Find research datasets worth reusing
Search datasets from major research repositories and use ShareScore to quickly assess how well each record supports discovery, access, and reuse.
8
datasets available to search
ShareScore release 0.9.0
Dataset results
8 results for “phishing”
Phishing Website Dataset
<p>This dataset contains a collection of legitimate and phishing websites, along with information on the target brands (brands.csv) being impersonated in the phishing attacks. The dataset includes a total of 10,395 websites, 5,244 of which are legitimate and 5,151 of which are phishing websites. These websites impersonate a total of 86 different target brands.</p> <p>For phishing datasets, the files can be downloaded in a zip file with a "phishing" prefix, while for legitimate websites, the files can be downloaded in a zip file with a "not-phishing" prefix.<br> <br> In addition, the dataset includes features such as screenshots, text, CSS, and HTML structure for each website, as well as domain information (WHOIS data), IP information, and SSL information. Each website is labeled as either legitimate or phishing and includes additional metadata such as the date it was discovered, the target brand being impersonated, and any other relevant information.</p> <p>The dataset has been curated for research purposes and can be used to analyze the effectiveness of phishing attacks, develop and evaluate anti-phishing solutions, and identify trends and patterns in phishing attacks. It is hoped that this dataset will contribute to the advancement of research in the field of cybersecurity and help improve our understanding of phishing attacks.</p>
Phishing and Benign Domain Dataset (DNS, IP, WHOIS/RDAP, TLS, GeoIP)
<p>The dataset contains DNS records, IP-related features, WHOIS/RDAP information, information from TLS certificate fields, and GeoIP information for 432,572 verified benign domains from Cisco Umbrella and 36,993 verified phishing domains from PhishTank and OpenPhish services. The dataset is useful for statistical analysis of domain data or feature extraction for training machine learning-based classifiers, e.g. for phishing detection. The data was collected between March and July 2023.The final assessment of the data was conducted in July 2023 (this is why the names are suffixed with _2307).</p> <p>The upload contains: a) <strong>data</strong> files, b) the description of the data <strong>structure</strong>, and c) the <strong>veature vector</strong> we used for ML-based phishing domain detection.</p> <h1>Data Files</h1> <p>The data is located in two individual files:</p> <ul> <li><strong>benign_2307.json</strong> - data about 432,572 benign domains, and</li> <li><strong>phishing_2307.json</strong> - data about 36,993 phishing domains.</li> </ul> <h1>Data Structure</h1> <p>Both files are in the JSON Array format. The structure is as follows:</p> <pre><code>[ { "_id" : "A unique ID of the data record", "domain_name" : "Name of the domain (e.g., zenodo.com)", "dns" : { "//": "Data obtained from DNS records" }, "evaluated_on" : "// ISO Timestamp of data collection ", "ip_data" : [ "// Data for each related IP adddress ", { "//": "IP-related data, including RTT from ICMP echo attempts (from Brno, Czechia)", "//": "WHOIS/RDAP data for the given IP address", "//": "GeoIP data for the given IP address", "//": "NERD system reputation score (if available)", "//": "ASN info", "//": "remarks: ISO timestamps of collection of the individual data pieces" }, ], "label" : "benign_2307 for benign OR misp_2307 for phishing", "rdap" : { "//": "WHOIS/RDAP information for the domain name" }, "remarks" : { "dns_evaluated_on" : "ISO Timestamp of DNS data collection", "rdap_evaluated_on" : "ISO Timestamp of WHOIS/RDAP data collection", "tls_evaluated_on" : "ISO Timestamp of TLS certificate information collection", "dns_had_no_ips" : "true if no IPs were found in DNS records" }, "sourced_on" : "ISO Timestamp of the moment the domain was found", "tls" : { "cipher" : "Identifier of the TLS cipher suite", "count" : "Number of certificates in chain", "protocol" : "Version of the TLS protocol", "certificates" : [ "//": "Information from TLS certificate fields: issuer, extensions, etc." ] }, "category" : "Category of the record (could be ignored)", "source" : "Name of the file that we used to save the domain list" } ]</code></pre> <h1>Feature Vector</h1> <p>This section describes the veature vector used in the "Unmasking the Phishermen: Phishing Domain Detection with Machine Learning and Multi-Source Intelligence" paper that was accepted to the IEEE NOMS 2024 conference.