Governed research artifact · Published 29 August 2026
Analysis-ready exports behind the statistical study and interactive dashboard, with publication-level provenance, source-linked candidate tags, review controls, and explicit interpretation limits.
The unit of analysis is a publication—not an incident, victim, attack, account, prompt, campaign, or malware sample. Extracted tags, metrics, IOCs, actors, ATT&CK candidates, countries, sectors, providers, and models still require source-level analyst validation.
Twelve governed artifacts
The public package supports recalculating the published distributions and inspecting source IDs, offsets, and provenance fields. The downloaded third-party HTML and PDF archive is intentionally not redistributed.
| Artifact | Grain | Purpose | Size |
|---|---|---|---|
Dataset guideREADME.md | Documentation | Schema, field definitions, interpretation cautions, and reproducibility boundary. | 5.0 KB |
Publicationspublications.csv | One publication | Wide analysis table with eligibility, provenance, tags, metrics, and IOC counts. | 135 KB |
Source-linked normalized tagstags_long.csv | One tag occurrence | Normalized dimensions, confidence, extraction method, source IDs, and source-text offsets. | 531 KB |
Metric candidatesmetrics_long.csv | One candidate metric | Unvalidated percentages, durations, costs, dwell, and blast-radius strings linked by source ID. | 66 KB |
IOC candidatesiocs_long.csv | One candidate observable | Hashes, public IPv4 addresses, and defanged-domain candidates linked by source ID for analyst review. | 36 KB |
Quality and inclusionquality.csv | One publication | Completeness, statistical inclusion, AI relevance, and review-state controls. | 7.9 KB |
Tag dictionarytag_dictionary.csv | One tag type | Definitions and interpretation safeguards for normalized statistical dimensions. | 3.0 KB |
Snapshot summarysummary.json | One dataset snapshot | Machine-readable corpus, quality, and all-record extraction totals. | 1.3 KB |
SQLite databaseai_attack_statistics.sqlite | Relational snapshot | Queryable publication, tag, metric, IOC, and quality tables; private source records are excluded. | 1.3 MB |
Research workbookai_attack_statistics.xlsx | Multi-sheet workbook | Sanitized, filterable analysis package for spreadsheet workflows. | 374 KB |
Collection reportsource-collection-report.md | Collection audit | Retrieval and archive-quality summary without copied third-party source documents. | 2.7 KB |
Uniqueness auditsource-uniqueness-report.tsv | One source comparison | Duplicate and near-duplicate evidence for the publication entities. | 25 KB |
Start here
include_with_manual_validation rows before reproducing primary percentages.publication_id.Spreadsheet safety
Text beginning with =, +, -, or @ is prefixed with an ASCII apostrophe in public CSV and XLSX files. Release tests verify that CSV cells retain no formula-capable prefix and the workbook contains no formula nodes.
Interpret carefully
Publication coverage, multi-label co-mentions, extracted metrics, and candidate observables do not establish unique incidents, causal relations, attribution, provider use, victim geography, or attack rates.
Provenance and uniqueness