THREATBYTESTM
All systems operational

Knowledge

Malware corpora and datasets

Where research malware comes from, how it is labelled and split, and the biases every corpus carries.

Sources01
  • Sample repositories for researchers, such as VirusShare, which provide large historical collections by hash.
  • Public benchmark datasets of extracted features, useful for comparison but often dated.
  • Sandbox-derived data generated by executing specimens under control.
  • Synthetic scenarios that simulate attacks to cover rare behaviours.
  • Community submissions, accepted only under consent, quarantine, and ethics governance.
Labelling02

Ground truth for malware is rarely certain. Labels usually come from antivirus consensus, which varies by vendor and changes over time, or from family-naming tools that normalise vendor labels. Recording the label source and date for every sample is essential for reproducibility.

Splitting for evaluation03

Random splits overstate performance. Time-aware splits (train on older, test on newer) and family-aware splits (hold out whole families) better reflect how a model meets genuinely new malware.

Known biases04
  • Platform bias: Windows executables dominate most corpora.
  • Collection bias: what repositories receive is not what attackers deploy.
  • Class imbalance: some families have thousands of variants, others a handful.
  • Benign scarcity: clean software is harder to collect at scale, which distorts false positive estimates.
RES / 01RESEARCH
Research data

Research data spans a large historical malware corpus, sandbox-derived behavioural features, synthetic attack scenarios, and governed community submissions via the THREATBYTES™ platform.

Read research page

RES / 02RESEARCH
Datasets

Dataset documentation covers historical corpora, sandbox-derived features, synthetic scenarios, and community submissions, with methodology, licensing, and experiment linkage.

Read research page

RES / 03RESEARCH
Ethics

Malware research involving real and submitted specimens follows institutional ethics requirements, quarantine policies, and responsible disclosure. Approval references are published when formally assigned.

Read research page

TOPIC / 01TOPIC
SI malware detection

How machine learning classifies malicious software from static and dynamic features, where it fails, and how to evaluate it honestly.

Open topic

TOPIC / 02TOPIC
Behavioural malware analysis

Observing what malware does when it runs (process, file, registry, and network behaviour) to complement static indicators.

Open topic