": {"attacker_change_user": ["attacker.escalate.audit.su.login"], "escalate": ["attacker.escalate.audit.su.login"]}} </blockquote> Each JSON object in this file assigns a label to one specific log line in the corresponding log file located at gather/intranet_server/logs/audit/audit.log. The field "line" in the JSON objects specify the line number of the respective event in the original log file, while the field "labels" comprise the corresponding labels. For example, the lines in the sample above provide the information that lines 1860-1863 in the gather/intranet_server/logs/audit/audit.log file are labeled with "attacker_change_user" and "escalate" corresponding to the attack step where the attacker receives escalated privileges. Inspecting these lines shows that they indeed correspond to the user authenticating as root: <blockquote> type=USER_AUTH msg=audit(1642999060.603:2226): pid=27950 uid=33 auid=4294967295 ses=4294967295 msg='op=PAM:authentication acct="jhall" exe="/bin/su" hostname=? addr=? terminal=/dev/pts/1 res=success' type=USER_ACCT msg=audit(1642999060.603:2227): pid=27950 uid=33 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="jhall" exe="/bin/su" hostname=? addr=? terminal=/dev/pts/1 res=success' type=CRED_ACQ msg=audit(1642999060.615:2228): pid=27950 uid=33 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="jhall" exe="/bin/su" hostname=? addr=? terminal=/dev/pts/1 res=success' type=USER_START msg=audit(1642999060.627:2229): pid=27950 uid=33 auid=4294967295 ses=4294967295 msg='op=PAM:session_open acct="jhall" exe="/bin/su" hostname=? addr=? terminal=/dev/pts/1 res=success' </blockquote> The same applies to all other labels for this log file and all other log files. There are no labels for logs generated by "normal" (i.e., non-attack) behavior; instead, all log events that have no corresponding JSON object in one of the files from the labels directory, such as the lines 1-1859 in the example above, can be considered to be labeled as "normal". This means that in order to figure out the labels for the log data it is necessary to store the line numbers when processing the original logs from the gather directory and see if these line numbers also appear in the corresponding file in the labels directory. Beside the attack labels, a general overview of the exact times when specific attack steps are launched are available in gather/attacker_0/logs/attacks.log. An enumeration of all hosts and their IP addresses is stated in processing/config/servers.yml. Moreover, configurations of each host are provided in gather/<host_name>/configs/ and gather/<host_name>/facts.json. Version history: <ul> <li><a href="https://doi.org/10.5281/zenodo.3723082">AIT-LDS-v1.x</a>: Four datasets, logs from single host, fine-granular audit logs, mail/CMS.</li> <li><a href="http://doi.org/10.5281/zenodo.5789064">AIT-LDS-v2.0</a>: Eight datasets, logs from all hosts, system logs and network traffic, mail/CMS/cloud/web.</li> </ul> Acknowledgements: Partially funded by the FFG projects INDICAETING (868306) and DECEPT (873980), and the EU projects GUARD (833456) and PANDORA (SI2.835928). If you use the dataset, please cite the following publications: [1] M. Landauer, F. Skopik, M. Frank, W. Hotwagner, M. Wurzenberger, and A. Rauber. <a href="https://ieeexplore.ieee.org/abstract/document/9866880">"Maintainable Log Datasets for Evaluation of Intrusion Detection Systems"</a>. IEEE Transactions on Dependable and Secure Computing, vol. 20, no. 4, pp. 3466-3482, doi: 10.1109/TDSC.2022.3201582. [<a href="https://arxiv.org/pdf/2203.08580.pdf">PDF</a>] [2] M. Landauer, F. Skopik, M. Wurzenberger, W. Hotwagner and A. Rauber, <a href="https://ieeexplore.ieee.org/document/9262078">"Have it Your Way: Generating Customized Log Datasets With a Model-Driven Simulation Testbed,"</a> in IEEE Transactions on Reliability, vol. 70, no. 1, pp. 402-415, March 2021, doi: 10.1109/TR.2020.3031317. [<a href="https://www.skopik.at/ait/2020_trel.pdf">PDF</a>]

opencc-by-4.0Mar 2022View details →

Data set figures 1-3 article Reaux et al; Communications Biology 2022

The files attached are : - the manuscript and figures of our article entitled ".." accepted for publication in Communication Biology in February 2022.  - A supplementary material, which is an Excel file is the dataset of the figures 1 to 3. It is composed of two sheets in which the values of cerebral blood volume are given for every single animal included in our study:  before and during each stimulation (been mechanical or chemical stimulation in sheet 1 - figure 2 or mechanical stimulations of either the ophthalmic or maxillary territories - 2d sheet - figure 3).  - A Matlab file with dataset of the figure 4 (ULM of the saggital brain showing the rich and complex vasculature in the trigeminal ganglion)

opencc-by-4.0Mar 2022View details →

Data sets for assessing potential CC impacts on the activity of the Vögelsberg landslide

Bias-corrected air temperature and precipitation time series (RCM sample from EURO CORDEX) for Kleinvolderberg station near the Vögelsberg landslide (OAL-AT) under RCP8.5, monthly water balance components derived from an empirical model for six elevation steps under current and potential land cover conditions for 1950-2100, median monthly displacement and current hydrological forcing of the Vögelsberg landslide