Find research datasets worth reusing
Search datasets from major research repositories and use ShareScore to quickly assess how well each record supports discovery, access, and reuse.
76
datasets available to search
ShareScore release 0.7.1
Dataset results
76 results for “TLS”
Mangrove terrestrial laser scanning (TLS) point clouds and quantitative structural models (QSMs)
<p>Datasets for a publication entitled, "Terrestrial laser scanning for the estimation of above ground biomass of mangrove roots by modelling them as inverted trees."</p> <p>See the file "Data dictionary for Mangrove terrestrial laser scanning.pdf" for a description of the datasets included in the zipped folder. </p>
BRAIN Journal-About the Design of QUIC Firefox Transport Protocol-Figure 2. QUIC vs TLS handshake protocol
<p>Figure 2 describes a sequence diagram using QUIC VS TLS handshake protocol. The right<br> side of Figure 2 shows the seven steps of calls and returns until a HTTP Get() method is<br> successfully implemented using a TLS handshake. In contrast, on the left side of Figure 2, we see<br> the implementation of HTTP Get() method using a single call of QUIC handshake.<br> Firefox is a completely open source browser with a tremendous community support. The<br> latest version of Firefox supports TLS 1.3 protocol in an experimental stage. The primary purpose<br> of this study was integrating the QUIC protocol in the Firefox web browser. The source code of this<br> software product is as large as 650MB. </p> <p> </p>
BRAIN Journal-About the Design of QUIC Firefox Transport Protocol-Figure 1. TLS vs QUIC protocol stack
<p>QUIC addresses many network problems such as the Head Of Line (HOL) blocking as well as the TCP reconnection over a subnet/network change. In addition, QUIC has many features such as connection IDs, which can overcome the challenge of changing networks. In this way, if someone switches from a WIFI network to a cellular network, the connection to the server will not be broken or lost. Paper (Langley and Chang, 2016) described the QUIC crypto protocol, representing the part of QUIC that provides transport security to a connection. The QUIC crypto protocol is now replaced by TLS 1.3. Currently, QUIC provides security of TLS 1.3 (in an experimental stage), considered the highest security standards for the communication protocols (Valsorda; 2016). </p> <p>Figure 1 describes the TLS vs. QUIC protocol user level stack in the context of application layer and transport layer.</p>
Artifacts supplementing the ACM DTRAP 2020 article "Will You Trust This TLS Certificate? Perceptions of People Working in IT (extended version)"
<p>These research artifacts supplement the following two publications:</p> <ul> <li>Will You Trust This TLS Certificate? Perceptions of People Working in IT [ACSAC 2019], DOI 10.1145/3359789.3359800, more details at https://crocs.fi.muni.cz/public/papers/acsac2019</li> <li>Will You Trust This TLS Certificate? Perceptions of People Working in IT (extended version) [ACM DTRAP 2020], DOI 10.1145/3419472, more details at https://crocs.fi.muni.cz/public/papers/dtrap2020</li> </ul> <p>The artifacts contain the full experimental setup (as described in Section 2.1 of the paper) and the complete anonymized dataset underlying the evaluation presented in Sections 3 and 4.</p> <p>The experimental setup contains the documents accompanying the task: the informed consent, pre-task questionnaire, task description, trust scales, and the list of questions posed during the post-task interview (all in PDFs). We further include the custom website with certificate validation documentation for the “redesigned” condition (static HTML). While working on the task, participants in the “redesigned” condition could access this website via a link that was in the redesigned error messages. Furthermore, we provide the software with which the participants interacted. It contains the displayed error messages and validated certificates. These things are available both individually and incorporated in a snapshot of a virtual machine used at the experiment (importable directly into VirtualBox).</p> <p>The collected data is presented in a single dataset (SPSS format; you can use PSPP as a free alternative). It includes the analysis syntax files to obtain the numerical results presented in the paper. For each participant, the dataset contains: 1) pre-task questionnaire answers, 2) reported trust ratings, 3) sub-task timing, 4) information on whether they browsed the Internet and 5) the interview codes assigned. Note that we do not publish the interview transcripts to preserve participant privacy.</p>
Phishing and Benign Domain Dataset (DNS, IP, WHOIS/RDAP, TLS, GeoIP)
<p>The dataset contains DNS records, IP-related features, WHOIS/RDAP information, information from TLS certificate fields, and GeoIP information for 432,572 verified benign domains from Cisco Umbrella and 36,993 verified phishing domains from PhishTank and OpenPhish services. The dataset is useful for statistical analysis of domain data or feature extraction for training machine learning-based classifiers, e.g. for phishing detection. The data was collected between March and July 2023.The final assessment of the data was conducted in July 2023 (this is why the names are suffixed with _2307).</p> <p>The upload contains: a) <strong>data</strong> files, b) the description of the data <strong>structure</strong>, and c) the <strong>veature vector</strong> we used for ML-based phishing domain detection.</p> <h1>Data Files</h1> <p>The data is located in two individual files:</p> <ul> <li><strong>benign_2307.json</strong> - data about 432,572 benign domains, and</li> <li><strong>phishing_2307.json</strong> - data about 36,993 phishing domains.</li> </ul> <h1>Data Structure</h1> <p>Both files are in the JSON Array format. The structure is as follows:</p> <pre><code>[ { "_id" : "A unique ID of the data record", "domain_name" : "Name of the domain (e.g., zenodo.com)", "dns" : { "//": "Data obtained from DNS records" }, "evaluated_on" : "// ISO Timestamp of data collection ", "ip_data" : [ "// Data for each related IP adddress ", { "//": "IP-related data, including RTT from ICMP echo attempts (from Brno, Czechia)", "//": "WHOIS/RDAP data for the given IP address", "//": "GeoIP data for the given IP address", "//": "NERD system reputation score (if available)", "//": "ASN info", "//": "remarks: ISO timestamps of collection of the individual data pieces" }, ], "label" : "benign_2307 for benign OR misp_2307 for phishing", "rdap" : { "//": "WHOIS/RDAP information for the domain name" }, "remarks" : { "dns_evaluated_on" : "ISO Timestamp of DNS data collection", "rdap_evaluated_on" : "ISO Timestamp of WHOIS/RDAP data collection", "tls_evaluated_on" : "ISO Timestamp of TLS certificate information collection", "dns_had_no_ips" : "true if no IPs were found in DNS records" }, "sourced_on" : "ISO Timestamp of the moment the domain was found", "tls" : { "cipher" : "Identifier of the TLS cipher suite", "count" : "Number of certificates in chain", "protocol" : "Version of the TLS protocol", "certificates" : [ "//": "Information from TLS certificate fields: issuer, extensions, etc." ] }, "category" : "Category of the record (could be ignored)", "source" : "Name of the file that we used to save the domain list" } ]</code></pre> <h1>Feature Vector</h1> <p>This section describes the veature vector used in the "Unmasking the Phishermen: Phishing Domain Detection with Machine Learning and Multi-Source Intelligence" paper that was accepted to the IEEE NOMS 2024 conference.