THULab/cyb005_sample

CYB005 — Synthetic Ransomware Attack Simulation (Sample) (TsFile)

Apache TsFile version of xpertsystems/cyb005-sample.

Overview

CYB005 — Synthetic Ransomware Attack Simulation Dataset (Sample) — This is a free preview of the full CYB005 — Synthetic Ransomware Attack Simulation Dataset product. It contains roughly ~10% of the full dataset at identical schema, actor-tier distribution, and statistical fingerprint, so you can evaluate fit before licensing the full product.

• Tables: attack_timelines, campaign_events, campaign_summary, victim_topology
• Rows: 228,426 across 4 TsFile table(s).
  • attack_timelines: 37,489 rows — Time is the source timestep simulation step counter, stored as milliseconds (1 step = 1 ms).
  • campaign_events: 190,137 rows — Time is the source timestep simulation step counter, stored as milliseconds (1 step = 1 ms).
  • campaign_summary: 500 rows — Time is synthetic row index over the stable source order (0 … N-1); the source table has no per-row clock.
  • victim_topology: 300 rows — Time is synthetic row index over the stable source order (0 … N-1); the source table has no per-row clock.

Schema (TsFile structure)

attack_timelines.tsfile

• Time (INT64, milliseconds) — the source timestep simulation step counter, stored as milliseconds (1 step = 1 ms).
• TAG: campaign_id — device dimension(s); query one device with WHERE campaign_id=....
• FIELD (19): actor_id (string), attack_phase (string), files_encrypted_cumulative (int64), encryption_throughput_mbps (double), endpoints_compromised (int64), lateral_move_count (int64), credential_harvest_count (int64), c2_bytes_exfiltrated (double), defender_alert_score (double), detection_outcome (string), blast_radius_pct (double), actor_capability_tier (string), living_off_land_score (double), attribution_risk_score (double), data_exfiltrated_gb (double), wiper_flag (int64), double_extortion_flag (int64), ir_activated (int64), target_segment_id (string)

campaign_events.tsfile

• Time (INT64, milliseconds) — the source timestep simulation step counter, stored as milliseconds (1 step = 1 ms).
• TAG: campaign_id — device dimension(s); query one device with WHERE campaign_id=....
• FIELD (6): actor_id (string), event_type (string), target_segment_id (string), defender_id (string), affected_endpoint_id (string), event_detail (string)

campaign_summary.tsfile

• Time (INT64, milliseconds) — synthetic row index over the stable source order (0 … N-1); the source table has no per-row clock.
• TAG: campaign_id — device dimension(s); query one device with WHERE campaign_id=....
• FIELD (42): actor_id (string), actor_capability_tier (string), ransomware_family (string), operator_model (string), victim_industry_vertical (string), target_segment_id (string), backup_maturity_tier (string), soc_maturity_tier (string), edr_coverage_rate (double), network_segmentation_quality (double), total_dwell_time_hrs (double), endpoints_encrypted_total (int64), blast_radius_pct (double), files_encrypted_total (int64), data_exfiltrated_gb (double), ransom_demand_usd (double), ransom_paid_flag (int64), recovery_time_hrs (double), total_business_downtime_hrs (double), ir_containment_speed_score (double), backup_recovery_success_flag (int64), double_extortion_flag (int64), wiper_component_flag (int64), lateral_move_count_total (int64), credential_harvest_count_total (int64), detection_phase (string), campaign_success_flag (int64), financial_impact_score (double), resilience_score (double), mean_time_to_detect_hrs (double), mean_time_to_contain_hrs (double), edr_alerts_total (int64), siem_fires_total (int64), vss_deletion_success (int64), backup_destruction (int64), worm_spread_flag (int64), coordinated_flag (int64), living_off_land_score (double), lateral_coverage_ratio (double), encrypted_data_recoverability (double), insurance_loss_ratio_score (double), attack_efficiency_score (double)

victim_topology.tsfile

• Time (INT64, milliseconds) — synthetic row index over the stable source order (0 … N-1); the source table has no per-row clock.
• TAG: segment_id — device dimension(s); query one device with WHERE segment_id=....
• FIELD (14): defender_id (string), segment_type (string), soc_maturity_tier (string), backup_maturity_tier (string), edr_coverage_rate (double), network_segmentation_quality (double), patch_posture_score (double), ir_activation_latency_hrs (double), endpoint_count (int64), ad_domain_complexity (double), soc_maturity_score (double), backup_recovery_prob (double), backup_recovery_hrs_mean (double), siem_rule_refresh_cadence_days (int64)

Conversion notes

• Each CSV of the sample is converted into its own TsFile table (4 tables), so no table is merged with another and no column is dropped.
• Event/telemetry tables use the source simulation clock as Time (INT64 milliseconds): timestep step counters and millisecond offsets are stored as-is, minute-based columns are multiplied by 60,000, and ISO/UTC strings are parsed to epoch milliseconds.
• Static inventory/topology/summary tables have no per-row clock; their Time is a synthetic row index (0..N-1) over the stable source order.
• Low-cardinality dimensions of each table (campaign/incident/asset/session ids, phases, labels) are declared as TAG columns; query one simulation with e.g. WHERE campaign_id='...'.

Usage

Install the Apache TsFile Python SDK (pip install tsfile) and read a converted file:

from pathlib import Path
from tsfile import TsFileReader

path = Path("attack_timelines.tsfile")
with TsFileReader(str(path)) as reader:
    schemas = reader.get_all_table_schemas()
    print("tables:", list(schemas))
    table_name = next(iter(schemas))
    table = schemas[table_name]
    columns = [column.get_column_name() for column in table.get_columns()]
    print("columns:", columns)
    field_names = [
        column.get_column_name()
        for column in table.get_columns()
        if column.get_column_name() not in {"Time", "time"}
    ]
    if field_names:
        with reader.query_table(table_name, field_names[:3], batch_size=1024) as result:
            batch = result.read_arrow_batch()
            if batch is not None:
                print(batch.to_pandas().head())

Source & license

• Original dataset: xpertsystems/cyb005-sample
• Source card title / publisher: CYB005 — Synthetic Ransomware Attack Simulation (Sample)
• License: cc-by-nc-4.0 (as declared by the original dataset).