cometadata/datacite-titles-descriptions-related-identifiers huggingface dataset:
DOI: 10.23721/100/1504346
title: intelmq

description: IntelMQ is a solution for IT security teams (CERTs & CSIRTs, SOCs, abuse departments, etc.) for collecting and processing security feeds (such as log files) using a message queuing protocol. It's a community driven initiative called IHAP (Incident Handling Automation Project) which was conceptually designed by European CERTs/CSIRTs during several Info Sec events. Its main goal is to give to incident responders an easy way to collect & process threat intelligence thus improving the incident handling processes of CERTs.
DOI: 10.23721/100/1504348
title: Android Malware and Normal permissions dataset

description: This dataset contains 18,850 normal android application packages and 10,000 malware android packages which are used to identify the behaviour of malware application on permission they need at run-time.
DOI: 10.23721/100/1504349
title: 10 Days DNS Network Traffic from April-May, 2016

description: Campus DNS network traffic consisting of more than 4000 active users (in peak load hours) for 10 random days in the month of April-May, 2016 is available in hourly PCAP files in the dataset. (At present only traffic for Day0(Full) and Day1(partial) could be uploaded due to 10GB data limit)
DOI: 10.23721/100/1504347
title: Labeled IP flows with their Application Protocol

description: The data presented here was collected in a network section from Universidad Del Cauca, Popayán, Colombia by performing packet captures at different hours, during morning and afternoon, over six days (April 26, 27, 28 and May 9, 11 and 15) of 2017. A total of 3.577.296 instances were collected and are currently stored in a CSV (Comma Separated Values) file. The dataset contains 87 features. Each instance holds the information of an IP flow generated by a network device i.e., source and destination IP addresses, ports, interarrival times, layer 7 protocol (application) used on that flow as the class, among others. Most of the attributes are numeric type but there are also nominal types and a date type due to the Timestamp.
DOI: 10.23721/100/1504350
title: CrackStation's Password Cracking Dictionary

description: The format of the list is a standard text file sorted in non-case-sensitive alphabetical order. Lines are separated with a newline "\n" character. The list is responsible for cracking about 30% of all hashes given to CrackStation's free hash cracker. The dataset is a comprehensive list containing every wordlist, dictionary, password database leak, every word in the Wikipedia databases, as well as lots of books from Project Gutenberg.
DOI: 10.23721/100/1504351
title: Bruteforce Database

description: Dictionaries included in the dataset: 8-more-passwords.txt sorting only passwords with more than 8 characters, removed all numeric passes, removed consecutive characters (3 characters or more), removed all lowercase passwords, passwords without a capital letter and also a number (61.682 password). 7-more-passwords.txt it consists of passwords 7 characters or more, and numeric passwords removed (528.136 passwords). 1000000_password_seclists.txt 1.000.000 password from SecLists bitcoin-brainwallet.lst bitcoin-brainwallet with 394.748 lines usernames.txt collection username of/at US - 403.355 lines us-cities.txt list 20.580 cities at US facebook-firstnames.txt 4.347.667 of Facebook firstnames. 2151220-passwords.txt 2.151.220 passwords from dazzlepod.com subdomains-10000.txt 10.000 subdomain for domain scanner. 38650-password-sktorrent.txt 38.650 passwords from sktorrent.eu. uniqpass_v16_password.txt UNIQPASS is a large password list for use with John the Ripper (JtR) wordlist mode to translate large number of hashes, e.g. MD5 hashes, into cleartext passwords indo-cities.txt list 102 cities at Indonesia 38650-username-sktorrent.txt 38.650 usernames from sktorrent.eu. forced-browsing every wordlist needed for forced browsing
DOI: 10.23721/100/1504352
title: santa

description: Santa consists of a kernel extension that monitors for executions, a userland daemon that makes execution decisions based on the contents of a SQLite database, a GUI agent that notifies the user in case of a block decision and a command-line utility for managing the system and synchronizing the database with a server. It is named Santa because it keeps track of binaries that are naughty or nice.
DOI: 10.23721/100/1504353
title: Ultimate Hosts Blacklist

