Raducu, Razvan; Villagrasa-Labrador, Alain; Rodríguez, Ricardo J.; Álvarez, Pedro
MALVADA: A Framework for Generating Datasets of Malware Execution Traces Journal Article
In: SoftwareX, vol. 30, pp. 102082, 2025, ISSN: 2352-7110.
Abstract | Links | BibTeX | Tags: Dataset generation, Execution traces, Malware behavior, Malware classification
@article{RaducuVRA-SoftwareX-25,
title = {MALVADA: A Framework for Generating Datasets of Malware Execution Traces},
author = {Razvan Raducu and Alain Villagrasa-Labrador and Ricardo J. Rodríguez and Pedro Álvarez},
url = {https://webdiis.unizar.es/~ricardo/files/papers/RaducuVRA-SoftwareX-25.pdf},
doi = {10.1016/j.softx.2025.102082},
issn = {2352-7110},
year = {2025},
date = {2025-05-01},
journal = {SoftwareX},
volume = {30},
pages = {102082},
abstract = {Malware attacks have been growing steadily in recent years, making more sophisticated detection methods necessary. These approaches typically rely on analyzing the behavior of malicious applications, for example by examining execution traces that capture their runtime behavior. However, many existing execution trace datasets are simplified, often resulting in the omission of relevant contextual information, which is essential to capture the full scope of a malware sample’s behavior. This paper introduces MALVADA, a flexible framework designed to generate extensive datasets of execution traces from Windows malware. These traces provide detailed insights into program behaviors and help malware analysts to classify a malware sample. MALVADA facilitates the creation of large datasets with minimal user effort, as demonstrated by the WinMET dataset, which includes execution traces from approximately 10,000 Windows malware samples.},
keywords = {Dataset generation, Execution traces, Malware behavior, Malware classification},
pubstate = {published},
tppubtype = {article}
}
Malware attacks have been growing steadily in recent years, making more sophisticated detection methods necessary. These approaches typically rely on analyzing the behavior of malicious applications, for example by examining execution traces that capture their runtime behavior. However, many existing execution trace datasets are simplified, often resulting in the omission of relevant contextual information, which is essential to capture the full scope of a malware sample’s behavior. This paper introduces MALVADA, a flexible framework designed to generate extensive datasets of execution traces from Windows malware. These traces provide detailed insights into program behaviors and help malware analysts to classify a malware sample. MALVADA facilitates the creation of large datasets with minimal user effort, as demonstrated by the WinMET dataset, which includes execution traces from approximately 10,000 Windows malware samples.
Raducu, Razvan; Rodríguez, Ricardo J.; Álvarez, Pedro
MalGraphIQ: A Tool for Generating Behavior Representations of Malware Execution Traces Journal Article
In: SoftwareX, vol. 32, pp. 102407, 2025, ISSN: 2352-7110.
Abstract | Links | BibTeX | Tags: Behavioral Patterns, Comparative Malware Analysis, Execution traces, Malware Analysis, Visual Analytics
@article{Raducu2025a,
title = {MalGraphIQ: A Tool for Generating Behavior Representations of Malware Execution Traces},
author = {Razvan Raducu and Ricardo J. Rodríguez and Pedro Álvarez},
url = {https://webdiis.unizar.es/~ricardo/files/papers/RaducuRA-SoftwareX-25.pdf},
doi = {10.1016/j.softx.2025.102407},
issn = {2352-7110},
year = {2025},
date = {2025-12-01},
urldate = {2025-12-01},
journal = {SoftwareX},
volume = {32},
pages = {102407},
abstract = {Understanding and interpreting malware behavior remains an open challenge in the field of cybersecurity. The dynamic analysis of malware execution traces has emerged as a promising approach for discovering behavioral insights that allow the visual explanation of malware activity. sc MalGraphIQ is an open-source tool for the analysis and visualization of malware behavior. It is based on a structured and hierarchical taxonomy of API-based behavior patterns, which facilitates the interpretation of malware objectives, strategies, and low-level interactions with the attacked system. These interpretations support the comparative analysis of collections of suspicious programs, particularly across malware families and types, enhancing security research, malware triage, and the development of behavior-aware detection systems.},
keywords = {Behavioral Patterns, Comparative Malware Analysis, Execution traces, Malware Analysis, Visual Analytics},
pubstate = {published},
tppubtype = {article}
}
Understanding and interpreting malware behavior remains an open challenge in the field of cybersecurity. The dynamic analysis of malware execution traces has emerged as a promising approach for discovering behavioral insights that allow the visual explanation of malware activity. sc MalGraphIQ is an open-source tool for the analysis and visualization of malware behavior. It is based on a structured and hierarchical taxonomy of API-based behavior patterns, which facilitates the interpretation of malware objectives, strategies, and low-level interactions with the attacked system. These interpretations support the comparative analysis of collections of suspicious programs, particularly across malware families and types, enhancing security research, malware triage, and the development of behavior-aware detection systems.