Dataset Information

UMUDGA: A dataset for profiling algorithmically generated domain names in botnet detection.

ABSTRACT: In computer security, botnets still represent a significant cyber threat. Concealing techniques such as the dynamic addressing and the domain generation algorithms (DGAs) require an improved and more effective detection process. To this extent, this data descriptor presents a collection of over 30 million manually-labeled algorithmically generated domain names decorated with a feature set ready-to-use for machine learning (ML) analysis. This proposed dataset has been co-submitted with the research article "UMUDGA: a dataset for profiling DGA-based botnet" [1], and it aims to enable researchers to move forward the data collection, organization, and pre-processing phases, eventually enabling them to focus on the analysis and the production of ML-powered solutions for network intrusion detection. In this research, we selected 50 among the most notorious malware variants to be as exhaustive as possible. Inhere, each family is available both as a list of domains (generated by executing the malware DGAs in a controlled environment with fixed parameters) and as a collection of features (generated by extracting a combination of statistical and natural language processing metrics).

SUBMITTER: Zago M

PROVIDER: S-EPMC7090278 | biostudies-literature | 2020 Jun

REPOSITORIES: biostudies-literature

ACCESS DATA

Publications

UMUDGA: A dataset for profiling algorithmically generated domain names in botnet detection.

Zago Mattia M Gil Pérez Manuel M Martínez Pérez Gregorio G

Data in brief 20200309

In computer security, botnets still represent a significant cyber threat. Concealing techniques such as the dynamic addressing and the domain generation algorithms (DGAs) require an improved and more effective detection process. To this extent, this data descriptor presents a collection of over 30 million manually-labeled algorithmically generated domain names decorated with a feature set ready-to-use for machine learning (ML) analysis. This proposed dataset has been co-submitted with the resear ...[more]

PMID: 32215308

Similar Datasets

Project description:BackgroundCamellias are popular ornamental, tea and woody-oil plants that have been cultivated throughout the world for centuries. To date, over 23,000 cultivars, with more than 45,000 cultivar names including synonyms, have been registered or published. A global digital dataset of Camellia names will provide a validated reference which can then serve to prevent further duplication when selecting names for new cultivars and assist in clearing up some of the confusion that still clings to a few of the old cultivar names. This comprehensive compendium is our review of camellia cultivars through history.New informationThe camellia cultivar names were collected from books and journals, as well as new registrations. These were then reviewed by experts in the online working platform, the Database of International Camellia Register (DICR). After treating and correcting important issues that existed in camellia names, especially those with many re-used names and diacritical marks etc. in Japanese cultivars, a dataset of camellia names from sources throughout the world was summarised from the year 1253 to 2019. To date, a total of 45,210 cultivar names were released by different countries, including 23,887 accepted names and 21,323 synonyms. Excluding 3,944 names believed extinct, a total of 19,944 cultivar names are still in use. Amongst camellia cultivars, most (23,449) were for ornamental use, 429 were additionally used for tea and 228 for oil. Camellia japonica and its hybrids represent 18,141 or 74.10%, followed by those of C. reticulata and its hybrids (1,432 or 5.85%) and C. sasanqua and its hybrids (1,291 or 5.27%). The top five countries of origin are USA (7,502 cultivars), Japan (6,592), Italy (2,833), China (2,066) and Australia (1,216). The data showed the number of camellia cultivars per country is somewhat related to each country's economic prosperity. Managed by the International Camellia Registration team, this is the most comprehensive dataset in the genus Camellia. It will facilitate quick reference and scientific naming for breeders.

Project description:Efforts to correctly detect Forbush decreases (FDs) in the cosmic ray (CR) intensity flux are ongoing (see [2], [7]). The FD data presented here are a part of the data generated in [6] in a recent investigation of the effects of CR anisotropies on the simultaneity of FDs. A part of the simultaneous and non-simultaneous FDs detected from both raw and Fourier transformed CR data are presented. Some of the filtered CR anisotropies are also presented. The datasets are interesting as they provide an opportunity to investigate the interaction of CR anisotropies on FDs. [6] identified FDs from both raw and Fourier transformed CR data. For the FDs identified in the raw data, the impact of diurnal anisopropy was not removed. Additionally, FDs were identified using a careful adjustment for diurnal anisotropy. The results of FD catalogues for ten CR stations are presented. All are calculated with the same method and selection criteria. Thus these catalogues can be united contrary to the indication of [1], allowing comparison of Chree, regression or correction analysis based on CR data from isolated neutron monitors [9]. These data can also be used in the analysis of FD event simultaneity. Several claims on FD event simultaneity by some authors ([5], [8]) using few FDs can be verified using the data. The diagrams show the relationships between raw and Fourier transformed CR data as well as CR anisotropic variations at different locations. The similarities and differences between these figures could be used to discuss the impact of rigidity on diurnal anisotropy and FDs. The quantitative amplitudes of the diurnal anisotropy calculated at the time of FDs could be useful in such investigation. Okike [6] calculated the amplitude of diurnal anisotropies accompanying FDs and are presented here. The large number of strong and small FDs selected from each station for the year 2003 may encourage reanalysis of previous work employing only 3 or 4 FDs in each year. Many studies relating FDs to terrestrial effects have focused on a single FD without strong evidence that it is generalizable to others. This may attract criticism that the conclusions drawn do not extend to all FDs. The diagrams presented here are similar to those presented in [6] for the Climax station. Rather than display separate FD events, the complete intensity variation together with the accompanying FDs are clearly displayed. Solar wind plasma data may be displayed alongside the data for comparative purposes. It is hoped that this approach will answer the numerous objections made to solar-terrestrial analysis involving FDs.

Project description:Botnets are some of the most recurrent cyber-threats, which take advantage of the wide heterogeneity of endpoint devices at the Edge of the emerging communication environments for enabling the malicious enforcement of fraud and other adversarial tactics, including malware, data leaks or denial of service. There have been significant research advances in the development of accurate botnet detection methods underpinned on supervised analysis but assessing the accuracy and performance of such detection methods requires a clear evaluation model in the pursuit of enforcing proper defensive strategies. In order to contribute to the mitigation of botnets, this paper introduces a novel evaluation scheme grounded on supervised machine learning algorithms that enable the detection and discrimination of different botnets families on real operational environments. The proposal relies on observing, understanding and inferring the behavior of each botnet family based on network indicators measured at flow-level. The assumed evaluation methodology contemplates six phases that allow building a detection model against botnet-related malware distributed through the network, for which five supervised classifiers were instantiated were instantiated for further comparisons-Decision Tree, Random Forest, Naive Bayes Gaussian, Support Vector Machine and K-Neighbors. The experimental validation was performed on two public datasets of real botnet traffic-CIC-AWS-2018 and ISOT HTTP Botnet. Bearing the heterogeneity of the datasets, optimizing the analysis with the Grid Search algorithm led to improve the classification results of the instantiated algorithms. An exhaustive evaluation was carried out demonstrating the adequateness of our proposal which prompted that Random Forest and Decision Tree models are the most suitable for detecting different botnet specimens among the chosen algorithms. They exhibited higher precision rates whilst analyzing a large number of samples with less processing time. The variety of testing scenarios were deeply assessed and reported to set baseline results for future benchmark analysis targeted on flow-based behavioral patterns.

Dataset Information

UMUDGA: A dataset for profiling algorithmically generated domain names in botnet detection.

Publications

UMUDGA: A dataset for profiling algorithmically generated domain names in botnet detection.

Similar Datasets

OmicsDI is part of the ELIXIR infrastructure

Tweets