description: The Ultimate Hosts Blacklist for all Unix, Linux and Windows Operating Systems. The Ultimate Unified Hosts file for protecting your network, computer, smartphones and Wi-Fi devices against millions of bad web sites. Use this Hosts File to protect your network, your children and your family from gaining access to millions of bad web sites. Protect your wifi network, computers and smartphone devices from being infected with Malware or Ransomware. Our hosts file is for use on any operating system to block bad domains out of your servers or devices. Information is gathered from multiple sources, tested regularly and merged into one massive hosts file and updated daily.
DOI: 10.23721/100/1504354
title: Wordpress Comment Blacklist

description: The dataset contains a list of keywords and other text arrangements in .txt format for use with Wordpress. With Wordpress, the file can be used as a comment blacklist, which has been shown to be just as effective as commercial solutions such as Akismet.
DOI: 10.23721/100/1504355
title: NetWorkPacketCapture

description: NetWorkPacketCapture has the ability to: It can display every network connection established by the selected client in real time. Ability to parse and view https (not open source) and http package content. By default, the captured data is saved and the saved records can be viewed. The packet capture data can be automatically parsed and saved. Support https capture (temporarily not open source), support image, GZIP, GIF and other formats. Support the selection of the corresponding APP for packet capture.
DOI: 10.23721/100/1504356
title: PcapPlusPlus

description: PcapPlusPlus enables decoding and forging capabilities for a large variety of network protocols. It also provides easy to use C++ wrappers for the most popular packet processing engines such as libpcap Packet reassembly - unique implementation of TCP Reassembly which includes TCP retransmission, out-of-order TCP packets and missing TCP data, and IP Fragmentation and Defragmentation to create and reassemble IPv4 and IPv6 fragments PcapPlusPlus consists of 3 libraries: Packet++ - a library for parsing, creating and editing network packets Pcap++ - a library for intercepting and sending packets, providing network and NIC info, stats, etc. It is actually a C++ wrapper for packet capturing engines such as libpcap, WinPcap, DPDK and PF_RING Common++ - a library with some common code utilities used by both Packet++ and Pcap++
DOI: 10.23721/100/1504366
title: ICS Cyber Attack Energy Management System Dataset

description: The data in the file Event_Export_082217.csv includes 30 days of events as logged by an Energy Management System (EMS) at an investor owned utility in the United States of America. Data in the file has been anonymized by changing the names of operators, devices, and facilities. Events in the data are arranged in rows where each row is a unique event, except the first row which gives names of the columns.
DOI: 10.23721/100/1504357
title: Libnet

description: Libnet is an API to help with the construction and handling of network packets. It provides a portable framework for low-level network packet writing and handlin. Libnet includes packet creation at the IP layer and at the link layer as well as a host of supplementary and complementary functionality. Libnet is very handy with which to write network tools and network test code. See the main page and sample test code for more detailed information.
DOI: 10.23721/100/1504358
title: Gophish

description: Gophish is a phishing framework that makes the simulation of real-world phishing attacks dead-simple. The idea behind gophish is simple – make industry-grade phishing training available. Gophish is written in the Go programming language. This has the benefit that gophish releases are compiled binaries with no dependencies.
DOI: 10.23721/100/1504359
title: Modlishka

description: Modlishka implements an entirely new and interesting approach of handling browser-based HTTP traffic flow, which allows to transparently proxy multi-domain destination traffic, both TLS and non-TLS, over a single domain, without a requirement of installing any additional certificate on the client. Modlishka can be currently used to: Support ethical phishing penetration tests with a transparent and automated reverse proxy component that has a universal 2FA “bypass” support. Automatically poison HTTP 301 browsers cache and permanently hijack non-TLS URLS. Diagnose and hijack browser-based applications HTTP traffic from the "Client Domain Hooking" attack perspective. Wrap legacy websites with TLS layer, confuse crawler bots and automated scanners, etc.
DOI: 10.23721/100/1504360
title: dnstwist

