cometadata/datacite-titles-descriptions-related-identifiers huggingface dataset:
DOI: 10.23721/100/1504321
title: Toxic IP Addresses, Domains and Usernames

description: IP Addresses are provided in two formats, CIDR (IP network and subnet) and as IP Addresses ranges. Two domain lists are provided. The "exact" domain lists domains that have been blacklisted in the API, and should be compared as in an identical match. The "partial" domain lists provides partial domains where a domain is often seen with many sub-domains or registered in bulk, and used in such a way as to avoid hash/string matching (eg spamdomain.com is listed to detect joe@aa.spamdomain.com, bob@bb.spamdomain.com, sue@cc.spamdomain.com). The data below is an appendum to to the table above, as it provides a filtered version of the "toxic_domains_whole" file. The filtered data removed domains that appear in the Top 1,000,000 Alexa domains list. Each file removed a domain from the toxic domain list if that domains appears in the top specified domains. eg toxic_domains_whole_filtered_10000 will remove a domain from the toxic list if that domains appears in the top 10,000 Alexa domains.
DOI: 10.23721/100/1504322
title: 2017 SUEE Dataset

description: The 2017 SUEE Dataset is comprised of PCAP files that display network traffic and contain various HTTP attacks. Internal hosts are hosts from within the university network, some of them are cable bound, others connect through one of two wifi services on campus (eduroam and welcome). The data was mixed with attack traffic. The attacks contained in these data sets are: 50 attackers running slowloris (IP addresses 10.128.0.1 to 10.128.0.50) 50 attackers running slowhttptest (IP addresses 10.128.0.50 to 10.128.0.100) 50 attackers running slowloris-ng (IP addresses 10.128.0.100 to 10.128.0.150)
DOI: 10.23721/100/1504323
title: ISOT Botnet Dataset

description: Two separate datasets containing malicious traffic from the French chapter of the honeynet project [1] involving the Storm and Waledac botnets were used. Waledac is currently one of the most prevalent P2P botnets and is widely considered as the successor of the Storm botnet with a more decentralized communication protocol. Unlike Storm using overnet as a communication channel, Waledac utilizes HTTP communication and a fast-flux based DNS network exclusively. To represent non-malicious, everyday usage traffic, two different were incorporated datasets, one from the Traffic Lab at Ericsson Research in Hungary [2] and the other from the Lawrence Berkeley National Lab (LBNL) [3]. The Ericsson Lab dataset contains a large number of general traffic from a variety of applications, including HTTP web browsing behavior, World of Warcraft gaming packets, and packets from popular bittorrent clients such as Azureus. We also incorporated all the datasets from the LBNL trace data to provide additional non-malicious background traffic.
DOI: 10.23721/100/1504324
title: Rampart Research, Inc (R2) - VxURL Malware Dataset

description: This dataset was obtained from Rampart Research, Inc (R2), a not-for-profit organization focused on serving the needs of the international information security community. Rampart Research maintains VxPortal, a web portal of malware samples repository. There are an estimated of 1.12 million malware samples from VxPortal, collected or submitted from 2013 - 2015. The underlying application runs on VxCage, a WSGI Python application for managing a malware samples repository with a REST API interface. The datasets are in various formats such as: - Documents (PDF, HTML, RSS + XML, Word ...) - BitTorrent - Images (PNG, GIF, JPEG...) - Audio and Visuals (OGG, SMAF, MPEG...) - Adobe Flash - Java application - Archives (RAR, 7zip, Zip, Gzip ...) - Portable Executables
DOI: 10.23721/100/1504325
title: SecureAge Malware Dataset

description: Researchers will find this collection useful as a training set for machine learning purposes or for binary analysis. SecureAge develops and refines PKI-based data security products. For more information about SecureAge, visit https://www.secureage.com/
DOI: 10.23721/100/1504326
title: Project Sonar (Rapid7 Open Data)

description: Project Sonar gathers data in two stages. In the first stage, this involves scanning all public IPv4 addresses in an attempt to determine which have the respective service port open. Once an IP is identified as meeting these criteria, collection activities take place which involve connecting to and communicating with the service.
DOI: 10.23721/100/1504335
title: Ether Malware Analysis Dataset

