# Maintainable Log Datasets for Evaluation of Intrusion Detection Systems

arXiv: https://arxiv.org/abs/2203.08580 · HTML: https://mlsanity.com/paper/2203.08580/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 16 Mar 2022.

## Built on by (most cited first, 10 of 10)

- [Deep Learning for Anomaly Detection in Log Data: A Survey](https://mlsanity.com/paper/2207.03820/) (2022)
- [Incident Response Planning Using a Lightweight Large Language Model with Reduced Hallucination](https://mlsanity.com/paper/2508.05188/) (2025)
- [Automated Alert Classification and Triage (AACT): An Intelligent System for the Prioritisation of Cybersecurity Alerts](https://mlsanity.com/paper/2505.09843/) (2025)
- [A Graph-Based Approach to Alert Contextualisation in Security Operations Centres](https://mlsanity.com/paper/2509.12923/) (2025)
- [CAM-LDS: Cyber Attack Manifestations for Automatic Interpretation of System Logs and Security Alerts](https://mlsanity.com/paper/2603.04186/) (2026)
- [TPLogAD: Unsupervised Log Anomaly Detection Based on Event Templates and Key Parameters](https://mlsanity.com/paper/2411.15250/) (2024)
- [Resource-Aware Deployment Optimization for Collaborative Intrusion Detection in Layered Networks](https://mlsanity.com/paper/2602.11851/) (2026)
- [Detecting and Eliminating Neural Network Backdoors Through Active Paths with Application to Intrusion Detection](https://mlsanity.com/paper/2603.10641/) (2026)
- [Multi-Axis Trust Modeling for Interpretable Account Hijacking Detection](https://mlsanity.com/paper/2603.13246/) (2026)
- [NLLog: Lightweight, Explainable SOC Anomaly Detection via Log-to-Language Rewriting](https://mlsanity.com/paper/2606.04957/) (2026)

## Abstract (arXiv)

Intrusion detection systems (IDS) monitor system logs and network traffic to recognize malicious activities in computer networks. Evaluating and comparing IDSs with respect to their detection accuracies is thereby essential for their selection in specific use-cases. Despite a great need, hardly any labeled intrusion detection datasets are publicly available. As a consequence, evaluations are often carried out on datasets from real infrastructures, where analysts cannot control system parameters or generate a reliable ground truth, or private datasets that prevent reproducibility of results. As a solution, we present a collection of maintainable log datasets collected in a testbed representing a small enterprise. Thereby, we employ extensive state machines to simulate normal user behavior and inject a multi-step attack. For scalable testbed deployment, we use concepts from model-driven engineering that enable automatic generation and labeling of an arbitrary number of datasets that comprise repetitions of attack executions with variations of parameters. In total, we provide 8 datasets containing 20 distinct types of log files, of which we label 8 files for 10 unique attack steps. We publish the labeled log datasets and code for testbed setup and simulation online as open-source to enable others to reproduce and extend our results.