LLM-MFC: A Large Language Model-Based Malware Family Classification Dataset

LLC-MFC Dataset

This dataset contains comprehensive binary analysis artifacts for a vast collection of both malware and benign executables. It is structured into multiple formats and collections to facilitate reverse engineering, static analysis, machine learning over binaries, and cyber threat intelligence research.

## 📑 Quick Navigation

- [🗂️ Dataset Structure](#-dataset-structure)
- [📊 Dataset Distribution](#-dataset-distribution)
- [📚 Dataset Sources](#-dataset-sources)
- [🏗️ Database Architecture & Collections](#️-database-architecture--collections)
- [🛠️ How to Use the Dataset](#️-how-to-use-the-dataset)
- [💾 Restoring the MongoDB Database](#-restoring-the-mongodb-database)

---

## 🗂️ Dataset Structure

The dataset comprises multiple file formats tailored for different analytical needs, along with a full MongoDB dump to restore the original working database. It is split categorically into **Benign** and **Malware** sets.

```text
├── README.MD
├── dataset_structure.md
├── quantum_dataset.mongodb_archive.zst # Compressed MongoDB dump
├── json/ # Standard JSON dumps
│ ├── benign/
│ └── malware/
├── jsonl/ # JSON-Lines formats (best for iterative processing)
│ ├── benign/
│ └── malware/
└── parquet/ # Parquet formats (best for DataFrame / ML operations)
├── benign/
└── malware/
```

### Supported Formats
* **JSON/JSONL:** Ideal for individual record inspection or text processing in Python. `jsonl` files are line-delineated and best for streaming large datasets without keeping them entirely in memory.
* **Parquet:** Strongly typed, highly compressed columnar data. Ideal for processing with data science tools like Pandas, Polars, or PySpark.
* **MongoDB Archive:** A full database dump. See below for database restoration instructions.

---

## 📊 Dataset Distribution

### All Malware Families (Total: 39)

| Family | Count |
|--------|-------|
| winwebsec | 4400 |
| unknown | 3895 |
| zbot | 2100 |
| mediyes | 1450 |
| benign | 975 |
| Conti | 951 |
| AsyncRAT | 890 |
| GuLoader | 779 |
| zeroaccess | 690 |
| NjRAT | 385 |
| locker | 310 |
| CoinMiner | 301 |
| XMRig | 284 |
| Metasploit | 257 |
| CobaltStrike | 244 |
| Emotet | 184 |
| DarkComet | 178 |
| Remcos | 115 |
| AgentTesla | 106 |
| LockBit | 102 |
| Petya | 85 |
| TrickBot | 81 |
| LokiBot | 74 |
| QakBot | 23 |
| Zeus | 23 |
| WannaCry | 23 |
| Conficker | 22 |
| WannaMine | 21 |
| BazarLoader | 16 |
| Azorult | 15 |
| REvil | 13 |
| RedLine | 11 |
| SmokeLoader | 7 |
| QuasarRAT | 7 |
| BlackCat | 4 |
| Ryuk | 3 |
| Raccoon | 2 |
| Poison Ivy | 2 |
| IcedID | 2 |

### All Malware Categories (Total: 18)

| Category | Count |
|----------|-------|
| virus | 8950 |
| backdoor | 3801 |
| downloader | 2424 |
| benign | 975 |
| ransomware | 663 |
| dropper | 613 |
| keylogger | 453 |
| trojan | 286 |
| miner | 150 |
| loader | 144 |
| botnet | 132 |
| stealer | 119 |
| unknown | 101 |
| rat | 97 |
| spyware | 48 |
| rootkit | 41 |
| infostealer | 23 |
| worm | 10 |

---

Download All files <b> Link to Globus download directory</b>
For download instructions and more information about GlobusRetrieve Data: Large Files (from Globus)