Dataset Overview
Definition：Buffer Overflow Detection Rule Dataset (BOF)is provided byChangsha Langhui Information Technology Co., Ltd.The binary security detection data set that is built by the security lab. Each data set is used to read: "XML Rules + PCAP Traffic + HTTP Reconstructed Text + Attack Type Labels + Ground Truth"The five-dimensional association structure organization, covering the Stack OverFlow, Heap OverFlow, Formatted Strings, Integer OverFlow, Off-by-One Five Subtype, ATT&CK Framework T1203 (using client-end loopholes), was designed to generate examples of training and fuzzing tests for binary gap detection models.
| Dataset Name | Buffer Overflow Detection Rule Dataset (BOF) |
| Total Data Volume | 500~10,000 |
| Data Type | Five-member group: XML rule + PCAP flow + HTTP returned text + attack type label + standard answer |
| Data Source | Langhui Security Laboratory + CVE/NVD Open Gap Database |
| License Type | Commercial Licensing Complete authorization documents are attached |
| Delivery Cycle | 2-3 Weeks |
| Buffer spill type | Stack OverFlow, Heap OverFlow, Formatted String Broken, Integer OverFlow, Off-by-One |
| ATT&CK Mapping | T1203（Exploitation for Client Execution） |
| Output Format | JSONL / CSV / PCAP |
| Language | Chinese-English Bilingual |
Core Data Fields
Each data contains six categories of rule identification, XML detection rules, attack payload, HTTP restore text, PCAP traffic, and standard answers, covering the complete closed loop from rule definition to validation evaluation.
| Field Category | Field Count | Typical Fields |
|---|---|---|
| Rule Identifier | 4 | rule_id (rule _KEEP_core_ID), rule_name (name of rule), overflow_type (spill type), severity (serious level: CC/High) |
| XML Detection Rules | 3 | rule_xml (XML rule in IDS/IPS format), vulnerable_function (hazard function: stcpy/gets/printf/scanf, etc.), payload_pattern (Payload feature mode) |
| Attack Payload | 4 | Payload (attack Payload in the original), overflow_ type (spill type), buffer_size (buffer zone size), overwrite_length (covering length) |
| HTTP Reconstructed Text | 3 | http_request (full HTTP request), http_response (full HTTP response), content_ type (response to Content-Type) |
| PCAP Traffic | 4 | pcap_file (PCAP file name), pcap_size (file size), packet_count (number of data packets), protocol (transport layer protocol) |
| Ground Truth | 4 | is_overflow (for spill attack: True/false), overflow_type (spray subtype), vulnerable_function (a leak function), available |
Data Sample Showcase
The following is a sample structured JSON after de-identification, showing the typical format of SQL injection quintuple detection data.
{
"entry_id": "BOF-2024-001836",
"rule_id": "BOF-STACK-0073",
"rule_name": "Stack Buffer Overflow via strcpy()",
"overflow_type": "Stack Overflow",
"severity": "Critical",
"rule_xml": "<rule id=\"951120\" phase=\"2\">\n <operator>detectBufferOverflow</operator>\n <action>block</action>\n <pattern>Content-Length:\\s*(\\d{4,})</pattern>\n <anomaly>request_body_length > expected_buffer_size</anomaly>\n</rule>",
"payload": "AAAA...AAAA256 bytes - overwrites return address with 0x42424242",
"buffer_size": 128,
"overwrite_length": 256,
"vulnerable_function": "strcpy(dest_buffer, user_input)",
"http_request": "POST /cgi-bin/vuln_binary HTTP/1.1\r\nHost: target.test\r\nContent-Type: application/octet-stream\r\nContent-Length: 256\r\n\r\noverflow_payload",
"http_response": "HTTP/1.1 200 OK\r\n\r\n<html>...<pre>Segmentation fault (core dumped)</pre>...</html>",
"pcap_file": "bof_stack_strcpy.pcap",
"pcap_size": "18923",
"packet_count": 34,
"technique_id": "T1203",
"cve_ref": "CVE-2023-XXXXX",
"answer": {
"is_overflow": true,
"overflow_type": "Stack Buffer Overflow",
"vulnerable_function": "strcpy",
"exploitable": true
}
}AI Application Scenarios
Binary Hole Detection Model
The 10,000 buffer zones have spilled over the binary gap detection model of CNN/GNN architecture, which automatically identifies the two-digit security gap from the network traffic and Payload model, such as the spill, the stacking, etc.
The example of fuzzy testing
A rich spill of Payload variant and hazard function mapping, training AI models to automatically generate examples of fuzzy tests for hazard functions such as stcpy/gets/printf to increase Fuzzing coverage.
Gap Use Detection
Training AI detection models to identify gaps in real time, based on ret addr overlaying patterns (ret addr rewrite/ROP chain) and formatting string utilization features (any address writing/%n usage).
Patchual authentication AI
Based on the gap information on CVE linkages and the binary differences of patches, training AI models automatically validate patches and detect the possibility of patches bypassing.
CGC training materials
Structured five-metaset data can be used directly for the AHE/CRA training of automated gap-deeping and repair (DARPA CGC) system to promote automated binary security.
Code security audit
Hazard function mapping + loophole data, training code audit of AI automatically locates buffer zone spill points in the C/C++ source code, generating recommendations for repairing security functions such as stncpy/snprintf.
Frequently asked questions
A buffer zone spill detection programme that needs to be customized?
Changsha Langhui Information Technology Co., Ltd. The DataAssetsAPI platform is dedicated to providing high-quality, compliant web security data assets for AI companies and research institutions. Supports flexible combinations by SQL injection subtype, by database platform, and by detection rule format.
Data sample preview Customization of BOF programmes Professional technical support