Compared with binaries and decompiled code, malware source code more directly reflects the attackers' original intent. However, the scarcity of source code and the high cost of manual review make such datasets difficult to build and maintain. We propose MASCOT-Android, a curated dataset of Android malware source code and an automated collection framework for scalable malware source code discovery on GitHub. A key finding of our work is that repository-level documentation alone provides a strong signal for malware source code collection. Our model extracts character-level TF-IDF features from 8,772 malware and 25,747 benign README documents and trains a LinearSVC classifier to distinguish malware repositories. This README-only model achieves an accuracy of 96.28\% and an FPR of 1.06\% in local evaluation. In addition, the model outputs confidence scores, allowing users to adjust the decision threshold to balance FPR and coverage, which is practical in real-world malware source code collection.

翻译：相较于二进制文件和反编译代码，恶意软件源代码更能直接反映攻击者的原始意图。然而，由于源代码稀缺且人工审查成本高昂，此类数据集的构建与维护困难重重。我们提出了MASCOT-Android——一个精选的安卓恶意软件源代码数据集，以及一套用于在GitHub上大规模自动化发现恶意软件源代码的收集框架。本研究的核心发现是：仅凭仓库级别的文档即可为恶意软件源代码收集提供强信号。我们的模型从8,772份恶意软件和25,747份良性软件的README文档中提取字符级TF-IDF特征，并训练一个LinearSVC分类器来区分恶意软件仓库。该纯README模型在本地评估中达到了96.28%的准确率和1.06%的假阳性率。此外，模型输出置信度分数，用户可据此调整决策阈值以平衡假阳性率与覆盖率，这对于实际场景中的恶意软件源代码收集具有实用价值。