Stalkerware-permissions set, version 1.0
==============================================

A synthetic teaching set for supervised learning (binary classification): does the permission and
behaviour profile of an Android app look like stalkerware, or like a benign app?

Every row was invented by generate.py from a fixed seed (20261106). No row describes a real app, a real
person or a real device. The features are the kind of values an examiner can read from a phone
extraction (requested and granted permissions, enabled accessibility service, device administrator,
notification listener, hidden launcher icon, install source, App Ops counts, background service time,
network egress bucket). The relationships between features and label are modelled, not measured: this set
teaches the method, it is not a measure of how well any tool does on real devices.

Files
  data/train.csv                2105 rows with the label column is_stalkerware
  data/test.csv                 895 rows, same columns without the label
  answers/test_answers.csv      the reference answers for test.csv (label, app family, family kind)
  DATA_DICTIONARY.md            every column, what it means, where an examiner reads it
  data_dictionary.csv           the same, machine readable
  TEACHING_GUIDE.md             session plan, exercises, traps, ethics of false positives
  code/baseline_stdlib.py       majority, indicator-count and logistic regression baselines (Python only)
  code/baseline_sklearn.py      optional scikit-learn version (needs numpy and scikit-learn)
  code/evaluate.py              scores a predictions file against test_answers.csv
  generator/generate.py         the script that wrote all of this (MIT)
  LICENCE.txt                   licences

Shape: 3000 rows, 225 positive (7.5 percent) and 2775 negative. Train: 171 positive of
2105. Test: 54 positive of 895. 141 app lineages; a lineage is in train or in test, never both.

Known traps (listed in TEACHING_GUIDE.md): a leakage column (prior_triage_flag), class imbalance,
benign look-alikes (parental control, remote support, accessibility, backup, device management,
find-my-device), covert use of a dual-use app that no feature separates, lineage clusters, blank
values that depend on the evidence source, an ordinal column that sorts wrongly as text.

Label meaning: 1 = an app built to watch a person without their knowledge (stalkerware, as the Coalition
Against Stalkerware uses the word) or a dual-use app used that way. Whether a person knew and agreed is
not something a phone's permission table can show.

Check files with SHA256SUMS.txt or manifest.json (next to this archive).
Licence: data CC BY 4.0, code MIT.