</p> <h2>Lexical Features</h2> <p>The following features were extracted from the sole domain name:</p> <ul> <li><strong>lex_name_len</strong> - length of the domain name,</li> <li><strong>lex_begins_with_digit</strong> - true if the domain name begins with a digit,</li> <li><strong>lex_www_flag</strong> - true if the domain name begins with "www.",</li> <li><strong>lex_phishing_keyword_count</strong> - occurence count of 47 phishing-related keywords,</li> <li><strong>lex_consecutive_chars</strong> - length of the longest consecutive character sequence,</li> <li><strong>lex_tld_len</strong> - length of the top-level domain (TLD),</li> <li><strong>lex_tld_hash</strong> - hash of the TLD,</li> <li><strong>lex_sld_len </strong>- length of the second-level domain (SLD),</li> <li><strong>lex_sld_norm_entropy </strong>- normalized entropy of the SLD,</li> <li><strong>lex_stld_unique_char_count </strong>- number of unique characters in the TLD and the SLD,</li> <li><strong>lex_sub_count </strong>- number of subdomains,</li> <li><strong>lex_sub_digit_ratio </strong>- ratio of digits in subdomains,</li> <li><strong>lex_sub_hex_ratio </strong>- ratio of hex symbols in subdomains,</li> <li><strong>lex_sub_non_alpanum_ratio </strong>- ratio of non-alphanumeric symbols in subdomains,</li> <li><strong>lex_sub_vowel_ratio </strong>- ratio of vowels in subdomains,</li> <li><strong>lex_sub_consonant_ratio </strong>- ratio of consonants in subdomains,</li> <li><strong>lex_sub_max_consonant_len </strong>- length of the longest consonant sequence in subdomains,</li> <li><strong>lex_sub_norm_entropy </strong>- normalized entropy of a string made from all subdomains,</li> <li><strong>lex_phishing_bigram_matches</strong> - occurrence count of the top 300 phishing domain bigrams,</li> <li><strong>lex_phishing_trigram_matches</strong> - occurrence count of the top 2000 phishing domain trigrams,</li> <li><strong>lex_phishing_tetragram_matches</strong> - occurrence count of the top 5000 phishing domain tetragrams,</li> <li><strong>lex_phishing_pentagram_matches</strong> - occurrence count of the top 10000 phishing domain pentagrams.</li> </ul> <h2>DNS-based Features</h2> <p>The following features were extracted from DNS responses when querying about the domain:</p> <ul> <li><strong>dns_A_count</strong> - number of A records for the domain,</li> <li><strong>dns_AAAA_count</strong> - number of AAAA records for the domain,</li> <li><strong>dns_CNAME_count</strong> - number of CNAME records for the domain,</li> <li><strong>dns_MX_count</strong> - number of MX records for the domain,</li> <li><strong>dns_NS_count</strong> - number of nameserver (NS) records for the domain,</li> <li><strong>dns_TXT_count</strong> - number of TXT records for the domain,</li> <li><strong>dns_soa_primary_ns_len</strong> - number of characters in the primary NS's domain name,</li> <li><strong>dns_soa_primary_ns_level</strong> - number of subdomain in the primary NS's domain name,</li> <li><strong>dns_soa_primary_ns_digit_count</strong> - number of digits in the primary NS's domain name,</li> <li><strong>dns_soa_primary_ns_entropy </strong>- normalized entropy of the primary NS's domain name,</li> <li><strong>dns_soa_email_len</strong> - number of characters in the admin's email domain name part,</li> <li><strong>dns_soa_email_level</strong> - number of subdomains in the admin's email domain name part,</li> <li><strong>dns_soa_email_digit_count</strong> - number of digits in the admin's email domain name part,</li> <li><strong>dns_soa_email_entropy</strong> - normalized entropy of the admin's email domain name part,</li> <li><strong>dns_soa_refresh</strong> - SOA refresh parameter,</li> <li><strong>dns_soa_retry</strong> - SOA retry parameter,</li> <li><strong>dns_soa_expire</strong> - SOA expire parameter,</li> <li><strong>dns_mx_avg_len</strong> - average number of characters of the domain names in MX records,</li> <li><strong>dns_mx_avg_entropy</strong> - average normalized entropy of the domain names in MX records,</li> <li><strong>dns_domain_name_in_mx </strong>- true if the domain name is contained in the MX record's domains,</li> <li><strong>dns_txt_spf_exists</strong> - true if an SPF record is in the TXT RRs,</li> <li><strong>dns_txt_avg_entropy</strong> - average normalized entropy of the TXT records</li> <li><strong>dns_ttl_low</strong> - number of RRsets with TTL in [0,100],</li> <li><strong>dns_ttl_mid </strong>- number of RRsets with TTL in [101,500],</li> <li><strong>dns_zone_entropy</strong> - normalized entropy of the zone's domain name.</li> </ul> <h2>IP-based Features</h2> <p>These features were derived from IP addresses and ICMP echo replies:</p> <ul> <li><strong>ip_mean_average_rtt</strong> - average RTT of all ICMP echo attempts,</li> <li><strong>ip_entropy</strong> - total entropy of all /16 (/64 for v6) IP prefixes,</li> <li><strong>ip_count</strong> - total number of IP addresses for the domain,</li> <li><strong>ip_v4_count</strong> - total number of IPv4 addresses for the domain,</li> <li><strong>ip_v6_count</strong> - total number of IPv6 addresses for the domain,</li> </ul> <h2>TLS-based Features</h2> <p>The following features were extracted from TLS certificate chains and TLS handshakes:</p> <ul> <li><strong>tls_chain_len</strong> - length of the TLS certificate chain,</li> <li><strong>tls_broken_chain</strong> - true if there is a certificate that has never been valid,</li> <li><strong>tls_expired_chain </strong>- true if there is an expired certificate in the chain,</li> <li><strong>tls_total_extension_count</strong> - total extensions in all certificates in the chain,</li> <li><strong>tls_critical_extensions</strong> - total extensions flagged as "critical" in all certificates,</li> <li><strong>tls_with_policies_crt_count</strong> - number of certificates that include the "policies" extension,</li> <li><strong>tls_percentage_crt_with_policies</strong> - percentage of certificates that include the "policies" extension,</li> <li><strong>tls_x509_anypolicy_crt_count</strong> - number of certificates not enforcing any security policy,</li> <li><strong>tls_iso_policy_crt_count</strong> - total discovered policies from the 1.