JLB-JLB/android-ransomware-fcg-baseline

Android Ransomware FCG Dataset (Baseline)

Binary graph-classification dataset for Android ransomware detection based on function call graphs (FCGs) extracted with Androguard.

Dataset Summary

Malware Families

Dataset Variants

internal_only/ — Author-Written Methods Only

Only methods defined in the APK's own code are kept as nodes. External/API calls are encoded as node features on the calling method.

Node features (dim=5): [is_entrypoint, log_in_degree, log_out_degree, log_api_calls, log_other_ext_calls]

full_fcg/ — Complete Function Call Graph

All methods (internal + external/API) are retained as graph nodes.

Node features (dim=5): [is_external, is_android_api, is_entrypoint, log_in_degree, log_out_degree]

Data Format

Each .pt file is a Python list of `torch_geometric.data.Data` objects, loadable with torch.load().

Each Data object contains:

• —x — node feature matrix [num_nodes, 5]
• —edge_index — COO edge list [2, num_edges]
• —y — graph label (0 = benign, 1 = malware)
• —family — string label ("benign", "simplelocker", etc.)
• —apk_name — source APK filename

Usage

from huggingface_hub import hf_hub_download
import torch

# Download the internal_only variant
path = hf_hub_download(
    repo_id="JLB-JLB/android-ransomware-fcg-baseline",
    filename="internal_only/fcg_dataset.pt",
    repo_type="dataset",
)
dataset = torch.load(path, weights_only=False)

print(f"Loaded {len(dataset)} graphs")
print(f"First graph: {dataset[0].x.shape[0]} nodes, {dataset[0].edge_index.shape[1]} edges")

Citation

If you use this dataset, please cite the associated thesis work.