</p> <h2>Lexical Features</h2> <p>The following features were extracted from the sole domain name:</p> <ul> <li><strong>lex_name_len</strong> - length of the domain name,</li> <li><strong>lex_begins_with_digit</strong> - true if the domain name begins with a digit,</li> <li><strong>lex_www_flag</strong> - true if the domain name begins with "www.",</li> <li><strong>lex_phishing_keyword_count</strong> - occurence count of 47 phishing-related keywords,</li> <li><strong>lex_consecutive_chars</strong> - length of the longest consecutive character sequence,</li> <li><strong>lex_tld_len</strong> - length of the top-level domain (TLD),</li> <li><strong>lex_tld_hash</strong> - hash of the TLD,</li> <li><strong>lex_sld_len </strong>- length of the second-level domain (SLD),</li> <li><strong>lex_sld_norm_entropy </strong>- normalized entropy of the SLD,</li> <li><strong>lex_stld_unique_char_count </strong>- number of unique characters in the TLD and the SLD,</li> <li><strong>lex_sub_count </strong>- number of subdomains,</li> <li><strong>lex_sub_digit_ratio </strong>- ratio of digits in subdomains,</li> <li><strong>lex_sub_hex_ratio </strong>- ratio of hex symbols in subdomains,</li> <li><strong>lex_sub_non_alpanum_ratio </strong>- ratio of non-alphanumeric symbols in subdomains,</li> <li><strong>lex_sub_vowel_ratio </strong>- ratio of vowels in subdomains,</li> <li><strong>lex_sub_consonant_ratio </strong>- ratio of consonants in subdomains,</li> <li><strong>lex_sub_max_consonant_len </strong>- length of the longest consonant sequence in subdomains,</li> <li><strong>lex_sub_norm_entropy </strong>- normalized entropy of a string made from all subdomains,</li> <li><strong>lex_phishing_bigram_matches</strong> - occurrence count of the top 300 phishing domain bigrams,</li> <li><strong>lex_phishing_trigram_matches</strong> - occurrence count of the top 2000 phishing domain trigrams,</li> <li><strong>lex_phishing_tetragram_matches</strong> - occurrence count of the top 5000 phishing domain tetragrams,</li> <li><strong>lex_phishing_pentagram_matches</strong> - occurrence count of the top 10000 phishing domain pentagrams.</li> </ul> <h2>DNS-based Features</h2> <p>The following features were extracted from DNS responses when querying about the domain:</p> <ul> <li><strong>dns_A_count</strong> - number of A records for the domain,</li> <li><strong>dns_AAAA_count</strong> - number of AAAA records for the domain,</li> <li><strong>dns_CNAME_count</strong> - number of CNAME records for the domain,</li> <li><strong>dns_MX_count</strong> - number of MX records for the domain,</li> <li><strong>dns_NS_count</strong> - number of nameserver (NS) records for the domain,</li> <li><strong>dns_TXT_count</strong> - number of TXT records for the domain,</li> <li><strong>dns_soa_primary_ns_len</strong> - number of characters in the primary NS's domain name,</li> <li><strong>dns_soa_primary_ns_level</strong> - number of subdomain in the primary NS's domain name,</li> <li><strong>dns_soa_primary_ns_digit_count</strong> - number of digits in the primary NS's domain name,</li> <li><strong>dns_soa_primary_ns_entropy </strong>- normalized entropy of the primary NS's domain name,</li> <li><strong>dns_soa_email_len</strong> - number of characters in the admin's email domain name part,</li> <li><strong>dns_soa_email_level</strong> - number of subdomains in the admin's email domain name part,</li> <li><strong>dns_soa_email_digit_count</strong> - number of digits in the admin's email domain name part,</li> <li><strong>dns_soa_email_entropy</strong> - normalized entropy of the admin's email domain name part,</li> <li><strong>dns_soa_refresh</strong> - SOA refresh parameter,</li> <li><strong>dns_soa_retry</strong> - SOA retry parameter,</li> <li><strong>dns_soa_expire</strong> - SOA expire parameter,</li> <li><strong>dns_mx_avg_len</strong> - average number of characters of the domain names in MX records,</li> <li><strong>dns_mx_avg_entropy</strong> - average normalized entropy of the domain names in MX records,</li> <li><strong>dns_domain_name_in_mx </strong>- true if the domain name is contained in the MX record's domains,</li> <li><strong>dns_txt_spf_exists</strong> - true if an SPF record is in the TXT RRs,</li> <li><strong>dns_txt_avg_entropy</strong> - average normalized entropy of the TXT records</li> <li><strong>dns_ttl_low</strong> - number of RRsets with TTL in [0,100],</li> <li><strong>dns_ttl_mid </strong>- number of RRsets with TTL in [101,500],</li> <li><strong>dns_zone_entropy</strong> - normalized entropy of the zone's domain name.</li> </ul> <h2>IP-based Features</h2> <p>These features were derived from IP addresses and ICMP echo replies:</p> <ul> <li><strong>ip_mean_average_rtt</strong> - average RTT of all ICMP echo attempts,</li> <li><strong>ip_entropy</strong> - total entropy of all /16 (/64 for v6) IP prefixes,</li> <li><strong>ip_count</strong> - total number of IP addresses for the domain,</li> <li><strong>ip_v4_count</strong> - total number of IPv4 addresses for the domain,</li> <li><strong>ip_v6_count</strong> - total number of IPv6 addresses for the domain,</li> </ul> <h2>TLS-based Features</h2> <p>The following features were extracted from TLS certificate chains and TLS handshakes:</p> <ul> <li><strong>tls_chain_len</strong> - length of the TLS certificate chain,</li> <li><strong>tls_broken_chain</strong> - true if there is a certificate that has never been valid,</li> <li><strong>tls_expired_chain </strong>- true if there is an expired certificate in the chain,</li> <li><strong>tls_total_extension_count</strong> - total extensions in all certificates in the chain,</li> <li><strong>tls_critical_extensions</strong> - total extensions flagged as "critical" in all certificates,</li> <li><strong>tls_with_policies_crt_count</strong> - number of certificates that include the "policies" extension,</li> <li><strong>tls_percentage_crt_with_policies</strong> - percentage of certificates that include the "policies" extension,</li> <li><strong>tls_x509_anypolicy_crt_count</strong> - number of certificates not enforcing any security policy,</li> <li><strong>tls_iso_policy_crt_count</strong> - total discovered policies from the 1.* OID space,</li> <li><strong>tls_joint_isoitu_policy_crt_count</strong> - total discovered policies from from the 2.* OID space,</li> <li><strong>tls_subject_count</strong> - number of subject alternative names (SANs) in the leaf certificate,</li> <li><strong>tls_server_auth_crt_count</strong> - number of certificates with the "Web Server Authentication",</li> <li><strong>tls_client_auth_crt_count</strong> - number of certificates with the "Web Client Authentication",</li> <li><strong>tls_CA_certs_in_chain_ratio</strong> - ratio of CA certificates in the chain,</li> <li><strong>tls_unique_SLD_count</strong> -number of unique second-level domains (SLD) in domain name SANs, </li> <li><strong>tls_common_name_count</strong> - number of common names in the chains,</li> <li><strong>tls_root_cert_validity_len</strong> - length of the validity period of the root certificate,</li> <li><strong>tls_leaf_cert_validity_len</strong> - length of the validity period of the leaf certificate.