Open Repository for the Evaluation of Ransomware Detection Tools

This repository contains the results of running more than 70 samples of ransomware, from different families, dating since 2015. It contains the network traffic (DNS and TCP) and the Input/Output (I/O) operations generated by the malware while encrypting a network shared directory. These data are contained in three files for each ransomware sample: one with the information from the DNS requests, other with the TCP connections another one containing the I/O operations. This information can be useful for testing new and old ransomware detection tools and compare their results.

DOI Link:

10.21227/qnyn-q136

Links:

Cite

Example of DNS requests of one ransomware sample
Example of I/O operations file of one ransomware sample
Example of TCP connections of one ransomware sample
output of 'tree' command of the full directory
Trace files for the version 1 of the 5GB directory. Original scenario
Trace files for the version 2 of the 5GB directory. Original scenario.
Trace files for the version 3 of the 5GB directory. Original scenario.
Trace files for the version 4 of the 5GB directory. Original scenario.
Trace files for the version 5 of the 5GB directory. Original scenario.
Trace files for the version 6 of the 5GB directory. Original scenario.
Trace files for the version 7 of the 5GB directory. Original scenario.
Trace files for the version 8 of the 5GB directory. Original scenario.
Trace files for the version 9 of the 5GB directory. Original scenario
Trace files for the version 10 of the 5GB directory. Original scenario
Trace files for the 10G directory. Original scenario.
Trace files for the 5G directory with different link bandwidth
Text files
Traces files for the 5G directory in NAT scenario
Trace files for the 5G directory in Windows 10 scenario

You must be an IEEE Dataport Subscriber to access these files. Subscribe now or login.

Documentation:

PDF with information about the files and the capture process

IEEE
BibTeX
RIS
APA
Harvard
MLA
Vancouver
Chicago

[1] Eduardo Berrueta, Daniel Morató , Eduardo Magaña, Mikel Izal, "Open Repository for the Evaluation of Ransomware Detection Tools", IEEE Dataport, 2020. [Online]. Available: http://dx.doi.org/10.21227/qnyn-q136. Accessed: Mar. 13, 2025.

@data{qnyn-q136-20,
doi = {10.21227/qnyn-q136},
url = {http://dx.doi.org/10.21227/qnyn-q136},
author = {Eduardo Berrueta; Daniel Morató ; Eduardo Magaña; Mikel Izal },
publisher = {IEEE Dataport},
title = {Open Repository for the Evaluation of Ransomware Detection Tools},
year = {2020} }

TY - DATA
T1 - Open Repository for the Evaluation of Ransomware Detection Tools
AU - Eduardo Berrueta; Daniel Morató ; Eduardo Magaña; Mikel Izal
PY - 2020
PB - IEEE Dataport
UR - 10.21227/qnyn-q136
ER -

Eduardo Berrueta, Daniel Morató , Eduardo Magaña, Mikel Izal. (2020). Open Repository for the Evaluation of Ransomware Detection Tools. IEEE Dataport. http://dx.doi.org/10.21227/qnyn-q136

Eduardo Berrueta, Daniel Morató , Eduardo Magaña, Mikel Izal, 2020. Open Repository for the Evaluation of Ransomware Detection Tools. Available at: http://dx.doi.org/10.21227/qnyn-q136.

Eduardo Berrueta, Daniel Morató , Eduardo Magaña, Mikel Izal. (2020). "Open Repository for the Evaluation of Ransomware Detection Tools." Web.

1. Eduardo Berrueta, Daniel Morató , Eduardo Magaña, Mikel Izal. Open Repository for the Evaluation of Ransomware Detection Tools [Internet]. IEEE Dataport; 2020. Available from : http://dx.doi.org/10.21227/qnyn-q136

Eduardo Berrueta, Daniel Morató , Eduardo Magaña, Mikel Izal. "Open Repository for the Evaluation of Ransomware Detection Tools." doi: 10.21227/qnyn-q136

Dataset Files