ANDRUBIS: Android Malware Dataset with 1 Million Apps

Over 1,000,000 Android apps, including 40% malicious apps, were collected using the ANDRUBIS automated analysis system. The dataset was created by researchers at TU Wien and includes apps dating back to 2010, allowing for trend analysis. ANDRUBIS combines static and dynamic analysis on both Dalvik VM and system levels to extract characteristic information.

Use Cases

• Classifying Android apps as malicious or benign based on automated analysis features.
• Analyzing trends in malware behavior over time using apps from 2010 onward.
• Training machine learning models for malware detection using static and dynamic analysis results.
• Evaluating code coverage stimulation techniques mentioned in the ANDRUBIS system description.

Strengths

• Contains over 1,000,000 Android apps, providing a large-scale resource.
• Includes 40% malicious apps, offering a substantial sample for malware research.
• Apps date back to 2010, enabling longitudinal studies of malware evolution.
• Data was collected using a comprehensive analysis system combining static and dynamic techniques.

Limitations

• Column-level documentation is absent; field semantics must be inferred after download.
• Last update date is unknown; freshness unverified.
• Row count is known, but specific file formats and data structure details are unavailable.

Provenance

Source

TU Wien

Collection Method

Collected via the ANDRUBIS automated analysis system, which combines static analysis, dynamic analysis on Dalvik VM and system level, and stimulation techniques.

Time Range

Apps date back to 2010.