</li> </ul> <h2>WHOIS/RDAP-based Features</h2> <p>These features are based on the information gathered from WHOIS/RDAP when asking about: a) the domain name and b) domain-related IP addresses:</p> <ul> <li><strong>rdap_registration_period</strong> - difference between domain expiration and registration date,</li> <li><strong>rdap_has_dnssec</strong> - true if DNSSEC is used for the domain,</li> <li><strong>rdap_domain_age</strong> - days elapsed from the domain registration,</li> <li><strong>rdap_time_from_last_change</strong> - days elapsed from the last change of records,</li> <li><strong>rdap_domain_active_time</strong> - min(today, expiration) - registration date,</li> <li><strong>rdap_registrar_name_hash</strong> - hash of the domain's registrar,</li> <li><strong>rdap_ip_avg_admin_name_len</strong> - average length of the admin's name for IP addresses.</li> </ul> <h2>Geolocation Features</h2> <p>This set of features is based on information gathered from the GeoIP service when asked about domain-related IP addresses:</p> <ul> <li><strong>geo_countries_count</strong> - number of distinct countries where servers of domain-related IPs are located,</li> <li><strong>geo_countries_hash</strong> - a unique hash for each combination of countries amongst domain-related IPs,</li> <li><strong>geo_continent_hash</strong> - a uniuque hash for each combinations of continents where the countries are situated.</li> </ul>
TLS Z+F Imager 5010 point clouds of hybrid poplar trees from short-rotation crops after 5, 6, and 7 growing seasons
<p>The point clouds are obtained from hybrid poplar crops installed in NE Romania, managed in short rotation (SRWCs) between 5, 6, and 7 growing seasons. The crops were planted every spring, outside the growing season, at a depth of 0.6 m in the ground with two clones: AF8 and Pannonia. Rods (2-meter-long cuttings) were used as planting material at a density of 1667 trees per ha (3 x 2 m). The scanning of the sample areas (3 x 10 trees for each variant, about 6 x 10 m) was outside the growing seasons.</p><p>The 3D model was obtained using the Z+F Imager 5010 (Zoller and Fröhlich, Wangen, Germany), phase-shift type, providing a distance estimation accuracy of ±1 mm at 25 m and a nominal range of 187 m, and the tree individualization was done in CloudCompare v.2.12 (public license). A total of six station points and eight fixed targets or remarks (200 mm spheres) for co-registration were adopted for scanning. Trees included in the survey (without leaves) were marked with a ring of adhesive tape (black with yellow, 50 mm wide) at 1.4 m height on the tree spindle to adjust the results for calibration. Individually segmented trees can be sent on request, the database has a limit of 100 files. They can be converted into different formats via the CloudCompare application.</p><p>File code: clone type _ number of growing seasons _ plot number</p>
CESNET-TLS22: A large dataset for fine-grained classification of TLS services
<p><strong>Please refer to the original article for further data description:</strong> Jan Luxemburk et al. Fine-grained TLS services classification with reject option, Computer Networks, 2023, 109467, ISSN 1389-1286, <a href="https://doi.org/10.1016/j.comnet.2022.109467">https://doi.org/10.1016/j.comnet.2022.109467</a></p> <p><strong>We recommend using the</strong> <strong>CESNET DataZoo python library, which facilitates the work with large network traffic datasets. </strong>More information about the DataZoo project can be found in the GitHub repository <a href="https://github.com/CESNET/cesnet-datazoo">https://github.com/CESNET/cesnet-datazoo</a>.</p> <p>The recent success and proliferation of machine learning and deep learning have provided powerful tools, which are also utilized for encrypted traffic analysis, classification, and threat detection. These methods, neural networks in particular, are often complex and require a huge corpus of training data. Moreover, because most of the network traffic is being encrypted, the traditional deep-packet-inspecting (DPI) solutions are becoming obsolete, and there is an urgent need for modern classification methods capable of analyzing encrypted traffic. These methods have to forgo the packet's opaque payload and focus on flow statistics and packet metadata sequences like packet sizes, directions, and inter-arrival times. The classification can be further extended with the task of "rejecting" unknown traffic, i.e., the traffic not seen during the training phase. This makes the problem more challenging, and neural networks offer superior performance for tackling this problem.<strong> When the factors of (1) the hardness of classification of encrypted traffic with unknown traffic detection and (2) the neural networks' inherent need for large datasets are combined, the requirement for a rich, large, and up-to-date dataset is even stronger.</strong></p> <p>Therefore, we created a large dataset spanning two weeks, consisting of 141 million network flows, and having 191 fine-grained service labels. The dataset is intended as a benchmark for the task of identification of services in encrypted traffic with the detection of unknown services.</p> <p><strong>Data capture</strong> The data was captured in the flow monitoring infrastructure of the <a href="https://www.cesnet.cz">CESNET2</a> network. The capturing was done for two weeks between 4.10.2021 and 17.10.2021. The following table provides per-week flow count, capture period, and uncompressed size:</p> <ul> <li><strong>W-2021-40</strong> <ul> <li>Uncompressed Size: 22 GB</li> <li>Capture Period: 4.10.2021 - 10.10.2021</li> <li>Flows: 73.2M</li> </ul> </li> <li><strong>W-2021-41</strong> <ul> <li>Uncompressed Size: 20 GB</li> <li>Capture Period: 11.10.2021 - 17.10.2021</li> <li>Flows: 68.5M</li> </ul> </li> <li><strong>CESNET-TLS22</strong> <ul> <li>Uncompressed Size: 42 GB</li> <li>Capture Period: 4.10.2021 - 17.10.2021</li> <li>Flows: 141.7M</li> </ul> </li> </ul> <p><strong>Dataset structure</strong> The dataset flows are delivered in compressed CSV files, which contain one flow per row. For each flow data file, there is a JSON file with the number of saved flows per service. There is also the <em>stats-week.json</em> file aggregating flow counts of a whole week and the <em>stats-dataset.json</em> file aggregating flow counts for the entire dataset. The mapping between services and service providers is provided in the <em>servicemap.csv</em> file, which also includes SNI domains used for ground truth labeling. The following table describes flow data fields in CSV files:</p> <ul> <li><strong>ID:</strong> Unique identifier</li> <li><strong>BYTES:</strong> Number of transmitted bytes from client to server</li> <li><strong>BYTES_REV:</strong> Number of transmitted bytes from server to client</li> <li><strong>PACKETS:</strong> Number of packets transmitted from client to server</li> <li><strong>PACKETS_REV:</strong> Number of packets transmitted from server to client</li> <li><strong>DURATION:</strong> Duration of the flow in seconds</li> <li><strong>PPI:</strong> Packet metadata sequence in the format: [[inter-packet times], [packet directions], [packet sizes]]</li> <li><strong>PPI_LEN:</strong> Number of packets in the PPI sequence</li> <li><strong>PPI_DURATION:</strong> Duration of the PPI sequence in seconds</li> <li><strong>PPI_ROUNDTRIPS:</strong> Number of roundtrips in the PPI sequence</li> <li><strong>APP:</strong> Web service label</li> <li><strong>CATEGORY:</strong> Service category</li> <li><strong>TCP_FLAGS:</strong> TCP flags sent from client to server</li> <li><strong>TCP_FLAGS_REV:</strong> TCP