一句话：提出基于差分数据流分析与信任域的 RogueOne，检测 JavaScript 包更新中的恶意代码。
针对软件供应链中攻击者将恶意代码隐藏在良性更新里的 Rogue Update，本文提出 RogueOne 检测 JavaScript 包更新。它使用差分数据流分析刻画更新如何改变包与外部 API 的交互；通过排除未变代码的高效抽象解释构建对象数据流关系图（ODRG），跟踪对象间数据流，并将对象按来源映射到目标包、依赖或系统 API 的信任域。基于 ODRG 生成跨信任域数据流集合，比较版本间差异以发现不可信的新外部 API 交互。在数百个 npm 包上评估，RogueOne 能有效检测并区分恶意更新，准确率高，检测恶意更新和避免误报的效果可比现有系统高七倍以上。
Rogue updates, an important type of software supply-chain attack in which attackers conceal malicious code inside updates to benign software, are a growing problem due to their stealth and effectiveness. We design and implement RogueOne, a system for detecting rogue updates to JavaScript packages. RogueOne uses a novel differential data-flow analysis to capture how an update changes a package's interactions with external APIs. Using an efficient form of abstract interpretation that can exclude unchanged code in a package, it constructs an object data-flow relationship graph (ODRG) that tracks data-flows among objects. RogueOne then maps objects to trust domains, a novel abstraction which summarizes trust relationships in a package. Objects are assigned a trust domain based on whether they originate in the target package, a dependency, or in a system API. RogueOne uses the ODRG to build a set of data-flows across trust domains. It compares data-flow sets across package versions to detect untrustworthy new interactions with external APIs. We evaluated RogueOne on hundreds of npm packages, demonstrating its effectiveness at detecting rogue updates and distinguishing them from benign ones. RogueOne achieves high accuracy and can be more than seven times as effective in detecting rogue updates and avoiding false positives compared to other systems built to detect malicious packages.
@inproceedings{paperbot11333,
title = {RogueOne: Detecting Rogue Updates via Differential Data-flow Analysis Using Trust Domains},
author = {Raphael J. Sofaer and Yaniv David and Mingqing Kang and Jianjia Yu and Yinzhi Cao and Junfeng Yang and Jason Nieh},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3639199}
}