Find research datasets worth reusing
Search datasets from major research repositories and use ShareScore to quickly assess how well each record supports discovery, access, and reuse.
9
datasets available to search
ShareScore release 0.9.0
Dataset results
9 results for “malware dataset”
MaDroid: A Maliciousness-aware Multifeatured Dataset for Detecting Android Malware
<p>MaDroid is a maliciousness-aware multifeatured dataset of system calls focused on APK anomaly detection. The dataset includes 50,429 well-marked normal and abnormal system call sequences, with 24,789 and 25,640 sets of normal and abnormal sequences, respectively, for a total of 1.1 billion system call feature information. Each APK is labeled with the latest VT checksum information, and the sequence data includes 81 groups of system calls, system call parameters, and return values. The size of the whole dataset is 457 GB (19 GB after compression), including 236 GB of malicious system call sequence data. The APKs from which the system call feature sequences are derived cover mobile apps of different types released at different times in the past 14 years (2010-2023), covering 10 mainstream app markets, including Google Play, PlayDrone, Anzhi, etc. The APKs are also used as the source of the system call feature sequences, and the system call sequence data is used as the source of the APKs. anzhi, etc. We store the source code and dataset in two open platforms, GitHub and Zenodo, respectively.</p><h2>DataSet</h2><p>Release address: <a href="http://doi.org/10.5281/zenodo.7997398">http://doi.org/10.5281/zenodo.7997398</a></p><ul><li>The dataset consists of two classifications, Normal and Malware, with a total of 21 zip files. The installation files of each sequence come from 10 application markets such as Google Play, PlayDrone, Anzhi, etc. The Malware classification contains information about the running system call sequences of some APKs in the Drebin dataset.</li><li>RF, MLP and GBDT models were used to establish benchmarks for the dataset, the use of the models can be found in the source code.</li><li>The file `merge_all_csv_count_online_check_replenish.csv` is the dataset APK information. We provide APK name (SHA256 name for APK only), classification, APK capacity, number of sequences, log capacity, CVT, OVT value, check time, etc.</li></ul><h2>Source Code</h2><p>Release address: <a href="https://github.com/HNUSystemsLab/MaDroid">https://github.com/HNUSystemsLab/MaDroid</a></p><ul><li>The released source code contains two folders, `Source_Code` and `ml_metadata`. Where `Source_Code` is the automated framework for data collection, the tool chain and some notes on the structure of the source files. `ml_metadata` contains the metadata used for machine learning, the partitioned data on which the article builds its benchmark.</li><li>The automation framework is described in detail in the `Readme.md` document in the `Source_Code` directory. It consists of four main parts: environment requirements, program structure, quick start (working steps), model training and evaluation (including training and evaluation). It describes in detail the preparation of the environment, the data import method, the functional description of each file in the source code directory, the working principle of model training and evaluation, and other related contents.</li></ul><h2>Tips: </h2><ul><li>MAS is another name of MaDroid, the content shown here is the final version of "Readme.md".</li><li>A Large-scale Multi-feature Dataset for Anomaly Detection of Mobile Applications, which is the name of the document during our experiment.</li></ul>
Evaluation of Android Malware Detection Based on System Calls - Dataset
<p>This is a data set accompanying a paper "Evaluation of Android Malware Detection Based on System Calls" published in the proceedings of the International Workshop on Security and Privacy Analytics, New Orleans, USA, 2016.</p> <p>See README.md for details of the data set.</p>
A Dataset of Information (DNS, IP, WHOIS/RDAP, TLS, GeoIP) for a Large Corpus of Benign, Phishing, and Malware Domain Names 2024
<p>The dataset contains DNS records, IP-related features, WHOIS/RDAP information, information from TLS handshakes and certificates, and GeoIP information for 368,956 benign domains from Cisco Umbrella, 461,338 benign domains from the actual CESNET network traffic, 164,425 phishing domains from PhishTank and OpenPhish services, and 100,809 malware domains from various sources like ThreatFox, The Firebog, MISP threat intelligence platform, and other sources. The ground truth for the phishing dataset was double-check with the VirusTotal (VT) service. Domain names not considered malicious by VT have been removed from phishing and malware datasets. Similarly, benign domain names that were considered risky by VT have been removed from the benign datasets. The data was collected between March 2023 and July 2024. The final assessment of the data was conducted in August 2024.</p> <p>The dataset is useful for cybersecurity research, e.g. statistical analysis of domain data or feature extraction for training machine learning-based classifiers, e.g. for phishing and malware website detection.