flags sent from server to client</li> <li><strong>FLAG_CWR:</strong> Presence of the CWR flag</li> <li><strong>FLAG_CWR_REV:</strong> Presence of the CWR flag in the reverse direction</li> <li><strong>FLAG_ECE:</strong> Presence of the ECE flag</li> <li><strong>FLAG_ECE_REV:</strong> Presence of the ECE flag in the reverse direction</li> <li><strong>FLAG_URG:</strong> Presence of the URG flag</li> <li><strong>FLAG_URG_REV:</strong> Presence of the URG flag in the reverse direction</li> <li><strong>FLAG_ACK:</strong> Presence of the ACK flag</li> <li><strong>FLAG_ACK_REV:</strong> Presence of the ACK flag in the reverse direction</li> <li><strong>FLAG_PSH:</strong> Presence of the PSH flag</li> <li><strong>FLAG_PSH_REV:</strong> Presence of the PSH flag in the reverse direction</li> <li><strong>FLAG_RST:</strong> Presence of the RST flag</li> <li><strong>FLAG_RST_REV:</strong> Presence of the RST flag in the reverse direction</li> <li><strong>FLAG_SYN:</strong> Presence of the SYN flag</li> <li><strong>FLAG_SYN_REV:</strong> Presence of the SYN flag in the reverse direction</li> <li><strong>FLAG_FIN:</strong> Presence of the FIN flag</li> <li><strong>FLAG_FIN_REV:</strong> Presence of the FIN flag in the reverse direction</li> </ul> <p><strong>Link to other CESNET datasets</strong></p> <ul> <li><a href="https://www.liberouter.org/technology-v2/tools-services-datasets/datasets/">https://www.liberouter.org/technology-v2/tools-services-datasets/datasets/</a></li> <li><a href="https://github.com/CESNET/cesnet-datazoo">https://github.com/CESNET/cesnet-datazoo</a></li> </ul> <p><strong>Please cite the original article:</strong></p> <blockquote> <p>@article{luxemburk_fine-grained-tls_2023, author = {Jan Luxemburk and Tomáš Čejka}, title = {Fine-grained TLS services classification with reject option}, journal = {Computer Networks}, volume = {220}, pages = {109467}, year = {2023}, issn = {1389-1286}, doi = {https://doi.org/10.1016/j.comnet.2022.109467}, url = {https://www.sciencedirect.com/science/article/pii/S1389128622005011} }</p> </blockquote>
A Dataset of Information (DNS, IP, WHOIS/RDAP, TLS, GeoIP) for a Large Corpus of Benign, Phishing, and Malware Domain Names 2024
<p>The dataset contains DNS records, IP-related features, WHOIS/RDAP information, information from TLS handshakes and certificates, and GeoIP information for 368,956 benign domains from Cisco Umbrella, 461,338 benign domains from the actual CESNET network traffic, 164,425 phishing domains from PhishTank and OpenPhish services, and 100,809 malware domains from various sources like ThreatFox, The Firebog, MISP threat intelligence platform, and other sources. The ground truth for the phishing dataset was double-check with the VirusTotal (VT) service. Domain names not considered malicious by VT have been removed from phishing and malware datasets. Similarly, benign domain names that were considered risky by VT have been removed from the benign datasets. The data was collected between March 2023 and July 2024. The final assessment of the data was conducted in August 2024.</p> <p>The dataset is useful for cybersecurity research, e.g. statistical analysis of domain data or feature extraction for training machine learning-based classifiers, e.g. for phishing and malware website detection.</p> <p>The dataset was created using software available in the associated GitHub repository <a href="https://github.com/nesfit/domainradar-dib" target="_blank" rel="noopener">nesfit/domainradar-dib</a>.</p> <h1>Data Files</h1> <ul> <li> <p>The data is located in the following individual files:</p> <ul> <li><strong>benign_umbrella.json</strong> - data for 368,956 benign domains from Cisco Umbrella,</li> <li><strong>benign_cesnet.json </strong>- data for 461,338 benign domains from the CESNET network,</li> <li><strong>phishing.json</strong> - data for 164,425 phishing domains, and</li> <li><strong>malware.json</strong> - data for 100,809 malware domains.</li> </ul> </li> <li>The <strong>schema.json</strong> file contains a JSON Schema with detailed description of the data entries.</li> </ul> <h1>Data Structure</h1> <div> <p>Both files contain a JSON array of records generated using mongoexport (in the MongoDB Extended JSON (v2) format in Relaxed Mode). The following table documents the structure of a record. Please note that:</p> <ul> <li>some fields may be missing (they should be interpreted as nulls), </li> <li>extra fields may be present (they should be ignored).</li> </ul> </div> <table> <tbody> <tr> <td> <div> <div> <p><strong>Field name </strong></p> </div> </div> </td> <td> <div> <div> <p><strong>Field type </strong></p> </div> </div> </td> <td> <div> <div> <p><strong>Nullable </strong></p> </div> </div> </td> <td> <div> <div> <p><strong>Description </strong></p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>domain_name </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The evaluated domain name </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>url </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The source URL for the domain name </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>evaluated_on </p> </div> </div> </td> <td> <div> <div> <p>Date </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Date of last collection attempt </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>source </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>An identifier of the source </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>sourced_on </p> </div> </div> </td> <td> <div> <div> <p>Date </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Date of ingestion of the domain name </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>dns </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>Data from DNS scan </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>rdap </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>Data from RDAP or WHOIS </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>tls </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>Data from TLS handshake </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>ip_data </p> </div> </div> </td> <td> <div> <div> <p>Array of Objects </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>Array of data objects capturing the IP addresses related to the domain name </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>malware_type</p> </div> </div> </td> <td> <div> <div> <p>String</p> </div> </div> </td> <td> <div> <div> <p>No</p> </div> </div> </td> <td> <div> <div> <p>The malware type/family or “unknown” (only present in malware.json) </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p><strong>DNS data (dns field) </strong></p> </div> </div> </td> <td> </td> <td> </td> <td> </td> </tr> <tr> <td> <div> <div> <p>A </p> </div> </div> </td> <td> <div> <div> <p>Array of Strings </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Array of IPv4 addresses </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>AAAA </p> </div> </div> </td> <td> <div> <div> <p>Array of Strings </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Array of IPv6 addresses </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>TXT </p> </div> </div> </td> <td> <div> <div> <p>Array of Strings </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Array of raw TXT values </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>CNAME </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The CNAME target and related