论文标题
picodomain：紧凑的高保真网络安全数据集
PicoDomain: A Compact High-Fidelity Cybersecurity Dataset
论文作者
论文摘要
对网络相关数据的分析已成为越来越重点的领域。随着较大百分比的企业和政府开始理解网络攻击的含义，对更好的网络安全解决方案的动力也有所增加。不幸的是，当前的网络安全数据集要么不提供基础真相，要么使用匿名数据进行。前者在验证结果时会导致难题，而后者可以删除有价值的信息。此外，大多数现有的数据集足够大，可以使它们在原型开发过程中变得笨拙。在本文中，我们开发了picodomain数据集，这是使用相关工具，技术和程序从现实入侵中从现实入侵中进行紧凑的高保真收集。该数据集在小型网络上进行模拟时，由企业网络的典型流量组成，该流量可用于快速验证和分析平台的迭代开发。我们已经使用传统的统计分析和现成的机器学习技术验证了该数据集。
Analysis of cyber relevant data has become an area of increasing focus. As larger percentages of businesses and governments begin to understand the implications of cyberattacks, the impetus for better cybersecurity solutions has increased. Unfortunately, current cybersecurity datasets either offer no ground truth or do so with anonymized data. The former leads to a quandary when verifying results and the latter can remove valuable information. Additionally, most existing datasets are large enough to make them unwieldy during prototype development. In this paper we have developed the PicoDomain dataset, a compact high-fidelity collection of Zeek logs from a realistic intrusion using relevant Tools, Techniques, and Procedures. While simulated on a small-scale network, this dataset consists of traffic typical of an enterprise network, which can be utilized for rapid validation and iterative development of analytics platforms. We have validated this dataset using traditional statistical analysis and off-the-shelf Machine Learning techniques.
