Logo image
Back
Introducing UWF-ZeekData22: A Comprehensive Network Traffic Dataset Based on the MITRE ATT&CK Framework
Journal article   Open access   Peer reviewed

Introducing UWF-ZeekData22: A Comprehensive Network Traffic Dataset Based on the MITRE ATT&CK Framework

Sikha S. Bagui, Dustin Mink, Subhash C. Bagui, Tirthankar Ghosh, Russel Plenkers, Tom McElroy, Stephan Dulaney and Sajida Shabanali
Data (Basel), Vol.8(1), p.18
01/2023
DOI: https://doi.org/10.3390/data8010018
Web of Science ID: WOS:000914573700001

Metrics

162 Record Views
23 Times Cited - Web of Science

Abstract

With the rapid rate at which networking technologies are changing, there is a need to regularly update network activity datasets to accurately reflect the current state of network infrastructure/traffic. The uniqueness of this work was that this was the first network dataset collected using Zeek and labelled using the MITRE ATT&CK framework. In addition to identifying attack traffic, the MITRE ATT&CK framework allows for the detection of adversary behavior leading to an attack. It can also be used to develop user profiles of groups intending to perform attacks. This paper also outlined how both the cyber range and hadoop's big data platform were used for creating this network traffic data repository. The data was collected using Security Onion in two formats: Zeek and PCAPs. Mission logs, which contained the MITRE ATT&CK data, were used to label the network attack data. The data was transferred daily from the Security Onion virtual machine running on a cyber range to the big-data platform, Hadoop's distributed file system. This dataset, UWF-ZeekData22, is publicly available at datasets.uwf.edu.
url
Introducing UWF-ZeekData22View
Published (Version of record)link to articleCC BY V4.0,  Open

Related links

Details

Logo image