</p> <p>The dataset was created using software available in the associated GitHub repository <a href="https://github.com/nesfit/domainradar-dib" target="_blank" rel="noopener">nesfit/domainradar-dib</a>.</p> <h1>Data Files</h1> <ul> <li> <p>The data is located in the following individual files:</p> <ul> <li><strong>benign_umbrella.json</strong> - data for 368,956 benign domains from Cisco Umbrella,</li> <li><strong>benign_cesnet.json </strong>- data for 461,338 benign domains from the CESNET network,</li> <li><strong>phishing.json</strong> - data for 164,425 phishing domains, and</li> <li><strong>malware.json</strong> - data for 100,809 malware domains.</li> </ul> </li> <li>The <strong>schema.json</strong> file contains a JSON Schema with detailed description of the data entries.</li> </ul> <h1>Data Structure</h1> <div> <p>Both files contain a JSON array of records generated using mongoexport (in the MongoDB Extended JSON (v2) format in Relaxed Mode). The following table documents the structure of a record. Please note that:</p> <ul> <li>some fields may be missing (they should be interpreted as nulls), </li> <li>extra fields may be present (they should be ignored).</li> </ul> </div> <table> <tbody> <tr> <td> <div> <div> <p><strong>Field name </strong></p> </div> </div> </td> <td> <div> <div> <p><strong>Field type </strong></p> </div> </div> </td> <td> <div> <div> <p><strong>Nullable </strong></p> </div> </div> </td> <td> <div> <div> <p><strong>Description </strong></p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>domain_name </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The evaluated domain name </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>url </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The source URL for the domain name </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>evaluated_on </p> </div> </div> </td> <td> <div> <div> <p>Date </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Date of last collection attempt </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>source </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>An identifier of the source </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>sourced_on </p> </div> </div> </td> <td> <div> <div> <p>Date </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Date of ingestion of the domain name </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>dns </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>Data from DNS scan </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>rdap </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>Data from RDAP or WHOIS </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>tls </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>Data from TLS handshake </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>ip_data </p> </div> </div> </td> <td> <div> <div> <p>Array of Objects </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>Array of data objects capturing the IP addresses related to the domain name </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>malware_type</p> </div> </div> </td> <td> <div> <div> <p>String</p> </div> </div> </td> <td> <div> <div> <p>No</p> </div> </div> </td> <td> <div> <div> <p>The malware type/family or “unknown” (only present in malware.json) </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p><strong>DNS data (dns field) </strong></p> </div> </div> </td> <td> </td> <td> </td> <td> </td> </tr> <tr> <td> <div> <div> <p>A </p> </div> </div> </td> <td> <div> <div> <p>Array of Strings </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Array of IPv4 addresses </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>AAAA </p> </div> </div> </td> <td> <div> <div> <p>Array of Strings </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Array of IPv6 addresses </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>TXT </p> </div> </div> </td> <td> <div> <div> <p>Array of Strings </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Array of raw TXT values </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>CNAME </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The CNAME target and related IPs </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>MX </p> </div> </div> </td> <td> <div> <div> <p>Array of Objects </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Array of objects with the MX target hostname, priority and related IPs </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>NS </p> </div> </div> </td> <td> <div> <div> <p>Array of Objects </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Array of objects with the NS target hostname and related IPs </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>SOA </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>All the SOA fields, present if found at the target domain name </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>zone_SOA </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The SOA fields of the target’s zone (closest point of delegation), present if found and not a record in the target domain directly </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>dnssec </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Flags