license: cc0-1.0
task_categories:
- other
language: - en
tags: - cybersecurity
- intrusion-detection
- network-traffic
- lanl
pretty_name: LANL Cyber Datasets (2015 + 2017)
LANL Cyber Datasets (2015 + 2017)
Raw, byte-identical copies of two Los Alamos National Laboratory public
cybersecurity datasets, acquired exclusively from the official LANL
source (https://csr.lanl.gov/). No mirrors, Kaggle copies, or
repackaged distributions were used.
Contents
lanl-2015/
redteam.txt.gz known red-team compromise events (ground truth)
auth.txt.gz authentication events
proc.txt.gz process start/stop events
flows.txt.gz network flow events
dns.txt.gz DNS lookup events
redteam.txt decompressed copies of the above, stored alongside
auth.txt the archives (same path minus .gz/.bz2), for direct
... use without a decompression step
lanl-2017/wls/
wls_day-01.bz2 … wls_day-30.bz2 Windows host event logs (JSON lines)
wls_day-01 … wls_day-30 decompressed copies (same path minus .bz2)
lanl-2017/netflow/
netflow_day-02.bz2 … netflow_day-30.bz2 network flows (CSV)
netflow_day-02 … netflow_day-30 decompressed copies (same path minus .bz2)
Notes:
- Filenames are preserved exactly as distributed by LANL. Each archive is
stored twice: the original compressed file (byte-identical, never
re-encoded) and its decompressed form at the same path minus the.gz/.bz2suffix. - Decompressed files are produced locally with
gzip -dc/bzip2 -dc
and verified on the repo by SHA-256 (LFS OID or byte comparison). - LANL does not publish
netflow_day-01.bz2; day-01 netflow is unavailable
from the official source. manifest.json/manifest.csv(added on completion) record per-file
source URL pattern, SHA-256/MD5, compressed size, UTC download time,
and integrity results.
Provenance & integrity
- 2015: A. D. Kent, "Comprehensive, Multi-Source Cyber-Security Events,"
LANL, http://dx.doi.org/10.17021/1179829 (release LA-UR-15-23810).
58 days, ~12 GB compressed, 1.65B events. - 2017: M. Turcotte, A. Kent, C. Hash, "Unified Host and Network Data
Set," Data Science for Cyber-Security, World Scientific, 2018,
doi:10.1142/9781786345646_001 (release LA-UR-17-20763). ~90 days of
enterprise host + network events. - Every file passed magic-byte inspection,
gzip -t/bzip2 -t, and
SHA-256 verification against the downloaded bytes before upload. - 2017 WLS files were additionally cross-checked against independently
recorded hashes.
License
To the extent possible under law, Los Alamos National Laboratory has
waived all copyright and related or neighboring rights to both datasets
(CC0-style waiver); published from the United States. If you use this
data, please cite the sources above and consider downloading future
copies directly from https://csr.lanl.gov/data/cyber1/ and
https://csr.lanl.gov/data/2017/.