license: cc-by-nc-4.0
task_categories:

• tabular-classification
• time-series-forecasting
  tags:
• tsfile
• timeseries
• cybersecurity
• mitre-attack
• kill-chain
• apt
• ransomware
• synthetic-data
• threat-modeling
• red-team
• blue-team
• time-series
• format:tsfile
  pretty_name: CYB002 — Synthetic Cyber Attack Dataset (Sample) (TsFile)
  size_categories:
• 1K<n<10K
  configs:
• config_name: default
  data_files:
  • split: attack_events
    path: attack_events.tsfile
  • split: campaign_events
    path: campaign_events.tsfile
  • split: campaign_summary
    path: campaign_summary.tsfile
  • split: network_topology
    path: network_topology.tsfile

CYB002 — Synthetic Cyber Attack Dataset (Sample) (TsFile)

Apache TsFile version of xpertsystems/cyb002-sample.

Overview

CYB002 — Synthetic Cyber Attack Dataset (Sample) — This is a free preview of the full CYB002 — Synthetic Cyber Attack Dataset product. It contains roughly 1 / 60th of the full dataset at identical schema, attacker-tier distribution, and statistical fingerprint, so you can evaluate fit before licensing the full product.

• Tables: attack_events, campaign_events, campaign_summary, network_topology
• Rows: 5,843 across 4 TsFile table(s).
  • attack_events: 4,353 rows — Time is the source timestep simulation step counter, stored as milliseconds (1 step = 1 ms).
  • campaign_events: 739 rows — Time is the source timestep simulation step counter, stored as milliseconds (1 step = 1 ms).
  • campaign_summary: 100 rows — Time is synthetic row index over the stable source order (0 … N-1); the source table has no per-row clock.
  • network_topology: 651 rows — Time is synthetic row index over the stable source order (0 … N-1); the source table has no per-row clock.

Schema (TsFile structure)

attack_events.tsfile

• Time (INT64, milliseconds) — the source timestep simulation step counter, stored as milliseconds (1 step = 1 ms).
• TAG: campaign_id — device dimension(s); query one device with WHERE campaign_id=....
• FIELD (22): attacker_id (string), kill_chain_phase (string), technique_id (string), technique_name (string), tactic_category (string), target_segment_id (string), target_asset_type (string), source_ip_class (string), dest_port (int64), protocol (string), bytes_transferred (double), connection_duration_s (double), auth_failure_count (int64), process_injection_flag (int64), lateral_hop_count (int64), c2_beacon_interval_s (double), detection_outcome (string), alert_severity (string), siem_rule_triggered (int64), edr_blocked_flag (int64), attacker_capability_tier (string), defender_maturity_level (string)

campaign_events.tsfile

• Time (INT64, milliseconds) — the source timestep simulation step counter, stored as milliseconds (1 step = 1 ms).
• TAG: campaign_id — device dimension(s); query one device with WHERE campaign_id=....
• FIELD (6): attacker_id (string), event_type (string), target_segment_id (string), target_asset_id (string), responder_id (string), related_campaign_id (string)

campaign_summary.tsfile

• Time (INT64, milliseconds) — synthetic row index over the stable source order (0 … N-1); the source table has no per-row clock.
• TAG: campaign_id — device dimension(s); query one device with WHERE campaign_id=....
• FIELD (30): attacker_id (string), attacker_capability_tier (string), campaign_type (string), target_environment_type (string), kill_chain_phases_reached (string), highest_phase_achieved (string), lateral_hops_total (int64), assets_compromised_count (int64), data_exfil_gb (double), dwell_time_hours (double), detection_rate (double), alert_volume_total (int64), suppressed_alert_count (int64), edr_block_count (int64), ir_escalation_count (int64), campaign_duration_steps (int64), campaign_success_flag (int64), ransomware_deployed_flag (int64), c2_sessions_established (int64), technique_count_unique (int64), tactic_breadth_score (double), attacker_stealth_score (double), defender_response_score (double), mttd_hours (double), mttr_hours (double), coordinated_attack_flag (int64), exfiltration_success_flag (int64), privesc_success_flag (int64), phase_detection_coverage (double), attacker_roi_score (double)

network_topology.tsfile

• Time (INT64, milliseconds) — synthetic row index over the stable source order (0 … N-1); the source table has no per-row clock.
• TAG: segment_id — device dimension(s); query one device with WHERE segment_id=....
• FIELD (17): asset_id (string), segment_type (string), asset_type (string), os_family (string), patch_lag_days (int64), exposure_score (double), defender_maturity_level (string), siem_coverage_flag (int64), edr_deployed_flag (int64), ndr_coverage_flag (int64), mfa_enforced_flag (int64), vulnerability_count (int64), trust_zone (string), inter_segment_trust_level (double), alert_threshold_sensitivity (double), mttd_baseline_hours (double), mttr_baseline_hours (double)

Conversion notes

• Each CSV of the sample is converted into its own TsFile table (4 tables), so no table is merged with another and no column is dropped.
• Event/telemetry tables use the source simulation clock as Time (INT64 milliseconds): timestep step counters and millisecond offsets are stored as-is, minute-based columns are multiplied by 60,000, and ISO/UTC strings are parsed to epoch milliseconds.
• Static inventory/topology/summary tables have no per-row clock; their Time is a synthetic row index (0..N-1) over the stable source order.
• Low-cardinality dimensions of each table (campaign/incident/asset/session ids, phases, labels) are declared as TAG columns; query one simulation with e.g. WHERE campaign_id='...'.

Usage

Install the Apache TsFile Python SDK (pip install tsfile) and read a converted file:

from pathlib import Path
from tsfile import TsFileReader

path = Path("attack_events.tsfile")
with TsFileReader(str(path)) as reader:
    schemas = reader.get_all_table_schemas()
    print("tables:", list(schemas))
    table_name = next(iter(schemas))
    table = schemas[table_name]
    columns = [column.get_column_name() for column in table.get_columns()]
    print("columns:", columns)
    field_names = [
        column.get_column_name()
        for column in table.get_columns()
        if column.get_column_name() not in {"Time", "time"}
    ]
    if field_names:
        with reader.query_table(table_name, field_names[:3], batch_size=1024) as result:
            batch = result.read_arrow_batch()
            if batch is not None:
                print(batch.to_pandas().head())

Source & license

• Original dataset: xpertsystems/cyb002-sample
• Source card title / publisher: CYB002 — Synthetic Cyber Attack Dataset (Sample)
• License: cc-by-nc-4.0 (as declared by the original dataset).