Multi-labeling of complex, multi-behavioral malware samples

The use of malware samples is usually required to test cyber security solutions. For that, the correct typology interest properly estimate exhibited performance tools under evaluation. Although several datasets are publicly available at present, most them not labeled or, if so, only one class or tag assigned each sample. We defend that just label enough represent usual complex behavior by current malware. With this hypothesis in mind, and based on varied classification generally provided automatic detection engines per sample, we introduce here a simple multi-labeling approach automatically multiple samples. In paper, first analyze coherence between behaviors specific number well-known dissected literature tags for our labeling proposal. After scheme executed over four public Android datasets, different results statistics obtained regarding their composition representativeness being discussed. share GitHub repository tool developed, usage.