ExtProbe evaluation traces (public subset, v1.0): redacted Chrome extension sandbox runs for re-scoring

# Zenodo record: ExtProbe evaluation traces, public subset (v1.0) ## Title ExtProbe evaluation traces (public subset, v1.0): redacted Chrome extension sandbox runs for re-scoring ## Upload type Dataset ## Version 1.0 ## Authors 1. Tran, Duong Tien — Ho Chi Minh City University of Technology (HCMUT), VNU-HCM2. Tran-Truong, Phat Tuan — Ho Chi Minh City University of Technology (HCMUT), VNU-HCM3. Le, Xuan-Bach — Ho Chi Minh City University of Technology (HCMUT), VNU-HCM4. Nguyen, Duy — University of Economics Ho Chi Minh City (UEH)5. Vu, Duc-Ly — Thu Dau Mot University ## Description Redacted run traces behind the evaluation of ExtProbe, a sandbox for inspecting Chrome extension behavior before installation (SANER 2027 tool demo). Each trace is the record of one sandbox run of one Chrome Manifest V3 extension: the network requests, tabs, injected nodes and other events the extension produced, each attributed to the extension context that issued it. The archive lets anyone re-run the host-side scoring without Docker and check that the published scores and flags reproduce. Contents (1,061 traces in `extprobe-traces-public-v1.0.zip`): - `dev/` (610): development set used to build the detectors. - `heldout/` (200): held-out test set (192 benign-labeled, 8 grey), run once on the frozen configuration. - `random/` (200): random sample of live Chrome Web Store MV3 extensions (197 complete runs). - `probe_b/` (50): runs of the experimental probing mode on held-out benign-labeled extensions. This is the only probing data in this record; the 43 probing runs on the reported-extension set belong to the restricted record. - `canary/` (1): the bundled canary test extension. Each trace folder holds `meta.json` and `output/events.json` (plus `output/events_probe.json` for `probe_b`). Packet captures, screenshots, logs, unpacked extensions and `.crx` packages are not included. Re-scoring, from a checkout of https://github.com/misu2tdt/ExtProbe: python -m extprobe score-v3 --traces extprobe-traces-public-v1.0/heldout --out heldout.json python -m extprobe score-v31 --traces extprobe-traces-public-v1.0/probe_b --out probe_b.json Re-scoring this archive gives the same score, flag, level and fired detectors as the original traces for all 1,061 traces. It reproduces the published flag rates: 17/192 held-out benign-labeled (8.9%), 1/197 random store extensions (0.5%), 41/278 development extensions labeled malicious by public datasets (14.7%), and the canary scoring 100. Redactions: cookie and authorization header values; bearer credentials and error-reporting keys in captured text; public IP addresses, replaced consistently by documentation addresses (198.51.100.0/24, 203.0.113.0/24, 198.18.0.0/15, 2001:db8::/32). API tokens and keys found in requests and responses were replaced with fixed placeholders. Domain names and request URLs are kept, because they are the evidence. The traces of the reported-extension set (215 traces, and the 43 probing runs on that set) are not in this record. They are available on request in a separate restricted record. Safety: traces contain content and code returned by servers of extensions that may be harmful. Treat it as untrusted data; do not execute it, open the recorded URLs, or render the recorded HTML. The score prioritizes review; it is not a malware verdict. ## License Creative Commons Attribution 4.0 International (CC BY 4.0). The grant covers the authors' recordings; third-party content captured inside the traces (pages, scripts, responses) remains under its owners' terms. ## Related identifiers - https://github.com/misu2tdt/ExtProbe — is supplement to (software, source code) - 10.5281/zenodo.23449077 — is supplement to (ExtProbe software release v1.0-saner) ## Keywords browser extensions; Chrome Manifest V3; dynamic analysis; request provenance; sandbox; reproducibility