{"id":"https://openalex.org/W4416286423","doi":"https://doi.org/10.1109/tse.2025.3633280","title":"Synthetic Malware at Scale: Malicious Code Generation With Code Transplanting","display_name":"Synthetic Malware at Scale: Malicious Code Generation With Code Transplanting","publication_year":2025,"publication_date":"2025-11-17","ids":{"openalex":"https://openalex.org/W4416286423","doi":"https://doi.org/10.1109/tse.2025.3633280"},"language":null,"primary_location":{"id":"doi:10.1109/tse.2025.3633280","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tse.2025.3633280","pdf_url":null,"source":{"id":"https://openalex.org/S8351582","display_name":"IEEE Transactions on Software Engineering","issn_l":"0098-5589","issn":["0098-5589","1939-3520","2326-3881"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Software Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5108153490","display_name":"Guangzhan Wang","orcid":null},"institutions":[{"id":"https://openalex.org/I183067930","display_name":"Shanghai Jiao Tong University","ror":"https://ror.org/0220qvk04","country_code":"CN","type":"education","lineage":["https://openalex.org/I183067930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Guangzhan Wang","raw_affiliation_strings":["School of Computer Science, Shanghai Jiao Tong University, Shanghai, China"],"raw_orcid":"https://orcid.org/0009-0001-1488-3153","affiliations":[{"raw_affiliation_string":"School of Computer Science, Shanghai Jiao Tong University, Shanghai, China","institution_ids":["https://openalex.org/I183067930"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5049787473","display_name":"Diwei Chen","orcid":"https://orcid.org/0000-0001-6080-9969"},"institutions":[{"id":"https://openalex.org/I183067930","display_name":"Shanghai Jiao Tong University","ror":"https://ror.org/0220qvk04","country_code":"CN","type":"education","lineage":["https://openalex.org/I183067930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Diwei Chen","raw_affiliation_strings":["School of Computer Science, Shanghai Jiao Tong University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0001-6080-9969","affiliations":[{"raw_affiliation_string":"School of Computer Science, Shanghai Jiao Tong University, Shanghai, China","institution_ids":["https://openalex.org/I183067930"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5033286111","display_name":"Xiaodong Gu","orcid":"https://orcid.org/0000-0002-0529-6408"},"institutions":[{"id":"https://openalex.org/I183067930","display_name":"Shanghai Jiao Tong University","ror":"https://ror.org/0220qvk04","country_code":"CN","type":"education","lineage":["https://openalex.org/I183067930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaodong Gu","raw_affiliation_strings":["School of Computer Science, Shanghai Jiao Tong University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0002-0529-6408","affiliations":[{"raw_affiliation_string":"School of Computer Science, Shanghai Jiao Tong University, Shanghai, China","institution_ids":["https://openalex.org/I183067930"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Yuting Chen","orcid":"https://orcid.org/0000-0002-4128-8966"},"institutions":[{"id":"https://openalex.org/I183067930","display_name":"Shanghai Jiao Tong University","ror":"https://ror.org/0220qvk04","country_code":"CN","type":"education","lineage":["https://openalex.org/I183067930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuting Chen","raw_affiliation_strings":["School of Computer Science, Shanghai Jiao Tong University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0002-4128-8966","affiliations":[{"raw_affiliation_string":"School of Computer Science, Shanghai Jiao Tong University, Shanghai, China","institution_ids":["https://openalex.org/I183067930"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5045672909","display_name":"Beijun Shen","orcid":"https://orcid.org/0000-0001-8370-3956"},"institutions":[{"id":"https://openalex.org/I183067930","display_name":"Shanghai Jiao Tong University","ror":"https://ror.org/0220qvk04","country_code":"CN","type":"education","lineage":["https://openalex.org/I183067930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Beijun Shen","raw_affiliation_strings":["School of Computer Science, Shanghai Jiao Tong University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0001-8370-3956","affiliations":[{"raw_affiliation_string":"School of Computer Science, Shanghai Jiao Tong