AndroTruth: A Reliable Benchmark Android Malware Dataset Derived from Technical Expert Reports
Bai, Zhang, Dong, Zhao, Zhang, Li · cs.CR · 2026-09-05 · 原文
Reliable family labels are essential for Android malware analysis, yet most widely used benchmarks derive such labels from aggregated VirusTotal engine outputs. Because antivirus vendors differ in detection logic, naming conventions, and signature updates, these labels are often inconsistent across engines and unstable over time, which introduces substantial noise into downstream empirical evaluation. To address this problem, we construct AndroTruth, an Android malware family benchmark whose labels are derived exclusively from traceable expert technical analysis reports rather than AV-consensus voting. AndroTruth spans 2016 to 2025 and contains 8,172 malware samples from 187 families. Our statistical results show that automated labeling tools can exhibit a misleading consensus failure mode in which AVClass2 and ClarAVy agree with each other yet jointly disagree with expert ground truth on 25.38% of samples with explicit labels from both tools. Experimental results show that, under expert-verified supervision, representative classifiers such as Meta-MAMC and AndMFC achieve accuracy above 96%. When trained with real-world AV-derived labels and evaluated against expert ground truth, h
讲义
讲义·推断 依据「原文」自动生成的结构化摘要（推断），非原文表述；以原文为准。
1. 人话版
Reliable family labels are essential for Android malware analysis, yet most widely used benchmarks derive such labels from aggregated VirusTotal engine outputs.
Because antivirus vendors differ in detection logic, naming conventions, and signature updates, these labels are often inconsistent across engines and unstable over time, which introduces substantial noise into downstream empirical evaluation.
2. 领域脉络
本文类目：cs.CR，属于其所在研究脉络的最新进展。
3. 机制拆解
To address this problem, we construct AndroTruth, an Android malware family benchmark whose labels are derived exclusively from traceable expert technical analysis reports rather than AV-consensus voting.
4. 证据与数字
AndroTruth spans 2016 to 2025 and contains 8,172 malware samples from 187 families.
Our statistical results show that automated labeling tools can exhibit a misleading consensus failure mode in which AVClass2 and ClarAVy agree with each other yet jointly disagree with expert ground truth on 25.38% of samples with explicit labels from both tools.
Experimental results show that, under expert-verified supervision, representative classifiers such as Meta-MAMC and AndMFC achieve accuracy above 96%.
5. 反例与边界
摘要未声明局限与反例——这是需要警惕的信号，精读时先问边界。
6. 跨领域连接与意外收获
思考本文机制能否迁移到你正在跟进的问题。
7. 可复用方法
把本文机制与你手头项目对照，找一个两周内能验证的最小实验。
8. 术语表
精读时把不熟的术语记入此处，作为下次回忆的锚点。