一句话：提出 SpiderScan，用图行为建模与匹配检测恶意 NPM 包，减少对敏感 API 和人工确认的依赖。
开源软件供应链日益成为攻击目标，NPM 作为最大包注册表近期充斥恶意包。已有检测工具没有整体建模恶意行为，只考虑预定义敏感 API，且因高误报与二值检测结果需要大量人工确认，实用性受限。SpiderScan 针对这些问题，提出基于图的行为建模与匹配方法，用于实用地检测恶意 NPM 包，力图更全面地刻画包行为并降低确认成本。摘要仅给出问题与工具思路，未报告具体方法细节、数据集和实验结果。
Open source software (OSS) supply chains have been attractive targets for attacks. One of the significant, popular attacks is realized by malicious packages on package registries. NPM, as the largest package registry, has been recently flooded with malicious packages. In response to this severe security risk, many detection tools have been proposed. However, these tools do not model malicious behavior in a holistic way; only consider a predefined set of sensitive APIs; and require huge manual confirmation effort due to high false positives and binary detection results. Thus, their practical usefulness is hindered.
DOI 原文 ·
@inproceedings{paperbot8331,
title = {SpiderScan: Practical Detection of Malicious NPM Packages Based on Graph-Based Behavior Modeling and Matching},
author = {Yiheng Huang and Ruisi Wang and Wen Zheng and Zhuotong Zhou and Susheng Wu and Shulin Ke and Bihuan Chen and Shan Gao and Xin Peng},
booktitle = {ASE},
year = {2024},
doi = {10.1145/3691620.3695492}
}