description: dnstwist takes in your domain name as a seed, generates a list of potential phishing domains and then checks to see if they are registered. Additionally it can test if the mail server from MX record can be used to intercept misdirected corporate e-mails and it can generate fuzzy hashes of the web pages to see if they are live phishing sites. Key features: A wide range of efficient domain fuzzing algorithms Unicode domain names (IDN) Multithreaded job distribution Queries A, AAAA, NS and MX records Evaluates web page similarity with fuzzy hashes to find live phishing sites Tests if MX host (mail server) can be used to intercept misdirected e-mails Additional domain variants using dictionary files GeoIP location information Grabs HTTP and SMTP service banners WHOIS lookups for creation and modification date Output in CSV and JSON format
DOI: 10.23721/100/1504361
title: king-phisher

description: King Phisher features an easy to use, yet very flexible architecture allowing full control over both emails and server content. King Phisher can be used to run campaigns ranging from simple awareness training to more complicated scenarios in which user aware content is served for harvesting credentials. Features: Run multiple phishing campaigns simultaneously Send email with embedded images for a more legitimate appearance Optional Two-Factor authentication Credential harvesting from landing pages SMS alerts regarding campaign status Web page cloning capabilities Integrated Sender Policy Framework (SPF) checks Geo location of phishing visitors Send email with calendar invitations
DOI: 10.23721/100/1504362
title: pythem

description: pythem can test multiple different types of attacks and phishing instances such as: ARP spoofing - Man-in-the-middle. ARP+DNS spoof - fake page redirect to credential harvester DHCP ACK Injection spoofing - Man-in-the-middle Man-in-the-middle inject BeEF hook SSH Brute-Force attack. Web page formulary brute-force URL content buster Overthrow the DNS of LAN range/IP address Redirect all possible DNS queries to host Get Shellcode from binary Filter strings on pcap files Exploit Development 1: Overwriting Instruction Pointer Exploit Development 2: Ret2libc
DOI: 10.23721/100/1504364
title: ICS Cyber Attack Gas Pipeline Datasets

description: The telemetry streams contained in the dataset include examples of command injection attacks, data injection attacks, and those where no attacks occurred (normal). These datasets were created in collaboration with Justin Beaver and Raymond Borges of Oak Ridge National Laboratories (ORNL). Raw data logs were provided to Justin by the MSU team and the ORNL team formatted these logs into datasets.
DOI: 10.23721/100/1504365
title: ICS Cyber Attack Gas Pipeline and Water Storage Tank Datasets

description: The data sets include network traffic, process control and process measurement features from normal operations and attacks against the two SCADA systems. The data sets are stored in the Attribute Relationship File Format (ARFF) for use with the WEKA software. WEKA is a comprehensive framework that enables researchers to compare and verify machine learning algorithms. Four data sets were created as part of this research. Data Set I contains transactions from the gas pipeline system. Data Set II contains transactions from the water storage tank system. The two data sets were generated from network ?ow records captured with a serial port data logger.Two reduced size data sets were also created. Data Set III is a gas pipeline system data set, which was created by randomly selecting 10% of the instances in Data Set I. Likewise, Data Set IV is a water storage tank system data set,which was created by randomly selecting 10% of the instances in Data Set II.
DOI: 10.23721/100/1504368
title: BoNeSi Botnet Simulator

description: BoNeSi is a network traffic generator for different protocol types. The attributes of the created packets and connections can be controlled by several parameters like send rate or payload size or they are determined by chance. It spoofs the source ip addresses even when generating tcp traffic. Therefor it includes a simple tcp-stack to handle tcp connections in promiscuous mode. For correct work, one has to ensure that the response packets are routed to the host at which BoNeSi is running. Therefore BoNeSi cannot used in arbitrary network infrastructures. The most advanced kind of traffic that can be generated are http requests. BoNeSi generates ICMP, UDP and TCP (HTTP) flooding attacks from a defined botnet size (different IP addresses). BoNeSi is highly configurable and rates, data volume, source IP addresses, URLs and other parameters can be configured.
DOI: 10.23721/100/1504369
title: Telnet IoT Honeypot

