NapierOne: A modern mixed file data set alternative to Govdocs1

Davies, Simon; Macfarlane, Richard; Buchanan, William J.

doi:10.1016/j.fsidi.2021.301330

Cited by 10 publications

(21 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this paper, we introduce a complementary data set for the Govdocs1 corpus, known as NapierOne [19], which may be used to address the points made above. The Govdocs1 data set and the techniques used to create it provided an excellent template on how to create and curate the NapierOne data set.…”

Section: Paper Contributionmentioning

confidence: 99%

“…In most case, there exist 5,000 example files for each data set and subset. The resulting NapierOne [19] data set contains nearly 500,000 unique files distributed between 100 separate data sets and subsets. A detailed overview of the structure of the data set is shown in Figure 5.…”

Section: Data Set Creationmentioning

confidence: 99%

“…The NapierOne [19] data set is a collection of multiple data subsets each associated with one specific file type or a specific, configuration of a file type. However, on a conceptual level, the individual data subsets can be grouped as follows.…”

Section: File Sourcesmentioning

confidence: 99%

“…As long as the attribution and license stipulations are followed, access to this NapierOne [19] data set for research purposes is free and unrestricted. For access to the data set, visit www.napierone.com or alternatively contact the authors of this paper.…”

Section: Accessmentioning

confidence: 99%

“…5. Each data subset was then documented and curated, with a copy finally being placed for public use on the www.napierone.com website [19].…”

Section: Paper Contributionmentioning

confidence: 99%

See 4 more Smart Citations

NapierOne: A modern mixed file data set alternative to Govdocs1

Davies,

Macfarlane,

Buchanan

2022

Preprint

Self Cite

View full text Add to dashboard Cite

It was found when reviewing the ransomware detection research literature that almost no proposal provided enough detail on how the test data set was created, or sufficient description of its actual content, to allow it to be recreated by other researchers interested in reconstructing their environment and validating the research results. A modern cybersecurity mixed file data set called NapierOne is presented, primarily aimed at, but not limited to, ransomware detection and forensic analysis research. NapierOne was designed to address this deficiency in reproducibility and improve consistency by facilitating research replication and repeatability. The methodology used in the creation of this data set is also described in detail. The data set was inspired by the Govdocs1data set and it is intended that NapierOne be used as a complement to this original data set.An investigation was performed with the goal of determining the common files types currently in use. No specific research was found that explicitly provided this information, so an alternative consensus approach was employed. This involved combining the findings from multiple sources of file type usage into an overall ranked list. After which 5,000 real-world example files were gathered, and a specific data subset created, for each of the common file types identified. In some circumstances, multiple data subsets were created for a specific file type, each subset representing a specific characteristic for that file type. For example, there are multiple data subsets for the ZIP file type with each subset containing examples of a specific compression method. Ransomware execution tends to produce files that have high entropy, so examples of file types that naturally have this attribute are also present. The resulting entire data set comprises of a 100 separate data subsets divided between 44 distinct file types, resulting in almost 500,000 unique files in total. A description of the techniques used to gather the files for each file type is provided together with the actions that were performed on the files to confirm that they were of the highest quality and provided an accurate representation of their specific file type. Details are also provided on the content of the entire data set as well as instructions on how researchers can gain free and unlimited access to the final data set.While the data set was initially created to aid research in ransomware detection, it is sufficiently broad and diverse enough to allow for its application in many other areas of research that require a varied mixture of common real-world file examples. The NapierOne data set is an ongoing project and researchers are strongly encouraged to leverage this data set in their own research.

show abstract

Section: Paper Contributionmentioning

confidence: 99%

Section: Data Set Creationmentioning

confidence: 99%

Section: File Sourcesmentioning

confidence: 99%

Section: Accessmentioning

confidence: 99%

“…5. Each data subset was then documented and curated, with a copy finally being placed for public use on the www.napierone.com website [19].…”

Section: Paper Contributionmentioning

confidence: 99%

See 3 more Smart Citations

NapierOne: A modern mixed file data set alternative to Govdocs1

Davies,

Macfarlane,

Buchanan

2022

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

Crypto-Ransomware Detection: A Honey-File Based Approach Using Chi-Square Test

Arakkal,

Pazheri Sharafudheen,

Vasudevan

2023

Information Systems Security

View full text Add to dashboard Cite

Ransomware Detection Using Machine Learning: A Review, Research Limitations and Future Directions

Ispahany,

Islam,

Islam

et al. 2024

IEEE Access

View full text Add to dashboard Cite

Ransomware attacks are on the rise in terms of both frequency and impact. The shift to remote work due to the COVID-19 pandemic has led more people to work online, prompting companies to adapt quickly. Unfortunately, this increased online activity has provided cybercriminals numerous opportunities to carry out devastating attacks. One recent method employed by malicious actors involves infecting corporate networks with ransomware to extract millions of dollars in profits. Ransomware falls into the category of malware. It works by encrypting sensitive data and demanding payments from victims to receive the encryption keys necessary for decrypting their data. The prevalence of this type of attack has prompted governments and organisations worldwide to intensify their efforts to combat ransomware. In response, the research community has also focused on ransomware detection, leveraging technologies such as machine learning. Despite this increased attention, practical solutions for real-world applications remain scarce in the existing literature. Numerous surveys have explored literature within the domain. Still, there is a notable lack of emphasis on the design of ransomware detection systems and the practical aspects of detection, including real-time and early detection. Against this backdrop, our review delves into the existing literature on ransomware detection, specifically examining the machine-learning techniques, detection approaches, and designs employed. Finally, we highlight the limitations of prior studies and propose future research directions in this crucial area.

show abstract

NapierOne: A modern mixed file data set alternative to Govdocs1

Cited by 10 publications

References 27 publications

NapierOne: A modern mixed file data set alternative to Govdocs1

NapierOne: A modern mixed file data set alternative to Govdocs1

Crypto-Ransomware Detection: A Honey-File Based Approach Using Chi-Square Test

Ransomware Detection Using Machine Learning: A Review, Research Limitations and Future Directions

Contact Info

Product

Resources

About