EMBER2024 -- A Benchmark Dataset for Holistic Evaluation of Malware Classifiers

TL;DR

EMBER2024 is a comprehensive malware dataset designed for holistic evaluation of classifiers, including evasive malware samples, supporting multiple tasks and advancing malware detection research.

Contribution

It introduces EMBER2024, a large, multi-format dataset with new features and challenge samples, enabling more realistic and thorough malware classifier evaluation.

Findings

Includes over 3.2 million files across six formats.

Supports seven malware classification tasks.

Contains a set of evasive malware samples for robustness testing.

Abstract

A lack of accessible data has historically restricted malware analysis research, and practitioners have relied heavily on datasets provided by industry sources to advance. Existing public datasets are limited by narrow scope - most include files targeting a single platform, have labels supporting just one type of malware classification task, and make no effort to capture the evasive files that make malware detection difficult in practice. We present EMBER2024, a new dataset that enables holistic evaluation of malware classifiers. Created in collaboration with the authors of EMBER2017 and EMBER2018, the EMBER2024 dataset includes hashes, metadata, feature vectors, and labels for more than 3.2 million files from six file formats. Our dataset supports the training and evaluation of machine learning models on seven malware classification tasks, including malware detection, malware family classification, and malware behavior identification. EMBER2024 is the first to include a collection of malicious files that initially went undetected by a set of antivirus products, creating a "challenge" set to assess classifier performance against evasive malware. This work also introduces EMBER feature version 3, with added support for several new feature types. We are releasing the EMBER2024 dataset to promote reproducibility and empower researchers in the pursuit of new malware research topics.