构建首个Android恶意代码源码数据集，自动挖掘GitHub恶意代码
MASCOT-Android: A Curated Dataset and Automated Collection Pipeline for Android Malware Source Code Specimens
- 仅用README文档的字符级特征，自动识别恶意代码仓库
- 分类准确率96.28%，误报率仅1.06%，可调阈值平衡覆盖率
- 适合安全研究者快速获取高质量恶意源码样本
与二进制和反编译代码相比，恶意软件源代码更能直接反映攻击者原始意图。然而，源代码稀缺且人工审查成本高，导致此类数据集难以构建与维护。我们提出MASCOT-Android，一个面向Android恶意软件源代码的精选数据集及自动化收集框架，支持在GitHub上规模化发现恶意源码。研究关键发现：仓库级别的文档本身即为强信号。模型从8,772个恶意与25,747个良性README文档中提取字符级TF-IDF特征，训练线性SVC分类器进行区分。该仅基于README的模型在本地评估中达到96.28%准确率与1.06%假阳性率。模型输出置信度分数，用户可调节决策阈值以平衡假阳性率与覆盖范围，适用于真实世界恶意源码采集场景。
原文摘要 · Abstract (English)
Compared with binaries and decompiled code, malware source code more directly reflects the attackers' original intent. However, the scarcity of source code and the high cost of manual review make such datasets difficult to build and maintain. We propose MASCOT-Android, a curated dataset of Android malware source code and an automated collection framework for scalable malware source code discovery on GitHub. A key finding of our work is that repository-level documentation alone provides a strong signal for malware source code collection. Our model extracts character-level TF-IDF features from 8,772 malware and 25,747 benign README documents and trains a LinearSVC classifier to distinguish malware repositories. This README-only model achieves an accuracy of 96.28\% and an FPR of 1.06\% in local evaluation. In addition, the model outputs confidence scores, allowing users to adjust the decision threshold to balance FPR and coverage, which is practical in real-world malware source code collection.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。