This dataset is part of my PhD research on malware detection and classification using Deep Learning. It contains static analysis data: Top-1000 imported functions extracted from the 'pe_imports' elements of Cuckoo Sandbox reports. PE malware examples were downloaded from virusshare.com. PE goodware examples were downloaded from portableapps.com and from Windows 7 x86 directories.

This dataset is part of my PhD research on malware detection and classification using Deep Learning. It contains static analysis data: Raw PE byte stream rescaled to a 32 x 32 greyscale image using the Nearest Neighbor Interpolation algorithm and then flattened to a 1024 bytes vector. PE malware examples were downloaded from virusshare.com. PE goodware examples were downloaded from portableapps.com and from Windows 7 x86 directories.

A labeled benchmark dataset for training machine learning models to statically detect malicious Windows portable executable files. The dataset includes features extracted from 1.1M binary files: 900K training samples (300K malicious, 300K benign, 300K unlabeled) and 200K test samples (100K malicious, 100K benign).

Introduction

This dataset is part of my PhD research on malware detection and classification using Deep Learning. It contains static analysis data (PE Section Headers of the .text, .code and CODE sections) extracted from the 'pe_sections' elements of Cuckoo Sandbox reports. PE malware examples were downloaded from virusshare.com. PE goodware examples were downloaded from portableapps.com and from Windows 7 x86 directories.

Features

Column name: hash
Description: MD5 hash of the example
Content: 32 bytes string

Column name: size_of_data
Description: The size of the section on disk
Content: Integer

Column name: virtual_address
Description: Memory address of the first byte of the section relative to the image base
Content: Integer

Column name: entropy
Description: Calculated entropy of the section
Content: Float

Column name: virtual_size
Description: The size of the section when loaded into memory
Content: Integer

Column name: malware
Description: Class
Content: 0 (Goodware) or 1 (Malware)

Acknowledgements

Thank you Cuckoo Sandbox for developing such an amazing dynamic analysis environment!
Thank you VirusShare! Because sharing is caring!

Citations

Please refer to http://dx.doi.org/10.21227/2czh-es14