description: Collection method: Samples were collected between January and March 2008 from honeypots, mail filters, proxy monitors, web crawling, file sharing networks, and other sources. To classify the samples, we surveyed them using PEiD, a signature-based packer detector, and a PEiD signature database from SANS ISC. The resulting set consisted of 25,118 malware instances, unique according to MD5 value. Date range of data: January - March 2008 Number of malware instances: 25,118
DOI: 10.23721/100/1504336
title: Mal-API-2019 Dataset

description: The dataset contains malware samples from eight different families: 832 spyware samples, 1001 downloader samples, 1001 trojan samples, 1001 worms samples, 379 adware samples, 891 dropper samples, 1001 virus samples, and 1001 backdoor samples. The associated study seeks to obtain data which will help to address machine learning based malware research gaps. The specific objective of the study is to build a benchmark dataset for Windows operating system API calls of various malware.
DOI: 10.23721/100/1504337
title: The Veris Community Database (VCDB)

description: VERIS and its accompanying dataset (VCDB) aim to provide not only a repository of widespread publicly collected incidents, but a common language for describing these incidents. The overall goal is to cooperatively learn from past experiences for better risk management, and to collect data for all publicly available data breaches. The repository contains individual JSON files for each incident in the dataset, including the original URLs used when coding the cases. The dataset collects information on publicly disclosed data breaches and drives the publication of the Verizon Data Breach Investigations Report (DBIR) annually.
DOI: 10.23721/100/1504298
title: Android Malware Dataset

description: We installed 5,000 of the collected samples (426 malware and 5,065 benign) on real devices. Our malware samples in the CICAndMal2017 dataset are classified into four categories: Adware Ransomware Scareware SMS Malware Our samples come from 42 unique malware families. The family kinds of each category and the numbers of the captured samples are as follows: Adware Dowgin family, 10 captured samples Ewind family, 10 captured samples Feiwo family, 15 captured samples Gooligan family, 14 captured samples Kemoge family, 11 captured samples koodous family, 10 captured samples Mobidash family, 10 captured samples Selfmite family, 4 captured samples Shuanet family, 10 captured samples Youmi family, 10 captured samples Ransomware Charger family, 10 captured samples Jisut family, 10 captured samples Koler family, 10 captured samples LockerPin family, 10 captured samples Simplocker family, 10 captured samples Pletor family, 10 captured samples PornDroid family, 10 captured samples RansomBO family, 10 captured samples Svpeng family, 11 captured samples WannaLocker family, 10 captured samples Scareware AndroidDefender 17 captured samples AndroidSpy.277 family, 6 captured samples AV for Android family, 10 captured samples AVpass family, 10 captured samples FakeApp family, 10 captured samples FakeApp.AL family, 11 captured samples FakeAV family, 10 captured samples FakeJobOffer family, 9 captured samples FakeTaoBao family, 9 captured samples Penetho family, 10 captured samples VirusShield family, 10 captured samples SMS Malware BeanBot family, 9 captured samples Biige family, 11 captured samples FakeInst family, 10 captured samples FakeMart family, 10 captured samples FakeNotify family, 10 captured samples Jifake family, 10 captured samples Mazarbot family, 9 captured samples Nandrobox family, 11 captured samples Plankton family, 10 captured samples SMSsniffer family, 9 captured samples Zsone family, 10 captured samples In order to acquire a comprehensive view of our malware samples, we created a specific scenario for each malware category. We also defined three states of data capturing in order to overcome the stealthiness of an advanced malware: Installation: The first state of data capturing which occurs immediately after installing malware (1-3 min). Before restart: The second state of data capturing which occurs 15 min before rebooting phones. After restart: The last state of data capturing which occurs 15 min after rebooting phones. For feature Extraction and Selection, we captured network traffic features (.pcap files), and extracted more than 80 features by using CICFlowMeter-V3 during all three mentioned states (installation, before restart, and after restart). See our publicly available Android Sandbox.
DOI: 10.23721/100/1504299
title: Anomaly Detection Dataset(CSE-CIC-IDS2018)

