arXiv:2506.23909cs.CRcs.LG2025-06被引 9

构建了类型与家族双标签的原始恶意软件数据集,支持更细粒度分类。

RawMal-TF: Raw Malware Dataset Labeled by Type and Family

  • 从多个平台收集原始二进制文件,结合命名与ClarAVy标注实现双层级标签。
  • 在完整数据上,家族级检测准确率达98.98%,类型级达98.5%。
  • 适用于恶意软件分析、安全研究者及需要细粒度分类的场景。

本工作针对机器学习驱动的恶意软件分类挑战,构建了一个新型数据集,其标签涵盖恶意软件类型与家族两级。原始二进制文件来自VirusShare、VX Underground和MalwareBazaar,家族标签通过二进制名称解析获得,类型标签则整合自ClarAVy。数据集包含14种恶意软件类型和17个家族,并采用统一的静态分析特征提取流程,重点提取可执行文件(PE)头信息。评估聚焦三项关键任务:在全量数据上,随机森林与XGBoost在类型检测中达到98.5%准确率,家族检测达98.98%;在1,000样本的受限数据下,类型检测仍达97.6%,家族检测达98.66%;跨类别分类中,类型任务最高准确率97.5%,家族任务93.7%;多类分类中,SVM在类型标签上为81.1%,随机森林与XGBoost在家族标签上约为73.4%。结果揭示了准确率与计算成本的权衡,证明双层级标注能实现更精细的分类。该工作为高级恶意软件检测与分类研究奠定了坚实基础。

原文摘要 · Abstract (English)

This work addresses the challenge of malware classification using machine learning by developing a novel dataset labeled at both the malware type and family levels. Raw binaries were collected from sources such as VirusShare, VX Underground, and MalwareBazaar, and subsequently labeled with family information parsed from binary names and type-level labels integrated from ClarAVy. The dataset includes 14 malware types and 17 malware families, and was processed using a unified feature extraction pipeline based on static analysis, particularly extracting features from Portable Executable headers, to support advanced classification tasks. The evaluation was focused on three key classification tasks. In the binary classification of malware versus benign samples, Random Forest and XGBoost achieved high accuracy on the full datasets, reaching 98.5% for type-based detection and 98.98% for family-based detection. When using truncated datasets of 1,000 samples to assess performance under limited data conditions, both models still performed strongly, achieving 97.6% for type-based detection and 98.66% for family-based detection. For interclass classification, which distinguishes between malware types or families, the models reached up to 97.5% accuracy on type-level tasks and up to 93.7% on family-level tasks. In the multiclass classification setting, which assigns samples to the correct type or family, SVM achieved 81.1% accuracy on type labels, while Random Forest and XGBoost reached approximately 73.4% on family labels. The results highlight practical trade-offs between accuracy and computational cost, and demonstrate that labeling at both the type and family levels enables more fine-grained and insightful malware classification. The work establishes a robust foundation for future research on advanced malware detection and classification.

恶意软件数据集分类

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。