* OID space,</li> <li><strong>tls_joint_isoitu_policy_crt_count</strong> - total discovered policies from from the 2.* OID space,</li> <li><strong>tls_subject_count</strong> - number of subject alternative names (SANs) in the leaf certificate,</li> <li><strong>tls_server_auth_crt_count</strong> - number of certificates with the "Web Server Authentication",</li> <li><strong>tls_client_auth_crt_count</strong> - number of certificates with the "Web Client Authentication",</li> <li><strong>tls_CA_certs_in_chain_ratio</strong> - ratio of CA certificates in the chain,</li> <li><strong>tls_unique_SLD_count</strong> -number of unique second-level domains (SLD) in domain name SANs, </li> <li><strong>tls_common_name_count</strong> - number of common names in the chains,</li> <li><strong>tls_root_cert_validity_len</strong> - length of the validity period of the root certificate,</li> <li><strong>tls_leaf_cert_validity_len</strong> - length of the validity period of the leaf certificate.</li> </ul> <h2>WHOIS/RDAP-based Features</h2> <p>These features are based on the information gathered from WHOIS/RDAP when asking about: a) the domain name and b) domain-related IP addresses:</p> <ul> <li><strong>rdap_registration_period</strong> - difference between domain expiration and registration date,</li> <li><strong>rdap_has_dnssec</strong> - true if DNSSEC is used for the domain,</li> <li><strong>rdap_domain_age</strong> - days elapsed from the domain registration,</li> <li><strong>rdap_time_from_last_change</strong> - days elapsed from the last change of records,</li> <li><strong>rdap_domain_active_time</strong> - min(today, expiration) - registration date,</li> <li><strong>rdap_registrar_name_hash</strong> - hash of the domain's registrar,</li> <li><strong>rdap_ip_avg_admin_name_len</strong> - average length of the admin's name for IP addresses.</li> </ul> <h2>Geolocation Features</h2> <p>This set of features is based on information gathered from the GeoIP service when asked about domain-related IP addresses:</p> <ul> <li><strong>geo_countries_count</strong> - number of distinct countries where servers of domain-related IPs are located,</li> <li><strong>geo_countries_hash</strong> - a unique hash for each combination of countries amongst domain-related IPs,</li> <li><strong>geo_continent_hash</strong> - a uniuque hash for each combinations of continents where the countries are situated.</li> </ul>
A Dataset of Information (DNS, IP, WHOIS/RDAP, TLS, GeoIP) for a Large Corpus of Benign, Phishing, and Malware Domain Names 2024
<p>The dataset contains DNS records, IP-related features, WHOIS/RDAP information, information from TLS handshakes and certificates, and GeoIP information for 368,956 benign domains from Cisco Umbrella, 461,338 benign domains from the actual CESNET network traffic, 164,425 phishing domains from PhishTank and OpenPhish services, and 100,809 malware domains from various sources like ThreatFox, The Firebog, MISP threat intelligence platform, and other sources. The ground truth for the phishing dataset was double-check with the VirusTotal (VT) service. Domain names not considered malicious by VT have been removed from phishing and malware datasets. Similarly, benign domain names that were considered risky by VT have been removed from the benign datasets. The data was collected between March 2023 and July 2024. The final assessment of the data was conducted in August 2024.</p> <p>The dataset is useful for cybersecurity research, e.g. statistical analysis of domain data or feature extraction for training machine learning-based classifiers, e.g. for phishing and malware website detection.</p> <p>The dataset was created using software available in the associated GitHub repository <a href="https://github.com/nesfit/domainradar-dib" target="_blank" rel="noopener">nesfit/domainradar-dib</a>.</p> <h1>Data Files</h1> <ul> <li> <p>The data is located in the following individual files:</p> <ul> <li><strong>benign_umbrella.json</strong> - data for 368,956 benign domains from Cisco Umbrella,</li> <li><strong>benign_cesnet.json </strong>- data for 461,338 benign domains from the CESNET network,</li> <li><strong>phishing.json</strong> - data for 164,425 phishing domains, and</li> <li><strong>malware.json</strong> - data for 100,809 malware domains.</li> </ul> </li> <li>The <strong>schema.json</strong> file contains a JSON Schema with detailed description of the data entries.