IPs </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>MX </p> </div> </div> </td> <td> <div> <div> <p>Array of Objects </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Array of objects with the MX target hostname, priority and related IPs </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>NS </p> </div> </div> </td> <td> <div> <div> <p>Array of Objects </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Array of objects with the NS target hostname and related IPs </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>SOA </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>All the SOA fields, present if found at the target domain name </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>zone_SOA </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The SOA fields of the target’s zone (closest point of delegation), present if found and not a record in the target domain directly </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>dnssec </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Flags describing the DNSSEC validation result for each record type </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>ttls </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The TTL values for each record type </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>remarks </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The zone domain name and DNSSEC flags </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p><strong>RDAP data (rdap field) </strong></p> </div> </div> </td> <td> </td> <td> </td> <td> </td> </tr> <tr> <td> <div> <div> <p>copyright_notice </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>RDAP/WHOIS data usage copyright notice </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>dnssec </p> </div> </div> </td> <td> <div> <div> <p>Bool </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>DNSSEC presence flag </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>entitites </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>An object with various arrays representing the found related entity types (e.g. abuse, admin, registrant). The arrays contain objects describing the individual entities. </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>expiration_date </p> </div> </div> </td> <td> <div> <div> <p>Date </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>The current date of expiration </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>handle </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>RDAP handle </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>last_changed_date </p> </div> </div> </td> <td> <div> <div> <p>Date </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>The date when the domain was last changed </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>name </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The target domain name for which the data in this object are stored </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>nameservers </p> </div> </div> </td> <td> <div> <div> <p>Array of Strings </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Nameserver hostnames provided by RDAP or WHOIS </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>registration_date </p> </div> </div> </td> <td> <div> <div> <p>Date </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>First registration date </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>status </p> </div> </div> </td> <td> <div> <div> <p>Array of Strings </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The state of the registered object (see RFC 7483, section 10.2.2)</p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>terms_of_service_url </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>URL of the RDAP usage ToS </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>url </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>URL of the RDAP entity </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>whois_server </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>WHOIS server address </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p><strong>TLS data (tls field) </strong></p> </div> </div> </td> <td> </td> <td> </td> <td> </td> </tr> <tr> <td> <div> <div> <p>cipher </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>TLS cipher suite description according to <a href="https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4" target="_blank" rel="noopener">IANA</a></p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>protocol </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>One of “TLS”, ”TLSv1.2”, ”TLSv1.3” </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>certificates </p> </div> </div> </td> <td> <div> <div> <p>Array of Objects </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Array of objects representing the certificate chain, the first element is the root certificate </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p><strong>IP data (elements in the ip_data array) </strong></p> </div> </div> </td> <td> </td> <td> </td> <td> </td> </tr> <tr> <td> <div> <div> <p>ip </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The IP address </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>from_record </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The type of the DNS record the address was captured from </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>remarks </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Ping round-trip time, “is alive” flag and rdap/geo/asn evaluation dates </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>rdap </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>RDAP data, similar to DNS RDAP, see the JSON Schema for details </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>geo </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>Geolocation data from the GeoLite2 City database (e.g. latitude, longitude, city, country, etc.) </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>asn </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>Autonomous system data from the GeoLite2 ASN database (ASN, organization, network) </p> </div> </div> </td> </tr> </tbody> </table> <h1>Acknowledgements</h1> <p>We would like to thank the OpenPhish Team for grating permission to use and publish their dataset. We also thank VirusTotal for providing us access to the API for research purposes.</p> <p>This dataset includes GeoLite2 data created by MaxMind, available from <a href="https://www.maxmind.com" target="_blank" rel="noopener">https://www.maxmind.com</a>.</p> <p>The research has been supported by the <strong>Flow-based Encrypted Traffic Analysis</strong> project, no. VJ02010024, granted by the Ministry of the Interior of the Czech Republic and the <strong>Smart Information Technology for a Resilient Society </strong>project, no. FIT-S-23-8209, granted by Brno University of Technology.</p>
Rambla Honda (Alicante, Spain) 3DPC TLS and SfM
<p>3D point clouds of a old limestones quarry in Rambla Honda, Alicante (Spain). It was scanned using a Leica C10 Scanstation and a RPAS to apply the SfM technique. </p> <p>The datasets were used for this work:</p> <p>https://www.sciencedirect.com/science/article/pii/S001379522200103X#!</p> <p>There are two files:</p> <ol> <li>210205 Rambla Honda 2-8 Georreferenciado.las --> TLS file</li> <li>210205 Rambla Honda SfM.las --> SfM file</li> </ol>
Individual TLS tree clouds collected from both Alto Tajo and Cuellar in Spain.
