一句话：提出结合源码切片、过程间与跨文件分析的多语言恶意代码检测框架，在 PyPI/NPM 上高效识别投毒包。
针对软件注册表与依赖管理系统中日益严重的恶意代码投毒威胁，本文提出 MalWuKong，一个融合源码切片、过程间分析和跨文件过程间分析的多分析检测框架，旨在提升恶意代码检测精度并降低误报。该框架面向真实软件包自动检测恶意代码，并支持多语言场景。作者将其部署于 PyPI 和 NPM 等主流第三方注册表，在连续五周的监控中，从 169,640 个包中识别出 130 个恶意包，验证了框架的实用性与效果。该工作推进了恶意代码检测的现有最优方案，对加强开源软件供应链防御具有实际影响。
In the face of increased threats within software registries and management systems, we address the critical need for effective malicious code detection. In this paper, we propose an innovative approach that integrates source code slicing, inter-procedural analysis, and cross-file inter-procedural analysis, thereby enhancing the detection precision and reducing false positives. This approach has been encapsulated within a multi-analysis-based framework for automatic detection of malicious code in real-world software packages. In its application to major third-party software registries like PyPI and NPM, our framework has proven effective, identifying 130 malicious packages from a total of 169,640 monitored over a continuous period of five weeks. This work advances the current state-of-the-art solution to malicious code detection, demonstrating significant practical impact in strengthening the software supply chain defense.
@inproceedings{LiWFWWW23,
title = {MalWuKong: Towards Fast, Accurate, and Multilingual Detection of Malicious Code Poisoning in OSS Supply Chains},
author = {Ningke Li and Shenao Wang and Mingxi Feng and Kailong Wang and Meizhen Wang and Haoyu Wang},
booktitle = {ASE},
year = {2023},
doi = {10.1109/ase56229.2023.00073}
}