Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

S-DAPT-2026: A Stage-Aware Synthetic Dataset for Advanced Persistent Threat Detection

Saleem Ishaq Tijjani, Bogdan Ghita, Nathan Clarke, Matthew Craven

TL;DR

This work tackles the challenge of evaluating advanced persistent threat detection by introducing S-DAPT-2026, a near-realistic synthetic dataset designed to model multi-stage APT campaigns within campus and organizational networks. It combines a scalable, KNN-based alert correlation framework with an explicit APT lifecycle model to generate AFSA and ASSA labeled alerts across 14 distinct alert types, enabling stage-aware analysis and robust evaluation of detection methods. The dataset provides comprehensive statistical characterization, including a 120,000 alert composition, realistic campaign durations, and a deliberate class imbalance, to support reproducible research and ML-based APT stage prediction. By delivering both realistic data and an efficient correlation/indexing pipeline, the work offers practical impact for developing scalable, stage-aware APT detectors and evaluators that can adapt to evolving threat landscapes.

Abstract

The detection of advanced persistent threats (APTs) remains a crucial challenge due to their stealthy, multistage nature and the limited availability of realistic, labeled datasets for systematic evaluation. Synthetic dataset generation has emerged as a practical approach for modeling APT campaigns; however, existing methods often rely on computationally expensive alert correlation mechanisms that limit scalability. Motivated by these limitations, this paper presents a near realistic synthetic APT dataset and an efficient alert correlation framework. The proposed approach introduces a machine learning based correlation module that employs K Nearest Neighbors (KNN) clustering with a cosine similarity metric to group semantically related alerts within a temporal context. The dataset emulates multistage APT campaigns across campus and organizational network environments and captures a diverse set of fourteen distinct alert types, exceeding the coverage of commonly used synthetic APT datasets. In addition, explicit APT campaign states and alert to stage mappings are defined to enable flexible integration of new alert types and support stage aware analysis. A comprehensive statistical characterization of the dataset is provided to facilitate reproducibility and support APT stage predictions.

S-DAPT-2026: A Stage-Aware Synthetic Dataset for Advanced Persistent Threat Detection

TL;DR

This work tackles the challenge of evaluating advanced persistent threat detection by introducing S-DAPT-2026, a near-realistic synthetic dataset designed to model multi-stage APT campaigns within campus and organizational networks. It combines a scalable, KNN-based alert correlation framework with an explicit APT lifecycle model to generate AFSA and ASSA labeled alerts across 14 distinct alert types, enabling stage-aware analysis and robust evaluation of detection methods. The dataset provides comprehensive statistical characterization, including a 120,000 alert composition, realistic campaign durations, and a deliberate class imbalance, to support reproducible research and ML-based APT stage prediction. By delivering both realistic data and an efficient correlation/indexing pipeline, the work offers practical impact for developing scalable, stage-aware APT detectors and evaluators that can adapt to evolving threat landscapes.

Abstract

The detection of advanced persistent threats (APTs) remains a crucial challenge due to their stealthy, multistage nature and the limited availability of realistic, labeled datasets for systematic evaluation. Synthetic dataset generation has emerged as a practical approach for modeling APT campaigns; however, existing methods often rely on computationally expensive alert correlation mechanisms that limit scalability. Motivated by these limitations, this paper presents a near realistic synthetic APT dataset and an efficient alert correlation framework. The proposed approach introduces a machine learning based correlation module that employs K Nearest Neighbors (KNN) clustering with a cosine similarity metric to group semantically related alerts within a temporal context. The dataset emulates multistage APT campaigns across campus and organizational network environments and captures a diverse set of fourteen distinct alert types, exceeding the coverage of commonly used synthetic APT datasets. In addition, explicit APT campaign states and alert to stage mappings are defined to enable flexible integration of new alert types and support stage aware analysis. A comprehensive statistical characterization of the dataset is provided to facilitate reproducibility and support APT stage predictions.
Paper Structure (18 sections, 6 equations, 10 figures, 3 tables, 2 algorithms)

This paper contains 18 sections, 6 equations, 10 figures, 3 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Related Work
  3. Proposed APT Dataset Generation
  4. Random Alert Generation Module (RAGM)
  5. Random Alert Generation (Non-APT)
  6. Alert Type:
  7. Timestamp and Source IP:
  8. Destination IP assignment:
  9. Destination port assignment:
  10. Host Fields:
  11. APT Attack Reconstruction Module
  12. APT Full-Scenario Alert (AFSA)
  13. APT Sub-Scenario Alert (ASSA)
  14. Alert Clustering Unit
  15. Correlation Indexing Unit
  16. ...and 3 more sections

Figures (10)

  • Figure 1: APT Life-cycle sharma2023advanced
  • Figure 2: Proposed synthetic APT dataset generation pipeline
  • Figure 3: Distribution of the alert types
  • Figure 4: APT campaign progression timeline
  • Figure 5: APT steps distribution
  • ...and 5 more figures