</li> </ul> <h1>Data Structure</h1> <div> <p>Both files contain a JSON array of records generated using mongoexport (in the MongoDB Extended JSON (v2) format in Relaxed Mode). The following table documents the structure of a record. Please note that:</p> <ul> <li>some fields may be missing (they should be interpreted as nulls), </li> <li>extra fields may be present (they should be ignored).</li> </ul> </div> <table> <tbody> <tr> <td> <div> <div> <p><strong>Field name </strong></p> </div> </div> </td> <td> <div> <div> <p><strong>Field type </strong></p> </div> </div> </td> <td> <div> <div> <p><strong>Nullable </strong></p> </div> </div> </td> <td> <div> <div> <p><strong>Description </strong></p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>domain_name </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The evaluated domain name </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>url </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The source URL for the domain name </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>evaluated_on </p> </div> </div> </td> <td> <div> <div> <p>Date </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Date of last collection attempt </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>source </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>An identifier of the source </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>sourced_on </p> </div> </div> </td> <td> <div> <div> <p>Date </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Date of ingestion of the domain name </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>dns </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>Data from DNS scan </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>rdap </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>Data from RDAP or WHOIS </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>tls </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>Data from TLS handshake </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>ip_data </p> </div> </div> </td> <td> <div> <div> <p>Array of Objects </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>Array of data objects capturing the IP addresses related to the domain name </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>malware_type</p> </div> </div> </td> <td> <div> <div> <p>String</p> </div> </div> </td> <td> <div> <div> <p>No</p> </div> </div> </td> <td> <div> <div> <p>The malware type/family or “unknown” (only present in malware.json) </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p><strong>DNS data (dns field) </strong></p> </div> </div> </td> <td> </td> <td> </td> <td> </td> </tr> <tr> <td> <div> <div> <p>A </p> </div> </div> </td> <td> <div> <div> <p>Array of Strings </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Array of IPv4 addresses </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>AAAA </p> </div> </div> </td> <td> <div> <div> <p>Array of Strings </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Array of IPv6 addresses </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>TXT </p> </div> </div> </td> <td> <div> <div> <p>Array of Strings </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Array of raw TXT values </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>CNAME </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The CNAME target and related IPs </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>MX </p> </div> </div> </td> <td> <div> <div> <p>Array of Objects </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Array of objects with the MX target hostname, priority and related IPs </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>NS </p> </div> </div> </td> <td> <div> <div> <p>Array of Objects </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Array of objects with the NS target hostname and related IPs </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>SOA </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>All the SOA fields, present if found at the target domain name </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>zone_SOA </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The SOA fields of the target’s zone (closest point of delegation), present if found and not a record in the target domain directly </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>dnssec </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Flags describing the DNSSEC validation result for each record type </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>ttls </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The TTL values for each record type </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>remarks </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The zone domain name and DNSSEC flags </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p><strong>RDAP data (rdap field) </strong></p> </div> </div> </td> <td> </td> <td> </td> <td> </td> </tr> <tr> <td> <div> <div> <p>copyright_notice </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>RDAP/WHOIS data usage copyright notice </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>dnssec </p> </div> </div> </td> <td> <div> <div> <p>Bool </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>DNSSEC presence flag </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>entitites </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>An object with various arrays representing the found related entity types (e.g. abuse, admin, registrant). The arrays contain objects describing the individual entities. </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>expiration_date </p> </div> </div> </td> <td> <div> <div> <p>Date </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>The current date of expiration </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>handle </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>RDAP handle </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>last_changed_date </p> </div> </div> </td> <td> <div> <div> <p>Date </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>The date when the domain was last changed </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>name </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The target domain name for which the data in this object are stored </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>nameservers </p> </div> </div> </td> <td> <div> <div> <p>Array of Strings </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Nameserver hostnames provided by RDAP or WHOIS </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>registration_date </p> </div> </div> </td> <td> <div> <div> <p>Date </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>First registration date </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>status </p> </div> </div> </td> <td> <div> <div> <p>Array of Strings </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The state of the registered object (see RFC 7483, section 10.2.2)</p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>terms_of_service_url </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>URL of the RDAP usage ToS </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>url </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>URL of the RDAP entity </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>whois_server </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>WHOIS server address </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p><strong>TLS data (tls field) </strong></p> </div> </div> </td> <td> </td> <td> </td> <td> </td> </tr> <tr> <td> <div> <div> <p>cipher </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>TLS cipher suite description according to <a href="https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4" target="_blank" rel="noopener">IANA</a></p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>protocol </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>One of “TLS”, ”TLSv1.2”, ”TLSv1.3” </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>certificates </p> </div> </div> </td> <td> <div> <div> <p>Array of Objects </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Array of objects representing the certificate chain, the first element is the root certificate </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p><strong>IP data (elements in the ip_data array) </strong></p> </div> </div> </td> <td> </td> <td> </td> <td> </td> </tr> <tr> <td> <div> <div> <p>ip </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The IP address </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>from_record </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The type of the DNS record the address was captured from </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>remarks </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Ping round-trip time, “is alive” flag and rdap/geo/asn evaluation dates </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>rdap </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>RDAP data, similar to DNS RDAP, see the JSON Schema for details </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>geo </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>Geolocation data from the GeoLite2 City database (e.g. latitude, longitude, city, country, etc.) </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>asn </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>Autonomous system data from the GeoLite2 ASN database (ASN, organization, network) </p> </div> </div> </td> </tr> </tbody> </table> <h1>Acknowledgements</h1> <p>We would like to thank the OpenPhish Team for grating permission to use and publish their dataset. We also thank VirusTotal for providing us access to the API for research purposes.</p> <p>This dataset includes GeoLite2 data created by MaxMind, available from <a href="https://www.maxmind.com" target="_blank" rel="noopener">https://www.maxmind.com</a>.</p> <p>The research has been supported by the <strong>Flow-based Encrypted Traffic Analysis</strong> project, no. VJ02010024, granted by the Ministry of the Interior of the Czech Republic and the <strong>Smart Information Technology for a Resilient Society </strong>project, no. FIT-S-23-8209, granted by Brno University of Technology.</p>
IDENTIFICAÇÃO DE PHISHINGS ATRAVÉS DE IMAGENS - ANÁLISECOMPARATIVA ENTRE FERRAMENTAS DE RECONHECIMENTO DE IMAGENS
