A Certificate-Informed Android Malware Detection Dataset

This is a curated Android malware research dataset designed for scalable static-analysis and machine-learning based malware detection. The dataset was developed as part of a research study on certificate-informed multi-stage Android malware flagging and contains engineered static features extracted from more than 15,000 Android applications. The dataset focuses on combining lightweight metadata-driven analysis with deeper semantic static-analysis features. Unlike many traditional Android malware datasets that rely primarily on permissions or API calls alone, this dataset introduces certificate-oriented indicators and staged-analysis feature groups intended for scalable malware triage pipelines. The dataset includes: Certificate-derived security features Permission-risk bundles Opcode-derived statistical features Reflection and control-flow indicators Entropy and opcode diversity metrics Malware/benign labels Feature-engineered static-analysis attributes Applications were collected using publicly available Android malware research sources and labeled using VirusTotal-based thresholding strategies commonly used in Android malware research literature. The dataset contains both benign and malicious Android applications with near-balanced class distribution. Key characteristics of the dataset include: ~15,700 Android applications 100+ engineered static-analysis features Certificate consistency and anomaly indicators Permission aggregation into behavior-oriented risk groups Opcode normalization and density metrics Features suitable for explainable security research Designed for staged malware analysis pipelines Compatible with traditional ML and ensemble-based classifiers Potential research use-cases include: Android malware classification Static malware analysis Certificate-based threat intelligence Explainable AI for cybersecurity Lightweight malware triage systems Ensemble learning for malware detection Feature engineering research Scalable app-store security screening Important Notes: This dataset does NOT contain raw malware APK binaries. Only extracted feature representations and metadata are provided. APK hashes and metadata are included for reproducibility where applicable. The dataset is intended strictly for cybersecurity research and educational purposes. Suggested Citation: Arora, Devansh; Hooda, Pulkit; Aggarwal, Mayank.CERTGUARD-Android-15K: Certificate-Informed Android Malware Dataset.Netaji Subhas University of Technology (NSUT), 2026. Research Context:The dataset was created for the thesis: “Certificate-Informed Multi-Stage Static Analysis for Scalable Android Malware Flagging” which investigates whether lightweight certificate and permission-based screening can reduce the computational cost of deeper semantic Android malware analysis while maintaining strong detection performance.