license: cc-by-nc-4.0
task_categories:

• tabular-classification
• time-series-forecasting
  tags:
• cybersecurity
• mitre-attack
• kill-chain
• apt
• ransomware
• synthetic-data
• threat-modeling
• red-team
• blue-team
  pretty_name: CYB002 — Synthetic Cyber Attack Dataset (Sample)
  size_categories:
• 1K<n<10K

CYB002 — Synthetic Cyber Attack Dataset (Sample)

XpertSystems.ai Synthetic Data Platform · SKU: CYB002-SAMPLE · Version 1.0.0

This is a free preview of the full CYB002 — Synthetic Cyber Attack
Dataset product. It contains roughly 1 / 60th of the full dataset at
identical schema, attacker-tier distribution, and statistical fingerprint, so
you can evaluate fit before licensing the full product.

🤖 Trained baseline available:
xpertsystems/cyb002-baseline-classifier
— XGBoost + PyTorch MLP for 10-class MITRE ATT&CK kill-chain phase
prediction, group-aware split by campaign, ablation evidence,
honest limitations in the model card.

Dataset Summary

CYB002 simulates end-to-end cyber attack lifecycles as a 9-phase MITRE
ATT&CK kill-chain state machine across enterprise, cloud, endpoint, and
OT/ICS environments, with:

• 9 ATT&CK phases: reconnaissance, resource_development, initial_access,
  execution, persistence, privilege_escalation, defense_evasion,
  lateral_movement, exfiltration
• 4 attacker capability tiers: opportunistic, organized_crime, apt,
  nation_state — with per-tier dwell time, lateral hop rate, and stealth
  weight distributions
• 5 defender maturity levels: ad_hoc, defined, managed, quantitatively_
  managed, optimizing
• MITRE ATT&CK technique catalogue with representative subset of
  Enterprise v14 techniques mapped to each phase
• EDR coverage modelling with configurable effectiveness
• Ransomware deployment, supply chain compromise, and exfiltration
  outcome paths

Trained Baseline Available

A working baseline classifier trained on this sample is published at
xpertsystems/cyb002-baseline-classifier.

The model card documents the three columns excluded for label leakage
(technique_id, technique_name, tactic_category), an ablation
showing timestep carries most of the phase signal, and six explicit
limitations including the gap between synthetic and real attack
telemetry. Late-stage phases (collection / exfiltration / impact) are
genuinely harder for a flat-tabular event-level model — the baseline
exposes this honestly.

Calibrated Benchmark Targets

The full product is calibrated to 12 benchmark metrics drawn from
authoritative threat intelligence sources (Mandiant M-Trends, IBM CODB,
Verizon DBIR, CrowdStrike GTR, MITRE ATT&CK Evaluations, SANS, ENISA).
The sample preserves the same calibration. Observed values on this sample:

Note: some benchmarks (e.g. APT dwell time, MTTR) require larger sample
sizes to converge. The full product passes all 12 benchmarks at Grade A-.

Schema Highlights

attack_events.csv (primary file, timestep-level)

campaign_summary.csv (per-campaign outcome)

See campaign_events.csv and network_topology.csv for the discrete event
log and asset inventory schemas respectively.

Suggested Use Cases

• Training kill-chain phase classifiers (predict next ATT&CK phase) —
  worked example available
• Benchmarking APT detection algorithms (long dwell, low stealth_score)
• Campaign outcome prediction (success / detected / blocked / aborted)
• MTTD / MTTR forecasting under varying defender maturity
• Ransomware risk modelling across attacker tiers
• Red-team simulation training data for purple-team exercises
• SOC alert triage benchmarking with realistic severity distributions

Loading the Data

import pandas as pd

attacks    = pd.read_csv("attack_events.csv")
campaigns  = pd.read_csv("campaign_summary.csv")
events     = pd.read_csv("campaign_events.csv")
topology   = pd.read_csv("network_topology.csv")

# Join to get the full attack context
enriched = attacks.merge(campaigns, on=["campaign_id", "attacker_id"], how="left")
enriched = enriched.merge(topology, on="segment_id", how="left")

# Binary detection target
y = attacks["detected"].astype(int)

# Campaign-level outcome target
y_outcome = campaigns["campaign_outcome"]

For a worked end-to-end example with the 10-class kill-chain phase target,
group-aware splitting, and feature engineering, see the inference notebook
in the baseline classifier repo.

License

This sample is released under CC-BY-NC-4.0 (free for non-commercial
research and evaluation). The full production dataset is licensed
commercially — contact XpertSystems.ai for licensing terms.

Full Product

The full CYB002 dataset includes ~454,000 rows across all four files,
with calibrated benchmark validation against 12 metrics drawn from
authoritative threat intelligence sources.

📧 [email protected]
🌐 https://xpertsystems.ai

Citation

@dataset{xpertsystems_cyb002_sample_2026,
  title  = {CYB002: Synthetic Cyber Attack Dataset (Sample)},
  author = {XpertSystems.ai},
  year   = {2026},
  url    = {https://huggingface.co/datasets/xpertsystems/cyb002-sample}
}

Generation Details

• Generator version : 2.0.0
• Random seed : 42
• Generated : 2026-05-16 13:39:22 UTC
• Kill-chain model : 9-phase MITRE ATT&CK state machine
• Overall benchmark : 95.3 / 100 (grade A)