description: The dataset includes seven different attack scenarios: Brute-force, Heartbleed, Botnet, DoS, DDoS, Web attacks, and infiltration of the network from inside. The attacking infrastructure includes 50 machines and the victim organization has 5 departments and includes 420 machines and 30 servers. The dataset includes the captures network traffic and system logs of each machine, along with 80 features extracted from the captured traffic.
DOI: 10.23721/100/1504300
title: Sherlock

description: The dataset is essentially a massive time-series dataset spanning nearly every single kind of software and hardware sensor that can be sampled from a Samsung Galaxy S5 smartphone, without root privileges. The dataset contains over 600 billion data points in over 10 billion data records. Some examples of the sampled sensors are: Resource utilization per running App (CPU, memory, …) Call/SMS logs Location WiFi Signal strength Network statistics And many more… (see the dataset description here) These sensors where sampled as a rate rivaling other similar datasets, some features sampled at a rate of up to once every second! More interestingly, we provide explicit labels (timestamps + descriptions) which capture exactly when malware on the device is performing its malicious activities. With these labels, you can use the dataset as a benchmark for your machine learning algorithms.
DOI: 10.23721/100/1504301
title: ADFA-IDS

description: ADFA-WD (Windows dataset) was generated on a Windows XP Service Pack 2 host OS with the XP default firewall enabled for all attacks, and file sharing enabled, a network printer configured, wireless and Ethernet networking. Norton AV 2013 was used to scan certain payloads. FTP server, web server and management tool, and streaming audio digital radio package were activated. A target ratio of 1 : 10 : 1 =normal data:validation data:attack data was used to guide collection and structuring activities. Vectors: TCP ports, web based vectors, browser attacks, and malware attachments Effects: Bind shell, reverse shell, exploitation payload, remote operation, staging, system manipulation, privilege escalation, data exfiltration, and back-door insertion.
DOI: 10.23721/100/1504302
title: Aktaion Dataset

description: Data was collected from multiple sources, most notably contagiodump.blogspot.com and malware-traffic-analysis.net as PCAP data. Due to license restrictions, the shared data is limited to the example data, which is in ARFF format, and derived from the raw PCAP data in two steps: PCAP to Bro format conversion, and then feature extraction (microbehaviors) to ARFF (using Aktaion). Aktaion is a lightweight Java virtual machine based project for detecting exploits (and more generally attack behaviors). The project is meant to be a learning/teaching tool on how to blend multiple security signals and behaviors into an expressive framework for intrusion detection. The key abstraction we wanted to prototype is the idea of a micro behavior. This concept helps to provide an expressive mechanism to add high level IOCs such as timing behavior of a certain malware family in parallel to simple statistics, rules or anything relevant to building a programmatic description of a sequential evolving set of adverse behaviors.
DOI: 10.23721/100/1504303
title: CSDMC2010 Malware API Sequence Dataset

description: Malware calls are classified and labeled '1' and benign software calls are labeled '0'. The calls are presented in sequential order. CSDM_API_Train.csv contains 388 logs. CSDM_API_TestData.csv contains 378 unclassified logs. CSDM_API_TestLable.csv contains the classifications for CSDM_API_TestData.csv. This data was collected by API monitors during a data mining competition at the International Conference on Neural Information Processing (ICNIP) in Sydney, Austrailia 2010.
DOI: 10.23721/100/1504304
title: Linux Redhat 7.1 System Deployed in a Honeynet Logs

description: The data has no sanitization or anonymization; the data is provided unmodified (and no modifications are needed or required to use the data for research). The following system logs were collected: /var/log/messages, /var/log/secure, /var/log/pacct, /var/log/httpd/access_log, /var/log/httpd/error-log, /var/log/mailog, /var/log/squid/access_log, /var/log/squid/store_log, /var/log/squid/cache_log, some other applications which write log data under /var The raw logs are provided as-is, with no post-processing (sanitization or anonymization) performed.
DOI: 10.23721/100/1504305
title: Malware Training Sets

