Zenodo.org will be unavailable for 2 hours on September 29th from 06:00-08:00 UTC. See announcement.

Dataset Open Access

Dynamic Malware Analysis kernel and user-level calls

Matthew Nunes

DataCite XML Export

<?xml version='1.0' encoding='utf-8'?>
<resource xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://datacite.org/schema/kernel-4" xsi:schemaLocation="http://datacite.org/schema/kernel-4 http://schema.datacite.org/meta/kernel-4.1/metadata.xsd">
  <identifier identifierType="DOI">10.5281/zenodo.1203289</identifier>
      <creatorName>Matthew Nunes</creatorName>
      <affiliation>Main Author</affiliation>
    <title>Dynamic Malware Analysis kernel and user-level calls</title>
    <date dateType="Issued">2018-03-19</date>
  <resourceType resourceTypeGeneral="Dataset"/>
    <alternateIdentifier alternateIdentifierType="url">https://zenodo.org/record/1203289</alternateIdentifier>
    <relatedIdentifier relatedIdentifierType="DOI" relationType="IsVersionOf">10.5281/zenodo.1203288</relatedIdentifier>
    <rights rightsURI="https://creativecommons.org/licenses/by/4.0/legalcode">Creative Commons Attribution 4.0 International</rights>
    <rights rightsURI="info:eu-repo/semantics/openAccess">Open Access</rights>
    <description descriptionType="Abstract">&lt;p&gt;This dataset contains the data collected from Cuckoo and our own kernel driver after running 1000 malicious and 1000 clean samples.&amp;nbsp;&lt;/p&gt;

&lt;p&gt;The Kernel Driver folder contains subfolders that hold the API-calls from clean and malicious data. The folders holding data from running clean samples are&amp;nbsp;ProcessIdClean, ProcessIdCleanHippo, ProcessIdCleanPippo, ProcessIdCleanZero. The folders holding data from running malicious samples are ProcessIdVirusShare500 and ProcessIdVirusShare1000. Within these folders are folders labeled as numbers with each number representing the running of a different sample. Within each run is a text file for each system call monitored (the text file&amp;#39;s name is the system call&amp;#39;s name that it contains the calls for). A new line is added to the file every time that system call is called.&amp;nbsp;&lt;/p&gt;

&lt;p&gt;In the Cuckoo folder, the subfolders containing clean data are CuckooClean, CuckooCleanHippo, and CuckooCleanPippo. CuckooVirusShare contains all of the results from running malware. These folders contain the standard data that Cuckoo offers.&lt;/p&gt;</description>
All versions This version
Views 3,7363,734
Downloads 8,3718,371
Data volume 111.1 TB111.1 TB
Unique views 3,4163,414
Unique downloads 1,3401,340


Cite as