Dataset Construction and Analysis of Screenshot Malware

Hugo Sbai, Jassim Happa, Michael Goldsmith, Samy Meftali

Research output: Chapter in Book/Report/Conference proceedingConference contribution

225 Downloads (Pure)


Among the various types of spyware, screenloggers are distinguished by their ability to capture screenshots. This gives them considerable nuisance capacity, giving rise to theft of sensitive data or, failing that, to serious invasions of the privacy of users. Several examples of attacks relying on this screen capture feature have been documented in recent years. However, there is not sufficient empirical and experimental evidence on this topic. Indeed, to the best of our knowledge, there is no dataset dedicated to screenshot-taking malware until today. The lack of datasets or common testbed platforms makes it difficult to analyse and study their behaviour in order to develop effective countermeasures. The screenshot feature is often a smart feature that does not activate automatically once the malware has infected the machine; the activation mechanisms of this function are often more complex. Consequently, a dataset which is completely dedicated to them would make it possible to better understand the subtleties of triggering screenshots and even to learn to distinguish them from the legitimate applications widely present on devices. The main purpose of this paper is to build such a dataset and analyse the behaviour of screenloggers.
Original languageEnglish
Title of host publicationInternational Conference on Trust, Security and Privacy in Computing and Communications (Trustcom)
ISBN (Electronic)978-0-7381-4380-4
ISBN (Print)978-0-7381-4381-1
Publication statusPublished - 29 Dec 2020
EventIEEE TrustCom2020 -
Duration: 29 Dec 20201 Jan 2021


ConferenceIEEE TrustCom2020
Internet address


  • Spyware
  • Screenlogger
  • Malware
  • Dataset
  • Behaviour Analysis
  • Malware Detection
  • Screencapture
  • Remote Access Trojan

Cite this