YuiIroha/McNdroid
收藏资源简介：
--- license: cc-by-4.0 task_categories: - tabular-classification language: - en tags: - malware-detection - android - multimodal - concept-drift - cybersecurity - benchmark - longitudinal - graph-neural-network - static-analysis - Croissant pretty_name: "McNdroid" size_categories: - 100K<n<1M --- # McNdroid: A Longitudinal Multimodal Benchmark for Robust Drift Detection in Android Malware ## Dataset Description McNdroid is a large-scale, longitudinal, multimodal Android malware detection dataset designed to benchmark concept drift robustness. It spans samples collected from 2013 to 2025 and provides three complementary modalities: static feature vectors, API call graphs (GML), and JSON-based behavioral representations. The dataset also includes a rich metadata CSV and per-vendor family-level verdicts, supporting fine-grained label analysis and multi-label learning. ### Dataset Summary - **Modalities:** Static features (NPZ), API call graphs (GML), JSON behavioral features - **Time span:** 2013–2025 - **Total size:** ~10.9 GB - **Splits:** Train/test per year with temporal evaluation protocols - **Labels:** Binary (malware/benign) and multi-vendor family-level verdicts ### Supported Tasks - Android malware detection (binary classification) - Concept drift detection and temporal robustness evaluation - Multi-modal learning for malware analysis - Graph-based malware classification ## Dataset Structure ### Repository Layout ``` McNdroid/ ├── README.md ├── metadata.csv # Sample-level metadata (~87 MB) ├── vendor_family_wide_verdict.csv # Multi-vendor family verdicts (~770 MB) ├── data_feature/ # Static feature modality │ └── processed_data/ │ └── init_2013/ │ ├── 2013/ │ │ ├── train_X.npz # Training feature matrix (sparse) │ │ ├── test_X.npz # Test feature matrix (sparse) │ │ ├── train_meta.npz # Training labels and metadata │ │ ├── test_meta.npz # Test labels and metadata │ │ ├── vocab.json # Feature vocabulary │ │ ├── selector_meta.json # Feature selector metadata │ │ └── split_meta.json # Split statistics │ ├── 2014/ │ ├── ... │ └── 2025/ ├── gml_feature/ # API call graph modality (GML files) │ └── processed_data/ │ └── ... ├── json_feature/ # JSON behavioral feature modality │ └── processed_data/ │ └── ... ``` ### Data Fields #### metadata.csv Contains per-sample metadata including SHA256 hashes, collection timestamps, labels, and source information. #### vendor_family_wide_verdict.csv Contains malware family labels from multiple antivirus vendors, enabling multi-label and label-noise research. #### Static Features (data_feature/) Each year folder contains: - `train_X.npz` / `test_X.npz`: Sparse feature matrices in NumPy compressed format - `train_meta.npz` / `test_meta.npz`: Associated labels and sample metadata - `vocab.json`: Feature name vocabulary mapping - `selector_meta.json`: Feature selection metadata - `split_meta.json`: Train/test split statistics #### Graph Features (gml_feature/) API call graphs stored in GML format, organized by year. Each graph represents inter-procedural API call relationships extracted via static analysis. #### JSON Features (json_feature/) Behavioral feature representations stored as JSON files, organized by year. ## Dataset Creation ### Source Data Samples were collected from public malware repositories and benign application stores spanning 2013–2025. Each sample was processed through a static analysis pipeline to extract permissions, API calls, intents, and other manifest and bytecode-level features. ### Annotations Labels are derived from VirusTotal multi-scanner verdicts. The `vendor_family_wide_verdict.csv` file preserves per-vendor family attributions to support research on label noise and disagreement. ## Considerations for Using the Data ### Social Impact This dataset is intended for defensive cybersecurity research. It should not be used to develop offensive malware capabilities. ### Licensing This dataset is released under the [Creative Commons Attribution 4.0 International License (CC-BY-4.0)](https://creativecommons.org/licenses/by/4.0/). ## Usage ### Loading Static Features ```python import numpy as np import json # Load a specific year's training data train_X = np.load("data_feature/processed_data/init_2013/2013/train_X.npz", allow_pickle=True) train_meta = np.load("data_feature/processed_data/init_2013/2013/train_meta.npz", allow_pickle=True) with open("data_feature/processed_data/init_2013/2013/vocab.json") as f: vocab = json.load(f) ``` ### Loading Metadata ```python import pandas as pd metadata = pd.read_csv("metadata.csv") verdicts = pd.read_csv("vendor_family_wide_verdict.csv") ``` ## Citation If you use this dataset, please cite: ```bibtex [More Information Needed] ``` ## Contact For questions or issues, please open a discussion on the [Community tab](https://huggingface.co/datasets/IQSeC-Lab/McNdroid/discussions).
McNdroid is a large-scale, longitudinal, multi-modal Android malware detection dataset designed to benchmark concept drift robustness. It covers samples collected from 2013 to 2025, and provides three complementary modalities: static feature vectors, API call graphs (GML), and JSON-based behavioral representations. The dataset also includes rich metadata in CSV format and vendor family-level annotations, supporting fine-grained label analysis and multi-label learning. Dataset Summary: The modalities include static features (NPZ), API call graphs (GML), and JSON behavioral features; the time span ranges from 2013 to 2025; the total size is approximately 10.9 GB; the training/test splits are stratified by year, adopting a temporal evaluation protocol; the labels include binary (malware/benign) and multi-vendor family-level annotations.
