ReadMe

########################################
#####This dataset contains malware######
########################################

Data and ReadMe file provided by the University of Arizona Artificial Intelligence Lab. Citation information below.

EtherMalwareDataset.zip file contains:
EtherMalwareDataset.tar.gz (12.9 GB compressed, 15 GB uncompressed)
readme.txt

Ether is a malware analysis framework which leverages hardware virtualization extensions (specifically Intel VT) to remain transparent to malicious software. This dataset contains 25,118 unique malware instances used to test EtherUnpack against packed malware.

Date range of data: January - March 2008

Number of malware instances: 25,118 

Collection method: Samples were collected between January and March 2008 from honeypots, mail filters, proxy monitors, web crawling, file sharing networks, and other sources. To classify the samples, we surveyed them using PEiD, a signature-based packer detector, and a PEiD signature database from SANS ISC. The resulting set consisted of 25,118 malware instances, unique according to MD5 value.





How to cite this dataset
Author(s): Artem Dinaburg, Paul Royal, Monirul Sharif, Wenke Lee

Title:  Ether Malware Analysis Dataset

Publisher: University of Arizona Artificial Intelligence Lab, AZSecure-data, Director Hsinchun Chen

Location: [AZSecure-data has not yet implemented Digital Object Identifiers or Persistent URLs, please 
copy and paste the location where you retrieve this file from within http://www.azsecure-data.org/]

Publication date: September 2016


IEEE formatted citation:
Dinaburg, A., Royal, P., Sharif, M., & Lee, W. Ether Malware Analysis Dataset, University of Arizona Artificial Intelligence Lab, AZSecure-data, Director Hsinchun Chen. Available http://www.azsecure-data.org/ [September 2016]



Also cite the following related publications:
Dinaburg, A., Royal, P., Sharif, M., & Lee, W. Ether: Malware analysis via hardware virtualization extensions. Paper presented at the 51-62. doi: 10.1145/1455770.1455779


The source code for Ether is available from http://ether.gtisc.gatech.edu


Funding sources: National Science Foundation Grant No. 0716570 and Homeland Security under Contract No. FA8750-08-2-0141.