Seven Years in MWS: Experiences of Sharing Datasets with Anti-malware Research Community in Japan
Mitsuhiro Hatada (Waseda University & NTT Communications Corporation)
Masato Terada (Hitachi Incident Response Team)
Tatsuya Mori (Waseda University)	
anti-Malware engineering WorkShop
http://www.iwsec.org/mws/2014/en.html
Main Objective of MWS

MWS Datasets

Accelerate and expand the activities of antimalware research by sharing attractive
datasets with community.

Features of the datasets are applicable to several attack phases, assist researchers in performing the long-term analysis, andfacilitate the correlation of various datasets collected by different research institutes and industries.

Contributions• To quantify the effectiveness of community
data sharing by tracking the number ofpapers and new researchers that havearisen from the use of our datasets.
• To share the lessons learned from ourexperiences over the past seven years ofsharing datasets with the researchcommunity – from the view point of Dataand Lowering obstacles.

Data• The packet traces have attracted themost newcomers for performing various
analysis such as machine learning.
• The synchronization of the formats
and collection periods of differentdatasets facilitates the identification ofcommon and separate trends of attack.
• The types of datasets have been
flexibly updated to remain abreast of
threat transitions in the wild.

1) Probing: collected by darknet analysis

Adversaries• NICTER Darknet Dataset (’11~’14): packet traces collected from the darkent
monitoring system, NICTER, which covers approximately 210 K unused IPaddresses.

BackscatterDDoS2) Infection: collected by server side and client side honeypot• CCC DATAset (’08~’13): list of hash digests for collected malware samples,
packet traces, and the logs of malware collection collected from server-side,high-interaction distributed honeypots operated by the Cyber Clean Center.
• IIJ MITF Dataset (’12): logs of malware collection collected from server-side,
low-interaction distributed honeypots operated by MITF.
• D3M (’10~’14): packet traces collected from web-client, high-interaction
honeypot, Marionette and dynamic malware analysis sysetm, Botnet Watcher.

Worm

Drive-by download

3) Malware activities: collected by sandbox and forensic analysis

C&C

• PRACTICE Dataset (’13): long-term packet traces collected from the dynamicmalware analysis system operated by the PRACTICE project.
• FFRI Dataset (’13~’14): logs collected from the dynamic malware analysis
system Cuckoo sandbox and yarai analyzer Professional.
• MARS for MWS (’08~’10): memory dump and forensic data collected from thedynamic malware analysis sytstem using not-virtualized machine, MARS.

Seven Years of Experiences
Number of published papers related to malware in the largest
domestic Computer Security Symposium in Japan.
50!

• The technical obstacles of datacollection such as developing andoperating honeypots.
• The simple procedure for accessingthese datasets as much as possible inorder to to make the datasets available
to any researcher wishing to conductanti-malware research using datasets.
• The descriptions of the datasets inJapanese to avoid the neglect ofstudents who are less capable with theEnglish language.

40!

# of papers

Lowering obstacles

MWS launched

Other sessions!

20!

’08	
# of groups	
28	
# of groups w/ contraction	 25	# of new groups	
2	’09	48	27	5	’10	54	33	2	’11	59	26	2	’12	
71	30	3	’13	
83	38	3	’14	
86	
31	-	• The number of research groups tripled from ’08 to ’14.
• Roughly 30 groups constantly used of the datasets.
• New research groups have arisen every year.

MWS sessions!

30!

MWS community growth (As of Jul. 12, 2014)* The new research groups: not worked in malware-related research in the past and theirfirst paper on malware-related research was presented at MWS.

10!
0!

'03!

'04!

'05!

'06!

'07!

'08!

'09!

'10!

'11!

'12!

Year
• The launch of MWS has significantly contributed to theincrease in the number of papers.
• Interestingly, the number of papers presented at othersessions has increased.

'13!

Number of published papers used MWS Datasets.
(As of Jul. 12, 2014)’10	
Journal (en)	
0	Journal (ja)	
2	Conference Proc.	 4	Subtotals	
6	’11	
2	1	3	6	’12	0	2	5	7	’13	4	3	2	9	’14	1	
1	0	
2	Total	7	9	14	30	

• The total number of publications has reached 30 in thepast five years.