This dataset includes 104 folders, each representing a different malware experiment run on the cloud. The 104 malware executable were obtained from VirusTotal. The malware mostly fall under the following categories: DDos/Dos, Backdoor, Trojan, Virus, and Worm. The csv files are named on the malware hash used in a particular experiment. Each Experiment is a 60 mins long. The first 30 mins is a benign phase. A single malware is injected randomly during the next 10 mins, followed by 20 mins of malicious phase. During each experiment, performance metrics (e.g., cpu, memory, and disk usage metrics, among others) for all processes running on the VM are captured every 10 second. We record ~360 samples in each experiment with a total of ~37440 samples accros all experiments. Each sample is a vector of all processes' performance metrics recorder at a particular time which makes the actual rows in a csv file 360 X number of processes.
These experiments are done on a testbed running a 3 tier web architecture on the cloud where autoscalability was enabled. Only scaling up was considered, so there is no deletion of VMs due to decreased load. Each experiment run included an entire stack deployed where multiple web servers, application servers and a database server. Note that the malware is injected in a random application server (VM), which means not all experiments csv files has the same number of rows. A malware could be injected in a VM that was spawned later in time because of the autoscalability. More information about the dataset (e.g., generated workload, etc.) can be found in the paper below.
If you are going to use the dataset, please cite our work: