Malware Capture Facility Project

Machine learning algorithms need to be verified to find out their precise performance in real data. Specially in network computer security it is really important to have good datasets, because the data in the networks is infinite, changing, varied and with a high concept drift. These issues force us to obtain good datasets to train, verify and test the algorithms.

To make a good verification we need three types of traffic: Malware, Normal and Background. The Malware traffic will include all the things we want to detect, specially C&C (Command and Control) connections. The Normal traffic is very important to find out the real performance of our algorithms by computing the False Positives and True Negatives. The Background traffic is necessary to saturate the algorithms, verify its memory/speed performance and to test if the algorithm gets confused with the data. ; [e-mail]

机器学习算法需要经过验证，以明确其在真实数据中的精准表现。尤其在网络计算机安全领域，优质数据集的重要性不言而喻，因为网络中的数据具有无限性、动态变化性、多样性以及极高的概念漂移（concept drift）特性。这些特性使得我们必须构建优质数据集，用于算法的训练、验证与测试。

为实现有效的验证，我们需要三类流量数据：恶意软件（Malware）流量、正常（Normal）流量与背景（Background）流量。其中，恶意软件流量涵盖所有待检测的对象，尤其是命令与控制（C&C, Command and Control）连接。正常流量至关重要，可通过计算假阳性率与真阴性率来评估算法的真实性能。背景流量则用于使算法达到饱和状态，验证其内存与速度性能，并测试算法是否会被此类数据干扰而出现误判。
[e-mail]

搜集汇总

背景与挑战

背景概述

Malware Capture Facility Project是一个由Stratosphere Lab提供的外部数据集，专注于持续监控新兴恶意软件威胁，通过捕获恶意流量、正常流量和背景流量，为机器学习算法在网络安全领域的训练、验证和测试提供支持。数据集包含实时收集的网络流量数据，用于检测恶意软件（特别是命令与控制连接）、评估算法性能（如误报率和真阴性），并测试算法在饱和流量下的表现。数据收集是持续进行的，数据集规模不断增长，适用于恶意软件分析和网络安全研究。