API Call Dataset of LockBit, Netwalker, WannaCry, and Petya Ransomware

This dataset comprises sequences of Windows API calls collected from ransomware and benign program samples in a controlled sandboxed environment. The ransomware samples belong to four families, namely LockBit, NetWalker, WannaCry, and Petya. This dataset provides host-based behavioral information about the samples during their execution. The underlying hypothesis behind this data collection is that ransomware exhibits distinct API call behavioral patterns compared with benign software. The data can be used to study ransomware-related behavioral patterns, perform feature extraction, and develop ransomware detection methods using machine learning techniques.本数据集包含在受控沙箱环境中，从勒索软件与良性程序样本中采集的Windows应用程序编程接口（Windows API）调用序列。所涉及的勒索软件样本共涵盖4个家族，分别为LockBit、NetWalker、WannaCry及Petya。本数据集提供了样本在执行期间的基于主机的行为信息。本次数据采集的核心假设为：相较于良性软件，勒索软件会展现出独特的API调用行为模式。该数据集可用于开展勒索软件相关行为模式研究、特征提取工作，以及借助机器学习技术开发勒索软件检测方法。