description: This project implements a python telnet server trying to act as a honeypot for IoT Malware which spreads over horribly insecure default passwords on telnet servers on the internet.The honeypot works by emulating a shell environment, just like cowrie. The aim of this project is primarily to automatically analyse Botnet connections and "map" Botnets by linking different connections and even Networks together. The application has a client/server architecture, with a client (the actual honeypot) accepting telnet connections and a server which receives information about connections and does the analysis. The backend server exposes a HTTP interface which is used to access to frontend as well as by the clients to push new Connection information to the backend.
DOI: 10.23721/100/1504370
title: Hale

description: The main idea with Hale is to help botnet hunting and research to collaborate by creating a network of sensors (Hale monitors). To improve this idea, a XMPP bot is available to connect to a centralized XMPP server where currently two different group rooms are used for coordinating between sensors and a room for sharing logs and files. The coordination room makes use of botnet hashes that are made out of the unique keys in the botnet settings, in this way, two botnets don't have to be monitored simultaneously that have the same hash (identity) and improves utilization. To help 3rd parties to make use of this network, a bot can join the coordination room and ask a sensor to start tracking a botnet if its untracked by sending the configurations for it. Additionally, in the share room, 3rd party bots can get their hands on logs and files captured by the sensors in real time. To assist with log history the web API can be used that support GET requests.
DOI: 10.23721/100/1504371
title: cyberprobe

description: The probe, cyberprobe has the following features: The probe can be tasked to collect packets from an interface and forward any which match a configurable address list. The probe can be configured to receive Snort alerts. In this configuration, when an alert is received from Snort, the IP source address associated with the alert is dynamically targeted for a period of time. In such a configuration, the system will collect data from any network actor who triggers a snort rule and is thus identified as a potential attacker. The probe can optionally run a management interface which allows remote interrogation of the state, and alteration of the configuration. This allows dynamic alteration of the targeting map, and integration with other systems. The probe can be configured to deliver on one of two standard stream protocols. The monitor tool, cybermon has the following features: Collects packets delivered in stream protocols. Decodes packet protocols in and raises events in near-real-time. Decoded information is made available to user-configurable logic to define how the decoded data is handled. A simple configuration language is used (LUA) and example configurations are provided to monitor data volumes, display data hexdumps, or stash the data in files. Packet forgery techniques are included, which allow resetting TCP connections, and forging DNS responses. This can be invoked from your LUA in order to fight back against attacks on your network. Has a pub/sub delivery mechanism with subscribers for ElasticSearch, Google BigQuery and Gaffer graph store. Supports IP, TCP, UDP, ICMP, HTTP and DNS protocols, currently. The cybermon software includes some support for STIX as a threat indicator specification, and can create alerts on the presence of threats on the network.
DOI: 10.23721/100/1504372
title: ossec-hids

description: OSSEC is a full platform to monitor and control your systems. It mixes together all the aspects of HIDS (host-based intrusion detection), log monitoring and SIM/SIEM together in a simple, powerful and open source solution. OSSEC has a powerful correlation and analysis engine, integrating log analysis, file integrity monitoring, Windows registry monitoring, centralized policy enforcement, rootkit detection, real-time alerting and active response. It runs on most operating systems, including Linux, OpenBSD, FreeBSD, MacOS, Solaris and Windows.
DOI: 10.23721/100/1504373
title: Security Onion

description: Security Onion is a free and open source Linux distribution for intrusion detection, enterprise security monitoring, and log management. It includes Elasticsearch, Logstash, Kibana, Snort, Suricata, Bro, Wazuh, Sguil, Squert, NetworkMiner, and many other security tools.
DOI: 10.23721/100/1504374
title: PHPIDS

description: PHPIDS (PHP-Intrusion Detection System) is a simple to use, well structured, fast and state-of-the-art security layer for your PHP based web application. The IDS neither strips, sanitizes nor filters any malicious input, it simply recognizes when an attacker tries to break your site and reacts in exactly the way you want it to. Based on a set of approved and heavily tested filter rules any attack is given a numerical impact rating which makes it easy to decide what kind of action should follow the hacking attempt. This could range from simple logging to sending out an emergency mail to the development team, displaying a warning message for the attacker or even ending the user’s session. PHPIDS enables you to see who’s attacking your site and how and all without the tedious trawling of logfiles or searching hacker forums for your domain
DOI: 10.23721/100/1504375
title: Acra

