# Virus-MNIST: A Benchmark Malware Dataset

arXiv: https://arxiv.org/abs/2103.00602 · HTML: https://mlsanity.com/paper/2103.00602/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 31 references that are in the map.
- First posted on arXiv 28 Feb 2021.

## Builds on (most cited first, 5 of 5)

- [MobileNetV2: Inverted Residuals and Linear Bottlenecks](https://mlsanity.com/paper/1801.04381/) (2018)
- [Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms](https://mlsanity.com/paper/1708.07747/) (2017)
- [EMBER: An Open Dataset for Training Static PE Malware Machine Learning Models](https://mlsanity.com/paper/1804.04637/) (2018)
- [Kannada-MNIST: A new handwritten digits dataset for the Kannada language](https://mlsanity.com/paper/1908.01242/) (2019)
- [Overhead MNIST: A Benchmark Satellite Dataset](https://mlsanity.com/paper/2102.04266/) (2021)

## Built on by (most cited first, 5 of 5)

- [A Survey on Cross-Architectural IoT Malware Threat Hunting](https://mlsanity.com/paper/2306.07989/) (2023)
- [Virus-MNIST: Machine Learning Baseline Calculations for Image Classification](https://mlsanity.com/paper/2111.02375/) (2021)
- [Intrusion Detection: Machine Learning Baseline Calculations for Image Classification](https://mlsanity.com/paper/2111.02378/) (2021)
- [Instance Attack:An Explanation-based Vulnerability Analysis Framework Against DNNs for Malware Detection](https://mlsanity.com/paper/2209.02453/) (2022)
- [MalVol-25: A Diverse, Labelled and Detailed Volatile Memory Dataset for Malware Detection and Response Testing and Validation](https://mlsanity.com/paper/2507.03993/) (2025)

## Abstract (arXiv)

The short note presents an image classification dataset consisting of 10 executable code varieties and approximately 50,000 virus examples. The malicious classes include 9 families of computer viruses and one benign set. The image formatting for the first 1024 bytes of the Portable Executable (PE) mirrors the familiar MNIST handwriting dataset, such that most of the previously explored algorithmic methods can transfer with minor modifications. The designation of 9 virus families for malware derives from unsupervised learning of class labels; we discover the families with KMeans clustering that excludes the non-malicious examples. As a benchmark using deep learning methods (MobileNetV2), we find an overall 80% accuracy for virus identification by families when beneware is included. We also find that once a positive malware detection occurs (by signature or heuristics), the projection of the first 1024 bytes into a thumbnail image can classify with 87% accuracy the type of virus. The work generalizes what other malware investigators have demonstrated as promising convolutional neural networks originally developed to solve image problems but applied to a new abstract domain in pixel bytes from executable files. The dataset is available on Kaggle and Github.