describing the DNSSEC validation result for each record type </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>ttls </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The TTL values for each record type </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>remarks </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The zone domain name and DNSSEC flags </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p><strong>RDAP data (rdap field) </strong></p> </div> </div> </td> <td> </td> <td> </td> <td> </td> </tr> <tr> <td> <div> <div> <p>copyright_notice </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>RDAP/WHOIS data usage copyright notice </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>dnssec </p> </div> </div> </td> <td> <div> <div> <p>Bool </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>DNSSEC presence flag </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>entitites </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>An object with various arrays representing the found related entity types (e.g. abuse, admin, registrant). The arrays contain objects describing the individual entities. </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>expiration_date </p> </div> </div> </td> <td> <div> <div> <p>Date </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>The current date of expiration </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>handle </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>RDAP handle </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>last_changed_date </p> </div> </div> </td> <td> <div> <div> <p>Date </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>The date when the domain was last changed </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>name </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The target domain name for which the data in this object are stored </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>nameservers </p> </div> </div> </td> <td> <div> <div> <p>Array of Strings </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Nameserver hostnames provided by RDAP or WHOIS </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>registration_date </p> </div> </div> </td> <td> <div> <div> <p>Date </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>First registration date </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>status </p> </div> </div> </td> <td> <div> <div> <p>Array of Strings </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The state of the registered object (see RFC 7483, section 10.2.2)</p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>terms_of_service_url </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>URL of the RDAP usage ToS </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>url </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>URL of the RDAP entity </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>whois_server </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>WHOIS server address </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p><strong>TLS data (tls field) </strong></p> </div> </div> </td> <td> </td> <td> </td> <td> </td> </tr> <tr> <td> <div> <div> <p>cipher </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>TLS cipher suite description according to <a href="https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-4" target="_blank" rel="noopener">IANA</a></p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>protocol </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>One of “TLS”, ”TLSv1.2”, ”TLSv1.3” </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>certificates </p> </div> </div> </td> <td> <div> <div> <p>Array of Objects </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Array of objects representing the certificate chain, the first element is the root certificate </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p><strong>IP data (elements in the ip_data array) </strong></p> </div> </div> </td> <td> </td> <td> </td> <td> </td> </tr> <tr> <td> <div> <div> <p>ip </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The IP address </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>from_record </p> </div> </div> </td> <td> <div> <div> <p>String </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>The type of the DNS record the address was captured from </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>remarks </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>No </p> </div> </div> </td> <td> <div> <div> <p>Ping round-trip time, “is alive” flag and rdap/geo/asn evaluation dates </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>rdap </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>RDAP data, similar to DNS RDAP, see the JSON Schema for details </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>geo </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>Geolocation data from the GeoLite2 City database (e.g. latitude, longitude, city, country, etc.) </p> </div> </div> </td> </tr> <tr> <td> <div> <div> <p>asn </p> </div> </div> </td> <td> <div> <div> <p>Object </p> </div> </div> </td> <td> <div> <div> <p>Yes </p> </div> </div> </td> <td> <div> <div> <p>Autonomous system data from the GeoLite2 ASN database (ASN, organization, network) </p> </div> </div> </td> </tr> </tbody> </table> <h1>Acknowledgements</h1> <p>We would like to thank the OpenPhish Team for grating permission to use and publish their dataset. We also thank VirusTotal for providing us access to the API for research purposes.