Rootkit Forensic Evidence Synthesis Question Answering Dataset

#forensic evidence synthesis #rootkit activity reconstruction #evidence-based question answering #rootkit threat investigation #digital forensic analysis #cybersecurity incident response

5000
0.3GB
JSON
CATL
MOBIUSI INC

Updated:2026-10-19

AI Analysis & Value Prop

This dataset pairs investigation questions with detailed expert analyses based on textual findings from memory, file systems, system logs, and runtime state. It focuses on reconstructing suspected rootkit activity from multiple evidence sources, distinguishing direct observations from analytical inferences, and addressing conflicting evidence, uncertainty, and examination limits. It supports domain-specific supervised fine-tuning, forensic analysis training, and generative question answering evaluation.

Dataset Insights

Sample Examples

{}

Technical Specifications

Field	Type	Description
file_name	string	File name
expert_answer	string	An analysis that reconstructs suspected rootkit activity across evidence sources; distinguishes direct observations from inferences; explains supporting reasoning, conflicting evidence, uncertainty, and evidentiary limits; and presents a cautious investigative conclusion.
evidence_report	string	Textual findings from memory, file system, system log, and runtime state examinations. May include source identifiers, timestamps, and examination limitations.
investigation_question	string	A question about suspected rootkit activity, formulated from the forensic evidence.

Compliance Statement

Authorization Type	Proprietary - Commercial AI Training License (No Redistribution)
Commercial Use	Requires exclusive subscription or authorization contract (monthly or per-invocation charging)
Privacy and Anonymization	No PII, no real company names, simulated scenarios follow industry standards
Compliance System	Compliant with China's Data Security Law / EU GDPR / supports enterprise data access logs

Frequently Asked Questions

What does the dataset contain?: Each record is organized around textual forensic evidence, an investigation question, and an expert analysis answer. Evidence may cover memory, file systems, system logs, and runtime state, and may include source identifiers, timestamps, and examination limits.

Which capabilities can it support?: It is designed for rootkit-focused supervised fine-tuning. Training can target multi-source evidence synthesis, reconstruction of suspected activity, separation of observed facts from inferences, and clear discussion of reasoning, uncertainty, and evidentiary limits. It can also support generative QA evaluation.

What are the dataset size and quality specifications?: The dataset centers on long-form question-answering records with structured evidence report, investigation question, and expert answer fields. The available information does not specify sample count, language coverage, or file format, so consult the product page or package documentation before acquisition.

How can I access the data, and what are the licensing terms?: Check the dataset product page for available access options, file formats, and licensing terms. Use, redistribution, and commercial use should follow the license provided with the relevant data package.

Can't find the data you need?

Post a request and let data providers reach out to you.

Get this Dataset

Verified for Enterprise Use

Cite this Work

@dataset{Mobiusi2026,
  title={Rootkit Forensic Evidence Synthesis Question Answering Dataset},
  author={MOBIUSI INC},
  year={2026},
  url={https://www.mobiusi.com/datasets/d8b705518ceec9429af306fcb995bbe8},
  urldate={2026-10-17},
  keywords={rootkit forensics dataset,rootkit analysis QA,memory forensics,file system forensics,system log analysis,multi-source evidence reasoning,malware investigation data,cybersecurity SFT},
  version={1.0}
}

Using this in research? Please cite us.

placeholder

Products

Scene

Domain

Modality

Task