<p>Imagens utilizadas nos treinamentos e testes dos algoritmos de reconhecimento de imagens. Em adicional um catálogo em formato xlsx contendo nome da imagem, URL onde estava o phishing e URL do Phishtank.</p>
Dataset for paper Spotting the Hook: Leveraging Domain Data for Advanced Phishing Detection
<p>The dataset contains DNS records, IP-related features, WHOIS/RDAP information, information from TLS certificate fields, and GeoIP information for 432,572 benign domains from Cisco Umbrella and 68,353 phishing domains from PhishTank and OpenPhish services. The ground truth for the phishing dataset was double-check with the VirusTotal (VT) service. Domain names not considered as phishing by VT have been removed. The data was collected between March and November 2023.The final assessment of the data was conducted in December 2023.</p> <p>The dataset is useful for statistical analysis of domain data or feature extraction for training machine learning-based classifiers, e.g. for phishing detection. </p> <h1>Data Files</h1> <p>The data is located in two individual files:</p> <ul> <li><strong>benign.json</strong> - data for 432,572 benign domains, and</li> <li><strong>phishing.json</strong> - data for 68,353 phishing domains.</li> </ul> <h1>Data Structure</h1> <div> <p>Both files contain a JSON array of records generated using mongoexport. The following table documents the structure of a record. Please note that:</p> <ul> <li>some fields may be missing (they should be interpreted as nulls), </li> <li>extra fields may be present (they should be ignored), </li> <li>due to a processing error, the common_name field of the certificate objects always contains trailing symbols: <code>‘></code> .</li> </ul> </div> <table> <tbody> <tr> <td> <div> <div> <p><strong>Field name </strong></p> </div> </div> </td> <td> <div> <div> <p><strong>Field type </strong></p> </div> </div> </td> <td> <div> <div> <p><strong>Nullable </strong></p> </div> </div> </td> <td> <div> <div> <p><strong>Description </strong></p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>domain_name </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The evaluated domain name </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>url </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The source URL for the domain name </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>evaluated_on </p> </div> </div> </td> <td> <div> <div> <p>Date </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Date of last collection attempt </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>source </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>An identifier of the source </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>sourced_on </p> </div> </div> </td> <td> <div> <div> <p>Date </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Date of ingestion of the domain name </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>dns </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>Data from DNS scan </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>rdap </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>Data from RDAP or WHOIS </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>tls </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>Data from TLS handshake </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>ip_data </p> </div> </div> </td> <td> <div> <div> <p>Array of Objects </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>Array of data objects capturing the IP addresses related to the domain name </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p><strong>DNS data (dns field) </strong></p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>A </p> </div> </div> </td> <td> <div> <div> <p>Array of Strings </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Array of IPv4 addresses </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>AAAA </p> </div> </div> </td> <td> <div> <div> <p>Array of Strings </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Array of IPv6 addresses </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>TXT </p> </div> </div> </td> <td> <div> <div> <p>Array of Strings </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Array of raw TXT values </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>CNAME </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The CNAME target and related IPs </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>MX </p> </div> </div> </td> <td> <div> <div> <p>Array of Objects </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Array of objects with the MX target hostname, priority and related IPs </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>NS </p> </div> </div> </td> <td> <div> <div> <p>Array of Objects </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Array of objects with the NS target hostname and related IPs </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>SOA </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>All the SOA fields, present if found at the target domain name </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>zone_SOA </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The SOA fields of the