COMISET: Dataset for the analysis of malicious events in Windows systems

Area of Science:

• Cybersecurity
• Data Science
• Computer Systems

Background:

• Existing event datasets lack sufficient up-to-date information for evaluating threat detection on Windows systems.
• Current datasets have limitations hindering comprehensive threat detection studies.
• There is a critical need for realistic, comprehensive datasets for cybersecurity research.

Purpose of the Study:

• To introduce COMISET, a novel, large-scale dataset for evaluating threat detection and prevention systems.
• To provide a resource with real-time, up-to-date events reflecting current threats and malware obfuscation.
• To facilitate research by offering freely available, labeled cybersecurity event data.

Main Methods:

• Collected real-time events from two distinct environments: a small company lab and a university network.
• Executed real attacks in a lab setting, employing various adversary techniques and tactics.
• Labeled captured events using the MITRE ATT&CK matrix for standardized analysis.

Main Results:

• Generated COMISET, a dataset comprising approximately 250 million malicious and non-malicious events.
• Ensured dataset relevance by incorporating current threats and malware obfuscation techniques.
• Demonstrated the dataset's utility with examples of valuable, labeled events.

Conclusions:

• COMISET is specifically designed to overcome limitations of existing datasets for evaluating threat detection systems.
• The dataset's comprehensive nature and MITRE ATT&CK labeling enhance cybersecurity research capabilities.
• COMISET offers a valuable, freely accessible resource for advancing threat detection and prevention strategies.