Avast-CTU Public CAPE Dataset

• Avast-CTU Public CAPE Dataset is a curated collection of 48,976 malicious PE samples with detailed CAPEv2 sandbox reports for dynamic malware analysis.
• It supports research on malware classification, concept drift, and robust machine learning by providing both full and leakage-mitigated reduced JSON reports.
• The dataset's temporal span (2017–2019) and imbalanced class distribution offer a realistic benchmark for evaluating dynamic malware detection models.

The Avast-CTU Public CAPE Dataset is a public dataset for malware behavioral analysis research introduced by Bosansky et al. and collected in cooperation between Avast Software and the Czech Technical University AI Center. It contains 48,976 malicious PE (Portable Executable) samples represented through CAPEv2 sandbox reports, with collection spanning malware dated primarily 2017 to 2019. The corpus provides both full and reduced JSON reports, enabling research on malware family classification, concept drift, and machine learning over rich dynamic-analysis artifacts rather than static-only binary features (Bosansky et al., 2022). In subsequent work, Perera and Jiang used the dataset as the evaluation benchmark for BEACON, a framework that derives dense embeddings from sandbox-generated behavior reports and achieved the strongest reported results among the compared classifiers on this benchmark (Perera et al., 18 Sep 2025).

1. Provenance and motivation

The dataset emerged from a specific gap in public malware research infrastructure: there was a limited amount of publicly available data for malware analysis technology, and “virtually no publicly available datasets generated from rich sandboxes such as Cuckoo/CAPE.” Its release was intended to support the design of new machine learning methods for malware detection, especially methods targeting automatic detection of generic malicious behavior through execution logs rather than solely through static binary attributes (Bosansky et al., 2022).

This motivation is tied to the basic advantage of dynamic sandboxing. In a sandbox, file execution is realistically simulated on the target machine, and the resulting execution log can capture malicious behavior in detail. The dataset therefore occupies a distinct position relative to widely used static corpora such as EMBER and SOREL-20M, which the source paper identifies as focused on static features. The Avast-CTU corpus was designed to make rich behavioral telemetry publicly available for academic work, narrowing the gap between industrial malware-analysis backends and open research settings (Bosansky et al., 2022).

2. Corpus composition and labeling

The dataset contains 48,976 samples, all of which are classified as malicious PE files. Each sample is labeled with a malware family and malware type, and each report includes metadata comprising the sha256 identifier, assigned malware family, type, and date of first detection. The time span is primarily 2017–2019, which is significant because it supports temporally realistic evaluation rather than purely random resampling (Bosansky et al., 2022).

The corpus covers 10 malware families. The associated malware types are listed as "banker", "trojan", "pws", "coinminer", "rat", "keylogger". The BEACON study presents the following class breakdown, including the decomposition of njRAT across two malware types; the dataset paper separately reports njRAT as 3,372 samples in aggregate, which is consistent with that split (Bosansky et al., 2022).

Malware type	Malware family	Number of instances
banker	Emotet	14,429
banker	Qakbot	4,895
banker	Trickbot	4,202
banker	Ursnif	1,343
banker	Zeus	2,594
coinminer	HarHar	655
keylogger	njRAT	29
pws	Lokibot	4,191
rat	njRAT	3,343
trojan	Adload	704
trojan	Swisyn	12,591

The distribution is strongly imbalanced. The source description explicitly contrasts 14,429 Emotet samples with 655 HarHar samples, and the BEACON evaluation treats this imbalance as a central property of the benchmark. This makes the dataset suitable for studying not only average classifier performance but also robustness under skewed class prevalence (Perera et al., 18 Sep 2025).

3. Behavioral report generation and data formats

The reports were generated with CAPEv2, described as an actively maintained fork or extension of Cuckoo Sandbox. The source materials attribute to CAPEv2 improved or augmented functionality including payload capture, binary unpacking, behavioral event detection, and YARA-based detection. The execution infrastructure comprised three physical machines, each hosting four Windows 7 virtual machines (Bosansky et al., 2022).

The virtual machines were configured to mimic real user PCs and were reported to have passed Pafish anti-VM checks. The environment included installed applications such as Chrome, Firefox, MS Office, Adobe Reader, and Spotify; stored private keys; a stored Chrome password; public documents and images; and external Internet connectivity. Malware execution and log capture were performed at the Czech Technical University in July–August 2021, using AVAST’s malware samples dated mainly 2017–2019 (Bosansky et al., 2022).

Two report forms are distributed. The full reports are JSON files containing the complete execution trace, including all API calls (with parameters), spawned process tree, memory dumps, YARA signature matches, and all generated (dropped) binaries. Some full reports can exceed 800 MB. To address practical and methodological issues, the dataset also provides reduced reports, each containing only behavior → summary and static → pe. The behavioral summary includes items such as accessed files, registry keys, mutexes, API calls, and executed commands; the static PE portion includes headers, sections, imports, and related PE metadata (Bosansky et al., 2022).

