Mnemosyne DataSets ================== ## Malicious O-Auth Attack Scenario. The dataset is broken down into four subdirectories: * benign-data-cfr-12-18--30 -- This includes data record while users were visting _hxxps://www.cfr.org_, but the website was not compromised at the time. * The directories _compromised-data-cfr-12-30--31_ and _compromised-data-cfr-1-1--3_ represents data collected while the website was compromised (i.e. malicious scripts were being delivered). * Data in _victims-cfr_ is data collected which represents when the user was a victim of the attack. In each directory, there will be a subdirectory, _user-x_ which contains the dataset for user _x_. For each user, they will have subdirectories that represent the websites they were visiting. ``` ~/mnemosyne-datasets/malicious-oauth/benign-data-cfr-12-18--30/user-1$ ls https:--www.cfr.org www-cfr-org ``` Data is partitioned based on which website was being viewed. (NOTE: data in directories that start with _http:--_ can be ignored. This meant there was an error during the crawling). Finally, for each website directory, there will be a _tarball_ which represents the data for a single user visit. ``` ~/mnemosyne-datasets/malicious-oauth/compromised-data-cfr-12-30--31/user-19/www-cfr-org$ ls 1577744083.6159859.tar.gz 1577775596.5461962.tar.gz 1577801363.3086824.tar.gz 1577745036.018119.tar.gz 1577777454.3620234.tar.gz 1577802687.9602113.tar.gz 1577746832.077025.tar.gz 1577781238.6884995.tar.gz 1577803528.5576396.tar.gz 1577772072.6600964.tar.gz 1577791003.6941533.tar.gz 1577806781.739799.tar.gz 1577772346.9669204.tar.gz 1577793729.7052355.tar.gz 1577773119.859776.tar.gz 1577797272.6986675.tar.gz ``` If you decompress one of these files, it will contain a set of csv files, where each csv file represents a set of graph objects. ``` ~/neo4j-csvs$ ls auditor.log scripts.1577744079.08537.csv created.1577744075.330545.csv scripts.1577744084.120851.csv frame-attached.1577744075.329695.csv scripts.1577744113.237513.csv frames.1577744072.725889.csv scripts.1577744144.743648.csv hosts.1577744072.844364.csv scripts.1577744144.788108.csv https:--www.cfr.org.1577744083.6162186.log scripts.1577744144.800462.csv navigation-edges.1577744075.432075.csv scripts.1577744144.807013.csv navigation_profile.csv scripts.1577744144.813677.csv parser.1577744072.78062.csv session.1577744072.111309.csv request-edges.1577744072.196122.csv started.1577744072.112399.csv resources.1577744072.196579.csv user.1577744072.111876.csv response-edges.1577744072.679494.csv Version.1577744075.432783.csv ```