description: One of the most challenging tasks during Machine Learning processing is to define a great training (and possible dynamic) dataset. Assuming a well known learning algorithm and a periodic learning supervised process what you need is a classified dataset to best train your machine. Thousands of training datasets are available out there, but no great classified datasets for malware analyses exist. This dataset was created to share with the scientific community (and everybody interested on it) in order to give to everyone a base point to start with Machine Learning for Malware Analysis. The collected dataset is composed by the following samples: APT1 292 Samples Crypto 2024 Samples Locker 434 Samples Zeus 2014 Samples
DOI: 10.23721/100/1504306
title: Web Attack Payloads

description: Requests extracted from either packet captures or log files of capture the flag (ctf) events. Mostly raw data so not all requests are actual payloads, however requests should be deduplicated.
DOI: 10.23721/100/1504414
title: The Drebin Dataset

description: To foster research on Android malware and to enable a comparison of different detection approaches, we make the datasets from our project Drebin publicy available. The samples have been collected in the period of August 2010 to October 2012 and were made available to us by the MobileSandbox project.
DOI: 10.23721/100/1504307
title: HTTPS and SSH Collection-1 Dataset

description: The captures span from 1 hour to 10 hours in duration and are captured from an HTTPS and SSH server within the network. Because these captures were performed in a controlled environment, we can guarantee that no malware or any other malicious behavior is present. The network consists of 1,022 nodes, of which 844 incorporate autonomous web crawling activity, and 36 incorporate autonomous SSH interactions.
DOI: 10.23721/100/1504308
title: M0DROID Dataset

description: This dataset comes bundled with the M0DROID mobile malware analysis tool, which is designed to detect Android malware using signatures derived from system call requests of individual Android APKs. The data was generated using real Android APKs as input, and signatures as output. The dataset comprises these signatures. The tool to generate the signatures is designed by the authors, and is called the server analyzer.
DOI: 10.23721/100/1504309
title: Shadowbrokers EternalBlue/EternalRomance PCAP Dataset

description: These PCAPs capture the actual exploits in action, on target systems that had not yet been patched to defeat to the exploits. The EternalBlue PCAP data uses a Windows 7 target machine, whereas the EternalRomance PCAP data uses a Windows 2008r2 target machine. Also included is EternalBlue PCAP data for a patched Windows 7 target machine showing the failed exploit.
DOI: 10.23721/100/1504310
title: Dark Net Markets Data Collection: Dream Market Dataset

description: This collection contains data about products advertised on Dark Net Markets in 2016 including (product name, category, description, shipping_options, shipping departure, shipping destination, price, and payment method) and sellers including (seller_name, member_since(date), pgp key, seller's description, feedback rating). This dataset was collected from Dream Market by developing special purpose crawler in python and was parsed via Beautiful Soup. The data format is a self-contained mySQL dump fil which contains two dump files, one for product listings and the other one for sellers. mySQL is required to import the dump file.
DOI: 10.23721/100/1504327
title: Malrec Dataset

description: Malrec, a malware sandbox system, uses PANDA's whole-system deterministic record and replay to capture high-fidelity, whole-system traces of malware executions with low time and space overheads. The Malrec system and dataset can help provide a standardized benchmark for evaluating the performance of future dynamic analyses.
DOI: 10.23721/100/1504328
title: LBNL-FTP-PKT

description: The trace ran from Jan 10-19, 2003, containing 22 thousand connections and 3.2 million packets. The connections are between 320 distinct servers and 5832 distinct clients. The traces have been "sanitized" using the Bro anonymizer to remove private information, such as passwords and remote client identity.
DOI: 10.23721/100/1504329
title: King Data

description: King estimates RTT between any two hosts in the Internet by estimating the RTT between their domain name servers. In order to do this, King depends on the following fact which hold true for most of the domain name servers in the current Internet. Most domain name servers in the current Internet (~75%-80%) support recursive queries from any host in the Internet. The accuracy of King depends crucially on another fact about the domain name servers in the Internet. In many cases the name servers are located close (measured as network latency) to their hosts. While the first fact is the result of a default choice by many name server administrators the second fact arises more out of administrative convenience than anything else.
DOI: 10.23721/100/1504339
title: Insider Threat Test Dataset

