MalFe

Please wait ...

Public Datasets

Registry operations for Ransomware Detection Rows: 2940 | Cols: 9 | Reports Used: 3084

Description: Using Registry information to detect ransomware

Dataset SHA256: d84c7f802e81c0cfa32569444019c6d2fd6e9d82b435477b190fbbfa5c07f335

Features (sample):

	category	label	Persistant	Backup	PercentageKeyOpen	PercentageKeyClosed	PercentageCreated	PercentageKeyUnique	SHA256
0	Ransomware	M	0	0	0	0	0	0	bfb9db791b8250ffa8ebc48295c5dbbca757a5ed3bbb01de12a871b5cd9afd5a
1	Ransomware	M	8	0	22	0	0	24	3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
...	...	...	...	...	...	...	...	...	...
2938	Ransomware	M	29	0	33	0	0	0	7757c11c449860e2dd54ae97e05835fb39f89a9c93f32dfc23b258ad49c3622e
2939	Ransomware	M	89	0	32	0	2	1	eb920e0fc0c360abb901e04dce172459b63bbda3ab8152350885db4b44d63ce5

2940 rows × 9 columns

Created by: Avinash
Downloaded 2 times
Comments Enabled: True
Comments: 0

def process(data, filename, sha256, category, malicious):
    try:
        # Implement your data processing here, this function will get called with the data of each 
        # report in the category you have selected along with the filename of the report and hash. 
        # Do your processing and add your data to the features array, and return the features_lables, features, and sha256
        # PLEASE NOTE: THE CODE BELOW SERVES AS AN EXAMPLE ONLY! This example extracts the entropy of the PE Sections. Which can be seen here: https://malfe.cs.up.ac.za/datasets/view/Entropy_of_PE_Sections/5
        ###
        features_labels = ["category", "label", "Persistant", "Backup", "PercentageKeyOpen", "PercentageKeyClosed", "PercentageCreated", "PercentageKeyUnique"]    
        label =   "M" if malicious else "B"
        features = []
        noData = True
        reg = []
        stats = {
            "open": [],
            "close": [],
            "count": 1,
            "keys": [],
            "create": []
        }
        
        if "behavior" in data:
            if "processes" in data["behavior"]:
                for proc in data["behavior"]["processes"]:
                    for call in proc["calls"]: 
                        if call["category"] == "registry":
                            try:
                                stats["count"] = stats["count"] + 1
                                if "open" in call["api"].lower():
                                    stats["open"].append(call["arguments"]["regkey"])
                                if "close" in call["api"].lower():
                                    stats["close"].append(call["arguments"]["regkey"])
                                if "create" in call["api"].lower():
                                    stats["create"].append(call["arguments"]["regkey"])
                                try:
                                    stats["keys"].append(call["arguments"]["regkey"])
                                except:
                                    continue
                            except:
                                continue
            persistant = 0
            backup = 0
            ko = 0
            kc = 0
            ku = 0
            kcc = 0

for k in stats["keys"]:
                if "run" in k.lower():
                    persistant = persistant + 1
                if "service" in k.lower():
                    persistant = persistant + 1
                if "restore" in k.lower():
                    backup = backup + 1

ko = round((len(stats["open"]) / stats["count"])*100)
            kc = round((len(stats["close"]) / stats["count"])*100)
            kcc = round((len(stats["create"]) / stats["count"])*100)
            ku = round((len(list(set(stats["keys"]))) / stats["count"])*100)
         
            features.append([category, label, persistant, backup, ko, kc, kcc, ku])
        ###
        return features_labels, features, sha256
        
    except Exception as e:
        log("|process error| " + filename + " -> " + sha256 + " (" + str(e) + ")")
        pass

July 11, 2024, 11:37 a.m. Public Create New Vesion Download Dataset (275.6 KB)

Please wait ...

Public Datasets

Registry operations for Ransomware Detection Rows: 2940 | Cols: 9 | Reports Used: 3084

Reports Used

Dataset Code

Comments

No comments to display