AIT-LDSv2.0 (AIT Log Data Set V2.0)

Synthetic log data suitable for evaluation of intrusion detection systems, federated learning, and alert aggregation. Each of the 8 datasets corresponds to a testbed representing a small enterprise network including mail server, file share, WordPress server, VPN, firewall, etc. Normal user behavior is simulated to generate background noise over a time span of 4-6 days. At some point, a sequence of attack steps are launched against the network. Log data is collected from all hosts and includes Apache access and error logs, authentication logs, DNS logs, VPN logs, audit logs, Suricata logs, network traffic packet captures, horde logs, exim logs, syslog, and system monitoring logs. Attacks include scans (nmap, WPScan, dirb), webshell upload, password cracking, privilege escalation, remote command execution, and data exfiltration.