S-DAPT-2026: A Stage-Aware Synthetic Dataset for Advanced Persistent Threat Detection

TL;DR

This paper introduces a realistic synthetic dataset for APT detection, along with an efficient alert correlation framework using KNN clustering, to improve multistage threat analysis.

Contribution

It presents a new synthetic APT dataset with explicit campaign states and a machine learning-based alert correlation method for scalable threat detection.

Findings

The dataset covers 14 alert types, surpassing existing datasets.

The correlation framework effectively groups alerts within a temporal context.

Statistical analysis supports reproducibility and APT stage prediction.

Abstract

The detection of advanced persistent threats (APTs) remains a crucial challenge due to their stealthy, multistage nature and the limited availability of realistic, labeled datasets for systematic evaluation. Synthetic dataset generation has emerged as a practical approach for modeling APT campaigns; however, existing methods often rely on computationally expensive alert correlation mechanisms that limit scalability. Motivated by these limitations, this paper presents a near realistic synthetic APT dataset and an efficient alert correlation framework. The proposed approach introduces a machine learning based correlation module that employs K Nearest Neighbors (KNN) clustering with a cosine similarity metric to group semantically related alerts within a temporal context. The dataset emulates multistage APT campaigns across campus and organizational network environments and captures a diverse set of fourteen distinct alert types, exceeding the coverage of commonly used synthetic APT datasets. In addition, explicit APT campaign states and alert to stage mappings are defined to enable flexible integration of new alert types and support stage aware analysis. A comprehensive statistical characterization of the dataset is provided to facilitate reproducibility and support APT stage predictions.