Open source component malicious behavior detection method and system

Abstract

The invention discloses an open source component malicious behavior detection method and system, and belongs to the technical field of software security. In order to solve the problem of open source component supply chain poisoning attack detection, a technical scheme of combining code slicing and a pre-training model is mainly adopted. Firstly, open source component data is collected, and sensitive feature grouping is carried out based on label propagation; analyzing a component structure, extracting a core module and generating a code attribute graph; secondly, key node elements are identified through taint analysis, and sensitive code snippets are extracted; and finally, finely adjusting the pre-training model by using the sensitive code snippets, and classifying the code snippets to detect malicious behaviors. According to the method, the potential malicious behaviors in the open source component can be efficiently and accurately detected, and the security of the software supply chain is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of software security, and particularly relates to a method and system for detecting malicious behaviors of open-source components. Background Art

[0002] Open source is an important part of today's software development process, which can improve the productivity and innovation ability of developers. Open source software (OSS) is computer software released in source code form under a license, and the copyright owner grants users the right to use, study, change, and distribute the software for any purpose. Open source software registries are platforms for code sharing, such as npm for JavaScript, PyPI for Python, RubyGems for Ruby, etc. They allow developers to reuse third-party code, share their own code, and simplify the build process. Open source software registries not only improve the efficiency of the development process, but also create a large community for cooperation and sharing of open source code.

[0003] The greatest advantage of software registries, namely the ability to import dependencies, is also an important vehicle for software poisoning. They are misused by attackers to distribute malware, posing significant security risks to developers and end-users. In a real development environment, even a simple package can import a large number of dependencies, and each dependency imports its own dependencies. This will inevitably result in an extremely deep dependency tree level and include hundreds of dependencies, creating fertile ground for attackers because the attack surface of a package includes not only the package itself but also all its dependencies. When maliciousness or vulnerabilities are injected at different stages of the software development chain, software supply chain attacks occur, posing security threats to downstream users and the ecosystem. Software supply chain poisoning refers to attackers taking advantage of the trust relationship between software suppliers and end-users to inject malicious programs into trusted applications or software systems, hijacking or tampering during the system development, dissemination, and upgrade processes to achieve the purpose of illegal attacks. Software supply chain poisoning is a typical form of software supply chain attack and is of relatively high danger. Because the software supply chain is an amplifier for hackers, meaning that when a supplier is affected, attackers can potentially reach any of their customers, which has a wider impact range than when they attack a single target.

[0004] Therefore, it is crucial to design and deploy an efficient and practical poisoning component detection system to ensure the security of the open-source software supply chain as much as possible from the source. The current automated poisoning component detection tools for open-source software registries have the following main problems in actual needs: First, the detection accuracy is insufficient: Investigations have shown that the false positive rate of existing detection tools is relatively high, generally between 15% and 35%, which far exceeds the acceptable range in the actual engineering environment. For example, the volume of package releases at the registry level is huge, and even a 1% false positive rate may trigger an unmanageable number of error alerts. This makes the existing detection tools less usable in engineering practice and difficult to meet the strict requirements of repository administrators for malware detection tools. Second, detection efficiency and cost limitations: With the rapid expansion of the open-source software package ecosystem, existing tools have a long detection time and high costs, making it difficult to meet the needs of large-scale real-time detection. Designing and implementing tools with high accuracy and low detection costs has become the key to helping the platform promptly discover and remove poisoned components, enhance the security of open-source software registries and package managers, defend against supply chain attacks, and protect downstream users. Third, the security review burden is too heavy: A high false positive rate will impose a huge burden on security analysts, prolong the analysis time, and affect the risk disposal efficiency. Existing tools lack effective intermediate information support, such as information about software package context (usage, dependencies, developer information, etc.), static or runtime analysis behaviors (such as network communication, file operations), and threat reports generated based on machine learning. The lack of this information makes it difficult for security analysts to identify potential risks in a timely and accurate manner. Summary of the Invention

[0005] The purpose of the present invention is to solve the above problems by proposing a solution for detecting malicious behaviors of open-source components based on code slicing and pre-trained models. By using code slicing technology to extract potential malicious behavior features in the source code and combining fine-tuning and optimization of pre-trained models, it can efficiently and accurately detect poisoning attacks on the supply chain by malicious components.

