Introducing the CYSAS-S3 Dataset for Operationalizing a Mission-Oriented Cyber Situational Awareness

Area of Science:

• Cyber Defence and Information Security
• Machine Learning and Data Science Applications
• Military Operations Research

Background:

• Digital transformation in defence faces challenges with data availability for training AI and decision-making systems.
• Existing cyber defence datasets lack comprehensive communication layer data and real-world operational context.
• Current datasets fail to correlate cyber incidents with mission objectives and dependencies across strategic, operational, and tactical levels.

Purpose of the Study:

• To introduce CYSAS-S3, a novel dataset addressing critical data gaps in cyber defence.
• To provide a collection of samples correlating Advanced Persistent Threats (APTs) with cyber kill chain phases.
• To link cyber-attack impacts to mission-level operations and goals for improved cyber situational awareness.

Main Methods:

• Development of a novel dataset (CYSAS-S3) through a joint research action.
• Generation of data samples focusing on specific cyber defence needs and environments.
• Correlation of selected Advanced Persistent Threats (APTs) across all phases of their cyber kill chain.

Main Results:

• CYSAS-S3 provides a comprehensive dataset linking cyber incidents to mission impacts.
• The dataset captures dependencies across strategic, operational, tactical, and technical domains.
• It includes data reflecting real-world usage profiles and specific cyber defence operational environments.

Conclusions:

• CYSAS-S3 significantly mitigates the lack of reliable, unbiased data for defence automatisms and training.
• The dataset enhances cyber situational awareness by connecting technical incidents to mission objectives.
• It supports the development of more effective cyber defence strategies and personnel education.