# Data Bounty - 2 : OS Anomaly Detection — Data

来源：https://www.kaggle.com/competitions/data-bounty-2-os-anomaly-detection/data

采集时间：2026-10-19T16:10:28Z

## 📂 Data Description

The dataset provided in this competition captures low-level system activity from a **Linux-based environment**, recorded via **kernel-level monitoring**. Each row reflects a snapshot of process behavior or a system call execution — providing a goldmine for detecting subtle anomalies in OS-level operations.

This data is ideal for tasks in **anomaly detection**, **process behavior analysis**, and **cybersecurity research**.

---

### 📁 Files Included

- **`train.csv`**  
  Labeled training data with detailed process and system call information.

- **`test.csv`**  
  Unlabeled data used for prediction during evaluation.

- **`submission_sample.csv`**  
  A submission template containing the expected output format. Each row should include your predicted anomaly label (`0` or `1`).

---

### 🧬 Feature Overview

Each row in the dataset corresponds to either a process-related event or a system call execution. The features provide insight into the system's behavior:

| Feature             | Description                                                                                 |
|---------------------|---------------------------------------------------------------------------------------------|
| **`processId`**     | Unique process identifier (PID) of the executing process.                                   |
| **`threadId`**      | Thread identifier within the process (typically matches PID for single-threaded processes). |
| **`parentProcessId`** | PID of the parent process that created this process.                                      |
| **`userId`**        | User ID under which the process runs (`0` = root user).                                     |
| **`mountNamespace`** | Identifier for the Linux mount namespace (isolates filesystem views).                     |
| **`argsNum`**       | Number of arguments passed to the system call (may indicate complexity or misuse).         |
| **`returnValue`**   | Return value from the system call (can indicate errors or success).                        |
| **`target`**        | Classification label: `0` = normal, `1` = anomalous (only in `train.csv`).                |

---

### 🔍 Highlights & Insights

- Captures **privileged (root)** and **unprivileged user** processes.
- Tracks **parent-child relationships**, useful for behavioral lineage analysis.
- Includes **namespace isolation context**, hinting at containerized/sandboxed activities.
- Records both **system call behavior** and **execution metadata** for deep OS insights.

This isn't just raw telemetry. It's an opportunity to **build systems that proactively detect threats** before they manifest. Are you ready to dive into the OS and uncover its secrets?

> Let the anomaly hunt begin. 🕵️🔍