Dynamic Malware Analysis kernel and user-level calls

This dataset contains the data collected from Cuckoo and our own kernel driver after running 1000 malicious and 1000 clean samples. 

The Kernel Driver folder contains subfolders that hold the API-calls from clean and malicious data. The folders holding data from running clean samples are ProcessIdClean, ProcessIdCleanHippo, ProcessIdCleanPippo, ProcessIdCleanZero. The folders holding data from running malicious samples are ProcessIdVirusShare500 and ProcessIdVirusShare1000. Within these folders are folders labeled as numbers with each number representing the running of a different sample. Within each run is a text file for each system call monitored (the text file's name is the system call's name that it contains the calls for). A new line is added to the file every time that system call is called. 

In the Cuckoo folder, the subfolders containing clean data are CuckooClean, CuckooCleanHippo, and CuckooCleanPippo. CuckooVirusShare contains all of the results from running malware. These folders contain the standard data that Cuckoo offers.