OS X Malware Dataset

Published 2018. As Apple’s market share grew, threat actors increasingly developed OS X malware — a notable example being the OS X Flashback Trojan, which successfully infected over 700,000 machines in 2012.

Introduction

This project created a malware detection dataset leveraging Radial Base Function (RBF) and machine learning, specifically Support Vector Machines (SVM). The approach analyzes application library calls to distinguish malware from benign samples. Findings showed that larger sample sizes improved detection accuracy while reducing false positive rates. Combining static and dynamic features with techniques like fuzzy classification and deep learning could enhance performance further.

Dataset details

The dataset comprises 152 malware samples collected between January 2012 and June 2016, compatible with:

• OS X 10.8 (Mountain Lion)
• OS X 10.9 (Mavericks)
• OS X 10.10 (Yosemite)
• OS X 10.11 (El Capitan)

Duplicate samples were removed via SHA-256 hash comparison. Known malware families included WireLurker, MacVX, LaoShu, and Kitmos. The dataset contains 456 benign samples to ensure unbiased evaluation.

Citation

Haddadpajouh, Hamed & Dehghantanha, Ali & Khayami, Raouf & Choo, Kim-Kwang Raymond (2018). Intelligent OS X malware threat detection with code inspection. Journal of Computer Virology and Hacking Techniques, 14. DOI: 10.1007/s11416-017-0307-5.

Download

The dataset is available on GitHub.