<p>36 30 x 30 m plots across two sites in Spain were scanned using a Leica HDS6200 scanner (3.2mm resolution at 10 m) following a grid pattern (see Owen et al., 2021 for more details). All 16 scans were co-registered and individual trees segmented using a combination of treeseg (Burt et al. 2019) and manual extraction/refinement. Trees in this database have been zero-centred and downsampled to 5 cm for the purpose of classifying species using deep learning. Individual tree species ID (Quercus faginea, Quercus ilex, Pinus nigra, Pinus sylvestris and Pinus pinaster) were appended to each tree using a combination of field derived hand drawn stem maps and TLS derived stem maps. Whether a tree is a multi-stem or single-stem has also been included in the metadata file.</p> <p>Owen et al 2021 - https://doi.org/10.1111/1365-2745.13670</p>
Text-fig. 10. Platanoxylon cf. haydenii, a, e, h: UF 279-34470; b, c, d, f g: UF 279-34469. a, b: Diffuse porous wood with vessels solitary and in small multiples, which are mostly tangential or oblique, diffuse and diffuse-in-aggregates axial parenchyma., TS. c–e: Scalariform perforation plates. f, g: Opposite intervessel pits, TLS. h: Two size classes of rays, TLS. Platanus sp., UF 279- 24552. i: Predominantly solitary vessels, diffuse and diffuse-in-aggregates parenchyma, growth ring boundary distinct, noded rays, TS. j: Simple perforation plates (PP), RLS. k: Body of ray with procumbent ray cells, RLS. l: Scalariform perforation plate, RLS. m: Rays of two sizes, wide rays>10-seriate, TLS. Scale bars: 200 µm in a, b, h, i, m; 100 µm in j, k: 50 µm in c, d, e, f, l. in A Diverse Assemblage Of Late Eocene Woods From Oregon, Western Usa
Text-fig. 10. Platanoxylon cf. haydenii, a, e, h: UF 279-34470; b, c, d, f g: UF 279-34469. a, b: Diffuse porous wood with vessels solitary and in small multiples, which are mostly tangential or oblique, diffuse and diffuse-in-aggregates axial parenchyma., TS. c–e: Scalariform perforation plates. f, g: Opposite intervessel pits, TLS. h: Two size classes of rays, TLS. Platanus sp., UF 279- 24552. i: Predominantly solitary vessels, diffuse and diffuse-in-aggregates parenchyma, growth ring boundary distinct, noded rays, TS. j: Simple perforation plates (PP), RLS. k: Body of ray with procumbent ray cells, RLS. l: Scalariform perforation plate, RLS. m: Rays of two sizes, wide rays>10-seriate, TLS. Scale bars: 200 µm in a, b, h, i, m; 100 µm in j, k: 50 µm in c, d, e, f, l.
Text-fig. 11. Acer Post Hammer species 1, UF 279-34456. a, b: Diffuse-porous wood with distinct growth rings, marked by marginal parenchyma, vessels solitary and in short radial multiples, TS. c: Crowded alternate intervessel pits, TLS. d: Simple perforation plates, helical thickenings in vessel elements, TLS. e: Rays 2–3-seriate, gum deposit in vessel element, TLS. Acer Post Hammer species 2. UF 279-34466. f: Diffuse-porous wood with distinct growth rings, marked by marginal parenchyma, vessels solitary and in short radial multiples, TS. g: Alternate intervessel pits, helical thickenings in vessel elements, TLS. h: Rays 1–4(–5)-seriate, TLS. i: Crystalliferous strand, multiseriate ray, TLS. Trochodendron beckii, UF 279-24558. j, k: Distinct growth rings, abrupt transition from earlywood to latewood, vesselless, wide rays noded at growth ring boundaries, TS. l: Rays of two distinct sizes, uniseriate and multiseriates>10-seriate, TLS. m. Scalariform intertracheary pits. RLS. Scale bars: 500 µm in j; 200 µm in a, f, k, l; 100 µm in b, h; 50 µm in c, d, e, g, i, m. in A Diverse Assemblage Of Late Eocene Woods From Oregon, Western Usa
Text-fig. 11. Acer Post Hammer species 1, UF 279-34456. a, b: Diffuse-porous wood with distinct growth rings, marked by marginal parenchyma, vessels solitary and in short radial multiples, TS. c: Crowded alternate intervessel pits, TLS. d: Simple perforation plates, helical thickenings in vessel elements, TLS. e: Rays 2–3-seriate, gum deposit in vessel element, TLS. Acer Post Hammer species 2. UF 279-34466. f: Diffuse-porous wood with distinct growth rings, marked by marginal parenchyma, vessels solitary and in short radial multiples, TS. g: Alternate intervessel pits, helical thickenings in vessel elements, TLS. h: Rays 1–4(–5)-seriate, TLS. i: Crystalliferous strand, multiseriate ray, TLS. Trochodendron beckii, UF 279-24558. j, k: Distinct growth rings, abrupt transition from earlywood to latewood, vesselless, wide rays noded at growth ring boundaries, TS. l: Rays of two distinct sizes, uniseriate and multiseriates>10-seriate, TLS. m. Scalariform intertracheary pits. RLS. Scale bars: 500 µm in j; 200 µm in a, f, k, l; 100 µm in b, h; 50 µm in c, d, e, g, i, m.
Text-fig. 9. Wataria kvacekii sp. nov., UF 279-24556. a: Wood ring-porous, earlywood with 2–3 rows of wide pores, vessels solitary and in radial multiples of 2, axial parenchyma scanty vasicentric and some apotracheal diffuse-in-aggregates, TS. b: Series of vessel elements with simple perforations, axial parenchyma strands adjacent to vessels, RLS. c: Alternate intervessel pitting, vessel element end walls horizontal, RLS. d: Vessel-axial parenchyma pitting similar to intervessel pitting, RLS. e, f: Rays with tile cells, storied axial parenchyma, some strands chambered crystalliferous, TLS. g: Detail of ray, TLS. h: Storied imperforate elements. Scale bars: 200 µm in a; 100 µm in b, e; 50 µm in c, d, f, h; 20 µm in g. in A Diverse Assemblage Of Late Eocene Woods From Oregon, Western Usa
Text-fig. 9. Wataria kvacekii sp. nov., UF 279-24556. a: Wood ring-porous, earlywood with 2–3 rows of wide pores, vessels solitary and in radial multiples of 2, axial parenchyma scanty vasicentric and some apotracheal diffuse-in-aggregates, TS. b: Series of vessel elements with simple perforations, axial parenchyma strands adjacent to vessels, RLS. c: Alternate intervessel pitting, vessel element end walls horizontal, RLS. d: Vessel-axial parenchyma pitting similar to intervessel pitting, RLS. e, f: Rays with tile cells, storied axial parenchyma, some strands chambered crystalliferous, TLS. g: Detail of ray, TLS. h: Storied imperforate elements. Scale bars: 200 µm in a; 100 µm in b, e; 50 µm in c, d, f, h; 20 µm in g.