description: The CERT Division, in partnership with ExactData, LLC, and under sponsorship from DARPA I2O, generated a collection of synthetic insider threat test datasets. These datasets provide both synthetic background data and data from synthetic malicious actors. Datasets are organized according to the data generator release that created them. Most releases include multiple datasets (e.g., r3.1 and r3.2). Generally, later releases include a superset of the data generation functionality of earlier releases. Each dataset file contains a readme file that provides detailed notes about the features of that release. The answer key file answers.tar.bz2 contains the details of the malicious activity included in each dataset, including descriptions of the scenarios enacted and the identifiers of the synthetic users involved.
DOI: 10.23721/100/1504340
title: Software Assurance Reference Dataset

description: The programs are in C, C++, Java, PHP, and C# and cover more than 150 classes of weaknesses, such as SQL injection, cross-site scripting (XSS), buffer overflow, and use of a broken cryptographic algorithm. Most are automatically generated synthetic programs, each a few pages of code long, but there are also over 7000 full-sized applications. In addition, SARD has production code and has hundreds of cases written by hand. The code is typical quality. It is neither pristine nor obfuscated. Many cases have corresponding “good” cases, in which weaknesses are fixed, to test for false positives. The SARD web interface allows users to browse test cases and test suites or search for test cases by programming language, weakness type, file name, size, words in the description, and several other criteria. The user can select and download any or all of the resulting cases. Each test case has metadata to describe it. Most bugs or weaknesses are recorded in metadata. Weaknesses are classified using the Common Weakness Enumeration (CWE) ID and name. We plan to add their Bugs Framework (BF) class and attributes.
DOI: 10.23721/100/1504341
title: Pwned Passwords List

description: The entire set of passwords is downloadable with each password being represented as either a SHA-1 or an NTLM hash to protect the original value (some passwords contain personally identifiable information) followed by a count of how many times that password had been seen in the source data breaches. The list may be integrated into other systems and used to verify whether a password has previously appeared in a data breach after which a system may warn the user or even block the password outright.
DOI: 10.23721/100/1504342
title: Volatility

description: The Volatility Framework is a completely open collection of tools,implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.The extraction techniques are performed completely independent of the system being investigated but offer visibility into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research.
DOI: 10.23721/100/1504343
title: PcapXray

description: Given a Pcap File, plot a network diagram displaying hosts in the network, network traffic, highlight important traffic and Tor traffic as well as potential malicious traffic including data involved in the communication.
DOI: 10.23721/100/1504344
title: opencti

description: OpenCTI has been created in order to structure, store, organize and visualize technical and non-technical information about cyber threats. The structuration of the data is performed using a knowledge schema based on the STIX2 standards. It has been designed as a modern web application including a GraphQL API and an UX oriented frontend.
DOI: 10.23721/100/1504345
title: dawnscanner

description: Dawnscanner is raising security scanner for ruby web applications. dawnscanner is a source code scanner designed to review your ruby code for securityissues. dawnscanner is able to scan plain ruby scripts (e.g. command line applications) butall its features are unleashed when dealing with web applications source code.dawnscanner is able to scan major MVC (Model View Controller) frameworks, out of thebox (Ruby on Rails, Sinatra, Padrino) When Dawnscanner is run on your code, it parses your project for the gems used and it tries to detect the ruby interpreter version you are using or you declared in your ruby version management tool you like most (RVM, rbenv, ...). Then the tool tries to detect the MVC framework your web application uses and it applies the security check accordingly. There checks designed to match rails application or checks that are applicable to any ruby code. Dawnscanner can also understand the code in your views and to back track sinks to spot cross site scripting and SQL injections introduced by the code you actually wrote. Dawnscanner security scan result is a list of vulnerabilities with some mitigation actions you want to follow in order to build a stronger web application.