Introducing the CYSAS-S3 Dataset for Operationalizing a Mission-Oriented Cyber Situational Awareness

Abstract

The digital transformation of the defence sector is not exempt from innovative requirements and challenges, with the lack of availability of reliable, unbiased and consistent data for training automatisms (machine learning algorithms, decision-making, what-if recreation of operational conditions, support the human understanding of the hybrid operational picture, personnel training/education, etc.) being one of the most relevant gaps. In the context of cyber defence, the state-of-the-art provides a plethora of data network collections that tend to lack presenting the information of all communication layers (physical to application). They are synthetically generated in scenarios far from the singularities of cyber defence operations. None of these data network collections took into consideration usage profiles and specific environments directly related to acquiring a cyber situational awareness, typically missing the relationship between incidents registered at the hardware/software level and their impact on the military mission assets and objectives, which consequently bypasses the entire chain of dependencies between strategic, operational, tactical and technical domains. In order to contribute to the mitigation of these gaps, this paper introduces CYSAS-S3, a novel dataset designed and created as a result of a joint research action that explores the principal needs for datasets by cyber defence centres, resulting in the generation of a collection of samples that correlate the impact of selected Advanced Persistent Threats (APT) with each phase of their cyber kill chain, regarding mission-level operations and goals.

State-of-the-Art in Cyber Situational Awareness: A Comprehensive Review and Analysis

“…There's also research that presented datasets for CSA in the power production sector. In this research, methods correlating the impact of selected Advanced Persistent Threats (APTs) with each stage of the cyber kill chain were explored [35]. As a result of this research, a new dataset called Cyber Situational Awareness System (CYSAS)-S3 was introduced.…”

“…The introduction of the CYSAS-S3 dataset, aimed at improving CSA in the power production sector by Medenou Choumanof et al [35], is particularly relevant to network traffic analysis and pattern recognition. By focusing on the relationship between APTs and the cyber kill chain, this research offers an advanced perspective in network traffic analysis, crucial for understanding and mitigating cyber threats.…”

Decision Support Elements and Enabling Techniques to Achieve a Cyber Defence Situational Awareness Capability

“…One of the tangible contributions of my PhD research is to approach a meaningful framework to perform V&V in a general context for CySA tools and solutions including its applicability to decision support systems. This research was conducted together with a research team which results led to a publication (Llopis et al, 2022) where all the various tests that comprise the framework are explained in more depth.…”

“…Another contribution of my PhD research is to approach the creation of meaningful datasets for CySA tools and solutions. This research was conducted together with a research team which results led to a publication (Medenou et al, 2022) where all the features of the synthetic datasets are explained in more depth.…”