A central design issue is label leakage. The reduced reports were explicitly created to exclude YARA-based detections, because these could leak labels and inflate results. The BEACON study therefore uses the reduced reports in order to focus on essential behavioral and static attributes, improve training efficiency through smaller input size, and reduce the risk of “cheating” features (Perera et al., 18 Sep 2025).

4. Temporal structure, drift, and evaluation protocol

The dataset’s multi-year span is one of its most important methodological properties. The source descriptions explicitly frame it as a resource for studying concept drift and evolving malware behaviors. Rather than assuming that train and test examples are exchangeable, the benchmark supports temporally ordered evaluation that more closely mirrors deployment conditions in which future samples may differ materially from historical ones (Bosansky et al., 2022).

In the evaluation protocol described in the BEACON study, the dataset follows a temporal split with 76% for training and 24% for testing, reflecting “real-world deployments facing new/unseen threats.” Hyperparameter selection and model assessment on the training portion use 5-fold cross-validation. Because of the marked class imbalance, the reported metrics are weighted and include Accuracy (ACC), Precision (PRE), Recall (REC), F1-score, and AUPRC (Area Under the Precision-Recall Curve) (Perera et al., 18 Sep 2025).

These choices matter for interpretation. A temporally ordered split constrains overly optimistic estimates that can arise when variants from similar periods appear in both training and test partitions. The source paper’s emphasis on weighted metrics likewise indicates that raw accuracy alone is insufficient on this corpus, since class skew can obscure degradation on minority families (Perera et al., 18 Sep 2025).

5. Role in model development and benchmarking

The dataset paper demonstrates hierarchical multi-instance learning (HMIL) baselines and uses the corpus to compare behavioral versus static-only representations. On reduced reports, the reported HMIL results are 99.5% training accuracy and 94.5% testing accuracy. On static-only reports, the reported values are 96.7% training accuracy and approximately 63% testing accuracy under the temporal or realistic split. The source text presents this contrast as evidence of the importance of behavioral information, particularly under drift (Bosansky et al., 2022).

The BEACON paper uses the same dataset to evaluate a behavioral malware-classification pipeline that applies LLMs to produce contextual embeddings from raw sandbox-generated reports and then processes those embeddings with a 1D CNN. On the Avast-CTU Public CAPE Dataset, the reported weighted results are as follows (Perera et al., 18 Sep 2025):

Model	Accuracy	Precision	Recall	F1-score
SVM (RBF)	0.976	0.977	0.959	0.966
MLP	0.981	0.981	0.980	0.981
Bidirectional LSTM	0.983	0.983	0.983	0.983
BEACON (Proposed)	0.985	0.985	0.985	0.985

The same source adds that per-family F1 scores are high across all malware families, including minor ones. This suggests that the dataset is not merely a large corpus but a benchmark capable of differentiating among modeling choices in the presence of realistic noise, temporal variation, and class imbalance (Perera et al., 18 Sep 2025).

6. Research significance, scope, and limitations

Several features distinguish the Avast-CTU Public CAPE Dataset from earlier public malware corpora. The source paper characterizes it as the first public dataset with full CAPEv2 behavioral logs, and emphasizes its richness, diversity, granularity, and time span. Because the logs are raw and unabstracted JSON, the corpus supports multiple representation strategies, including treating the reports as text, graphs, or inputs to hierarchical/multi-instance models. The source text also identifies research opportunities in feature engineering, adversarial malware, evasion, label noise, unsupervised learning, few-shot learning, and benchmarking of dynamic malware-analysis pipelines (Bosansky et al., 2022).

The dataset is publicly released through the GitHub repository at https://github.com/avast/avast-ctu-cape-dataset. The source notes that the exact license is not described in the paper excerpt and advises consulting the repository for precise licensing and redistribution terms (Bosansky et al., 2022).

Two interpretive cautions are especially important. First, the dataset consists entirely of malicious files. A plausible implication is that it is primarily suited to malware-family classification and behavioral representation learning, and that binary malicious-versus-benign detection studies would require additional benign data. Second, the presence of YARA detections in full reports creates a risk of label leakage; the reduced reports were introduced specifically to mitigate that problem. These are not incidental preprocessing details but central methodological conditions for obtaining credible results on the benchmark (Perera et al., 18 Sep 2025).

Taken together, the dataset serves as a realistic and technically detailed benchmark for dynamic malware analysis. Its importance lies not only in scale—48,976 samples—but in the combination of rich CAPEv2 execution telemetry, explicit temporal structure, family-level annotation, and the availability of both full and leakage-mitigated reduced reports (Bosansky et al., 2022).