the exponential growth of open-source package ecosystems, particularly NPM and PyPI, has led to an alarming increase in software supply chain poisoning attacks. Existing static analysis methods struggle with high fals...
详细信息
ISBN:
(数字)9798400712487
ISBN:
(纸本)9798400712487
the exponential growth of open-source package ecosystems, particularly NPM and PyPI, has led to an alarming increase in software supply chain poisoning attacks. Existing static analysis methods struggle with high false positive rates and are easily thwarted by obfuscation and dynamic code execution techniques. While dynamic analysis approaches offer improvements, they often suffer from capturing non-package behaviors and employing simplistic testing strategies that fail to trigger sophisticated malicious behaviors. To address these challenges, we present OSCAR, a robust dynamic code poisoning detection pipeline for NPM and PyPI ecosystems. OSCAR fully executes packages in a sandbox environment, employs fuzz testing on exported functions and classes, and implements aspect-based behavior monitoring with tailored API hook points. We evaluate OSCAR against six existing tools using a comprehensive benchmark dataset of real-world malicious and benign packages. OSCAR achieves an F1 score of 0.95 in NPM and 0.91 in PyPI, confirming that OSCAR is as effective as the current state-of-the-art technologies. Furthermore, for benign packages exhibiting characteristics typical of malicious packages, OSCAR reduces the false positive rate by an average of 32.06% in NPM (from 34.63% to 2.57%) and 39.87% in PyPI (from 41.10% to 1.23%), compared to other tools, significantly reducing the workload of manual reviews in real-world deployments. In cooperation with Ant Group, a leading financial technology company, we have deployed OSCAR on its NPM and PyPI mirrors since January 2023, identifying 10,404 malicious NPM packages and 1,235 malicious PyPI packages over 18 months. this work not only bridges the gap between academic research and industrial application in code poisoning detection but also provides a robust and practical solution that has been thoroughly tested in a real-world industrial setting.
Service caching is an emerging solution to addressing massive service request in a distributed environment for supporting rapidly growing services and applications. Withthe explosive increases in global mobile data t...
详细信息
Autonomous driving relies on multiple sensors, such as lidar and cameras, to perceive the surrounding environment and the vehicle’s own position. Among them, lidar point cloud segmentation is a crucial and challengin...
详细信息
According to Eurocontrol’s latest research, by year 2035 airports across Europe are expected to handle 14.4 million flights and 1.4 billion passengers. However, current Air Traffic Management (ATM) system is not adeq...
详细信息
the upward progress in Data-Information-knowledge-Wisdom (DIKW) has advanced manufacturing from digitalization to networking in Industry 3.0, and to intelligence and even wisdom in Industry 4.0, which reveals the inev...
详细信息
Bioinspired algorithms have gained relevance in Search-Based software Testing (SBST) mainly because they can find multiple solutions to difficult-to-solve problems. Exploring the usage trends and elements of its imple...
详细信息
Large language models such as OpenAI’s GPT and Google’s Bard offer new opportunities for supporting softwareengineering processes. Large language model assisted softwareengineering promises to support developers i...
详细信息
In this paper, the method for knowledge graph completion based on using multi-hop reasoning is proposed. the relevance of the problem is due to the widespread use of large sparse knowledge graphs with incomplete data....
详细信息
Teaching HCI engineering focuses on preparing students for the design, development, and implementation of usable and effective interactive computing systems. Amongst the engineering approaches that can be taught for t...
详细信息
ISBN:
(纸本)9783031616877;9783031616884
Teaching HCI engineering focuses on preparing students for the design, development, and implementation of usable and effective interactive computing systems. Amongst the engineering approaches that can be taught for that purpose, model-based techniques are interesting because they match the industry's needs for techniques to develop usable and reliable interactive computing systems. Beyond this concrete motivation for teaching students how to build and use models, models are also interesting because they help students to reason and understand problems, and can even make them better at identifying and solving problems. However, students do not always understand the benefits of using modelling techniques. they may find them abstract, cumbersome, and worthless. the purpose of this paper is to discuss the importance of teaching modelling for HCI engineering, especially in a context where new technologies and new methodology trends are continuously emerging. this paper proposes several strategies to increase the involvement of students with modelling techniques.
software projects spend a significant effort on fixing defects. In fact, some ‘successful’ companies are unable to develop new features, since they devote all resources on supporting the multitude of customers and a...
详细信息
暂无评论