GT Malware Netflow Daily Feed 2018 (2018-09-01)

This dataset contains a daily feed of network flow data produced by the Georgia Tech Information Security Center's malware analysis system. Metadata included with the feed associates each body of netflow with a specific suspect Windows executable, which is run in a sterile, isolated environment, with controlled access to the Internet, for a short period of time. Each sample's full network activity is recorded, distilled using nfcapd, and the resulting netflow information made available.

This feed is structured as a set of archives that each correspond to a single day of sample processing-based netflow data. Each archive decompresses to a top-level folder containing files that are named according to the MD5 of the sample that generated them.