NCC-G

We analyzed three widely used botnet datasets (CTU-13, NCC, and NCC-2) in comma-separated value (CSV) format by clustering them based on the hosts involved and the time intervals of their activities. The results of this clustering were then transformed into a graph, where hosts are represented as nodes and their communication links are defined as edges. We further examined each feature within the dataset, aggregating and analyzing the data statistically to determine the weight of the edges. The findings from the graph visualization and edge weighting were also compiled into a table format in CSV style. The "G" in NCC-G can be understood as either "Graph" or "Group Activity," reflecting the nature of the dataset, which is the result of extracting network traffic with botnet attack activities that have been grouped into activity groups and transformed into a graph.本研究针对三个广泛使用的逗号分隔值（Comma-Separated Value, CSV）格式僵尸网络数据集（CTU-13、NCC与NCC-2），基于其涉及的主机与活动时间间隔开展聚类分析。随后将聚类结果转化为图结构：以主机作为节点，主机间的通信链路作为边。本研究进一步对数据集中的各项特征进行解析，通过统计聚合与数据分析确定各边的权重。将图可视化与边权重计算所得的研究结果整理为CSV格式的表格。NCC-G中的“G”可解读为“图（Graph）”或“群组活动（Group Activity）”，该数据集的本质为：提取包含僵尸网络攻击活动的网络流量，将其按活动群组归类后转化为图结构所得到的产物。