构建首个高质量安卓函数调用图数据集,助力恶意软件分类研究。
Better Call Graphs: A New Dataset of Function Call Graphs for Malware Classification
- 从最新安卓APK提取大规模唯一函数调用图
- 包含良性与恶意样本,覆盖多种病毒家族
- 解决旧数据过时冗余问题,适合模型评估
函数调用图(FCG)已成为恶意软件检测的重要抽象,能捕捉应用行为结构,超越表面签名。在安卓生态中尤其关键,因其广泛使用和组件化架构。然而,现有研究受限于缺乏大规模、高质量的安卓专属FCG数据集:多数数据陈旧,由重复或小规模图构成,无法反映真实恶意软件多样性,导致模型过拟合与评估不可靠。为此,我们提出Better Call Graphs(BCG)——一个从近期安卓APK中提取的大型、独特函数调用图数据集,涵盖良性与恶意样本,覆盖多种病毒家族,并提供每个APK的图级特征。通过基线分类器实验,验证了BCG相比现有数据集的必要性与价值。该数据集已公开:https://erdemub.github.io/BCG-dataset。
原文摘要 · Abstract (English)
Function call graphs (FCGs) have emerged as a powerful abstraction for malware detection, capturing the behavioral structure of applications beyond surface-level signatures. Their utility in traditional program analysis has been well established, enabling effective classification and analysis of malicious software. In the mobile domain, especially in the Android ecosystem, FCG-based malware classification is particularly critical due to the platform's widespread adoption and the complex, component-based structure of Android apps. However, progress in this direction is hindered by the lack of large-scale, high-quality Android-specific FCG datasets. Existing datasets are often outdated, dominated by small or redundant graphs resulting from app repackaging, and fail to reflect the diversity of real-world malware. These limitations lead to overfitting and unreliable evaluation of graph-based classification methods. To address this gap, we introduce Better Call Graphs (BCG), a comprehensive dataset of large and unique FCGs extracted from recent Android application packages (APKs). BCG includes both benign and malicious samples spanning various families and types, along with graph-level features for each APK. Through extensive experiments using baseline classifiers, we demonstrate the necessity and value of BCG compared to existing datasets. BCG is publicly available at https://erdemub.github.io/BCG-dataset.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。