Advanced Persistent Threat (APT) and intrusion detection evaluation dataset for linux systems 2024.

Area of Science:

• Cybersecurity
• Network Security
• Malware Analysis

Background:

• Existing datasets lack comprehensive Linux-specific Advanced Persistent Threat (APT) data.
• There's a need for detailed log sources to understand APT tactics and behaviors on Linux.

Purpose of the Study:

• Introduce the Linux-APT Dataset 2024, a novel resource for APT attack analysis on Linux.
• Provide a realistic environment with current APT techniques and payloads for research.

Main Methods:

• Emulated recent APTs and sophisticated payloads within a Linux environment.
• Utilized a centralized logging system to capture diverse Linux log sources.
• Mapped captured events to the MITRE ATT&CK framework for generalized analysis.

Main Results:

• Created a detailed dataset capturing APT attacks and advanced payloads on Linux.
• The dataset includes comprehensive logs from various Linux sources, unlike typical systems.
• Mapped attacker behaviors to the MITRE ATT&CK framework.

Conclusions:

• The Linux-APT Dataset 2024 is valuable for training and developing advanced intrusion detection solutions for Linux.
• Enhances research into APTs by providing up-to-date, realistic attack data.
• Facilitates a deeper understanding of APT operations and detection strategies on Linux systems.