The detection of advanced persistent threats (APTs) remains a crucial challenge due to their stealthy, multistage nature and the limited availability of realistic, labeled datasets for systematic evaluation. Synthetic dataset generation has emerged as a practical approach for modeling APT campaigns; however, existing methods often rely on computationally expensive alert correlation mechanisms that limit scalability. Motivated by these limitations, this paper presents a near realistic synthetic APT dataset and an efficient alert correlation framework. The proposed approach introduces a machine learning based correlation module that employs K Nearest Neighbors (KNN) clustering with a cosine similarity metric to group semantically related alerts within a temporal context. The dataset emulates multistage APT campaigns across campus and organizational network environments and captures a diverse set of fourteen distinct alert types, exceeding the coverage of commonly used synthetic APT datasets. In addition, explicit APT campaign states and alert to stage mappings are defined to enable flexible integration of new alert types and support stage aware analysis. A comprehensive statistical characterization of the dataset is provided to facilitate reproducibility and support APT stage predictions.

翻译：高级持续性威胁（APTs）的检测因其隐秘性、多阶段特性以及可用于系统性评估的真实标记数据集的稀缺性，仍然是一个关键挑战。合成数据集生成已成为模拟APT攻击活动的一种实用方法；然而，现有方法通常依赖于计算成本高昂的告警关联机制，限制了可扩展性。针对这些局限性，本文提出了一种近乎真实的合成APT数据集和一个高效的告警关联框架。所提出的方法引入了一个基于机器学习的关联模块，该模块采用K最近邻（KNN）聚类与余弦相似度度量，在时间上下文中对语义相关的告警进行分组。该数据集模拟了校园和组织网络环境中的多阶段APT攻击活动，并捕获了十四种不同的告警类型，其覆盖范围超过了常用的合成APT数据集。此外，定义了明确的APT攻击活动状态以及告警到阶段的映射，以支持新告警类型的灵活集成和阶段感知分析。本文提供了数据集的全面统计特征描述，以促进可复现性并支持APT阶段预测。