[0006] To achieve the above purpose, the technical solution adopted by the present invention is:

[0007] A method for detecting malicious behaviors of open-source components, comprising the following steps:

[0008] 1) Collect open-source component data and sensitive feature data;

[0009] 2) Group sensitive features based on label propagation;

[0010] 3) Conduct a structural analysis of the open-source components, extract the setup.py file and the core module with the same name as the component name, and generate a code property graph;

[0011] 4) Perform taint analysis on the code property graph according to the sensitive feature grouping to identify key node elements;

[0012] 5) Classify the key node elements, then perform code slicing to extract sensitive code snippets;

[0013] 6) Fine-tune the pre-trained model using the sensitive code snippets;

[0014] 7) Use the fine-tuned pre-trained model to classify the code snippets of open-source components and detect malicious behaviors of open-source components.

[0015] Furthermore, the steps of sensitive feature grouping based on label propagation in step 2) include:

[0016] Generate corresponding function descriptions for sensitive features and convert the function descriptions into word embedding vectors;

[0017] Use the label propagation algorithm based on variant Gaussian kernel distance to classify the word embedding vectors for sensitive behaviors;

[0018] Convert the classification results into sensitive feature groups in the format of [source point, convergence point].

[0019] Furthermore, use the label propagation algorithm to classify sensitive behaviors into 7 categories: operations involving file reading and writing, behaviors of executing system commands, code for performing information collection-related tasks, behaviors related to thread allocation and management, operations involving network communication and data transmission, behaviors of dynamically executing code or using code obfuscation techniques, and tasks related to environment cleaning and maintenance.

[0020] Furthermore, the steps of taint analysis in step 4) include: capture the data flow path from the source point to the convergence point, if there is a sensitive data flow path, capture the key node elements involved; if not, capture the key node elements at the start of the path.

[0021] Furthermore, classifying the key node elements in step 5) means matching according to the following 3 categories: sensitive control flow graph, sensitive code segments, and sensitive regular expressions.

[0022] Furthermore, when performing code slicing in step 5), if the slicing fails, conduct in-depth inspections through manual inspection, intelligent assisted inspection, or online virus scanning services to extract new features to complete feature updates; if the slicing is successful, obtain and count the number of code lines corresponding to all key nodes and extract sensitive code snippets.

[0023] Furthermore, before fine-tuning the pre-trained model in step 6), first clean the sensitive code snippets, use regular expressions to mark the noise content, and replace it with specific markers.

[0024] Furthermore, the pre-trained model selected in step 6) is the CodeBERT model.

[0025] Furthermore, in step 6), the fine-tuning of the pre-trained model adopts full-parameter fine-tuning or LoRA fine-tuning.

[0026] An open-source component malicious behavior detection system includes a memory and a processor. The memory is used to store a computer program, and the processor is used to execute the computer program to implement the steps of the above method.

[0027] Compared with the prior art, the beneficial effects achieved by the present invention are as follows:

[0028] 1. The present invention proposes a fine-grained program slicing scheme. By deeply analyzing the subtle differences between malicious code and normal code, it can more accurately locate the malicious part, thereby improving the poisoning detection rate and reducing the possibility of false positives.

[0029] 2. Through the malicious code slicing technology, the present invention can extract key code fragments related to specific threats or attack vectors to form a relevant subset, that is, a code slice, reducing the component-level code complexity.

[0030] 3. The present invention incorporates a context information capture mechanism for code slicing, which not only includes the actual implementation of malicious code but also the surrounding context information, effectively enhancing the perception ability of complex code behaviors, thereby enhancing the accuracy of malicious code detection and improving the accuracy and efficiency of detection.

[0031] 4. The present invention has the ability to detect large-scale component poisoning in the wild. In the actual application environment, it can identify poisoning behaviors as comprehensively as possible on the premise of minimizing the false positive rate, effectively reducing the manual inspection time and cost of security analysts. This is crucial for accurately identifying and quickly responding to potential security threats, ensuring that necessary protection measures can be taken in a timely manner to enhance the overall security of the system. Description of the Drawings

[0032] Figure 1 is the overall flowchart of the open-source component malicious behavior detection method in the embodiment of the present invention.

[0033] Figure 2 is the flowchart of feature semantic association classification based on label propagation in the embodiment of the present invention.

[0034] Figure 3 is the flowchart of program slicing based on taint analysis in the embodiment of the present invention.

[0035] Figure 4 is the flowchart of program slice poisoning detection based on the pre-trained model in the embodiment of the present invention. Detailed Embodiments

[0036] To enable those skilled in the art to better understand the technical solution of the present invention and make the objectives, features, and advantages of the present invention obvious and easy to understand, the following further detailed description is given in conjunction with embodiments and drawings.

