Code Red Dataset (2001-07-19 to 2001-08-19)

This dataset contains information useful for studying the spread of the Code-Red version 2, and CodeRedII worms. The dataset consists of a publicly available set of files that contain summarized information that does not individually identify infected computers. The first incarnation of the Code-Red worm (CRv1) began to infect hosts running unpatched versions of Microsoft's IIS webserver on July 12th, 2001. The first version of the worm uses a static seed for it's random number generator. Then, around 10:00 UTC in the morning of July 19th, 2001, a random seed variant of the Code-Red worm (CRv2) appeared and spread. This second version shared almost all of its code with the first version, but spread much more rapidly. Next, on August 4th, a new worm began to infect machines exploiting the same vulnerability in Microsoft's IIS webserver as the original Code-Red virus. Although the new worm had no relationship to the first one outside of exploiting the same vulnerability, it contained in its source code the string "CodeRedII" and was thus named CodeRed II. Finally, on September 18, 2001, the Nimda worm began to spread via backdoors left by CodeRedII, as well as via email, open network shares, and compromised web sites.本数据集包含有助于研究红色代码第二代（Code-Red version 2）以及CodeRedII蠕虫传播态势的相关信息。该数据集由公开可用的文件集合组成，其中包含汇总后的信息，无法单独识别受感染计算机。 2001年7月12日，初代“红色代码”蠕虫（CRv1）开始感染运行未打补丁的微软（Microsoft）IIS网页服务器的主机。该初代蠕虫的随机数生成器采用静态种子。同年7月19日UTC时间上午10时左右，搭载随机种子变体的“红色代码”蠕虫（CRv2）出现并开始传播。该第二代蠕虫与初代蠕虫的代码几乎完全同源，但传播速度要快得多。 8月4日，一款新蠕虫开始感染利用微软IIS网页服务器同一漏洞的主机。尽管这款新蠕虫除利用相同漏洞外，与初代“红色代码”蠕虫并无其他关联，但其源代码中包含"CodeRedII"字符串，因此被命名为CodeRed II。 2001年9月18日，Nimda蠕虫开始通过CodeRedII遗留的后门、电子邮件、开放网络共享以及已被攻陷的网站进行传播。

搜集汇总

背景与挑战

背景概述

该数据集由UCSD应用互联网数据分析中心提供，收集于2001年7月19日至8月19日，用于研究CodeRed蠕虫的传播，包含CodeRed版本2和CodeRedII蠕虫的汇总匿名数据，属于'黑洞地址空间数据'类别，主题涉及计算机蠕虫。数据集已撤回不再可用，大小为255.0MB，使用无限制且允许商业用途。