---
title: Malware Source Code Datasets
url: https://www.emergentmind.com/topics/malware-source-code-datasets
type: topic
---

# Malware Source Code Datasets

Malware source code datasets are curated collections of the underlying program code used in malicious software. These datasets serve as foundational resources for security research, enabling empirical studies of malware engineering, lineage, code reuse, summarization, and the training and evaluation of analysis tools, including large language models for code intelligence. Unlike collections of binaries, source code datasets expose explicit logic, structure, and evolutionary relationships, thereby supporting sophisticated static and semantic analyses of adversarial programming.

## 1. Major Datasets: Composition and Properties

A number of large-scale, systematically curated malware source code datasets have emerged, with each providing unique coverage across operating systems, languages, taxonomy, and granularity.

- **MASCOT**: Contains 6,032 Windows-based malware specimens from November 2000 to February 2025, encompassing 32 programming languages (Python, C++, C, C#, Assembly, Go, HTML, PowerShell, Rust, and others). Malware is labeled by class (12 AVClass2/ClarAVy-based categories), family, behavior, vulnerabilities (CWEs), packer, and FUD status. Each sample’s scale and code quality are recorded using metrics such as SLOC, function points, cyclomatic complexity, and execution paths. Genealogical structure is established via function-level code clone analysis, quantifying directed code reuse among families and specimens [2512.00741].

- **MalSource**: Spanning from 1975 to 2016 with 456 samples from 428 families, MalSource focuses on “classic” malware (viruses, worms, RATs, exploit kits) obtained from leaks, underground forums, and public archives. Assembly and C/C++ dominate (92% of samples), with additional coverage for Visual Basic, Delphi/Pascal, Python, and interpreted languages. Metadata includes detailed build instructions, type/family labels, and language breakdowns [1811.06888].

- **SourceFinder**: Identifies 7,504 malware source code repositories from the October 2019 GitHub corpus (32M repositories), using a supervised bag-of-words model for repository metadata classification (89% precision, 86% recall). Encompasses C/C++, Python, Java, JavaScript, PHP, Go, and other languages, with broad platform coverage (Windows, Linux, MacOS, IoT, Android). Annotation includes type (keylogger, ransomware, etc.) and target platform; repository-level social metrics are provided [2005.14311].

- **CAMA (Android)**: Curates 118 Android APKs (13 families), decompiled to yield 7.54 million distinct Java methods. Samples are deduplicated at category and family levels to ensure representative coverage. Each method’s source body, line count, and metadata are included for function-level analysis or summarization [2504.00694].

- **MalS/MalP (Summarization Benchmarks)**: MalS comprises 89,609 C functions with LLM-generated, expert-refined natural language summaries, derived from 2,289 GitHub malware repos found primarily via SourceFinder. MalP is a benchmark of 500 hand-annotated IDA-style pseudocode functions from 20 real malware families, with associated call graphs and expert-generated summaries. Both are designed for evaluation and training of malware summarization systems [2406.18379].

| Dataset         | Specimens / Units       | Span         | Platforms/Types                | Languages                  |
|-----------------|------------------------|--------------|-------------------------------|----------------------------|
| MASCOT          | 6,032 specimens        | 2000–2025    | Win (12 AVClass2/ClarAVy)      | 32 (Py, C++, C, C#, ASM, …)|
| MalSource       | 456 samples (428 fam.) | 1975–2016    | Viruses, worms, RATs, etc.     | 14+ (ASM, C/C++, VB, ...)  |
| SourceFinder    | 7,504 repos            | 2008–2019    | Windows, Linux, Mac, IoT, etc. | C/C++, Py, Java, JS, …     |
| CAMA            | 118 APKs, 7.5M methods | –            | Android (13 families)          | Java (decompiled)          |
| MalS/MalP       | 89,609 fns / 500 fns   | –            | C-source, IDA pseudocode       | C                         |

## 2. Curation and Validation Methodologies

Dataset integrity, ground truth, and representativeness are enforced through multi-stage pipelines:

