Rule checked both malware dataset and benign apps