# The MalSource Dataset: Quantifying Complexity and Code Reuse in Malware Development

arXiv: https://arxiv.org/abs/1811.06888 · HTML: https://mlsanity.com/paper/1811.06888/

## Key facts

- Cited by 7 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 16 Nov 2018.

## Built on by (most cited first, 7 of 7)

- [Jigsaw Puzzle: Selective Backdoor Attack to Subvert Malware Classifiers](https://mlsanity.com/paper/2202.05470/) (2022)
- [Evaluating the Efficacy of Large Language Models in Identifying Phishing Attempts](https://mlsanity.com/paper/2404.15485/) (2024)
- [PBP: Post-training Backdoor Purification for Malware Classifiers](https://mlsanity.com/paper/2412.03441/) (2024)
- [MASCOT: Analyzing Malware Evolution Through A Well-Curated Source Code Dataset](https://mlsanity.com/paper/2512.00741/) (2025)
- [Counteracting Concept Drift by Learning with Future Malware Predictions](https://mlsanity.com/paper/2404.09352/) (2024)
- [Uplifted Attackers, Human Defenders: The Cyber Offense-Defense Balance for Trailing-Edge Organizations](https://mlsanity.com/paper/2508.15808/) (2025)
- [MASCOT-Android: A Curated Dataset and Automated Collection Pipeline for Android Malware Source Code Specimens](https://mlsanity.com/paper/2606.16072/) (2026)

## Abstract (arXiv)

During the last decades, the problem of malicious and unwanted software (malware) has surged in numbers and sophistication. Malware plays a key role in most of today's cyber attacks and has consolidated as a commodity in the underground economy. In this work, we analyze the evolution of malware from 1975 to date from a software engineering perspective. We analyze the source code of 456 samples from 428 unique families and obtain measures of their size, code quality, and estimates of the development costs (effort, time, and number of people). Our results suggest an exponential increment of nearly one order of magnitude per decade in aspects such as size and estimated effort, with code quality metrics similar to those of benign software.We also study the extent to which code reuse is present in our dataset. We detect a significant number of code clones across malware families and report which features and functionalities are more commonly shared. Overall, our results support claims about the increasing complexity of malware and its production progressively becoming an industry.