Text-fig. 8. Pterocaryoxylon sp., a–c, e: UF 279-85024; d, f: UF 279-24551. a, b: Wood semi-ring-porous, vessels solitary and in short radial multiples, axial parenchyma scanty vasicentric, marginal, and in narrow lines, TS. c: Crowded alternate intervessel pitting, simple perforation plate (PP), TLS. d: Vessel-axial parenchyma pitting similar to intervessel pitting, RLS. e: Rays mostly 1–3 cells wide, occasionally 4 cells, uniseriate rays probably mostly square to upright cells, TLS. f: Rays heterocellular, body cells procumbent. Scale bars: 200 µm in a, b; 100 µm in e, f; 50 µm in c; 20 µm in d. in A Diverse Assemblage Of Late Eocene Woods From Oregon, Western Usa
Text-fig. 8. Pterocaryoxylon sp., a–c, e: UF 279-85024; d, f: UF 279-24551. a, b: Wood semi-ring-porous, vessels solitary and in short radial multiples, axial parenchyma scanty vasicentric, marginal, and in narrow lines, TS. c: Crowded alternate intervessel pitting, simple perforation plate (PP), TLS. d: Vessel-axial parenchyma pitting similar to intervessel pitting, RLS. e: Rays mostly 1–3 cells wide, occasionally 4 cells, uniseriate rays probably mostly square to upright cells, TLS. f: Rays heterocellular, body cells procumbent. Scale bars: 200 µm in a, b; 100 µm in e, f; 50 µm in c; 20 µm in d.
Text-fig. 7. Hamamelidoxylon crystalliferum sp. nov., UF 279-34464. a: Diffuse porous wood with exclusively solitary vessels, tending to be angular in outline, TS. b: Growth ring boundary, marked by radially narrowed fibers, latewood vessels narrower than earlywood vessels of the next ring, fibers thick-walled, no axial parenchyma visible, TS. c: Scalariform intervessel pits in narrow vessel (left), fibers with distinctly bordered pits, TLS. d: Scalariform perforation plate, tyloses (T) formation from marginal ray cell, TLS. e: Scalariform perforation plates with fewer than 15 bars (PP), RLS. f: Vessel-ray parenchyma pits with in A Diverse Assemblage Of Late Eocene Woods From Oregon, Western Usa
Text-fig. 7. Hamamelidoxylon crystalliferum sp. nov., UF 279-34464. a: Diffuse porous wood with exclusively solitary vessels, tending to be angular in outline, TS. b: Growth ring boundary, marked by radially narrowed fibers, latewood vessels narrower than earlywood vessels of the next ring, fibers thick-walled, no axial parenchyma visible, TS. c: Scalariform intervessel pits in narrow vessel (left), fibers with distinctly bordered pits, TLS. d: Scalariform perforation plate, tyloses (T) formation from marginal ray cell, TLS. e: Scalariform perforation plates with fewer than 15 bars (PP), RLS. f: Vessel-ray parenchyma pits with
Text-fig. 5. Lithocarpoxylon ashwillii sp. nov., UF 279-24544. a, b: Semi-ring porous wood, exclusively solitary vessels in a radial/ diagonal arrangement, diffuse axial parenchyma, TS. c: Homocellular rays composed of procumbent cells; vasicentric tracheids; vessel elements with simple perforation plates (PP), TLS. d: Vessel-ray parenchyma pits (VRP) with reduced borders, vertical, RLS. e: Crystalliferous axial parenchyma strand (C) with a single crystal per chamber; ray with procumbent cells, RLS. f: Aggregate ray (right) composed of loosely associated 1–2-seriate rays, TLS. g: Uniseriate rays, thin-walled tyloses in vessels, vasicentric tracheids (VT). Lithocarpoxylon sp., UF 279-84864. h, i: Semi-ring porous wood, exclusively solitary vessels in radial arrangement. j: Aggregate ray and uniseriate rays. k: Scalariform perforation plate with fewer than 10 bars. l: Vessel-ray parenchyma pits with reduced borders to simple, vertical. Scale bars: 200 µm in a, b, f, h, j; 100 µm in c, i; 50 µm in d. e; 20 µm in k, l. in A Diverse Assemblage Of Late Eocene Woods From Oregon, Western Usa
Text-fig. 5. Lithocarpoxylon ashwillii sp. nov., UF 279-24544. a, b: Semi-ring porous wood, exclusively solitary vessels in a radial/ diagonal arrangement, diffuse axial parenchyma, TS. c: Homocellular rays composed of procumbent cells; vasicentric tracheids; vessel elements with simple perforation plates (PP), TLS. d: Vessel-ray parenchyma pits (VRP) with reduced borders, vertical, RLS. e: Crystalliferous axial parenchyma strand (C) with a single crystal per chamber; ray with procumbent cells, RLS. f: Aggregate ray (right) composed of loosely associated 1–2-seriate rays, TLS. g: Uniseriate rays, thin-walled tyloses in vessels, vasicentric tracheids (VT). Lithocarpoxylon sp., UF 279-84864. h, i: Semi-ring porous wood, exclusively solitary vessels in radial arrangement. j: Aggregate ray and uniseriate rays. k: Scalariform perforation plate with fewer than 10 bars. l: Vessel-ray parenchyma pits with reduced borders to simple, vertical. Scale bars: 200 µm in a, b, f, h, j; 100 µm in c, i; 50 µm in d. e; 20 µm in k, l.
Text-fig. 1. Pistacia terrazasae sp. nov., a: UF 279-85025; b–i: UF 279-24545. a: Ring-porous wood with widely spaced solitary earlywood vessels; latewood vessels in radial multiples of 4 or more and in clusters, TS. b: Growth ring boundary, fiber walls thin to thick, TS. c: Simple perforation plates, alternate intervessel pits, helical thickenings in vessels, TLS. d: Multiseriate rays to 4-seriate, tyloses in vessels, helical thickenings throughout body of vessel element, and alternate intervessel pitting, TLS. e: Vessel-ray parenchyma pitting with reduced borders, oval in outline, RLS. f: Marginal row of upright cells, one inflated and crystalliferous, procumbent body cells, RLS. g: Multiseriate rays mostly 3-seriate, occasionally 4-seriate, uniseriate rays usually <10 cells tall, TLS. h: Ray with enlarged crystalliferous marginal cell, to left of C, TLS. i: Ray with canal, TLS. Scale bars: 200 µm in a, g; 100 µm in b, d, h; 50 µm in c, i; 20 µm in e, f. in A Diverse Assemblage Of Late Eocene Woods From Oregon, Western Usa
Text-fig. 1. Pistacia terrazasae sp. nov., a: UF 279-85025; b–i: UF 279-24545. a: Ring-porous wood with widely spaced solitary earlywood vessels; latewood vessels in radial multiples of 4 or more and in clusters, TS. b: Growth ring boundary, fiber walls thin to thick, TS. c: Simple perforation plates, alternate intervessel pits, helical thickenings in vessels, TLS. d: Multiseriate rays to 4-seriate, tyloses in vessels, helical thickenings throughout body of vessel element, and alternate intervessel pitting, TLS. e: Vessel-ray parenchyma pitting with reduced borders, oval in outline, RLS. f: Marginal row of upright cells, one inflated and crystalliferous, procumbent body cells, RLS. g: Multiseriate rays mostly 3-seriate, occasionally 4-seriate, uniseriate rays usually <10 cells tall, TLS. h: Ray with enlarged crystalliferous marginal cell, to left of C, TLS. i: Ray with canal, TLS. Scale bars: 200 µm in a, g; 100 µm in b, d, h; 50 µm in c, i; 20 µm in e, f.
