Multi-Source Cybersecurity Logs: An ATT&CK-Labeled Dataset and SLM Evaluation
Abir Ashab Niloy, Ahmed Ryan, Imamul Hossain Rafi, and 2 more authors
arXiv preprint arXiv:2606.18190, 2026
Multi-stage cyberattacks span system, network, and browser logs. Detecting them requires correlating events across all three sources. Machine learning methods can learn these cross-source patterns, but they need labeled multi-source data. Existing public datasets fall short. Network-only datasets such as CICIDS and UNSW-NB15 miss host and browser activity. Host-focused datasets such as LMDG and CICAPT-IIoT lack browser telemetry. ATLAS includes all three sources but labels events only as malicious or benign, without MITRE ATT&CK technique granularity. We close the gap by building a multi-source log dataset of 870 sessions (70 attack, 800 benign) and approximately 2.3 million events, labeled with ATT&CK technique IDs covering 12 tactics and 53 techniques. We fine-tuned three SLMs (Qwen2.5-1.5B, Llama-3.2-3B, Phi-4-Mini) using LoRA and showed chunk classification accuracy rising from 8% to 90–97% after fine-tuning.