DYNAMISM 2016-2023: Postprocessed Execution Traces of Android Malware and Benign Apps

DYNAMISM (Dynamic Analysis of Malware) 2016-2023 contains post-processed execution traces of both benign and malicious applications for Android. The traces were obtained by executing the applications in a controlled environment using Dock-Droid, a Docker-based container running Android 9. This setup ensures reproducibility and isolation, mimicking real-world conditions while maintaining strict control over the execution environment. Each application was subjected to 20,000 pseudorandom UI Monkey events (e.g., touches, gestures) within a 5-minute execution limit, simulating user interactions to trigger diverse runtime behaviors. Data collection was performed at 1-second intervals using Android Debug Bridge (ADB) commands to extract the following system-level metrics: System calls (syscalls): Captured using STrace to monitor interactions between applications and the operating system kernel. Memory usage: Collected via DumpSysMemInfo to track memory allocation and consumption patterns. Process statistics: Monitored using DumpSysProcStats to analyze running processes and their resource footprint. CPU usage: Tracked with ps and top commands to measure CPU utilization over time. Network traffic was instead captured using TcpDump directly on the network interface of the container. Applications were sourced from the AndroZoo dataset, focusing on files in the period between 2016 and 2023. A total of 2,000 malicious and 2,000 benign applications were randomly selected for each year, ensuring a balanced representation of both classes over time. To offer a more realistic evaluation dataset, a subset of apps was executed twice. The dataset is organized into two distinct folders, named 1strun and 2ndrun:- 1strun: Contains the post-processed execution traces of all benign and malicious apps described above. Not all applications executed successfully; 87 benign and 1,311 malicious apps failed to run, reflecting real-world challenges in dynamic analysis (such as environment compatibility issues). After filtering out invalid results (e.g., records that were too short or missing critical information on specific feature classes), this folder contains verified results for 12,706 benign and 10,560 malicious apps.- 2ndrun: Contains post-processed traces of a second execution for 1,049 benign and 772 malicious apps. This second run is designed to simulate real-life deployment conditions, where malware detection systems must identify threats not only in completely new software but also in previously analyzed applications. The raw data was processed and aggregated using a custom suite of scripts and already available tools, such as Tcpstat, to generate the final dataset files. Every available folder contains a set of CSV files, with one file dedicated to each app. The filenames preserve the original hashes used in AndroZoo, allowing researchers to easily look up metadata and further details for each app on the AndroZoo website. This dataset represents a significant update and improvement over the original "DYNAMISM - Postprocessed Execution Traces Of Android Malware and Benign Apps" dataset, which has been available on Zenodo since 2018. Key improvements compared to the legacy DYNAMISM dataset include:- A significantly larger and more up-to-date repository of applications.- Upgraded execution environment running Android 9 instead of Android 4.- Enhanced monitoring granularity, featuring a 1-second sampling period compared to the previous 2-second interval, alongside improved overall result consistency.- The addition of a secondary execution (2ndrun) subset to test detection model stability across multiple runs.