DEFEAT: Android device behavior-based datasets for multi-stage APT

Android devices play a central role in both personal and organizational operations, which has made them a primary target for Advanced Persistent Threats (APTs). Unlike traditional attacks, APT attacks are implemented through multiple covert stages, allowing attackers to remain active on a device while avoiding detection models. Existing studies depend on data that captures only a single stage of an attack or focuses mainly on static features. Consequently, detection models trained on such datasets may fail to detect multi-stage APT attacks in real-world environments. In order to address this gap, this paper introduces DEFEAT, a benchmarking dataset built specifically for detecting APT attacks on Android devices. DEFEAT follows the MITRE ATT&CK framework to more accurately reflect multi-stage APT attacks in real-world environments. The dataset generation process includes three main phases: gathering normal activity, simulating multi-stage APT attacks, and preparing the data. The datasets were collected from a real Android smartphone and are provided in two parts: a resource-usage dataset that tracks CPU, RAM, battery, and network activity; and an app-based dataset that logs permissions, sensors, and services used by apps. The dataset captures the active phase of APT attacks, focusing on observable malicious behavior rather than long-term dormant activity. The requirements of a well-structured dataset have been met in the proposed datasets to ensure they are suitable for use by other researchers. Feature contributions have also been examined using SHAP (SHapley Additive exPlanations) to better understand their role in detecting APTs. In addition, statistical t-test analysis is applied to the resource-usage datasets to verify that the collected behavioral features vary significantly across malware families and attack stages, supporting their suitability for behavior-based APT detection. By offering a realistic and publicly accessible representation of multi-stage APTs, DEFEAT addresses an important gap in current Android security research and supports the development of more effective behavioral detection models. The datasets are publicly available and can be reused by other researchers for the tuning, evaluation, and comparison of detection models for multi-stage APT activities on Android devices.