Public intrusion datasets are often criticised as “too clean”: benign traffic that is too regular, artefacts, and labelling errors that models learn instead of the attacks. Yet there is no agreed definition of what makes a security dataset realistic, and no standard way to measure it. This thesis is part of the AI4Cyber project at the RMA CyLab, which builds GAKY, an enterprise cyber range for generating labelled security telemetry.
The student will first give a clear definition of realism for security telemetry. They will then define a set of metrics that measure it, and use them for a large, detailed analysis of public datasets. The goal is to show where each dataset is realistic, where it falls short, and why.
| Dimension | Candidate metrics |
|---|---|
| Field distributions | Jensen-Shannon divergence, Wasserstein distance, entropy |
| Timing | Day/week profiles, burstiness, inter-arrival times |
| Diversity | Sequence entropy, share of repeated sessions |
| Graph structure | Degree distribution, communities in user-host and host-host graphs |
| Cross-sensor consistency | Share of network flows with a matching endpoint event |
| Semantic plausibility | LLM or rule-based scoring of file names, URLs, emails |
Yemen Rhouma (RMA CyLab, AI4Cyber). y.RHOUMA@cylab.be