"Releasing the Malware Analysis Dataset: Memory Forensics + ML for Ransomware Detection"
I'm excited to announce the release of our Malware Analysis Dataset on Hugging Face — a comprehensive memory forensics dataset for ransomware research that combines the Volatility Framework, YARA rules, and machine learning for IoT/energy system cybersecurity.
This work was conducted with Sonika Malik and published at IEEE ICAIA 2026 (4th International Conference on Artificial Intelligence and Applications) under the title:
"Integrating Machine Learning and Memory Forensics for Enhancing Cybersecurity in IoT-Enabled Energy Systems"
What's in the Dataset
| Component | Scale |
|---|---|
| Memory Dumps | 18 total (6 benign + 12 ransomware) × 4.5 GB each |
| Ransomware Families | WannaCry, Cerber, GandCrab, Jigsaw, TeslaCrypt, ViraLock, BlueHowl, Annabelle, Vipasna |
| ELF Binaries | 18 extracted binaries (benign + ransomware) |
| Volatility Scans | malfind, pslist, psscan, pstree, psxview, vadinfo, vadwalk, yarascan, memmap |
| YARA Rules | 100+ curated rules (packers, crypto, exploit kits, APTs, ransomware families) |
| VM Images | Full Ubuntu 64-bit VM with snapshots |
| Code & Papers | Automation scripts, Jupyter notebooks, IEEE ICAIA 2026 paper |
Total: ~470 GB raw data + 33 GB analysis outputs — all public on Hugging Face.
The Research (IEEE ICAIA 2026)
Our paper "Integrating Machine Learning and Memory Forensics for Enhancing Cybersecurity in IoT-Enabled Energy Systems" presents:
- Automated Volatility orchestration — plugin pipeline (malfind, vadinfo, yarascan, pslist) extracting behavioral features from raw memory
- Feature engineering — process injection indicators, VAD anomalies, YARA match profiles, memory entropy
- ML classification — benign vs. ransomware process identification using extracted forensic artifacts
- 100+ YARA rules — custom signatures for ransomware family attribution (WannaCry, Cerber, GandCrab, etc.)
- Real-world validation — tested on 18 memory dumps from controlled ransomware execution environments
This bridges the gap between traditional memory forensics (manual, expert-driven) and scalable ML detection for IoT/OT environments where memory analysis is critical but expertise is scarce.
Access Everything
- Dataset (analysis):
hf://datasets/Vedaang/malware_analysis— scripts, YARA, scan outputs - Raw data bucket:
hf://buckets/Vedaang/malware-analysis-data/— Benign_Analysis, Ransomware_Analysis, Scans, Virtual_Machines - Code bucket:
hf://buckets/Vedaang/malware-code-base/— automation, notebooks, papers - GitHub:
github.com/Vedaang-Chopra/Malware_Analysis— documentation, quick start
# Quick access
hf download Vedaang/malware_analysis
hf sync hf://buckets/Vedaang/malware-analysis-data/Ransomware_Analysis ./ransomware
Why This Matters
IoT/energy systems are increasingly targeted by ransomware (Colonial Pipeline, etc.). Memory forensics is one of the few ways to detect fileless/in-memory attacks — but it's historically manual. This dataset + automation enables reproducible, ML-ready forensic research for the community.
Links
- Dataset: huggingface.co/datasets/Vedaang/malware_analysis
- Raw Data Bucket: huggingface.co/buckets/Vedaang/malware-analysis-data
- Code Bucket: huggingface.co/buckets/Vedaang/malware-code-base
- GitHub: github.com/Vedaang-Chopra/Malware_Analysis
- IEEE Paper: Published at ICAIA 2026
Co-authored with Sonika Malik. Shoutout to the open-source Volatility/YARA communities that make this work possible.