APT-ClaritySet: A Large-Scale, High-Fidelity Labeled Dataset for APT Malware

Large-scale, standardized datasets for AdvancedPersistent Threat (APT) research are scarce, and inconsistentactor aliases and redundant samples hinder reproducibility. Thispaper presents APT-ClaritySet and its construction pipelinethat normalizes threat actor aliases (reconciling approximately11.22% of inconsistent names) and applies graph-feature dedu-plication\u2014reducing the subset of statically analyzable executablesby 47.55% while retaining behaviorally distinct variants. APT-ClaritySet comprises: (i) APT-ClaritySet-Full, the complete pre-deduplication collection with 34,363 malware samples attributedto 305 APT groups (2006\u2013early 2025); (ii) APT-ClaritySet-Unique, the deduplicated release with 25,923 unique samplesspanning 303 groups and standardized attributions; and (iii)APT-ClaritySet-FuncReuse, a function-level resource that in-cludes 324,538 function-reuse clusters (FRCs) enabling mea-surement of inter-\/intra-group sharing, evolution, and toolinglineage. By releasing these components and detailing the aliasnormalization and scalable deduplication pipeline, this workprovides a high-fidelity, reproducible foundation for quantitativestudies of APT patterns, evolution, and attribution.