- **Repository and Keyword Mining**: GitHub and public archives are queried via extensive, multi-lingual keyword lists (family names, malware classes, behaviors), with ranking and coverage maximized through query permutations and source cross-linking [2512.00741, 2005.14311].
- **Automated and Manual Filtering**: Specimens are regularly verified for authentic source code presence (README, directory analysis), with trivial forks and stubs dropped. Manual review eliminates duplicates, non-code artifacts, and demo/sampleware with no observed malicious functionality [2512.00741, 1811.06888].
- **Labeling and Metadata Augmentation**: Labels such as malware class, behavioral description, family, vulnerability (CWE), packer, and detection-resistant (FUD) status are propagated from VirusTotal/AVClass2, GitHub, or annotator analysis. Not every sample obtains full label coverage (e.g., only 9.6% of MASCOT samples acquire the family label) [2512.00741].
- **Open-Source Codeview**: No binaries are distributed; all datasets release only disarmed source (post-stripping of payloads and sensitive data), often requiring users to agree to research-only licensing with restrictions on redistribution, re-compilation, and live deployment [1811.06888, 2512.00741, 2005.14311].
- **Deduplication and Category Balancing**: For Android (CAMA), near-duplicate APKs are eliminated based on size and method count similarity within families to achieve balanced, representative coverage [2504.00694].

## 3. Software Engineering, Analytical, and Security Metrics

Advanced metrics cover size, cost, quality, and reuse, with all formulas fully specified:

- **Size:**
  - Source lines of code (SLOC): Computed excluding comments/blanks.
  - Files: Number of source files per sample.
  - Function points (FP): User-centric measure based on empirical SLOC-per-FP tables, e.g., $FP = \mathrm{SLOC}/\mathrm{PLT}_{l}$ [1811.06888].

- **Development Cost (COCOMO):**
  - Basic: $\mathit{Effort} = a \left(\frac{\mathrm{SLOC}}{1000}\right)^b$
  - Time: $\mathit{Time} = 2.5 \, (\mathit{Effort})^{0.38}$
  - Team size: $\approx \mathit{Effort}/\mathit{Time}$ [2512.00741, 1811.06888].

- **Quality:**
  - Comment-to-Code Ratio: $\mathrm{CR} = \frac{\#\text{comment lines}}{\#\text{code lines}}\times 100\%$
  - Cyclomatic Complexity: $CC = E_{\text{CFG}} - N_{\text{CFG}} + 2\,P_{\text{CFG}}$
  - Maintainability Index (MalSource): 
    $$
    MI = 100 \times \frac{171 - 5.2\ln(\overline{V}) - 0.23\,\overline{CC} - 16.2\ln(\overline{\mathrm{LOC}})}{171}
    $$
  - Execution paths, call graph analytics, and system call/API enumeration [2512.00741, 1811.06888].

- **Vulnerability/Dependency:**
  - CWE detection (e.g., CWE-398, CWE-561, CWE-476) via Cppcheck.
  - System and API call extraction using extensive Windows signatures and syscall lists, with epoch stratification for historical analysis [2512.00741].

## 4. Code Reuse, Genealogy, and Evolutionary Analysis

Rigorous clone detection and genealogy mapping underpin malware lineage studies:

- **Clone Detection**:
  - Function-level: Deckard (AST-based clustering), LSH for high-volume clustering, and minimum clone size thresholds (100 AST tokens in MalSource) [1811.06888, 2512.00741].
  - Textual similarity: Ratcliff–Obershelp for language-agnostic matching, with SLOC-based cutoffs for clone reporting.
  - Post-filtering for boilerplate, include guards, and macro-generated code [1811.06888].

- **Genealogy Construction** (MASCOT):
  - Per-sample code reuse weights $W_{i\to j}$ aggregate clone counts, strictly directed by commit timestamp ($t_i < t_j \Rightarrow i$ is ancestor).
  - Visualization as weighted, directed graphs at category and specimen level. Edges annotated with function tag-sets provide interpretable semantic inheritance [2512.00741].
  - Ancestor-descendant chains recover multi-decade lineages; e.g., X0R-USB’s routines reused through 2021, with FUD children inheriting unrefactored parent code.