[0037] The embodiments of the present invention specifically disclose an open-source component malicious behavior detection method based on code slicing and pre-trained models. The technical concept of this method is that first, through static program analysis of open-source components, key features related to potential malicious behaviors are extracted to construct a unified cross-language code semantic representation; then, combined with the strong language understanding ability and context awareness characteristics of pre-trained models, accurate identification of malicious code is achieved through fine-tuning techniques and supervised learning methods. The overall process of the present invention is as Figure 1 shown, mainly including feature semantic association classification based on label propagation, program slicing based on taint analysis, and program slice poisoning detection based on pre-trained models. The main processing procedures are described as follows:

[0038] Step 100: Dataset acquisition: Collect datasets of open-source components (such as PyPI open-source components) and sensitive feature datasets.

[0039] I. Feature semantic association classification based on label propagation, the processing flow is as Figure 2 shown.

[0040] Step 200: Feature function description generation, mainly generating corresponding function descriptions for sensitive features. To prevent the introduction of interfering and unnecessary information, the length of each description is controlled to not exceed two sentences.

[0041] Step 210: Use the API interface of the Voyage-large-2-instruct model to convert the function descriptions into vectorized expression forms (word embeddings) so that their formats are suitable for pre-trained models.

[0042] Step 220: Use the label propagation algorithm based on variant Gaussian kernel distance and adopt a synchronous update method to perform behavior classification on the word embeddings, which are divided into 7 types of sensitive behaviors:

[0043] S1. Operations involving file reading and writing, covering scenarios such as file creation, modification, and deletion.

[0044] S2. Behaviors of executing system commands, including calling the underlying command-line interface of the operating system.

[0045] S3. Code for performing information collection-related tasks, involving the acquisition of environment variables, configuration files, and user data.

[0046] S4. Behaviors related to thread allocation and management, such as creating, destroying, or scheduling threads.

[0047] S5. Operations involving network communications and data transmission, including the sending and receiving of data packets.

[0048] S6. Dynamically executing code or using code obfuscation techniques, including dynamic module loading and runtime parsing.

[0049] S7. Tasks related to environment cleanup and maintenance, such as log cleanup, resource recycling, and temporary file processing.

[0050] Label propagation algorithm: By calculating the variant Gaussian kernel distance between the initial labeled features and the unlabeled features, it realizes automatic category label assignment for the remaining features, so that semantically similar feature embeddings can be effectively classified into corresponding categories.

[0051] In this algorithm, the similarity weight based on the variant Gaussian kernel distance is defined as follows:

[0052]

[0053] Among them, w ij represents the weight between embedding i and j, ‖v i -v j ‖ represents the Euclidean distance; σ1 and σ2 represent the bandwidth parameters of the Gaussian kernel, which control the radial range of the kernel.

[0054] In terms of the update mechanism, a synchronous update method is used, and all nodes refresh their labels at the same time, ensuring data consistency and unified improvement of the entire system. The specific update formula is as follows:

[0055]

[0056] Among them, C x (t) represents the label of node x at time t, and function f returns the label of node x in the neighborhood The most frequently appearing tag in .

[0057] To ensure the convergence of the algorithm, a specific condition is set: after a series of consecutive iterations, each node in the network will eventually adopt a label that matches the majority of its neighbors. The specific convergence conditions are as follows:

[0058]

[0059] Among them, C m Indicates the currently active label of node i in the network, Indicates that the neighbors of node i have label C j The number of

[0060] Step 230: Sensitive feature grouping and policy optimization based on label propagation. Specifically, group features according to their roles in the data stream and their associations with potential security threats. Organize the classification results into a format suitable for taint analysis, which serves as the structured input for subsequent taint-based program slicing. Group sensitive features according to behavior classification and taint classification, and introduce an improved taint analysis technique, namely the taint group pairs method, to group sensitive features in the format of [source point, sink point]. The meanings of the two concepts of source point and sink point are as follows:

[0061] Source Points: These are the starting points of the data stream, usually involving user input, configuration file reading, API calls, etc., providing initial data for the data stream. In security analysis, source points are the starting points of potential risks because they may introduce untrusted inputs. If these inputs are not verified, they may be maliciously exploited.

[0062] Sink Points: Opposite to source points, sink points are the end points of the data stream, including system calls, file writing, network transmission, etc. Sink points are where malicious behaviors may be triggered. If tainted data reaches these points, they may pose a threat to system security.

[0063] The instance results of feature semantic association classification based on label propagation are shown in the following table:

[0064] Table 1 Instance of Feature Semantic Association Classification Based on Label Propagation

[0065]

[0066] II. Program Slicing Based on Taint Analysis, and the processing flow is as Figure 3 shown.

[0067] Step 240: Conduct a structural analysis of open-source components and extract the following files:

[0068] (1) The setup.py file. The setup.py is a Python script located in the root directory of the project. It defines the metadata and distribution parameters of the project and is the core file in the Python project packaging and distribution process. If an attacker modifies the setup.py and injects malicious code, then when the user uses the pip install command to install the package, the malicious code may be executed.