</p> <p>This dataset includes GeoLite2 data created by MaxMind, available from <a href="https://www.maxmind.com" target="_blank" rel="noopener">https://www.maxmind.com</a>.</p> <p>The research has been supported by the <strong>Flow-based Encrypted Traffic Analysis</strong> project, no. VJ02010024, granted by the Ministry of the Interior of the Czech Republic and the <strong>Smart Information Technology for a Resilient Society </strong>project, no. FIT-S-23-8209, granted by Brno University of Technology.</p>
Android Malware Dataset with VirusTotal Labels
<p>This dataset contains labels of 2.47 million Android apk hashes extracted from VirusTotal reports.</p> <p>The dataset was used in the experiments of our publication titled <a href="https://www.mdpi.com/1424-8220/21/16/5671" rel="nofollow">An Analysis of Android Malware Classification Services<br></a><br>The csv of the labels that was extracted from the VirusTotal reports is provided in <code>labeling_dataset.csv.gz</code> . A cell's value of <code>-1</code> is used whenever there was no result from the<br>engine for the given apk file hash value. The column names are provided in <code>cols_labeling_dataset.csv</code>.</p> <p>Note</p> <p><code>-1</code> is a <code>string</code> and not an <code>integer</code></p> <h2>If you use information from this repo, please cite our paper</h2> <p>Rashed M, Suarez-Tangil G. An Analysis of Android Malware Classification Services. Sensors. 2021; 21(16):5671. <a href="https://doi.org/10.3390/s21165671" rel="nofollow">https://doi.org/10.3390/s21165671</a></p> <h2>BibTeX</h2> <p><code>@Article</code>{s21165671,<br>AUTHOR = {Rashed, Mohammed and Suarez-Tangil, Guillermo},<br>TITLE = {An Analysis of Android Malware Classification Services},<br>JOURNAL = {Sensors},<br>VOLUME = {21},<br>YEAR = {2021},<br>NUMBER = {16},<br>ARTICLE-NUMBER = {5671},<br>URL = {<a href="https://www.mdpi.com/1424-8220/21/16/5671%7D,%5C" rel="nofollow">https://www.mdpi.com/1424-8220/21/16/5671},\</a><br>ISSN = {1424-8220},<br>DOI = {10.3390/s21165671}<br>}</p> <h2>Required Software</h2> <p><code>gzip</code></p> <ul> <li>Debian-based Linux: you may install it using the following command <code>apt-get install gzip</code></li> <li>MacOS: <code>gzip</code> is pre-installed</li> <li>Windows: you may download <code>gzip</code> from <a href="http://gnuwin32.sourceforge.net/packages/gzip.htm" rel="nofollow">http://gnuwin32.sourceforge.net/packages/gzip.htm</a></li> </ul> <h2>How to use the file?</h2> <p>There are two ways to use the file:</p> <ol> <li>Extract the gzip file and then you will have a csv output file. For that you need to install gzip and then extracting .csv.gz. The user may use the command <code>gunzip labelingDataset.csv.gz</code></li> <li>Extract information from the zipped file directly (following the same logic of <a href="https://androzoo.uni.lu/lists" rel="nofollow">AndroZoo's csv</a>):<br>To extract the first column and save to a file called <code>list_of_selected_sha256</code>, run the following command:<br><code>zcat labelingDataset.csv.gz | cut -d',' -f1 > list_of_selected_sha256</code><br>To obtain rows of apk hashes that were first seen after the 1st of May, 2016, run this command:<br><code>zcat labeling_dataset.csv.gz | grep -v ',snaggamea' | awk -F, '{if ( $2 >= "2016-05" ) {print} }'</code></li> </ol>
Dataset for the paper Exploring the Use of Static and Dynamic Analysis to Improve the Performance of the Mining Sandbox Approach for Android Malware Identification
<p><strong>Short Description: </strong>This is the dataset for the paper "Exploring the Use of Static and Dynamic Analysis to Improve the Performance of the Mining Sandbox Approach for Android Malware Identification", accepted for publication in the Journal of Systems and Software. </p> <p><strong>Link to this repository: </strong><a href="https://github.com/droidxp/paper-replication-package">https://github.com/droidxp/paper-replication-package</a></p> <p><strong>Authors of the Paper</strong></p> <ul> <li>Francisco Handrick da Costa</li> <li>Ismael Medeiros</li> <li>Thales Menezes</li> <li>João Victor da Silva</li> <li>Ingrid Lorraine da Silva</li> <li>Rodrigo Bonifácio</li> <li>Krishna Narasimhanb</li> <li>Márcio Ribeiro</li> </ul> <p><strong>Abstract</strong></p> <p>The popularization of the Android platform and the growing number of Android applications (apps) that manage sensitive data turned the Android ecosystem into an attractive target for malicious software. For this reason, researchers and practitioners have investigated new approaches to address Android's security issues, including techniques that leverage dynamic analysis to mine Android sandboxes. The mining sandbox approach consists in running dynamic analysis tools on a benign version of an Android app. This exploratory phase records all calls to sensitive APIs. Later, we can use this information to (a) prevent calls to other sensitive APIs (those not recorded in the exploratory phase) or (b) run the dynamic analysis tools again in a different version of the app. During this second execution of the fuzzing tools, a warning of possible malicious behavior is raised whenever the new version of the app calls a sensitive API not recorded in the exploratory phase.