首个融合三源日志并带ATT&CK标签的网络安全数据集，可训练模型识别复杂攻击链。
Multi-Source Cybersecurity Logs: An ATT&CK-Labeled Dataset and SLM Evaluation
- 构建包含系统、网络、浏览器三类日志的870个会话数据集，每条恶意事件标注ATT&CK技术编号。
- 微调小语言模型后，日志片段分类准确率从约8%提升至90%-97%，验证了多源学习可行性。
- 适合做威胁检测、安全分析或生成式模型在攻防场景中应用的研究者使用。
多阶段网络攻击横跨系统、网络和浏览器日志，需跨源关联事件才能检测。现有公开数据集存在缺陷：仅网络日志的数据集（如CICIDS、UNSW-NB15）缺失主机与浏览器信息；侧重主机的数据集（如LMDG、CICAPT-IIoT）缺乏浏览器遥测；ATLAS虽含三类日志，但仅标记为恶意或良性，未提供MITRE ATT&CK技术级细粒度标签。本文填补空白，构建了一个包含870个会话（70次攻击，800次正常）的多源日志数据集，共约230万条事件。所有日志在Windows终端上同步采集，并对恶意事件标注了涵盖12个战术、53个技术的ATT&CK ID。攻击数据均使用真实工具生成，包括远程访问木马（RAT）、命令与控制（C2）隧道及云数据外泄。为验证可学习性，我们对三个小型语言模型（Qwen2.5-1.5B、Llama-3.2-3B、Phi-4-Mini）采用低秩适配（LoRA）进行微调，在两个任务（片段分类与ATT&CK技术识别）上对比其基线版本。结果表明，微调后所有模型在十项指标上均有提升：片段分类准确率从基线约8%升至90%-97%；技术识别虽仍具挑战，最佳精确匹配达42%，但高部分匹配分数表明模型已掌握主要推理逻辑。
原文摘要 · Abstract (English)
Multi-stage cyberattacks span system, network, and browser logs. Detecting them requires correlating events across all three sources. Machine learning methods can learn these cross-source patterns, but they need labeled multi-source data. Existing public datasets fall short. Network-only datasets such as CICIDS and UNSW-NB15 miss host and browser activity. Host-focused datasets such as LMDG and CICAPT-IIoT lack browser telemetry. ATLAS includes all three sources but labels events only as malicious or benign, without MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) technique granularity. No public dataset combines all three sources with per-entry ATT&CK technique labels. We close the gap by building a multi-source log dataset of 870 sessions (70 attack, 800 benign) and approximately 2.3 million events. We captured system, network, and browser activity simultaneously on Windows endpoints. We labeled malicious events with ATT&CK technique IDs, covering 12 tactics and 53 techniques. We generated all attack data using real tools, including Remote Access Trojan (RAT), Command and Control (C2) tunnels, and cloud exfiltration. To demonstrate learnability, we fine-tuned three Small Language Models (SLMs) (Qwen2.5-1.5B, Llama-3.2-3B, Phi-4-Mini) using Low-Rank Adaptation (LoRA). We compared each against its base variant across ten metrics on two tasks: chunk classification and ATT&CK technique identification. Fine-tuning improved every model on every metric. Chunk classification accuracy rose from approximately 8% in the base variants to between 90% and 97% after fine-tuning. Technique identification remained challenging, with the best exact-match accuracy at 42%, although high partial-match scores show the models captured most of the underlying reasoning.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。