---
# System prepended metadata

title: Mnemosyne DataSets

---

Mnemosyne DataSets
==================


## Malicious O-Auth Attack Scenario. 

The dataset is broken down into four  subdirectories:
* benign-data-cfr-12-18--30 -- This includes data record while users were visting _hxxps://www.cfr.org_, but the website was not compromised at the time. 
* The directories _compromised-data-cfr-12-30--31_ and _compromised-data-cfr-1-1--3_   represents data collected while the website was compromised (i.e. malicious scripts were being delivered). 

* Data in _victims-cfr_ is data collected which represents when the user was a victim of the attack. 


In each directory, there will be a subdirectory, _user-x_ which contains the dataset for user _x_. 

For each user, they will have subdirectories that represent the websites they were visiting. 

```
~/mnemosyne-datasets/malicious-oauth/benign-data-cfr-12-18--30/user-1$ ls
https:--www.cfr.org  www-cfr-org
```

Data is partitioned based on which website was being viewed. (NOTE: data in directories that start with _http:--_ can be ignored. This meant there was an error during the crawling).

Finally, for each website directory, there will be a _tarball_ which represents the data for a single user visit. 

```
~/mnemosyne-datasets/malicious-oauth/compromised-data-cfr-12-30--31/user-19/www-cfr-org$ ls
1577744083.6159859.tar.gz  1577775596.5461962.tar.gz  1577801363.3086824.tar.gz
1577745036.018119.tar.gz   1577777454.3620234.tar.gz  1577802687.9602113.tar.gz
1577746832.077025.tar.gz   1577781238.6884995.tar.gz  1577803528.5576396.tar.gz
1577772072.6600964.tar.gz  1577791003.6941533.tar.gz  1577806781.739799.tar.gz
1577772346.9669204.tar.gz  1577793729.7052355.tar.gz
1577773119.859776.tar.gz   1577797272.6986675.tar.gz
```

If you decompress one of these files, it will contain a set of csv files, where each csv file represents a set of graph objects. 


```
~/neo4j-csvs$ ls
auditor.log                                 scripts.1577744079.08537.csv
created.1577744075.330545.csv               scripts.1577744084.120851.csv
frame-attached.1577744075.329695.csv        scripts.1577744113.237513.csv
frames.1577744072.725889.csv                scripts.1577744144.743648.csv
hosts.1577744072.844364.csv                 scripts.1577744144.788108.csv
https:--www.cfr.org.1577744083.6162186.log  scripts.1577744144.800462.csv
navigation-edges.1577744075.432075.csv      scripts.1577744144.807013.csv
navigation_profile.csv                      scripts.1577744144.813677.csv
parser.1577744072.78062.csv                 session.1577744072.111309.csv
request-edges.1577744072.196122.csv         started.1577744072.112399.csv
resources.1577744072.196579.csv             user.1577744072.111876.csv
response-edges.1577744072.679494.csv        Version.1577744075.432783.csv
```