</p> <p>The use of a mining sandbox approach is an effective technique for Android malware analysis, as previous research works revealed. Particularly, existing reports present an accuracy of almost 70% in the identification of malicious behavior using dynamic analysis tools to mine android sandboxes. However, although the use of dynamic analysis for mining Android sandboxes has been investigated before, little is known about the potential benefits of combining static analysis with a mining sandbox approach for identifying malicious behavior. Accordingly, in this paper we present the results of two studies that investigate the impact of using static analysis to complement the performance of existing dynamic analysis tools tailored for mining Android sandboxes, in the task of identifying malicious behavior.</p> <p>In the first study we conduct a non-exact replication of a previous study (hereafter BLL-Study) that compares the performance of test case generation tools for mining Android sandboxes. Differently from the original work, here we isolate the effect of an independent static analysis component (DroidFax) they used to instrument the Android apps in their experiments. This decision was motivated by the fact that DroidFax could have influenced the efficacy of the dynamic analyses tools positively---through the execution of specific static analysis algorithms DroidFax also implements. In our second study, we carried out a new experiment to investigate the efficacy of taint analysis algorithms to complement the mining sandbox approach previously used to identify malicious behavior. To this end, we executed the FlowDroid tool to mine the source-sink flows from benign/malign pairs of Android apps used in previous research work.</p> <p>Our study brings several findings. For instance, the first study reveals that DroidFax alone (static analysis) can detect 43.75% of the malwares in the BLL-Study dataset, contributing substantially in the performance of the dynamic analysis tools in the BLL-Study. The results of the second study show that taint analysis is also practical to complement the mining sandboxes approach, with a performance similar to that reached by dynamic analysis tools.</p> <p> </p>
A malware dataset
<p>A malware dataset contains 10 families and 8132 samples of malware. The dataset is collected on a Win32-bit machine, and each malware sample is the original EXE file.</p>
Revisiting Concept Drift in Windows Malware Detection: Adaptation to Real Drifted Malware with Minimal Samples (Artifact Dataset)
<p>Dataset for Peer-Reviewed Artifact of 'Revisiting Concept Drift in Windows Malware Detection: Adaptation to Real Drifted Malware with Minimal Samples' (NDSS 2025) </p>
Malware dataset from VirusShare used in article "DeepDetectNet vs RLAttackNet: An Adversarial Method to Improve Deep Learning-based Static Malware Detection Model"
<p>This repository contains all malicious samples used in article "DeepDetectNet vs RLAttackNet: An Adversarial Method to Improve Deep Learning-based Static Malware Detection Model". It is safe to download these samples <strong>without </strong>running them. Please note that when downloading these samples, <strong>close all </strong>anti-virus software, including Windows Defender.</p>
RmvDroid: Towards A Reliable Android Malware Dataset with App Metadata
<p>Dataset for the paper "RmvDroid: Towards A Reliable Android Malware Dataset with App Metadata", The 16th International Conference on Mining Software Repositories (MSR 2019), Data Showcase Track</p>
ScienceDex guides
Understand access before you commit
These curated guides explain access requirements, typical timelines, costs, and reuse considerations for widely used research datasets.
Allen Brain Atlas
Allen Brain Atlas is an Allen Institute collection of brain map atlases, datasets, APIs, and analysis tools covering mouse, human, and non-human primate brain resources.
Annotated Behaviour and Observability Dataset (ABODe)
ABODe is a University of Edinburgh DataShare dataset for behavior classification in group-housed mice using home-cage video, identities, bounding boxes, ground-plate positions, and annotator labels.
DANDI Archive for NWB datasets
DANDI is a BRAIN Initiative archive for publishing and sharing neurophysiology data, including electrophysiology, optophysiology, and behavioral data packaged as NWB and related standards.
International Brain Laboratory public data
The International Brain Laboratory public data releases expose standardized mouse decision-making experiments, including Neuropixels recordings, widefield calcium imaging, behavior, and session metadata accessed through the ONE API.
OpenNeuro
OpenNeuro is a free, open platform for sharing neuroimaging datasets, with public search, dataset pages, and download paths for web, S3, DataLad, and the OpenNeuro CLI.