target’s zone (closest point of delegation), present if found and not a record in the target domain directly </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>dnssec </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Flags describing the DNSSEC validation result for each record type </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>ttls </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The TTL values for each record type </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>remarks </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The zone domain name and DNSSEC flags </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p><strong>RDAP data (rdap field) </strong></p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>copyright_notice </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>RDAP/WHOIS data usage copyright notice </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>dnssec </p> </div> </div> </td> <td> <div> <div> <p>Bool </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>DNSSEC presence flag </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>entitites </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>An object with various arrays representing the found related entity types (e.g. abuse, admin, registrant). The arrays contain objects describing the individual entities. </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>expiration_date </p> </div> </div> </td> <td> <div> <div> <p>Date </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>The current date of expiration </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>handle </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>RDAP handle </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>last_changed_date </p> </div> </div> </td> <td> <div> <div> <p>Date </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>The date when the domain was last changed </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>name </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The target domain name for which the data in this object are stored </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>nameservers </p> </div> </div> </td> <td> <div> <div> <p>Array of Strings </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Nameserver hostnames provided by RDAP or WHOIS </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>registration_date </p> </div> </div> </td> <td> <div> <div> <p>Date </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>First registration date </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>status </p> </div> </div> </td> <td> <div> <div> <p>Array of Strings </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The state of the registered object [TODO] </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>terms_of_service_url </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>URL of the RDAP usage ToS </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>url </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>URL of the RDAP entity </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>whois_server </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>WHOIS server address </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p><strong>TLS data (tls field) </strong></p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>cipher </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>TLS cipher suite description according to [TODO] </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>protocol </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>One of “TLS”, ”TLSv1.2”, ”TLSv1.3” </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>certificates </p> </div> </div> </td> <td> <div> <div> <p>Array of Objects </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Array of objects representing the certificate chain, the first element is the root certificate </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p><strong>IP data (elements in the ip_data array) </strong></p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>ip </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The IP address </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>from_record </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The type of the DNS record the address was captured from </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>remarks </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Ping round-trip time, “is alive” flag and rdap/geo/asn evaluation dates </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>rdap </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>RDAP data, similar to DNS RDAP, see the JSON Schema for details </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>geo </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>Geolocation data from the GeoLite2 City database (e.g. latitude, longitude, city, country, etc.) </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>asn </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>Autonomous system data from the GeoLite2 ASN database (ASN, organization, network) </p> </div> </div> </td> </tr> </tbody> </table> <h1>Acknowledgements</h1> <p>We would like to thank the OpenPhish Team for grating permission to use and publish their dataset. We also thank VirusTotal for providing us access to the API for research purposes. The research has been supported by the <strong>Flow-based Encrypted Traffic Analysis</strong> project, no. VJ02010024, granted by the Ministry of the Interior of the Czech Republic and the <strong>Smart Information Technology for a Resilient Society </strong>project, no. FIT-S-23-8209, granted by Brno University of Technology.</p>
