Are you looking for a master thesis or an internship?
Here are some ideas...
Public intrusion datasets are often criticised as “too clean”: benign traffic that is too regular, artefacts, and labelling errors that models learn instead of the attacks. Yet there is no agreed definition of what makes a security dataset realistic, and no standard way to measure it. This thesis is part of the AI4Cyber project at the RMA CyLab, which builds GAKY, an enterprise cyber range for generating labelled security telemetry.