Troid: Temporal and Cross-Sectional Android Dataset and Its Applications
收藏资源简介：
Numerous studies have focused on exploring Android malware in recent years, covering areas such as malware detection and application analysis. As a result, there is a pressing need for a reliable and scalable malware dataset to support the development and evaluation of effective malware studies. Although several benchmarks for Android malware datasets are widely used in research, they have significant limitations. Firstly, many of these datasets are outdated and do not capture current malware trends. Additionally, some have become obsolete or inaccessible, limiting their usefulness. Secondly, most datasets only contain the apps themselves (APKs), lacking important meta features like content rating, ad coverage, user ratings, and privacy policies. This omission restricts the potential applications of these datasets. This paper introduces a reliable Android malware dataset called \ours{} and sourced from the Google Play Store Market, covering the period from 2019 to 2023. To label malicious apps, we use VirusTotal and track their availability and removal status on the Google Play Store. We curate a meticulous Android malware dataset with 5,028 samples using this method. We augment our dataset with various features, including privacy policies, metadata, control flow graphs, permissions, API calls, strings, function names, hex dumps, and labels. We believe this benchmark dataset will greatly support various research efforts, including Android malware classification and detection, static program analysis, and privacy policy analysis.
近年来，诸多研究聚焦于安卓恶意软件（Android malware）的探索与分析，涵盖恶意软件检测、应用程序分析等领域。因此，业界亟需一款可靠且可扩展的恶意软件数据集，以支撑高效恶意软件相关研究的开发与评估工作。尽管多款安卓恶意软件数据集基准在研究中被广泛应用，但这些基准仍存在诸多显著局限。其一，多数数据集已过时，无法反映当前的恶意软件发展态势；此外，部分数据集已被废弃或无法访问，大幅限制了其使用价值。其二，多数数据集仅包含应用程序安装包（APKs），缺失内容分级、广告覆盖范围、用户评分、隐私政策等重要元特征。此类缺失限制了这些数据集的潜在应用场景。本文提出一款名为ours{}的可靠安卓恶意软件数据集，其数据源自谷歌应用商店（Google Play Store），覆盖2019年至2023年的样本。为对恶意应用进行标注，我们使用维鲁斯塔总（VirusTotal）平台，并追踪这些应用在谷歌应用商店的上架状态与下架情况。通过该流程，我们整理得到一份精细严谨的安卓恶意软件数据集，共包含5028个样本。我们为该数据集补充了多类特征，包括隐私政策、元数据、控制流图、权限、API调用、字符串、函数名、十六进制转储（hex dumps）以及样本标签。我们相信，这款基准数据集将为诸多研究工作提供有力支撑，涵盖安卓恶意软件分类与检测、静态程序分析以及隐私政策分析等领域。
