Android-Malware-Datasets - Popular Android malware datasets

项目说明

Android malware datasets

1. Android Malware Genome Project

In this project, we focus on the Android platform and aim to systematize or characterize existing Android malware. Particularly, with more than one year effort, we ha to collect more than 1,200 malware samples that cover the majority of existing Android malware families, ranging from their debut in August 2010 to recent ones in October 2011.

Publication
Dissecting Android Malware: Characterization and E.
Yajin Zhou, Xuxian Jiang.
Proceedings of the 33rd IEEE Symposium on Security and Privacy (Oakland 2012).
San Francisco, CA, May 2012

Homepage (Has stopped dataset sharing)

2. M0Droid Dataset

M0Droid basically is android application beha pattern recognition tool which is used to identify android malwares and categorize them according to their behavior. It utilized a kernel level hook to capture all system call requests of the application and then generate a signature for the behavior of the application.

Publication
Damshenas M, Dehghantanha A, Choo K K R, et al. M0droid: An android beha malware detection model[J]. Journal of Information Privacy and Security, 2015, 11(3): 141-157.

Homepage

Blog

3. The Drebin Dataset

The dataset contains 5,560 applications from 179 different malware families. The samples have been collected in the period of August 2010 to October 2012 and were made a to us by the MobileSandbox project. You can find more details on the dataset in the paper.

Publication
Arp D, Spreitzenbarth M, Hubner M, et al. [Drebin: Efficient and explainable detection of android malware in your pocket[C]]()//Proc. of 17th Network and Distributed System Security Symposium, NDSS. 14.

Homepage

4. A Dataset based on ContagioDump

*The dataset is a collection of Android based malware seen in the wild. The malware pieces were downloaded on October 26th, 2011. The total number of malware included in the sample is 189. I ha split them into categories based on their primary beha where a. I obtained their primary beha from malware reports from the A.If the malware would download a separate payload as its primary function, it was put in the Trojan category. If the malware executed an escalation of pri attack, it was in the escalation of pri category. If the malware primarily stole data from the phone, it was classified as information stealing. If the malware sent premium SMS messages, it was a premium SMS transmitting malware. *

Homepage

5. AndroMalShare

AndroMalShare is a project focused on sharing Android malware samples. It's only for research, no commercial use. We present statistical information of the samples, a detail report of each malware sample scanned by SandDroid and the detection results by the anti-virus productions. You can upload malware samples to share with others and each malware sample can be downloaded(only by registered users)!

Homepage

6. Kharon Malware Dataset

The Kharon dataset is a collection of malware totally re and documented. This dataset has been constructed to help us to e our research experiments. Its construction has required a huge amount of work to understand the malicous code, trigger it and then construct the documentation. This dataset is now a for research purpose, we hope it will help you to lead your own experiments.

Publication
CIDRE, EPI. Kharon dataset: Android malware under a microscope. Learning from Authoritati Experiment Results (2016): 1.

Homepage

7. AMD Project

AMD contains 24,553 samples, categorized in 135 among 71 malware families ranging from 2010 to 2016. The dataset provides an up-to-date picture of the current landscape of Android malware, and is publicly shared with the community.

Publication
Li Y, Jang J, Hu X, et al. Android malware clustering through malicious payload mining[C]//International Symposium on Research in Attacks, Intrusions, and Defenses. Springer, Cham, 2017: 192-214.

Wei F, Li Y, Roy S, et al. Deep Ground Truth Analysis of Current Android Malware[C]//International Conference on Detection of Intrusions and Malware, and Assessment. Springer, Cham, 2017: 252-276.

Homepage

8. AAGM Dataset

AAGM dataset is captured by installing the Android apps on the real smartphones semi-automated. The dataset is generated from 1900 applications.

Publication
Arash Habibi Lashkari, Andi Fitriah A.Kadir, Hugo Gonzalez, Kenneth Fon Mbah and Ali A. Ghorbani, Towards a Network-Based Framework for Android Malware Detection and Characterization, In the proceeding of the 15th International Conference on Privacy, Security and Trust, PST, Calgary, Canada, 2017.

Homepage

9. Android PRAGuard Dataset

As retrieving malware for research purposes is a difficult task, we decided to release our dataset of obfuscated malware.

The dataset contains 10479 samples, obtained by obfuscating the MalGenome and the Contagio Minidump datasets with se obfuscation techniques.

Publication
Davide Maiorca, Davide Ariu, Igino Corona, Marco Aresu and Giorgio Giacinto. Stealth attacks: an extended insight into the obfuscation effects on Android malware. In Computers and Security, vol. 51, pp. 16-31, 2015.

Homepage

10. AndroZoo

AndroZoo is a growing collection of Android Applications collected from several sources, including the official Google Play app market.It currently contains 5,781,781 different APKs, each of which has been (or will soon be) analysed by tens of different AntiVirus products to know which applications are detected as Malware.
We provide this dataset to contribute to ongoing research efforts, as well as to enable new potential research topics on Android Apps.By releasing our dataset to the research community, we also aim at encouraging our fellow researchers to engage in reproducible experiments.

Publication
K. Allix, T. F. Bissyandé, J. Klein, and Y. Le Traon. AndroZoo: Collecting Millions of Android Apps for the Research Community. Mining Software Repositories (MSR) 2016.

Homepage

项目信息

开发语言：未知

Star 数：174

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Popular Android malware datasets展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。