Which datasets contains malicious HTTPS traffic?

[hawkinsw]

I just finished reading your thesis -- wonderful! Great job!

I just have a quick question, if you don't mind:

How did you determine which of the CTU-13 and MCFP captures are from malware that communicate via HTTPS? Did you simply download the entire set of captures and assume that any HTTPS connections were spawned by malware communicating over HTTPS? That seems like a reasonable method. I am just curious!

Again, great research and thank you for making your code available so that we can recreate your findings!

Will

[frenky-strasak]

Thanks,

Good question. Each capture from CTU-13 and MCFP dataset has infected IP. So I read the capture flow by flow and if a source IP == infected ip of the flow, then such flow is malicious flow.