DOI: 10.5281/zenodo.18782863
title: AndMal2025: Behavioral Android Malware Analysis Dataset

description: The AndMal2025 dataset provides a comprehensive behavioral representation of Android applications by integrating static code attributes and runtime execution indicators. Each record corresponds to a single APK instance, where the feature set captures permission usage, system interactions, service binding activities, resource consumption patterns, and network behavior. The dataset to support robust supervised learning for Android malware analysis, including both primary binary detection and auxiliary multi-label family characterization.

The feature space is organized into six major groups to reflect different operational layers of Android applications.



1. Application Metadata Features

These attributes summarize high-level structural properties of the APK and provide contextual signals regarding application complexity.





App_ID — Unique identifier assigned to each application instance.




APK_Size_KB — Size of the packaged APK file in kilobytes, reflecting application footprint.




Dex_Method_Count — Total number of methods extracted from the DEX bytecode, indicating codebase complexity.



These metadata features help distinguish lightweight benign utilities from feature-dense malicious packages.



2. Permission-Based Static Features

Permission indicators capture declared capabilities within the Android manifest and are widely recognized as strong malware predictors.





perm_SEND_SMS — Indicates whether the application requests SMS transmission permission.




perm_ACCESS_NETWORK_STATE — Reflects access to network connectivity state information.




perm_WRITE_SETTINGS — Indicates permission to modify system settings.




perm_INTERNET — Specifies whether the application can access network resources.




perm_count_total — Total number of permissions requested by the application.




perm_count_dangerous — Number of high-risk permissions requested.




danger_perm_ratio — Ratio of dangerous permissions to total permissions.



These features characterize the privilege profile of each application and expose over-permission patterns commonly associated with malicious behavior.



3. Intent and Broadcast Action Features

Broadcast receivers and intent filters reveal persistence mechanisms and background execution strategies.





intent_BOOT_COMPLETED — Indicates registration for device boot completion events.




intent_SCREEN_ON — Indicates monitoring of screen activation events.



Such signals are frequently linked to stealth persistence and opportunistic background activity.



4. Class and API Usage Indicators

These features capture the presence of sensitive framework classes that often appear in suspicious workflows.





class_java_lang_Class — Reflects dynamic class loading or reflection usage.




class_android_telephony_SmsManager — Indicates access to SMS management APIs.



API-level evidence complements permission analysis by exposing how declared privileges are operationalized.



5. Runtime Event and Service Interaction Features

Dynamic execution monitoring provides insight into inter-process communication and service orchestration behaviors.





evt_Transact — Count of Binder transaction events.




evt_onServiceConnected — Number of successful service connection callbacks.




evt_bindService — Frequency of service binding requests.




evt_attachInterface — Interface attachment operations observed at runtime.




evt_ClassLoader — Dynamic class loading events.




evt_total — Aggregate count of monitored runtime events.




evt_entropy — Distribution entropy of runtime event types.



These features expose behavioral patterns that may remain hidden in purely static inspection.



6. System Activity, Resource, and Network Features

This group captures operational footprints generated during application execution.

System and Resource Metrics





syscall_count_total — Total number of observed system calls.




cpu_mean — Mean CPU utilization during execution.




mem_mean_mb — Average memory consumption in megabytes.




file_write_count — Number of file write operations.




service_start_count — Count of service start invocations.



Network Behavior Metrics





net_conn_count — Number of outbound network connections.




dns_query_count — DNS query frequency.




net_tx_kb — Volume of transmitted network data (KB).




net_rx_kb — Volume of received network data (KB).



Code Structure Indicators





opcode_ngram_entropy — Entropy of opcode n-gram distribution.




dex_string_entropy — Entropy of embedded string constants.



These features jointly model communication intensity, resource usage patterns, and code-level irregularities associated with malicious workflows.



Target Labels

The dataset supports both primary detection and fine-grained family characterization.

Primary Prediction Label





Malware_Binary — Binary ground truth where





0 denotes benign applications




1 denotes malicious applications





This label is intended for the main supervised malware detection task.



Auxiliary Multi-Label Family Annotations

To enable detailed behavioral analysis, the dataset provides non-exclusive malware family indicators:





y_scareware — Scareware activity indicator




y_ransomware — Ransomware activity indicator




y_adware — Adware activity indicator




y_sms_malware — SMS-based malicious activity indicator



Multiple family labels may be active simultaneously for a single application, enabling multi-label learning and cross-family behavioral studies.