# Guarding against malicious biased threats (GAMBiT) datasets: Revealing cognitive bias in human-subjects red-team cyber range operations

## TL;DR

This paper introduces datasets from experiments on how skilled hackers behave in simulated cyber attacks, capturing their actions and biases for research and analysis.

## Contribution

The paper provides novel multi-modal datasets from red-team cyber range operations to study cognitive bias in attacker behavior.

## Key findings

- Multi-modal data from 19-20 attackers per experiment were collected over 8-hour sessions in a simulated network.
- The datasets include logs, psychometric data, and operational details for modeling attacker behavior and bias-aware analytics.
- The data are publicly available via IEEE DataPort for benchmarking and research purposes.

## Abstract

We present datasets from three large-scale human-subject experiments involving red-team hacking in a cyber range in the Guarding Against Malicious Biased Threats (GAMBiT) project. Across Experiments 1-3 (July 2024-March 2025), 19-20 skilled attackers per experiment conducted two 8-hour days of self-paced operations in a simulated enterprise network (SimSpace Cyber Force Platform) while collecting multi-modal data: self-reports (background, demographics, psychometrics), operational notes, terminal histories, key logs, network packet captures (PCAP), and NIDS alerts (Suricata). Each participant began from a standardized Kali Linux VM and pursued realistic objectives (e.g., target discovery and data exfiltration) under controlled constraints. Derivative curated logs and labels are included. The combined data release supports research on attacker behavior modeling, bias-aware analytics, and method benchmarking. Data are available via IEEE DataPort entries for Experiments 1-3.