VESTA ANTLR DATASET

This dataset (vesta_antlr_static_dynamic_reports.csv) contains 1,043 source-code files — each a unique file hash drawn from 8 repositories and analyzed between February and April 2026 — that were run through "Vesta," a hybrid malware/risk-detection pipeline combining static, dynamic, and machine-learning signals. The corpus is mostly Python (966 files) with smaller amounts of JavaScript (55), C (11), and C++ (11), and is heavily class-imbalanced: only 2 files carry the malicious label (label = 1) versus 1,041 benign. Across its 15 columns, each row pairs the raw source_code with three layers of analysis: an ANTLR-based static report (antlr_report) listing line-level findings tagged by severity (CRITICAL/HIGH), weight, and finding type (e.g., CODE_EXECUTION, HARDCODED_CREDENTIALS) along with behavioral triggers like dynamic_code_exec; an aggregated antlr_features object that rolls those findings into density/weight signals, a PE-style numeric feature vector, and the model's own decision metadata; and a 768-dimensional codebert_embedding capturing the code semantically. Every prediction is sourced from a ML_ANTLR_HYBRID strategy that fuses the learned model with the static rules — the metadata even records when ANTLR findings reinforce or override the ML verdict — yielding per-file outputs including amount_findings (0–80, avg ≈1.9), prediction_probability (0.83–0.98), and a risk_score (15–100, avg ≈54). In short, it's a labeled, feature-rich corpus designed to train or evaluate a hybrid static-plus-ML model that flags suspicious or malicious code.