<?xml version="1.0" encoding="UTF-8" standalone="yes"?><?xml-stylesheet type="text/xsl" href="/oai-pmh-repository/static/oai2.xsl"?>
<OAI-PMH xmlns="http://www.openarchives.org/OAI/2.0/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.openarchives.org/OAI/2.0/ http://www.openarchives.org/OAI/2.0/OAI-PMH.xsd">
    <responseDate>2026-10-13T23:52:38Z</responseDate>
    <request verb="GetRecord" identifier="oai:data.mendeley.com/gj8vp49xm5.1" metadataPrefix="oai_dc">https://data.mendeley.com/oai</request>
    <GetRecord>
        <record>
            <header>
                <identifier>oai:data.mendeley.com/gj8vp49xm5.1</identifier>
                <datestamp>2026-09-24T23:23:28Z</datestamp>
            </header>
            <metadata><oai_dc:dc xsi:schemaLocation="http://www.openarchives.org/OAI/2.0/oai_dc/ http://www.openarchives.org/OAI/2.0/oai_dc.xsd" xmlns:oai_dc="http://www.openarchives.org/OAI/2.0/oai_dc/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <dc:creator>Jeremiah, Daniel</dc:creator>
    <dc:title>WASP: Adversarial Process-Injection Snapshots from Trusted Windows Binaries</dc:title>
    <dc:publisher>Mendeley Data</dc:publisher>
    <dc:description>We introduce WASP (Windows Adversarial Simulation of Process Injection), a dataset of runtime snapshots collected from trusted Windows binaries during normal execution and controlled adversarial process-injection experiments. Unlike static malware collections, every retained binary was launched and observed dynamically in three isolated virtualised Windows environments with native services and active endpoint-security controls installed.

The dataset contains 74,368 ordered process snapshots: 72,472 benign-labelled observations and 1,896 injection-labelled observations. The benign baseline covers 2,102 accepted launches and 305 distinct trusted-binary identifiers. The controlled component contains 63 experiments in which the same target was independently launched under clean and injection conditions. Adversarial activity was simulated using Cobalt Strike C2, NimPlant C2, AsyncRAT and QuasarRAT across nine process-injection procedures.

Each snapshot records process resources, CPU and I/O activity, executable-memory structure, modules, network state, thread context, image provenance and available ETW/kernel-audit measurements. The release includes explicit missingness indicators, grouping keys, feature definitions, experimental coverage records and integrity checksums.

Snapshot rows are repeated runtime measurements rather than independent attacks. Analyses should therefore preserve launch and experiment grouping. The release contains sanitised numerical telemetry only; it excludes Windows executables, malware binaries, payloads, injectors, credentials, IP addresses, raw memory and operational C2 configurations.

 - Folder Structure

data/
├── longitudinal_benign_dataset/
│   ├── windows10.csv
│   ├── win2016_dc.csv
│   └── win11_x64.csv
│
└── controlled_paired_dataset/
    ├── controlled_clean_snapshots.csv
    └── injection_labelled_snapshots.csv
</dc:description>
    <dc:subject>Artificial Intelligence</dc:subject>
    <dc:subject>Machine Learning</dc:subject>
    <dc:subject>Information Security</dc:subject>
    <dc:subject>Computer</dc:subject>
    <dc:subject>Data Analytics Cybersecurity</dc:subject>
    <dc:subject>Adversarial Machine Learning</dc:subject>
    <dc:contributor id="https://orcid.org/0000-0002-3178-4026">Rafiq, Husnain</dc:contributor>
    <dc:contributor id="https://orcid.org/0000-0003-0399-9633">Ta, Vinh Thong</dc:contributor>
    <dc:contributor id="https://orcid.org/0000-0003-4546-4127">Okoyeigbo, Obinna </dc:contributor>
    <dc:contributor id="https://orcid.org/0009-0000-9247-1456">Akande , Jamiu </dc:contributor>
    <dc:type>Dataset</dc:type>
    <dc:identifier>doi:10.17632/gj8vp49xm5.1</dc:identifier>
    <dc:identifier>oai:data.mendeley.com/gj8vp49xm5.1</dc:identifier>
    <dc:rights>Creative Commons Attribution 4.0 International</dc:rights>
    <dc:rights>http://creativecommons.org/licenses/by/4.0</dc:rights>
    <dc:relation>https://data.mendeley.com/datasets/gj8vp49xm5</dc:relation>
    <dc:date>2026-09-24T23:23:28Z</dc:date>
</oai_dc:dc></metadata>
        </record>
    </GetRecord>
</OAI-PMH>
