AndMal2025: Behavioral Android Malware Analysis Dataset

The AndMal2025 dataset provides a comprehensive behavioral representation of Android applications by integrating static code attributes and runtime execution indicators. Each record corresponds to a single APK instance, where the feature set captures permission usage, system interactions, service binding activities, resource consumption patterns, and network behavior. The dataset to support robust supervised learning for Android malware analysis, including both primary binary detection and auxiliary multi-label family characterization. The feature space is organized into six major groups to reflect different operational layers of Android applications. 1. Application Metadata Features These attributes summarize high-level structural properties of the APK and provide contextual signals regarding application complexity. App_ID — Unique identifier assigned to each application instance. APK_Size_KB — Size of the packaged APK file in kilobytes, reflecting application footprint. Dex_Method_Count — Total number of methods extracted from the DEX bytecode, indicating codebase complexity. These metadata features help distinguish lightweight benign utilities from feature-dense malicious packages. 2. Permission-Based Static Features Permission indicators capture declared capabilities within the Android manifest and are widely recognized as strong malware predictors. perm_SEND_SMS — Indicates whether the application requests SMS transmission permission. perm_ACCESS_NETWORK_STATE — Reflects access to network connectivity state information. perm_WRITE_SETTINGS — Indicates permission to modify system settings. perm_INTERNET — Specifies whether the application can access network resources. perm_count_total — Total number of permissions requested by the application. perm_count_dangerous — Number of high-risk permissions requested. danger_perm_ratio — Ratio of dangerous permissions to total permissions. These features characterize the privilege profile of each application and expose over-permission patterns commonly associated with malicious behavior. 3. Intent and Broadcast Action Features Broadcast receivers and intent filters reveal persistence mechanisms and background execution strategies. intent_BOOT_COMPLETED — Indicates registration for device boot completion events. intent_SCREEN_ON — Indicates monitoring of screen activation events. Such signals are frequently linked to stealth persistence and opportunistic background activity. 4. Class and API Usage Indicators These features capture the presence of sensitive framework classes that often appear in suspicious workflows. class_java_lang_Class — Reflects dynamic class loading or reflection usage. class_android_telephony_SmsManager — Indicates access to SMS management APIs. API-level evidence complements permission analysis by exposing how declared privileges are operationalized. 5. Runtime Event and Service Interaction Features Dynamic execution monitoring provides insight into inter-process communication and service orchestration behaviors. evt_Transact — Count of Binder transaction events. evt_onServiceConnected — Number of successful service connection callbacks. evt_bindService — Frequency of service binding requests. evt_attachInterface — Interface attachment operations observed at runtime. evt_ClassLoader — Dynamic class loading events. evt_total — Aggregate count of monitored runtime events. evt_entropy — Distribution entropy of runtime event types. These features expose behavioral patterns that may remain hidden in purely static inspection. 6. System Activity, Resource, and Network Features This group captures operational footprints generated during application execution. System and Resource Metrics syscall_count_total — Total number of observed system calls. cpu_mean — Mean CPU utilization during execution. mem_mean_mb — Average memory consumption in megabytes. file_write_count — Number of file write operations. service_start_count — Count of service start invocations. Network Behavior Metrics net_conn_count — Number of outbound network connections. dns_query_count — DNS query frequency. net_tx_kb — Volume of transmitted network data (KB). net_rx_kb — Volume of received network data (KB). Code Structure Indicators opcode_ngram_entropy — Entropy of opcode n-gram distribution. dex_string_entropy — Entropy of embedded string constants. These features jointly model communication intensity, resource usage patterns, and code-level irregularities associated with malicious workflows. Target Labels The dataset supports both primary detection and fine-grained family characterization. Primary Prediction Label Malware_Binary — Binary ground truth where 0 denotes benign applications 1 denotes malicious applications This label is intended for the main supervised malware detection task. Auxiliary Multi-Label Family Annotations To enable detailed behavioral analysis, the dataset provides non-exclusive malware family indicators: y_scareware — Scareware activity indicator y_ransomware — Ransomware activity indicator y_adware — Adware activity indicator y_sms_malware — SMS-based malicious activity indicator Multiple family labels may be active simultaneously for a single application, enabling multi-label learning and cross-family behavioral studies. Steps to reproduceTo reproduce experiments using the AndMal2025 dataset, download and extract the dataset archive, load the feature file into a machine learning environment, and apply the required preprocessing steps, including data cleaning, missing-value handling, normalization, feature selection, and train-test splitting. The processed feature matrix can then be used for binary Android malware detection and auxiliary family-level malware characterization. Researchers may train machine learning or deep learning models using the static, dynamic, behavioral, resource, and network-level feature groups and evaluate performance using accuracy, precision, recall, F1-score, ROC-AUC, PR-AUC, MCC, and confusion-matrix-based analysis. InstitutionsUniversity of New Brunswick, Fredericton, NB, Canada CategoriesMachine Learning, Android Malware, Cybersecurity, Explainable Artificial Intelligence, Artificial Intelligence of Things, Mobile Security, Deep Learning Related LinksArticle: CIC-AndMal2017 Android malware dataset studyArticle: DREBIN: Effective and Explainable Detection of Android Malware in Your PocketArticle: CIC-MalDroid2020 Android malware characterization study LicenceCreative Commons Attribution 4.0 InternationalCC BY 4.0 Cite this dataset @misc{AndMal2025, author = {Arp, D.}, title = {AndMal2025: Behavioral Android Malware Analysis Dataset}, year = {2025}, doi = {10.5281/zenodo.18782865}, note = {Zenodo dataset}}