- **Empirical Findings**:
  - Reuse drives persistent code vulnerabilities: e.g., Mydoom-derived specimens share CWE-467 (65% vs. 7.1% overall), supporting the view of exploit inheritance [2512.00741].
  - Core logic and anti-analysis components are most cloned across families (MalSource), aligning with expectations for modular malware architecture [1811.06888].

## 5. Specialized Datasets for Summarization and LLM Benchmarking

Emerging focus on automated understanding and summarization of malware code has motivated new annotation paradigms:

- **MalS/MalP**:
  - MalS provides large-scale, function-level C source paired with LLM-generated, human-refined English summaries focused on malicious semantics (89,609 instances).
  - MalP delivers manually crafted summaries for decompiled IDA pseudocode, with call-graph context and summary style guidelines ensuring accurate behavioral coverage [2406.18379].

- **CAMA**:
  - Extends the function granularity paradigm to Android: functions extracted from 118 decompiled APKs across 13 families (7.54M unique methods), with metadata scaffolding for future downstream tasks (summaries, name recovery, maliciousness scores) [2504.00694].

- **Annotation and Evaluation**:
  - Automated summarization benchmarks: BLEURT-sum, fine-tuned for code-summary alignment, achieves $F_1 \to 0.9999$ on validation. Models trained on MalS and benign pseudocode demonstrate close human–metric correlation for usability and completeness (e.g., BLEURT-sum = 47.22 for real-world test, $r \approx 0.81$ with usability) [2406.18379].

## 6. Access, Ethics, and Limitations

Availability and usage constraints reflect ethical imperatives and practical constraints:

- **Public Access**: Most datasets are mirrored on platforms such as GitHub, Zenodo, or IEEE DataPort; usage is restricted to non-commercial, research, and educational applications, often enforced via license agreements [1811.06888, 2512.00741, 2504.00694].
- **Disarmament**: Published sets contain only source code, excluding all operational payloads, build artifacts, or binaries, to prevent weaponization and legal non-compliance [2512.00741, 1811.06888].
- **Curation Bias and Coverage**: Coverage is non-uniform—differences in leak availability, platform focus (Windows bias in MASCOT, Android in CAMA, mixed in SourceFinder), and the absence of commercial and nation-state malware result in inherent sample bias. Most datasets comprise single-version specimens; intra-family evolution is incompletely captured outside genealogical mappings [1811.06888].
- **Clone Detection Limits**: High false positive rates in AST-based (Deckard) methods; string-diff techniques miss refactored or obfuscated clones; cross-validating genealogy at the binary level is recommended for high confidence [2512.00741, 1811.06888].
- **Adherence to Ethics**: Users must comply with local export-control, informatics ethics, and responsible research guidelines when handling malware-associated artifacts or performing live analyses [2512.00741].

## 7. Research Impact and Applications

Malware source code datasets catalyze multifaceted research at the intersection of cybersecurity, software engineering, and AI:

- **Longitudinal Engineering Studies**: Systematic tracking of SLOC, file count, function points, and maintainability reveals exponential growth in malware complexity and convergence with mainstream engineering practices—yet with persistent deficits in documentation and modularity [1811.06888, 2512.00741].
- **Evolution and Attribution**: Fine-grained mapping of code reuse drives advanced evolutionary studies and assists in malware provenance, variant clustering, and attribution [2512.00741].
- **Detection and Summarization**: Data support the design and benchmarking of supervised detectors, code-LM summarizers, and function name predictors under realistic, noisy code conditions [2406.18379, 2504.00694].
- **Education, Benchmarking, and Tooling**: Datasets underpin reproducible experiments, curriculum development, and the objective evaluation of reverse engineering, code deobfuscation, and static/dynamic analysis pipelines [2005.14311].

A plausible implication is that ongoing expansion and refinement of these datasets—including contribution of multiple versions per family, integration of richer metadata, and adoption of standardized annotation and evaluation frameworks—will remain essential for the evolution of malware analysis research.

Source: https://www.emergentmind.com/topics/malware-source-code-datasets