Two-platform Ransomware Datasets

The Windows virtual machine environment executed both benign software and ransomware samples to simulate real-world attack scenarios. The primary HPC events monitored include branches, branches-misses, L1_icache_load_misses, iTLB_load_misses, and instructions.

During the post-processing stage, the relevant event fields were extracted from the raw logs and structured into a CSV file. The first column of the CSV file contains the sample names, the second column contains binary classification labels (distinguishing benign software from ransomware), and the subsequent columns sequentially list 100 consecutive time-series data points collected for each HPC event.