University, Shanghai, China","institution_ids":["https://openalex.org/I183067930"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I183067930"],"apc_list":null,"apc_paid":null,"fwci":0.6454,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.73163121,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"52","issue":"1","first_page":"171","last_page":"186"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9703999757766724,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9703999757766724,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.009399999864399433,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.003700000001117587,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.9054999947547913},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.6915000081062317},{"id":"https://openalex.org/keywords/cryptovirology","display_name":"Cryptovirology","score":0.6474999785423279},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.508899986743927},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.448199987411499},{"id":"https://openalex.org/keywords/malware-analysis","display_name":"Malware analysis","score":0.42179998755455017},{"id":"https://openalex.org/keywords/source-code","display_name":"Source code","score":0.39570000767707825},{"id":"https://openalex.org/keywords/code-generation","display_name":"Code generation","score":0.36899998784065247}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.9054999947547913},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8598999977111816},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.6915000081062317},{"id":"https://openalex.org/C84525096","wikidata":"https://www.wikidata.org/wiki/Q3506050","display_name":"Cryptovirology","level":3,"score":0.6474999785423279},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.508899986743927},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.448199987411499},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.42179998755455017},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.39570000767707825},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.385699987411499},{"id":"https://openalex.org/C133162039","wikidata":"https://www.wikidata.org/wiki/Q1061077","display_name":"Code generation","level":3,"score":0.36899998784065247},{"id":"https://openalex.org/C47434764","wikidata":"https://www.wikidata.org/wiki/Q1770035","display_name":"Dead code","level":5,"score":0.33869999647140503},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.33180001378059387},{"id":"https://openalex.org/C2780992000","wikidata":"https://www.wikidata.org/wiki/Q17016113","display_name":"Generator (circuit theory)","level":3,"score":0.3140000104904175},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.31049999594688416},{"id":"https://openalex.org/C125411270","wikidata":"https://www.wikidata.org/wiki/Q18653","display_name":"Encoding (memory)","level":2,"score":0.31029999256134033},{"id":"https://openalex.org/C10144332","wikidata":"https://www.wikidata.org/wiki/Q14645","display_name":"Rootkit","level":3,"score":0.2957000136375427},{"id":"https://openalex.org/C152124472","wikidata":"https://www.wikidata.org/wiki/Q1204361","display_name":"Redundancy (engineering)","level":2,"score":0.29249998927116394},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.28790000081062317},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.27559998631477356},{"id":"https://openalex.org/C544833334","wikidata":"https://www.wikidata.org/wiki/Q2005","display_name":"JavaScript","level":2,"score":0.27320000529289246},{"id":"https://openalex.org/C50951305","wikidata":"https://www.wikidata.org/wiki/Q2482534","display_name":"Unreachable code","level":5,"score":0.26919999718666077},{"id":"https://openalex.org/C151578736","wikidata":"https://www.wikidata.org/wiki/Q1251793","display_name":"Redundant code","level":4,"score":0.26820001006126404},{"id":"https://openalex.org/C39569185","wikidata":"https://www.wikidata.org/wiki/Q371199","display_name":"Cross-site scripting","level":5,"score":0.26669999957084656},{"id":"https://openalex.org/C206345919","wikidata":"https://www.wikidata.org/wiki/Q20380951","display_name":"Resource (disambiguation)","level":2,"score":0.26440000534057617}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tse.2025.3633280","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tse.2025.3633280","pdf_url":null,"source":{"id":"https://openalex.org/S8351582","display_name":"IEEE Transactions on Software Engineering","issn_l":"0098-5589","issn":["0098-5589","1939-3520","2326-3881"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Software