Malware Classification

A labeled benchmark dataset for training machine learning models to statically detect malicious Windows portable executable files. The dataset includes features extracted from 1.1M binary files: 900K training samples (300K malicious, 300K benign, 300K unlabeled) and 200K test samples (100K malicious, 100K benign). Source: EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models

The Microsoft Malware Classification Challenge was announced in 2015 along with a publication of a huge dataset of nearly 0.5 terabytes, consisting of disassembly and bytecode of more than 20K malware samples. Apart from serving in the Kaggle competition, the dataset has become a standard benchmark for research on modeling malware behaviour. To date, the dataset has been cited in more than 50 research papers. Here we provide a high-level comparison of the publications citing the dataset. The comparison simplifies finding potential research directions in this field and future performance evaluation of the dataset.

MalNet is a large public graph database, representing a large-scale ontology of software function call graphs. MalNet contains over 1.2 million graphs, averaging over 17k nodes and 39k edges per graph, across a hierarchy of 47 types and 696 families. Image Source: Expore MalNet

The Malimg Dataset contains 9,339 malware byteplot images from 25 different families.

Dataset used for the paper entitled "Towards a Fair Comparison and Realistic Evaluation Framework of Android Malware Detectors based on Static Analysis and Machine Learning". ##Desciption The dataset consist of 100 monthly samples of each class (malware, goodware and greyware) during the period starting from January 2012 to December 2019. We resorted the VTD values of apps for labeling. In particular, we used a VTD≥7 to label malware, VTD=0 for goodware and apps with a 1≤VTD≤6 rating were labeled as greyware. In total, our dataset consists of 28,800 app samples. The directory "dataset" contains a file with the SHA hashes of the APKs that comprise each of the three classes (goodware, malware and greyware). All these APKs were originally downloaded from AndroZoo. To download the APKs in our dataset, you can use the AZ tool. ## Authors and acknowledgment If you use this dataset, please cite: @article{molinacoronado2022towards, title = {Towards a Fair Comparison and Realistic Evaluation Framework of Android Malware Detectors based on Static Analysis and Machine Learning}, author = {Borja Molina-Coronado and Usue Mori and Alexander Mendiburu and Jose Miguel-Alonso}, journal = {Computers & Security}, pages = {102996}, year = {2022}, issn = {0167-4048}, doi = {https://doi.org/10.1016/j.cose.2022.102996}, url = {https://www.sciencedirect.com/science/article/pii/S0167404822003881} } ## License This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License. For more information check the link below: http://creativecommons.org/licenses/by-nc/4.0/

We collaborate with Blue Hexagon to release a dataset containing timestamped malware samples and well-curated family information for research purposes. The BODMAS dataset contains 57,293 malware samples and 77,142 benign samples collected from August 2019 to September 2020, with carefully curated family information (581 families). We also provide preprocessed feature vectors and metadata available to everyone. The malware binaries can be obtained per request. Source: BODMAS: An Open Dataset for Learning based Temporal Analysis of PE Malware

IoT-23 is a dataset of network traffic from Internet of Things (IoT) devices. It has 20 malware captures executed in IoT devices, and 3 captures for benign IoT devices traffic. It was first published in January 2020, with captures ranging from 2018 to 2019. These IoT network traffic was captured in the Stratosphere Laboratory, AIC group, FEL, CTU University, Czech Republic. Its goal is to offer a large dataset of real and labeled IoT malware infections and IoT benign traffic for researchers to develop machine learning algorithms. This dataset and its research was funded by Avast Software. The malware was allow to connect to the Internet.

Click to add a brief description of the dataset (Markdown and LaTeX enabled). Provide: * a high-level explanation of the dataset characteristics * explain motivations and summary of its content * potential use cases of the dataset

This dataset is comprised of the dynamic analysis reports generated by CAPEv2, from both malware and goodware. We source the goodware as they do in Dambra et al. (https://arxiv.org/abs/2307.14657), where trough the community-maintained packages of Chocolatey they create a dataset that spans 2012 to 2020. The malware are sourced from VirusTotal, namely samples of Portable Executable from 2017 - 2020 that they release for academic purposes. In total, the dataset we assembled contains 26,200 PE samples: 8,600 (33%) goodware and 17,675 (67%) malware. All samples were executed in a series of Windows 7 VMware virtual machines and without network connectivity due to policy/ethical constraints. These were orchestrated through CAPEv2, a maintained open-source successor of Cuckoo. This framework is widely used for analyzing and detecting potentially malicious binaries by executing them in an isolated environment and observing their behavior without risking the security of the host system. Every sample was executed for 150 seconds, an empirical lower bound on the time required to gather the full behavior of samples. We tried to mitigate evasive checks by running the VMwareCloak script to remove well-known artifacts introduced by VMware. Moreover, we populated the filesystem with documents and other common types of files, to resemble a legitimate desktop workstation that malware may identify as a valuable target. The dynamic analysis output is a detailed report with information on the syscalls invoked by the binary and all the relative flags and arguments, as well as all interactions with the file system, registry, network, and other key elements of the operating system. The final dataset contains only the dynamic analysis reports, without the original binaries.