Sophos/ReversingLabs 20 Million Malware and Benign PE Files with EMBER Features

Sophos AI provides a dataset of approximately 20 million Portable Executable files, split evenly between benign and malicious samples. It includes EMBER-v2 features, metadata from the pefile library, ReversingLabs detection telemetry, and behavioral tags for malware samples. The dataset is hosted on AWS Open Data and is intended to support machine learning research for malware detection.

Use Cases

• Train malware classification models based on EMBER-v2 feature vectors.
• Benchmark detection algorithms using labeled malicious and benign PE files.
• Analyze malware behavior patterns based on the provided behavioral tags.
• Correlate detection rates with ReversingLabs telemetry data.

Strengths

• Approximately 20 million total samples, with a balanced 10 million benign and 10 million malicious files.
• Includes disarmed but complete malware files for analysis.
• Features are extracted using the standardized EMBER-v2 feature set.
• Labels are applied using Sophos in-house methods and supplemented with ReversingLabs telemetry.

Limitations

• Column-level documentation is absent; field semantics must be inferred after download.
• Last update date is unknown; freshness unverified.
• Row count is an approximate figure; exact scale may require verification.

Provenance

Source

Sophos AI, with data from ReversingLabs telemetry.

Collection Method

Files are labeled using Sophos methods, with features extracted via EMBER-v2 and metadata via the pefile Python library.

Time Range

null

Freshness

Last updated date is unknown.

Geography

null