一句话：用 LLM 从威胁情报报告中抽取环境配置参数，自动构建容器化隔离环境以动态验证恶意包行为。
软件仓库中恶意包的泛滥给软件供应链带来了严峻的安全挑战。威胁情报报告虽经常记录新发现的恶意包，但对这些报告的人工验证既耗费人力又容易出错。本文提出一种自动化方法，利用大语言模型（LLM）从威胁情报报告中抽取环境配置参数，并据此自动构建隔离的测试环境，以验证报告所述的恶意行为。该方法包含四个关键组件：威胁情报处理、基于 LLM 的环境参数抽取、基于容器的自动化环境构建，以及动态行为验证。作者通过一个真实 PyPI 恶意包的案例研究展示了方法的有效性：系统成功抽取了相关参数并确认了报告中所描述的恶意行为。
The proliferation of malicious packages in software repositories presents significant security challenges for the software supply chain. While threat intelligence reports frequently document newly discovered malicious packages, validating these reports remains a labor-intensive and error-prone process. This paper introduces an automated approach that leverages large language models (LLMs) to extract environmental configuration parameters from threat intelligence reports and automatically construct isolated testing environments to validate reported malicious behaviors. Our methodology encompasses four key components: threat intelligence processing, environment parameter extraction using LLMs, automated environment construction with containers, and dynamic behavior validation. We demonstrate the effectiveness of our approach through a case study involving a real-world malicious PyPI package, where our system successfully extracted relevant parameters and confirmed the reported malicious behavior.
@inproceedings{paperbot9167,
title = {Automated Environment Extraction for Malicious Package Validation: Leveraging Threat Intelligence},
author = {Wenbo Guo and Limin Wang and Yiran Zhang and Zhengzi Xu and Jiahui Wu},
booktitle = {FSE},
year = {2025},
doi = {10.1145/3696630.3730568}
}