sarimahsan101/hpc-intrusion-dataset

Server-4 Hardware Performance Counter Dataset

  

Author

Syed Muhammad Sarim Ahsan

Description

The Server-4 Hardware Performance Counter (HPC) dataset is a real-world, high-fidelity microarchitectural dataset designed for empirical security and performance analysis in cloud environments. Collected on a virtual machine node powered by an AMD EPYC Turin processor running Ubuntu 22.04 LTS (Linux kernel 5.15) under full KVM hypervisor virtualization, the dataset captures low-level processor execution dynamics across 29,994 high-frequency samples. Data collection was performed using the Linux perf stat subsystem with a 300 ms sampling window and randomized anti-aliasing inter-measurement jitter. To simulate diverse execution environments, synthetic workload stressors were generated via stress-ng pinned to CPU Core 0, reserving Core 1 for profiler logging to prevent measurement bias. The workload matrix comprises normal operational baseline activity alongside seven distinct attack and stressor categories—cache, cpu, memory, branch, tlb, io, and mixed—each executed across three intensity levels (low, medium, and high). The dataset is structured around five core hardware performance counter features: cache_misses (L1/L2/L3 miss events), cache_references (total cache access attempts), instructions (retired CPU instructions), cycles (elapsed CPU clock cycles), and branch_misses (mispredicted branch instructions). Ground-truth binary labels are categorized as 0 for Normal baseline traffic (15,000 samples, 50.01%) and 1 for Attack workloads (14,994 samples, 49.99%), establishing a perfectly balanced 50/50 class distribution. This dataset is explicitly curated to serve as a benchmark for training and evaluating Hardware-based Intrusion Detection Systems (HIDS), supervised Machine Learning classifiers, unsupervised Anomaly Detection models, and microarchitectural Cross-VM Generalization and domain-shift research.

Dataset Loading via Hugging Face datasets

from datasets import load_dataset

# Load directly from Hugging Face Hub
dataset = load_dataset("your-hf-username/server4-hpc-dataset")

# Convert to Pandas DataFrame
df = dataset["train"].to_pandas()
print("Dataset shape:", df.shape)
print(df.head())

Quick Dataset Overview

• —Dataset File: `data/hpc_dataset_train_20260624_134745.csv`
• —Dataset Size: 29,994 samples (rows)
• —Hardware Platform: AMD EPYC Turin (2 vCPUs, KVM Hypervisor)
• —Operating System: Ubuntu 22.04.5 LTS (5.15.0-181-generic kernel)
• —Profiling Tool: Linux perf stat
• —Class Ratio: 50/50 Balanced (15,000 Normal vs. 14,994 Attack)

Features & Labels Summary

Hardware Performance Counter Features

1. 1.cache_misses: L1/L2/L3 cache miss count per 300 ms sample.
2. 2.cache_references: Total cache read and write attempts.
3. 3.instructions: Retired instruction throughput.
4. 4.cycles: Total CPU clock cycles elapsed.
5. 5.branch_misses: Mispredicted branch count.

Labels

• —0 = Normal (Baseline operational activity, 15,000 samples)
• —1 = Attack (Synthetic microarchitectural stressor workload, 14,994 samples)

Attack Categories (attack_type)

• —cache: Cache hierarchy contention stressors
• —cpu: Matrix multiplication arithmetic CPU stressors
• —memory: Virtual memory allocation stressors
• —branch: Pipeline branch target buffer stressors
• —tlb: Translation Lookaside Buffer shootdown stressors
• —io: Disk I/O latency stressors
• —mixed: Concurrent multi-resource stressors

Repository File Structure

server4-hpc-dataset-v1.0/
│
├── data/
│   └── hpc_dataset_train_20260624_134745.csv   # Direct uncompressed CSV dataset file (29,994 rows)
│
├── README.md                                    # Hugging Face Dataset Card & Documentation
├── DATASET_REPORT.pdf                           # PDF technical analysis report
├── LICENSE                                      # Creative Commons Attribution 4.0 International
├── CITATION.cff                                 # Citation File Format (v1.2.0)
├── metadata.json                                # Zenodo dataset deposit metadata
├── hpc.sh                                       # Data collection shell script
├── explain_server_4_data.py                     # Python script to analyze & report on dataset
├── upload_to_huggingface.py                     # Script to upload dataset directly to HF Hub
└── checksums.txt                                # SHA-256 integrity verification manifest

License

This dataset is released under the [Creative Commons Attribution 4.0 International License (CC BY 4.0)](LICENSE).

Citation

Please cite the Zenodo DOI when using this dataset in your research:

@dataset{ahsan_2026_server4_hpc,
  author       = {Syed Muhammad Sarim Ahsan},
  title        = {Server-4 Hardware Performance Counter Dataset},
  month        = jul,
  year         = 2026,
  publisher    = {Zenodo},
  version      = {v1.0},
  doi          = {10.5281/zenodo.21641252},
  url          = {https://doi.org/10.5281/zenodo.21641252}
}