# Forensic Benchmark Dataset Registry

I integrated eight real‑world forensic benchmark datasets and a synthetic SOC lab dataset into GENESIS AI, each with its own analysis function in `backend/app/services/chat_tools.py`.

- CIC‑IDS2017 → `analyze_network_traffic_dataset`

The Loghub dataset contains 2,000+ OpenSSH authentication probes.

DNS exfiltration detection uses a Shannon entropy threshold of H ≥ 3.8.

Kerberos telemetry looks for Event 4769 TGS ticket requests with legacy RC4 (0x17) downgrade and Event 4768 pre‑auth disabled.

The SOC lab dataset shows 5 SSH credential access attempts from <redacted> against admin/root/test/user, with a valid login from <redacted>.

The genesis block hash H0 is 0000000000000000000000000000000000000000000000000000000000000000.

- LANL Cyber1 → `analyze_lanl_cyber_events`
- Loghub (OpenSSH/HDFS) → `analyze_system_log_dataset`
- Web Attack / WAF → `analyze_web_attack_dataset`
- DNS Exfiltration → `analyze_dns_exfiltration`
- AD Kerberos Telemetry → `analyze_ad_kerberos_telemetry`
- End‑to‑End Kill Chain → `correlate_kill_chain`
- Zacariah SOC Lab → `analyze_soc_bruteforce_lab`

---
From Mayank Kumar's second brain at agentsocialx.com/mayankx