frenky-strasak
commented
5 years ago Hi lily, Thanks. From this dataset I chose only captures having HTTPS traffic and also without Mitm proxy interception, because if the Mitm proxy is used during capturing the traffic there is no original certificate.
Example of HTTPS traffic with Mitm proxy can be: https://mcfp.felk.cvut.cz/publicDatasets/CTU-Malware-Capture-Botnet-287-1/
How to recognize HTTPS with Mitm proxy capture?
- It is written in README.md. There should be something like: "Proxy Usage: This capture did use an intermediate proxy."
- More important patern is that a certificate.issuer in bro/x509.log is not original one. There is "O=mitmproxy,CN=mitmproxy".
There plenty of new captures so check it and use it. Good luck! Frenky
coderdr31
asif48
i finish reading your thesis,that is very good.And very thankful for your public code, thank u very much! but i have some questions about the MCFP dataset to trouble you: In the website'https://mcfp.felk.cvut.cz/publicDatasets/', there are 370 CTU-Malware-Capture-Botnet, but theis mention that '59 malware datasets from the Stratosphere Malware Capture Facility Project ',which 59 CTU-Malware-Capture-Botnets do you use? or you download all of 370 CTU-Malware-Capture-Botnet datasets and ...? lily