MASCOT: Analyzing Malware Evolution Through A Well-Curated Source Code Dataset

• URL: http://arxiv.org/abs/2512.00741v1
• Date: Sun, 30 Nov 2025 05:26:23 GMT
• Title: MASCOT: Analyzing Malware Evolution Through A Well-Curated Source Code Dataset
• Abstract summary: This paper introduces a manually-reviewed malware source code dataset containing 6032 specimens.<n>At an overall view, this analysis quantifies the strength and direction of connections among specimens and categories.<n>At a detailed view, it traces the evolutionary histories of individual specimens.
• Score: 1.4287348604206223
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: In recent years, the explosion of malware and extensive code reuse have formed complex evolutionary connections among malware specimens. The rapid pace of development makes it challenging for existing studies to characterize recent evolutionary trends. In addition, intuitive tools to untangle these intricate connections between malware specimens or categories are urgently needed. This paper introduces a manually-reviewed malware source code dataset containing 6032 specimens. Building on and extending current research from a software engineering perspective, we systematically evaluate the scale, development costs, code quality, as well as security and dependencies of modern malware. We further introduce a multi-view genealogy analysis to clarify malware connections: at an overall view, this analysis quantifies the strength and direction of connections among specimens and categories; at a detailed view, it traces the evolutionary histories of individual specimens. Experimental results indicate that, despite persistent shortcomings in code quality, malware specimens exhibit an increasing complexity and standardization, in step with the development of mainstream software engineering practices. Meanwhile, our genealogy analysis intuitively reveals lineage expansion and evolution driven by code reuse, providing new evidence and tools for understanding the formation and evolution of the malware ecosystem.