description: Acra provides selective encryption, multi-layered access control, database leakage prevention, and intrusion detection capabilities in a convenient, developer-friendly package. Acra was specifically designed for web and mobile apps with centralised data storage, including with distributed, microservice-rich applications. Supports client-side and proxy-side encryption. Works for SQL databases and (limited functionality) for NoSQL databases. Acra's cryptographic design ensures that no secret (password, key, etc.) leaked from the application or database will be sufficient for decryption of the protected data chunks that originate from it. Acra minimises the leakage scope, detects unauthorised behavior, and prevents the leakage, informing operators of the incident underway.
DOI: 10.23721/100/1504376
title: Waidps

description: WAIDPS is an open source wireless swissknife written in Python and work on Linux environment. This is a multipurpose tools designed for audit (penetration testing) networks, detect wireless intrusion (WEP/WPA/WPS attacks) and also intrusion prevention (stopping station from associating to access point). Apart from these, it will harvest all WiFi information in the surrounding and store in databases. This will be useful when it comes to auditing a network if the access point is ‘MAC filtered’ or ‘hidden SSID’ and there isn’t any existing client at that moment.
DOI: 10.23721/100/1504377
title: expose

description: Expose allows for two kinds of processing - real-time as the request comes in and delayed (queued). This can be controlled by setting the the queueRequests parameter on the run method in the Manager. If it is set to true, Expose will take the request data and insert it into the data store. By default, queuing is disabled. Real-time reporting will process the impact scores of the matching rules and report back the results. These results can be fetched with the getReports method (as shown above). You’re then free to do with the results as you wish. Queued processing can be handled by something like a cron job using the command-line tool. When enabled, the request data is pushed into the data store with a processed value of false. The CLI then grabs the latest entries from this queue and processes them against the rules. The results are either directly outputted in a JSON format or can be written to an external file.
DOI: 10.23721/100/1504378
title: Psad Intrusion Detection System

description: The Port Scan Attack Detector psad is a lightweight system daemon written in is designed to work with Linux iptables/ip6tables/firewalld firewalling code to detect suspicious traffic such as port scans and sweeps, backdoors, botnet command and control communications, and more. It features a set of highly configurable danger thresholds (with sensible defaults provided), verbose alert messages that include the source, destination, scanned port range, begin and end times, TCP flags and corresponding nmap options, reverse DNS info, email and syslog alerting, automatic blocking of offending IP addresses via dynamic configuration of iptables rulesets, passive operating system fingerprinting, and DShield reporting. In addition, psad incorporates many of the TCP, UDP, and ICMP signatures included in the Snort intrusion detection system. to detect highly suspect scans for various backdoor programs (e.g. EvilFTP, GirlFriend, SubSeven), DDoS tools (Mstream, Shaft), and advanced port scans (SYN, FIN, XMAS) which are easily leveraged against a machine via nmap. psad can also alert on Snort signatures that are logged via fwsnort, which makes use of the iptables string match extension to detect traffic that matches application layer signatures. As of the 2.4.4 release, psad can also detect the IoT default credentials scanning phase of the Mirai botnet.
DOI: 10.23721/100/1504379
title: BriarIDS

description: A simple yet effective IDS for the Raspberry PI. BriarIDS is configured to work with Raspbian and takes advantage of the PyQT GUI frontend for an all-in-one solution that monitors your home network. Bro is now integrated into the BriarIDS GUI for additional logging options. This is a home network based IDS solution using Suricata that primarily monitors WAN traffic.
DOI: 10.23721/100/1504380
title: AndroZoo

description: The dataset currently contains 9,524,608 different APKs, each of which has been (or will soon be) analysed by tens of different AntiVirus products to know which applications are detected as Malware. This dataset is provided to contribute to ongoing research efforts, as well as to enable new potential research topics on Android Apps.