4
$\begingroup$

I'm planning to gather a benign dataset for my ML malware detection model

the problem I'm having is finding benign PE files, i just need a source that has a dataset of normal executables, i will scan them with VT and extract benign ones, but i cant find anything useful

if there is nothing out there, then at least what is the best website that has the potential to be useful for a PE downloader crawler? (meaning its easy to crawl and automatically download .exe files without running into problems)

also another problem of using a download website is Installers, considering most of their files are installer and i need to install the program first, is there any good solution to this? is there any AutoIT script that somehow can install all types of installers ?

(I tried looking at surveys on using ML in malware detection like [1], but seems like non of the papers have released any useful benign dataset other than simple windows files which anyone can gather and is less than 10k, and very small amounts like 1000, i need to gather a large benign dataset, more than 50,000 benign files because my malware dataset is really large)

[1] https://www.sciencedirect.com/science/article/pii/S0167404818303808

$\endgroup$
5
  • $\begingroup$ I'm not sure about their scope rules but security.stackexchange.com might be a better place for this question. $\endgroup$
    – Erwan
    Jun 25, 2020 at 21:43
  • $\begingroup$ @Erwan I asked there too, they said finding datasets is off topic there $\endgroup$
    – Mery Ted
    Jun 26, 2020 at 8:50
  • $\begingroup$ ok sorry, maybe you can try opendata.stackexchange.com. it's a quite specialized domain so I'm not sure there are people here who can answer. $\endgroup$
    – Erwan
    Jun 26, 2020 at 12:12
  • $\begingroup$ can you please share your malware binary dataset? I am searching for it but have not found it anywhere. it will be a great favour if you help me $\endgroup$ Sep 16, 2021 at 8:29
  • $\begingroup$ @RabiaMubeen I answered the question myself. check out the answer. $\endgroup$
    – Mery Ted
    Oct 13, 2021 at 10:56

2 Answers 2

0
$\begingroup$

I finally solved this by using the Virusshare website. It has millions of malwares, and is free.

Note that around 1-2% of their PE files are probably benign, meaning less than 1-2 detection on VirusTotal, so just labeling every single PE file as malware might not be academically complete.

$\endgroup$
0
$\begingroup$

You can check my repo https://github.com/bormaa/Benign-NET It contains about 14,000 benign .NET files and I am working on a new repo for all benign exe files

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.