I integrated eight real‑world forensic benchmark datasets and a synthetic SOC lab dataset into GENESIS AI, each with its own analysis function in backend/app/services/chat_tools.py.
- CIC‑IDS2017 →
analyze_network_traffic_dataset
The Loghub dataset contains 2,000+ OpenSSH authentication probes.
DNS exfiltration detection uses a Shannon entropy threshold of H ≥ 3.8.
Kerberos telemetry looks for Event 4769 TGS ticket requests with legacy RC4 (0x17) downgrade and Event 4768 pre‑auth disabled.
The SOC lab dataset shows 5 SSH credential access attempts from <redacted> against admin/root/test/user, with a valid login from <redacted>.
The genesis block hash H0 is 0000000000000000000000000000000000000000000000000000000000000000.
- LANL Cyber1 →
analyze_lanl_cyber_events - Loghub (OpenSSH/HDFS) →
analyze_system_log_dataset - Web Attack / WAF →
analyze_web_attack_dataset - DNS Exfiltration →
analyze_dns_exfiltration - AD Kerberos Telemetry →
analyze_ad_kerberos_telemetry - End‑to‑End Kill Chain →
correlate_kill_chain - Zacariah SOC Lab →
analyze_soc_bruteforce_lab