  Where can we find malware source code? This question is motivated by a real
need: there is a dearth of malware source code, which impedes various types of
security research. Our work is driven by the following insight: public
archives, like GitHub, have a surprising number of malware repositories.
Capitalizing on this opportunity, we propose, SourceFinder, a
supervised-learning approach to identify repositories of malware source code
efficiently. We evaluate and apply our approach using 97K repositories from
GitHub. First, we show that our approach identifies malware repositories with
89% precision and 86% recall using a labeled dataset. Second, we use
SourceFinder to identify 7504 malware source code repositories, which arguably
constitutes the largest malware source code database. Finally, we study the
fundamental properties and trends of the malware repositories and their
authors. The number of such repositories appears to be growing by an order of
magnitude every 4 years, and 18 malware authors seem to be "professionals" with
well-established online reputation. We argue that our approach and our large
repository of malware source code can be a catalyst for research studies, which
are currently not possible.
