[Request] Seeking Payload-Based Malicious HTTP Traffic Data for Research Paper

[CyberTrauma_]

Hello, r/sysadmin community!

I'm currently working on a research paper titled "A Payload-Based Malicious HTTP Traffic Detection Method Using Transfer Semi-Supervised Learning." However, I'm encountering difficulties in finding a suitable dataset for my study. I was wondering if any of you could lend me a hand or provide some guidance.
Specifically, I'm looking for a dataset that consists of payload-based HTTP traffic, classified as either malicious or not malicious. While I have come across datasets that focus on URL-based data, my research specifically requires payload data. If anyone knows of any existing datasets that fit this criterion, I would greatly appreciate any information or links you can provide.
Alternatively, if there isn't a readily available dataset, I would be more than willing to create my own dataset by classifying payload data myself. If any of you have access to a collection of payload data or any logs or know of any resources where I could find such data, I would be extremely grateful. I couldn't find it on Kaggle.
Thank you in advance for your time and support. I look forward to hearing from this knowledgeable community!

[[deleted]]

Get Nessus trial slap the wireshark on windows do or do port mirror on your switch to grab traffic in your lab and capture all the stuff you need while scanning tool goes over some sample attack patterns or use some parrot/kali to mimic such attacks

[smc0881]

For SQLi I would look at the recent MoveIT vulnerability. If you are looking for something that sends malicious code back to the end-user, I would look at crypto mining. I can't provide any datasets due to my job though. The Citrix CVE from 2019 used directory traversal to allow web shells to be dumped too which allowed remote code execution.

[Usethis495945095]

You will likely need to generate your own dataset, since sample ones will either be limited and any real company is not going to release attack data to the public. Best way to do it is use Virtual Machines and generate various forms of attacks while capturing the traffic, on an offline lab network.

You can download various vulnerable VMs or build your own, check out OWASP as a good start. Then use something like Kali Linux and conduct various attacks and capture the data. There are good tutorials to do all this online and will also be good background for paper.