Android Malware Dataset with VirusTotal Labels

This dataset contains labels of 2.47 million Android apk hashes extracted from VirusTotal reports. The dataset was used in the experiments of our publication titled An Analysis of Android Malware Classification ServicesThe csv of the labels that was extracted from the VirusTotal reports is provided in labeling_dataset.csv.gz . A cell's value of -1 is used whenever there was no result from theengine for the given apk file hash value. The column names are provided in cols_labeling_dataset.csv. Note -1 is a string and not an integer If you use information from this repo, please cite our paper Rashed M, Suarez-Tangil G. An Analysis of Android Malware Classification Services. Sensors. 2021; 21(16):5671. https://doi.org/10.3390/s21165671 BibTeX @Article{s21165671,AUTHOR = {Rashed, Mohammed and Suarez-Tangil, Guillermo},TITLE = {An Analysis of Android Malware Classification Services},JOURNAL = {Sensors},VOLUME = {21},YEAR = {2021},NUMBER = {16},ARTICLE-NUMBER = {5671},URL = {https://www.mdpi.com/1424-8220/21/16/5671},\ISSN = {1424-8220},DOI = {10.3390/s21165671}} Required Software gzip Debian-based Linux: you may install it using the following command apt-get install gzip MacOS: gzip is pre-installed Windows: you may download gzip from http://gnuwin32.sourceforge.net/packages/gzip.htm How to use the file? There are two ways to use the file: Extract the gzip file and then you will have a csv output file. For that you need to install gzip and then extracting .csv.gz. The user may use the command gunzip labelingDataset.csv.gz Extract information from the zipped file directly (following the same logic of AndroZoo's csv):To extract the first column and save to a file called list_of_selected_sha256, run the following command:zcat labelingDataset.csv.gz | cut -d',' -f1 > list_of_selected_sha256To obtain rows of apk hashes that were first seen after the 1st of May, 2016, run this command:zcat labeling_dataset.csv.gz | grep -v ',snaggamea' | awk -F, '{if ( $2 >= "2016-05" ) {print} }'本数据集包含从VirusTotal报告中提取的247万个Android应用包（Android APK）哈希值的标签。 本数据集曾用于我们发表的题为《Android恶意软件分类服务分析》的研究论文的实验环节。 从VirusTotal报告中提取的标签逗号分隔值（Comma-Separated Values，CSV）文件已以`labeling_dataset.csv.gz`格式提供。当给定的APK文件哈希值未在对应检测引擎中获得结果时，将使用值为`-1`的单元格。列名信息已在`cols_labeling_dataset.csv`中给出。 注意 `-1`为字符串类型，而非整数类型。 若您使用本代码仓库中的信息，请引用我们的论文： Rashed M, Suarez-Tangil G. An Analysis of Android Malware Classification Services. Sensors. 2021; 21(16):5671. https://doi.org/10.3390/s21165671 BibTeX @Article{s21165671,AUTHOR = {Rashed, Mohammed and Suarez-Tangil, Guillermo},TITLE = {An Analysis of Android Malware Classification Services},JOURNAL = {Sensors},VOLUME = {21},YEAR = {2021},NUMBER = {16},ARTICLE-NUMBER = {5671},URL = {https://www.mdpi.com/1424-8220/21/16/5671},ISSN = {1424-8220},DOI = {10.3390/s21165671}} 所需软件 gzip 基于Debian的Linux发行版：可通过以下命令安装gzip：`apt-get install gzip` macOS系统：gzip已预安装至系统中 Windows系统：可从 http://gnuwin32.sourceforge.net/packages/gzip.htm 下载gzip安装包 文件使用方法 共有两种使用该文件的方式： 1. 先解压gzip压缩文件，即可得到完整的CSV输出文件。您需先安装gzip工具，再对`.csv.gz`格式文件进行解压。用户可通过命令`gunzip labelingDataset.csv.gz`完成解压操作。 2. 直接从压缩文件中提取所需信息（遵循AndroZoo的CSV处理逻辑）： - 若需提取第一列数据并保存至名为`list_of_selected_sha256`的文件中，可运行以下命令：`zcat labelingDataset.csv.gz | cut -d',' -f1 > list_of_selected_sha256` - 若需获取2016年5月1日之后首次被检测到的APK哈希值对应行，请执行以下命令：`zcat labeling_dataset.csv.gz | grep -v ',snaggamea' | awk -F, '{if ( $2 >= "2016-05" ) {print} }'`