# MH-1M: A 1.34 Million-Sample Comprehensive Multi-Feature Android Malware Dataset for Machine Learning, Deep Learning, Large Language Models, and Threat Intelligence Research

arXiv: https://arxiv.org/abs/2511.00342 · HTML: https://mlsanity.com/paper/2511.00342/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 11 of its 64 references that are in the map.
- First posted on arXiv 1 Nov 2025.

## Builds on (most cited first, 11 of 11)

- [Tabular Data: Deep Learning is Not All You Need](https://mlsanity.com/paper/2106.03253/) (2021)
- [When Do Neural Nets Outperform Boosted Trees on Tabular Data?](https://mlsanity.com/paper/2305.02997/) (2023)
- [A Random Forest Guided Tour](https://mlsanity.com/paper/1511.05741/) (2015)
- [MaMaDroid: Detecting Android Malware by Building Markov Chains of Behavioral Models](https://mlsanity.com/paper/1612.04433/) (2016)
- [TIF: Learning Temporal Invariance in Android Malware Detectors](https://mlsanity.com/paper/2502.05098/) (2025)
- [Dataset Bias in Android Malware Detection](https://mlsanity.com/paper/2205.15532/) (2022)
- [X-Factor: Quality Is a Dataset-Intrinsic Property](https://mlsanity.com/paper/2505.22813/) (2025)
- [Enhancing Phishing Detection through Feature Importance Analysis and Explainable AI: A Comparative Study of CatBoost, XGBoost, and EBM Models](https://mlsanity.com/paper/2411.06860/) (2024)
- [A Longitudinal Study of Cryptographic API: a Decade of Android Malware](https://mlsanity.com/paper/2205.05573/) (2022)
- [Reassessing feature-based Android malware detection in a contemporary context](https://mlsanity.com/paper/2301.12778/) (2023)
- [On building machine learning pipelines for Android malware detection: a procedural survey of practices, challenges and opportunities](https://mlsanity.com/paper/2306.07118/) (2023)

## Abstract (arXiv)

We present MH-1M, one of the most comprehensive and up-to-date datasets for advanced Android malware research. The dataset comprises 1,340,515 applications, encompassing a wide range of features and extensive metadata. To ensure accurate malware classification, we employ the VirusTotal API, integrating multiple detection engines for comprehensive and reliable assessment. Our GitHub, Figshare, and Harvard Dataverse repositories provide open access to the processed dataset and its extensive supplementary metadata, totaling more than 400 GB of data and including the outputs of the feature extraction pipeline as well as the corresponding VirusTotal reports. Our findings underscore the MH-1M dataset's invaluable role in understanding the evolving landscape of malware.