# Sources and attribution

SecJev-Corpus v1.0.0 transforms upstream observations into structured decision
questions. Transformations include feature projection, identifier anonymization,
history-window construction, explicit-policy labeling, deduplication, option
permutation, and grouped splitting. Source annotations are not relabeled as
proven real-world attacks. Newly run simulations are identified as SecJev
experiments rather than results reported by the upstream authors.

## CICIoT2023 — 48,000 questions

E. C. P. Neto, S. Dadkhah, R. Ferreira, A. Zohourian, R. Lu, and A. A. Ghorbani.
*CICIoT2023: A real-time dataset and benchmark for large-scale attacks in IoT environment* (2023).

- [Dataset and paper](https://www.unb.ca/cic/datasets/iotdataset-2023.html)
- [CIC redistribution and citation policy, under Common questions](https://www.unb.ca/cic/datasets/index.html)
- Mirror used: `bencorn/CIC-IoT-2023`, revision `dac6afc7c1f6242202abf6059932e4c4d166e662`.

CIC explicitly permits redistribution and mirroring with dataset and paper attribution.
Capture labels remain capture-level annotations; incidental background traffic is possible.

## ToN-IoT — 40,000 questions

[Official dataset and usage conditions](https://research.unsw.edu.au/projects/toniot-datasets).
Free academic research use is granted by the authors; commercial use requires
separate author permission. The source requests citation of the following eight
publications, linked from its official page:

1. Nour Moustafa (2021), network dataset study, *Sustainable Cities and Society*, 102994.
2. Tim M. Booij, Irina Chiscop, Erik Meeuwissen, Nour Moustafa, and Frank T. H. den Hartog (2021), ToN-IoT heterogeneity and feature standardization, *IEEE Internet of Things Journal*.
3. Abdullah Alsaedi, Nour Moustafa, Zahir Tari, Abdun Mahmood, and Adnan Anwar (2020), TON-IoT telemetry dataset, *IEEE Access* 8, 165130–165150.
4. Nour Moustafa, M. Keshk, E. Debie, and H. Janicke (2020), federated Windows datasets, *TrustCom*, 848–855. DOI: 10.1109/TrustCom50675.2020.00114.
5. Nour Moustafa, M. Ahmed, and S. Ahmed (2020), ToN-IoT Linux dataset evaluation, *TrustCom*, 727–735. DOI: 10.1109/TrustCom50675.2020.00100.
6. Nour Moustafa (2019), TON-IoT dataset presentation, *eResearch Australasia*.
7. Nour Moustafa (2019), IoT–Fog–Cloud architecture review. [arXiv:1906.01055](https://arxiv.org/abs/1906.01055).
8. Javed Ashraf et al. (2021), IoTBoT-IDS, *Sustainable Cities and Society*, 103041.

Mirror used: `codymlewis/TON_IoT_network`, revision
`b953d9388d2db3bc392ea7150476e4f219a2a1cb`. Features derive from the fixed network CSV.

## VeReMi NextGen — 22,498 questions

Artur Hermann, Jan-Niklas Remmers, Dennis Eisermann, Benjamin Erb, and Frank Kargl.
*VeReMi NextGen: A Dataset for Evaluating Misbehavior Detection Systems in VANETs*.
[Zenodo record / DOI 10.5281/zenodo.19665762](https://zenodo.org/records/19665762).
License: CC BY 4.0; full notice in `licenses/VeReMi-LICENSE.txt`.

Only validated observation categories enter this corpus. Sender claims are
projected into a common representation. The official independent test boundary is retained.

## Twins / Streamlet — 29,588 questions

[Twins simulator](https://github.com/asonnino/twins-simulator), revision
`3a3215addf3f79cb7b1dd2b0677f4d0896943d0b`; Apache-2.0 notice included.
These are newly sampled controlled experiments using the upstream implementation.
Answers follow the explicit observer certificate policy and visible message history.
A validator ID follows the simulator's physical-author representation; no hidden
attacker identity is inferred.

## ByzFL / FoolsGold / MNIST — 17,000 questions

- [ByzFL](https://github.com/LPD-EPFL/byzfl), EPFL, revision `5830978d991a0900748f7ce901dc3ca532081b26`; MIT.
- [FoolsGold](https://github.com/DistributedML/FoolsGold), revision `0aa55114296a2d3c2bcb6f544a6fae31e8e7b8b4`; MIT.
- Yann LeCun, Corinna Cortes, and Christopher J. C. Burges, MNIST handwritten-digit data, underlying the controlled gradient experiments.

The corpus contains measured update summaries from 80 fresh runs, with separate
MNIST pools across splits and explicit attacker configurations. Original images
are not redistributed. The earlier simulated aggregation-selection tasks are
not part of this release.

## LANL — 7,902 questions

Alexander D. Kent (2015), *Comprehensive, Multi-Source Cyber-Security Events*.
Los Alamos National Laboratory. DOI: 10.17021/1179829.
Related publication: A. D. Kent, *Cybersecurity Data Sources for Dynamic Network
Research*, in *Dynamic Networks in Cybersecurity*, 2015.

[Official data, citation and public-domain dedication](https://csr.lanl.gov/data/cyber1/).
Our questions use visible authentication histories and explicit triage rules.
Unlabeled events are not assigned a confirmed-benign label. The source's
successful-authentication selection bias remains applicable.

## AgentDojo — 4,143 questions

[AgentDojo](https://github.com/ethz-spylab/agentdojo), ETH Zurich SPY Lab and contributors,
revision `089ed468cf3ed0322acc66b0211f26d9d90dbf60`; MIT notice included.
Records are drawn from published tool outputs and attack/control runs. Task and
shared-response components are grouped; shared environment or attack templates
are not a claim of unseen-template evaluation.

## InjecAgent — 1,054 questions

[InjecAgent](https://github.com/uiuc-kang-lab/InjecAgent), UIUC Kang Lab and contributors,
revision `f19c9f2c79a41046eb13c03c51a24c567a8ffa07`; MIT notice included.
This release uses the declared objectives of injected instructions. The
all-positive injection-detection task is excluded.