# AVClass2: Massive Malware Tag Extraction from AV Labels

arXiv: https://arxiv.org/abs/2006.10615 · HTML: https://mlsanity.com/paper/2006.10615/

## Key facts

- Cited by 19 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 18 Jun 2020.

## Built on by (most cited first, 19 of 19)

- [Continuous Learning for Android Malware Detection](https://mlsanity.com/paper/2302.04332/) (2023)
- [Adversarial Attacks against Windows PE Malware Detection: A Survey of the State-of-the-Art](https://mlsanity.com/paper/2112.12310/) (2021)
- [Decoding the Secrets of Machine Learning in Malware Classification: A Deep Dive into Datasets, Feature Extraction, and Model Performance](https://mlsanity.com/paper/2307.14657/) (2023)
- [Adversarial Transfer Attacks With Unknown Data and Class Overlap](https://mlsanity.com/paper/2109.11125/) (2021)
- [Towards an Automated Pipeline for Detecting and Classifying Malware through Machine Learning](https://mlsanity.com/paper/2106.05625/) (2021)
- [Towards a Fair Comparison and Realistic Evaluation Framework of Android Malware Detectors based on Static Analysis and Machine Learning](https://mlsanity.com/paper/2205.12569/) (2022)
- [EMBERSim: A Large-Scale Databank for Boosting Similarity Search in Malware Analysis](https://mlsanity.com/paper/2310.01835/) (2023)
- [AVScan2Vec: Feature Learning on Antivirus Scan Data for Production-Scale Malware Corpora](https://mlsanity.com/paper/2306.06228/) (2023)
- [Small Effect Sizes in Malware Detection? Make Harder Train/Test Splits!](https://mlsanity.com/paper/2312.15813/) (2023)
- [HiGraph: A Large-Scale Hierarchical Graph Dataset for Malware Analysis](https://mlsanity.com/paper/2509.02113/) (2025)
- [MASCOT: Analyzing Malware Evolution Through A Well-Curated Source Code Dataset](https://mlsanity.com/paper/2512.00741/) (2025)
- [APT-MMF: An advanced persistent threat actor attribution method based on multimodal and multilevel feature fusion](https://mlsanity.com/paper/2402.12743/) (2024)
- [A New Formulation for Zeroth-Order Optimization of Adversarial EXEmples in Malware Detection](https://mlsanity.com/paper/2405.14519/) (2024)
- [Trust Under Siege: Label Spoofing Attacks against Machine Learning for Android Malware Detection](https://mlsanity.com/paper/2503.11841/) (2025)
- [Automated Malware Family Classification using Weighted Hierarchical Ensembles of Large Language Models](https://mlsanity.com/paper/2604.02490/) (2026)
- [On the Effectiveness of Adversarial Samples against Ensemble Learning-based Windows PE Malware Detectors](https://mlsanity.com/paper/2309.13841/) (2023)
- [Examining the Rat in the Tunnel: Interpretable Multi-Label Classification of Tor-based Malware](https://mlsanity.com/paper/2409.16639/) (2024)
- [A Unified Evaluation of Learning-Based Similarity Techniques for Malware Detection](https://mlsanity.com/paper/2602.15376/) (2026)
- [HYDRA: Proactive Android Malware Drift Adaptation via Hierarchical Graph Contrastive Learning](https://mlsanity.com/paper/2609.26352/) (2026)

## Abstract (arXiv)

Tags can be used by malware repositories and analysis services to enable searches for samples of interest across different dimensions. Automatically extracting tags from AV labels is an efficient approach to categorize and index massive amounts of samples. Recent tools like AVClass and Euphony have demonstrated that, despite their noisy nature, it is possible to extract family names from AV labels. However, beyond the family name, AV labels contain much valuable information such as malware classes, file properties, and behaviors. This work presents AVClass2, an automatic malware tagging tool that given the AV labels for a potentially massive number of samples, extracts clean tags that categorize the samples. AVClass2 uses, and helps building, an open taxonomy that organizes concepts in AV labels, but is not constrained to a predefined set of tags. To keep itself updated as AV vendors introduce new tags, it provides an update module that automatically identifies new taxonomy entries, as well as tagging and expansion rules that capture relations between tags. We have evaluated AVClass2 on 42M and showed how it enables advanced malware searches and to maintain an updated knowledge base of malware concepts in AV labels.