Related papers

• On Automated and Explainable Provenance of AI-Generated Code [56.818202904805446]
  We argue that the next generation of CodeGenAI tools must be built on a foundation of explainable provenance.<n>We describe a research program combining large-scale empirical studies with post-hoc causal and interpretability techniques.
  arXiv  Detail & Related papers  (2026-08-03T14:50:31Z)
• MalTree: Tracing Malware Evolution from Embeddings at Scale [3.147593802429888]
  MalTree is a framework that applies bioinformatics inspired phylogenetic techniques at scale to model malware evolution.<n>Our analysis shows that some families mutate over 10 times faster than others, suggesting that detection strategies should be tailored to family-specific evolutionary tempos.
  arXiv  Detail & Related papers  (2026-06-04T17:51:49Z)
• Exploring the connection between coding habits and cognitive styles in malware developers [5.123298347655087]
  This study investigates the behavioral signatures and coding patterns embedded in the malware source code.<n>Based on cognitive psychology and criminological theories, our work interprets differences in code structure and quality as behavioral indicators.
  arXiv  Detail & Related papers  (2026-06-04T09:46:25Z)
• A systematic literature Review for Transformer-based Software Vulnerability detection [0.8409304328108455]
  This SLR critically analysed 80 studies published between 2021 and 2025 that utilised transformer models to identify software vulnerabilities.<n>We classify transformer models into encoder, decoder, and combined architectures and analyse both pre-trained and fine-tuned versions utilized on source code, logs, and smart contracts.
  arXiv  Detail & Related papers  (2026-04-27T14:26:19Z)
• XGen-Q: An Explainable Domain-Adaptive LLM Framework with Retrieval-Augmented Generation for Software Security [5.062812514858075]
  Generative AI and large language models (LLMs) have shown strong capabilities in code understanding, but their use in cybersecurity remains limited.<n>We introduce XGen-Q, a domain-adapted LLM built on the Qwen-Coder architecture and pretrained on a large-scale corpus of over one million malware samples.<n>XGen-Q uses a multi-stage prompt strategy combined with retrieval-augmented generation (RAG) to deliver reliable malware identification and detailed forensic reporting.
  arXiv  Detail & Related papers  (2025-10-21T18:35:38Z)
• CoDA: Agentic Systems for Collaborative Data Visualization [57.270599188947294]
  Deep research has revolutionized data analysis, yet data scientists still devote substantial time to manually crafting visualizations.<n>Existing approaches, including simple single- or multi-agent systems, often oversimplify the task.<n>We introduce CoDA, a multi-agent system that employs specialized LLM agents for metadata analysis, task planning, code generation, and self-reflection.
  arXiv  Detail & Related papers  (2025-10-03T17:30:16Z)
• Content Generation Models in Computational Pathology: A Comprehensive Survey on Methods, Applications, and Challenges [55.41538606569424]
  Review focuses on four key domains: image generation, text generation, molecular profile-morphology generation, and other specialized generation applications.<n>We trace the evolution of content generation architectures -- from early generative adversarial networks to recent advances in diffusion models and generative vision-language models.<n>Review concludes with a discussion of open challenges and prospective research directions, with an emphasis on developing integrated and clinically deployable generation systems.
  arXiv  Detail & Related papers  (2025-05-16T08:44:50Z)
• Recent Advances in Malware Detection: Graph Learning and Explainability [2.5824213547618067]
  This survey focuses on the interplay between graph learning and explainability.<n>By integrating these components, this survey demonstrates how graph learning and explainability contribute to building robust, interpretable, and scalable malware detection systems.
  arXiv  Detail & Related papers  (2025-02-14T21:10:03Z)
• Exploring Large Language Models for Semantic Analysis and Categorization of Android Malware [0.0]
  msp is designed to augment malware analysis for Android through a hierarchical-tiered summarization chain and strategic prompt engineering.<n>msp can achieve up to 77% classification accuracy while providing highly robust summaries at functional, class, and package levels.
  arXiv  Detail & Related papers  (2025-01-08T21:22:45Z)
• A Survey of Neural Code Intelligence: Paradigms, Advances and Beyond [84.95530356322621]
  This survey presents a systematic review of the advancements in code intelligence.<n>It covers over 50 representative models and their variants, more than 20 categories of tasks, and an extensive coverage of over 680 related works.<n>Building on our examination of the developmental trajectories, we further investigate the emerging synergies between code intelligence and broader machine intelligence.
  arXiv  Detail & Related papers  (2024-03-21T08:54:56Z)
• SimSCOOD: Systematic Analysis of Out-of-Distribution Generalization in Fine-tuned Source Code Models [58.78043959556283]
  We study the behaviors of models under different fine-tuning methodologies, including full fine-tuning and Low-Rank Adaptation (LoRA) fine-tuning methods. Our analysis uncovers that LoRA fine-tuning consistently exhibits significantly better OOD generalization performance than full fine-tuning across various scenarios.
  arXiv  Detail & Related papers  (2022-10-10T16:07:24Z)
• Critical Learning Periods for Multisensory Integration in Deep Networks [112.40005682521638]
  We show that the ability of a neural network to integrate information from diverse sources hinges critically on being exposed to properly correlated signals during the early phases of training. We show that critical periods arise from the complex and unstable early transient dynamics, which are decisive of final performance of the trained system and their learned representations.
  arXiv  Detail & Related papers  (2022-10-06T23:50:38Z)
• Software Vulnerability Detection via Deep Learning over Disaggregated Code Graph Representation [57.92972327649165]
  This work explores a deep learning approach to automatically learn the insecure patterns from code corpora. Because code naturally admits graph structures with parsing, we develop a novel graph neural network (GNN) to exploit both the semantic context and structural regularity of a program.
  arXiv  Detail & Related papers  (2021-09-07T21:24:36Z)
• Machine Learning for Malware Evolution Detection [4.111899441919165]
  We perform experiments on a significant number of malware families to determine when malware evolution is likely to have occurred. We consider analysis based on hidden Markov models (HMM) and the word embedding techniques HMM2Vec and Word2Vec.
  arXiv  Detail & Related papers  (2021-07-04T13:47:06Z)
• Word Embedding Techniques for Malware Evolution Detection [4.111899441919165]
  We perform a variety of experiments aimed at detecting points in time where a malware family has likely evolved. Several malware families are analyzed, each of which includes a number of samples collected over an extended period of time. Our experiments indicate that improved results are obtained using feature engineering based on word embedding techniques.
  arXiv  Detail & Related papers  (2021-03-07T14:55:32Z)
• Select-ProtoNet: Learning to Select for Few-Shot Disease Subtype Prediction [55.94378672172967]
  We focus on few-shot disease subtype prediction problem, identifying subgroups of similar patients. We introduce meta learning techniques to develop a new model, which can extract the common experience or knowledge from interrelated clinical tasks. Our new model is built upon a carefully designed meta-learner, called Prototypical Network, that is a simple yet effective meta learning machine for few-shot image classification.
  arXiv  Detail & Related papers  (2020-09-02T02:50:30Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.