Text-fig. 4. Fagus dodgei sp. nov., a, b, d–h: UF 279-34468; c: UF 279-30165. a: Wood diffuse-porous to semi-ring-porous with distinct latewood zone with narrower vessels; vessels solitary and in short multiples; diffuse, diffuse-in-aggregates axial parenchyma visible in latewood, TS. b: Growth ring boundary, TS. c: Opposite intervessel pitting, TLS. d: Scalariform perforation plate with fewer than 10 bars, RLS. e: Simple perforation plates (PP), RLS. f: Vessel-ray parenchyma pitting with reduced borders and frequently oval in outline, RLS. g: Rays 1–4(–5)-seriate with variable numbers of marginal rows, TLS. h: Rays of two distinct sizes, widest rays>10-seriate, TLS. Scale bars: 200 µm in a, h; 100 µm in b, e, g; 50 µm in d, f. in A Diverse Assemblage Of Late Eocene Woods From Oregon, Western Usa
Text-fig. 4. Fagus dodgei sp. nov., a, b, d–h: UF 279-34468; c: UF 279-30165. a: Wood diffuse-porous to semi-ring-porous with distinct latewood zone with narrower vessels; vessels solitary and in short multiples; diffuse, diffuse-in-aggregates axial parenchyma visible in latewood, TS. b: Growth ring boundary, TS. c: Opposite intervessel pitting, TLS. d: Scalariform perforation plate with fewer than 10 bars, RLS. e: Simple perforation plates (PP), RLS. f: Vessel-ray parenchyma pitting with reduced borders and frequently oval in outline, RLS. g: Rays 1–4(–5)-seriate with variable numbers of marginal rows, TLS. h: Rays of two distinct sizes, widest rays>10-seriate, TLS. Scale bars: 200 µm in a, h; 100 µm in b, e, g; 50 µm in d, f.
Text-fig. 2. Celtis popsii sp. nov., UF 279-34460. a: Growth ring with earlywood of multiple rows of vessels solitary and in radial multiples; latewood vessels in wavy tangential bands, TS. b: Growth ring boundary, latewood vessels in multiples with axial parenchyma confluent, TS. c: Simple perforation plates, alternate intervessel pits, polygonal in outline, TLS. d: Vessel-ray parenchyma pits to right of VRP, oval in outline, with slightly reduced borders, RLS. e: Rays tending to two sizes, some multiseriate rays with distinct sheath cells, multiseriate rays usually with 1 marginal row of square to upright cells, occasionally with 4 or more; uniseriate rays less than 10 cells high, TLS. f: Detail of multiseriate ray with distinct sheath cells, vessel element end walls, TLS. Scale bars: 200 µm in a, e; 100 µm in b; 50 µm in c, f; 20 µm in d. in A Diverse Assemblage Of Late Eocene Woods From Oregon, Western Usa
Text-fig. 2. Celtis popsii sp. nov., UF 279-34460. a: Growth ring with earlywood of multiple rows of vessels solitary and in radial multiples; latewood vessels in wavy tangential bands, TS. b: Growth ring boundary, latewood vessels in multiples with axial parenchyma confluent, TS. c: Simple perforation plates, alternate intervessel pits, polygonal in outline, TLS. d: Vessel-ray parenchyma pits to right of VRP, oval in outline, with slightly reduced borders, RLS. e: Rays tending to two sizes, some multiseriate rays with distinct sheath cells, multiseriate rays usually with 1 marginal row of square to upright cells, occasionally with 4 or more; uniseriate rays less than 10 cells high, TLS. f: Detail of multiseriate ray with distinct sheath cells, vessel element end walls, TLS. Scale bars: 200 µm in a, e; 100 µm in b; 50 µm in c, f; 20 µm in d.
Text-fig. 3. Cercidiphyllum cf. alalongum R.A.SCOTT et E.A.WHEELER, UF 279-24543. a, b: Diffuse-porous wood, exclusively solitary vessels, axial parenchyma rare, thick-walled fibers, TS. c: Scalariform perforation plate with more than 30 bars, RLS. d: Helical thickenings (HT) in vessel element tip, RLS. e: Opposite to scalariform intervessel pits, RLS. f, g: Heterocellular rays 1–2 cells wide, occasionally uniseriate and biseriate portions of similar width, TLS. h: Ray with alternating rows of procumbent and upright (-square) cells, RLS. Scale bars: 200 µm in a; 100 µm in b, f; 50 µm in c, g, h; 20 µm in d, e. in A Diverse Assemblage Of Late Eocene Woods From Oregon, Western Usa
Text-fig. 3. Cercidiphyllum cf. alalongum R.A.SCOTT et E.A.WHEELER, UF 279-24543. a, b: Diffuse-porous wood, exclusively solitary vessels, axial parenchyma rare, thick-walled fibers, TS. c: Scalariform perforation plate with more than 30 bars, RLS. d: Helical thickenings (HT) in vessel element tip, RLS. e: Opposite to scalariform intervessel pits, RLS. f, g: Heterocellular rays 1–2 cells wide, occasionally uniseriate and biseriate portions of similar width, TLS. h: Ray with alternating rows of procumbent and upright (-square) cells, RLS. Scale bars: 200 µm in a; 100 µm in b, f; 50 µm in c, g, h; 20 µm in d, e.
ScienceDex guides
Understand access before you commit
These curated guides explain access requirements, typical timelines, costs, and reuse considerations for widely used research datasets.
Allen Brain Atlas
Allen Brain Atlas is an Allen Institute collection of brain map atlases, datasets, APIs, and analysis tools covering mouse, human, and non-human primate brain resources.
Annotated Behaviour and Observability Dataset (ABODe)
ABODe is a University of Edinburgh DataShare dataset for behavior classification in group-housed mice using home-cage video, identities, bounding boxes, ground-plate positions, and annotator labels.
DANDI Archive for NWB datasets
DANDI is a BRAIN Initiative archive for publishing and sharing neurophysiology data, including electrophysiology, optophysiology, and behavioral data packaged as NWB and related standards.
International Brain Laboratory public data
The International Brain Laboratory public data releases expose standardized mouse decision-making experiments, including Neuropixels recordings, widefield calcium imaging, behavior, and session metadata accessed through the ONE API.
OpenNeuro
OpenNeuro is a free, open platform for sharing neuroimaging datasets, with public search, dataset pages, and download paths for web, S3, DataLad, and the OpenNeuro CLI.