Private datasets

We construct a private encrypted traffic dataset consisting of benign traffic and malicious traffic generated by ten representative malware frameworks, including NOPEN, BVP47, DanderSpritz, Cobalt Strike, Sliver, Covenant, Empire, Merlin, Pupy, and Koadic. Malicious traffic is collected by deploying independent instances under multiple communication configurations (e.g., staged and stageless modes) to emulate realistic attacker behaviors, while benign traffic is captured at the core network switch. Only HTTPS traffic is retained, and data are collected during multiple time windows to ensure diversity.