Engineering","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":38,"referenced_works":["https://openalex.org/W1996374694","https://openalex.org/W2058373514","https://openalex.org/W2344444819","https://openalex.org/W2574797807","https://openalex.org/W2619704817","https://openalex.org/W2800651024","https://openalex.org/W2962739339","https://openalex.org/W2963206148","https://openalex.org/W2963206679","https://openalex.org/W2964303116","https://openalex.org/W2970323597","https://openalex.org/W3004658838","https://openalex.org/W3015481738","https://openalex.org/W3046453918","https://openalex.org/W3098605233","https://openalex.org/W3131641316","https://openalex.org/W3133702157","https://openalex.org/W3138230581","https://openalex.org/W3198685994","https://openalex.org/W4226416841","https://openalex.org/W4281385582","https://openalex.org/W4281763794","https://openalex.org/W4301163492","https://openalex.org/W4312436517","https://openalex.org/W4313563660","https://openalex.org/W4320560161","https://openalex.org/W4361004367","https://openalex.org/W4384154408","https://openalex.org/W4384345705","https://openalex.org/W4387723777","https://openalex.org/W4389161980","https://openalex.org/W4389519352","https://openalex.org/W4391503438","https://openalex.org/W4391815887","https://openalex.org/W4394769426","https://openalex.org/W4402827393","https://openalex.org/W4402957915","https://openalex.org/W4403182498"],"related_works":[],"abstract_inverted_index":{"Malicious":[0],"code":[1,44,81,129,142,159,179,195,216,229,258,291],"detection":[2,292],"is":[3,35],"one":[4],"of":[5,42,89,96,103,111,158,227,256],"the":[6,32,39,85,162,168,172,183,189,250,277,295,305],"most":[7],"essential":[8],"tasks":[9],"in":[10,54,230,267,289],"safeguarding":[11],"against":[12],"security":[13],"breaches,":[14],"data":[15],"compromise,":[16],"and":[17,56,87,131,135,140,175,232,245,270],"related":[18],"threats.":[19],"While":[20],"machine":[21,47],"learning":[22,48],"has":[23],"emerged":[24],"as":[25,126,280],"a":[26,75,94,100,108,155,224,286,298],"predominant":[27],"method":[28,77],"for":[29,78],"pattern":[30],"detection,":[31],"training":[33,272,282],"process":[34,187],"intricate":[36],"due":[37],"to":[38,62,115,181,191,223,302],"severe":[40],"scarcity":[41],"malicious":[43,52,80,90,97,112,194,206,218,236,241,257,290],"samples.":[45,82,308],"Consequently,":[46],"detectors":[49],"often":[50],"encounter":[51],"patterns":[53],"limited":[55],"isolated":[57],"scenarios,":[58],"hindering":[59],"their":[60],"ability":[61],"generalize":[63],"effectively":[64],"across":[65],"diverse":[66,109],"threat":[67],"landscapes.":[68],"In":[69],"this":[70],"paper,":[71],"we":[72,152,284],"introduce":[73],"MalCoder,":[74],"novel":[76],"synthesizing":[79],"MalCoder":[83,123,166,202,222],"enlarges":[84],"quantity":[86],"diversity":[88],"instances":[91,113],"by":[92,275],"transplanting":[93],"set":[95],"prototypes":[98,170],"into":[99,197,208,217],"vast":[101],"pool":[102,226],"benign":[104,198,209,215,228,263],"code,":[105,264],"thereby":[106],"crafting":[107],"array":[110],"tailored":[114],"various":[116,149],"application":[117],"scenarios.":[118],"For":[119],"each":[120],"malware":[121,163],"prototype,":[122],"treats":[124],"it":[125],"an":[127,177],"incomplete":[128],"fragment":[130],"crafts":[132],"its":[133],"preceding":[134],"subsequent":[136],"contexts":[137],"through":[138],"right-to-left":[139],"left-to-right":[141],"completion":[143],"respectively.":[144],"By":[145],"leveraging":[146],"GPTs":[147],"with":[148,262],"sampling":[150],"strategies,":[151],"can":[153,203],"instantiate":[154],"large":[156,225],"number":[157],"samples":[160,174,210,237,252,279],"bearing":[161],"prototype.":[164,185],"Subsequently,":[165],"masks":[167],"original":[169,184,306],"within":[171],"transplanted":[173],"fine-tunes":[176],"LLM":[178],"generator":[180],"reconstruct":[182],"This":[186],"enables":[188],"model":[190],"seamlessly":[192,261],"transplant":[193],"fragments":[196,207],"code.":[199,219],"During":[200],"inference,":[201],"automatically":[204],"insert":[205],"at":[211],"random":[212],"positions,":[213],"transforming":[214],"We":[220],"apply":[221],"CodeSearchNet":[231],"craft":[233],"over":[234],"50,000":[235],"stemming":[238],"from":[239],"39":[240],"prototypes.":[242],"Both":[243],"qualitative":[244],"quantitative":[246],"analyses":[247],"show":[248],"that":[249],"generated":[251,278],"maintain":[253],"key":[254],"characteristics":[255],"while":[259],"blending":[260],"which":[265],"helps":[266],"creating":[268],"realistic":[269],"varied":[271],"data.":[273],"Additionally,":[274],"using":[276],"augmented":[281],"data,":[283],"witness":[285],"remarkable":[287],"surge":[288],"capabilities.":[293],"Specifically,":[294],"F1-score":[296],"experiences":[297],"significant":[299],"increase":[300],"compared":[301],"utilizing":[303],"only":[304],"prototype":[307]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-07-21T08:15:58.654021","created_date":"2025-11-17T00:00:00"}