MASCOT: Analyzing Malware Evolution Through A Well-Curated Source Code Dataset
Rapid malware evolution and pervasive code reuse complicate lineage inference, hindering threat attribution and defense. Method: We construct a curated dataset of 6,032 manually verified malware source-code samples and, for the first time, systematically quantify engineering attributes—including scale, development cost, code quality, security practices, and dependency structure—from a software engineering perspective. We propose a multi-view lineage analysis framework that jointly leverages code similarity, dependency graphs, and multidimensional engineering metrics to quantify association strength, reconstruct individual evolutionary trajectories, and generate interpretable lineage visualizations. Results: Empirical analysis reveals a persistent increase in malware complexity and standardization, yet significant code-quality deficiencies persist. Our approach effectively uncovers familial derivation patterns, cross-family module reuse, and ecosystem-level evolutionary dynamics—establishing a novel, engineering-informed paradigm for malware threat intelligence, attribution, and proactive defense strategy formulation.