security-datasets

A collection of resources for security data

Malware

Binaries

• Malware Capture Facility Project (downloaded in GoeSec share) http://mcfp.weebly.com/
• A tool to retrieve malware directly from the source for security researchers
  • https://github.com/technoskald/maltrieveMaltrieve
  • http://maltrieve.org/
• Malware Corpus Tracker http://track.h3x.eu/
• Malware Knowledge Base. Hosted by the National Center for High-performance Computing, is a malware analysis platform that observes and records system behaviors conducted by analysis objects in a controlled environment with various types of dynamic analysis tools. https://owl.nchc.org.tw
• Malware Shares
  • http://virusshare.com
  • https://avcaesar.malware.lu
  • http://oc.gtisc.gatech.edu:8080
  • http://www.kernelmode.info/forum/viewforum.php?f=16
  • http://www.malwaregroup.com
  • https://www.threatminer.org/
  • http://www.malshare.com

Web-based Malware

• Threat Glass. Explore web threats. View and analyze thousands of exploited websites http://threatglass.com/

Network Traffic

• List of pcaps and traces from execution of malware samples in PANDA
  • https://github.com/moyix/panda/
  • http://panda.gtisc.gatech.edu/malrec/
• NETRESEC Publicly available PCAP files http://www.netresec.com/?page=PcapFiles
• UNSW-NB15 Raw Network Packets
  • https://www.unsw.adfa.edu.au/australian-centre-for-cyber-security/cybersecurity/ADFA-NB15-Datasets/
• Traffic Analysis Datasets
  • http://www.malware-traffic-analysis.net/
  • http://digitalcorpora.org/corpora/network-packet-dumps
  • https://www.openpacket.org/ (Security Onion 12.04 contains some pcaps from openpacket.org. You can find them at /opt/samples/.)
  • http://www.netresec.com/?page=PcapFiles
  • http://old.honeynet.org/scans/
  • http://www.novell.com/connectionmagazine/laurachappell.html
  • http://cctf.shmoo.com/
  • http://ee.lbl.gov/anonymized-traces.html
  • https://www.openpacket.org/post/showthread/49
  • https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Public_Data_Sets
  • http://wiki.wireshark.org/SampleCaptures#Sample_Captures
  • http://forensicscontest.com/puzzles
  • https://www.evilfingers.com/repository/pcaps.php
  • https://www.openpacket.org/capture
  • http://www.honeynet.org/node/504
  • https://github.com/markofu/hackeire/tree/master/2011/pcap
  • http://www.defcon.org/html/links/dc-ctf.html (You have to follow some of the links, which redirect to competitor blogs but there's lots of goodness).

Threat Intelligence

IOC Databases

• IOC Bucket. Community Supported Threat Intelligence https://www.iocbucket.com/
• Citizen Lab Malware Indicators https://github.com/citizenlab/malware-indicators

Platforms

• Malware Information Sharing Platform http://www.misp-project.org/

CTF Logs

• DEFCON CTF Archive https://www.defcon.org/html/links/dc-ctf.html

Other Collections

• SecRepo.com is a repository of Security Data Samples licensed as Creative Commons for researchers to get their feet wet on data analysis in Information Security. Maintained by Mike Sconzo. http://www.secrepo.com

Tools

• VirusShare-Search. Downloads VirusShare hashes and searches them for specified MD5 hash values https://github.com/AdamGreenhill/VirusShare-Search