Phishing Email Curated Datasets
<p>We have curated 11 datasets spanning from 1995 to 2022.</p> <p>If you use this datasets, please cite:<br>1. A. I. Champa, M. F. Rabbi, and M. F. Zibran, “Why phishing emails escape detection: A closer look at the failure points,” in <em>12th Interna- tional Symposium on Digital Forensics and Security (ISDFS)</em>, 2024, pp. 1–6.<br>2. A. I. Champa, M. F. Rabbi, and M. F. Zibran, “Curated datasets and feature analysis for phishing email detection with machine learning,” in 3rd IEEE International Conference on Computing and Machine Intelligence (ICMI), 2024, pp. 1–7.</p> <p><br>Bibtext:<br>1. @inproceedings{champa2024phishing,<br> title={Why Phishing Emails Escape Detection: A Closer Look at the Failure Points},<br> author={Champa, Arifa I and Rabbi, Fazle and Zibran, Minhaz F},<br> booktitle={2024 12th International Symposium on Digital Forensics and Security (ISDFS)},<br> pages={1--6},<br> year={2024},<br> organization={IEEE}<br>}</p> <p>2. @inproceedings{champa2024curated,<br> title={Curated Datasets and Feature Analysis for Phishing Email Detection with Machine Learning},<br> author={Champa, Arifa I and Rabbi, Md Fazle and Zibran, Minhaz F},<br> booktitle={3rd IEEE International Conference on Computing and Machine Intelligence (ICMI)},<br> pages = {1--7},<br> year={2024}<br>}</p>
Phishing validation emails dataset
<p><strong>Description</strong>:<br>This dataset contains a collection of 2,000 emails, specifically curated for the purpose of validating machine learning models designed to differentiate between safe emails and phishing attempts. The dataset is a mix of real-world email samples and artificially generated emails, ensuring a comprehensive reflection of realistic email scenarios.</p> <p>Each entry in the dataset includes the full text of an email and a corresponding label that categorizes the email as either 'Safe Email' or 'Phishing Email.' This dataset is intended for use in validating the performance of models after they have been trained, providing a crucial step in ensuring the model's accuracy and reliability before deployment.<br><br></p> <p><strong>Dataset Structure</strong>:</p> <ul> <li><strong>Total Emails</strong>: 2,000</li> <li><strong>Email Types</strong>: <ul> <li>Safe Emails</li> <li>Phishing Emails</li> </ul> </li> <li><strong>Attributes</strong>: <ul> <li>Full text of the email</li> <li>Label indicating whether the email is safe or phishing</li> </ul> </li> </ul> <p><strong>Example Entries</strong>:</p> <ol> <li><strong>Email Text</strong>: "Dear Jordan, your subscription has been succes..." <ul> <li><strong>Email Type</strong>: Safe Email</li> </ul> </li> <li><strong>Email Text</strong>: "Congratulations! You've won a $3000 gift card...." <ul> <li><strong>Email Type</strong>: Phishing Email</li> <li> </li> </ul> </li> </ol> <p><strong><span>Acknowledgments</span></strong></p> <p>The authors would like to thank Sofia Tech Park and the Artificial intelligence and CAD systems laboratory for their assistance and support in conducting this research.</p>
Replication Package - The applicability of a hybrid framework for automated phishing detection
<p>Replication package and dataset for the paper: The applicability of a hybrid framework for automated phishing detection</p>
ScienceDex guides
Understand access before you commit
These curated guides explain access requirements, typical timelines, costs, and reuse considerations for widely used research datasets.
Allen Brain Atlas
Allen Brain Atlas is an Allen Institute collection of brain map atlases, datasets, APIs, and analysis tools covering mouse, human, and non-human primate brain resources.
Annotated Behaviour and Observability Dataset (ABODe)
ABODe is a University of Edinburgh DataShare dataset for behavior classification in group-housed mice using home-cage video, identities, bounding boxes, ground-plate positions, and annotator labels.
DANDI Archive for NWB datasets
DANDI is a BRAIN Initiative archive for publishing and sharing neurophysiology data, including electrophysiology, optophysiology, and behavioral data packaged as NWB and related standards.
International Brain Laboratory public data
The International Brain Laboratory public data releases expose standardized mouse decision-making experiments, including Neuropixels recordings, widefield calcium imaging, behavior, and session metadata accessed through the ONE API.
OpenNeuro
OpenNeuro is a free, open platform for sharing neuroimaging datasets, with public search, dataset pages, and download paths for web, S3, DataLad, and the OpenNeuro CLI.