[0069] (2) The core module with the same name as the component name. Due to its core position in the package, it often becomes the target for attackers to deploy attack payloads. This module usually contains the __init__.py file and the program code related to the main functions of the package. The __init__.py file enables this directory to be regarded as a separate module by the Python interpreter, so that it can be imported by other packages through import. On this basis, initialization code can be written in the __init__.py file, and these codes are automatically executed when the package is imported, including configuration, package version information, initializing database connections, etc. If the __init__.py is tampered with, malicious code can be automatically executed when the package is imported. The program code related to the main functions of the package usually contains the main functions and API interfaces of the package. Therefore, once it is tampered with, its scope of influence and potential harm cannot be underestimated.

[0070] Step 250: Generate a corresponding Code Property Graph (CPG) based on the extracted files.

[0071] Step 260: Use the sensitive feature grouping result of Step 230 [source point, sink point] as the input.

[0072] Step 270: Perform taint analysis to capture the data flow path from the source point to the sink point.

[0073] Step 280: If there is a sensitive data flow path between the source point and the sink point, capture all the key node elements involved in the path; if there is no sensitive data flow path, capture the key node elements at the start of the path.

[0074] Step 290: First, match the key node elements into the following three categories, and then perform code slicing according to the classification results to extract the sensitive code segments that are crucial for identifying potential poisoning.

[0075] (1) Sensitive Control Flow Graph (CFG) calls: These calls are closely related to the execution of sensitive operations, such as file reading and writing or network communication. They may include access to the file system, initiating network requests, etc. These behaviors are often common means used by attackers to carry out malicious activities.

[0076] (2) Sensitive code segments: These code segments contain sensitive commands or keywords that may indicate malicious behavior. In particular, attackers may use Unicode encoding (such as stylized characters like \uD835\uDD44) to obfuscate malicious code to avoid traditional security detection.

[0077] (3) Sensitive Regular Expressions: Regular expressions are used here to match and identify specific patterns, such as URLs. Attackers may use specific URL patterns to transmit malicious payloads or perform phishing attacks. In-depth analysis of these regular expressions helps identify URL patterns that may be used for malicious purposes.

[0078] Step 300: If slicing fails, that is, malicious code cannot be captured or key aspects are missed, then the malicious components that failed to slice successfully need to be inspected in depth to extract new features to complete feature updates. The coverage of sensitive features has a significant impact on the effectiveness of code slicing. If rules are missing or new attack strategies appear in the components, it may lead to slicing failure, that is, malicious code cannot be captured or key aspects are missed. The inspection process includes but is not limited to the following methods:

[0079] (1) Manual Inspection: Conduct in-depth analysis by experienced security analysts to identify potential malicious behaviors.

[0080] (2) Intelligent Assistant Inspection: Utilize artificial intelligence tools such as ChatGPT and adopt natural language processing techniques to analyze the behavior and intention of the code.

[0081] (3) Online Virus Scanning Service: Use online platforms such as VirusTotal to conduct a comprehensive virus and malware scan on the components to obtain more security intelligence.

[0082] Step 310: If slicing is successful, obtain and count the number of lines of code corresponding to all key nodes, and extract sensitive code fragments. Sensitive code fragments refer to the code fragments that may trigger sensitive behaviors during program execution and their related context information, which are used to reveal the subtle behavioral differences between benign components and malicious components, especially paying attention to the parts that are easily misjudged in the absence of semantic analysis.

[0083] III. Program Slicing Poisoning Detection Based on Pre-trained Models, and the processing flow is as Figure 4 shown.

[0084] Step 320: Clean the sensitive code fragments. That is, use regular expressions to identify and match the unnecessary noise content (including web links, etc.), and replace the matched noise with specific tokens, such as using [URL] to mark URL links.

[0085] Step 330: Fine-tune the pre-trained model (such as CodeBERT) using the sensitive code fragments. The fine-tuning methods include the following two:

[0086] (1) Full-parameter Fine-tuning. Optimize or train all layers of the neural network. Usually, it can achieve the best results, but it also consumes the most resources and time.

[0087] (2) LoRA (Low-Rank Adaptation) fine-tuning. LoRA approximates the weight matrix of the pre-trained large language model by fine-tuning two smaller matrices instead of fine-tuning all the weights. These two matrices form the LoRA adapter, which, after fine-tuning, is loaded into the pre-trained model for subsequent inference tasks. This method specifically fine-tunes the query, key, and value modules because these three modules are the core components of the self-attention mechanism in the Transformer model and directly affect the model's understanding and processing of input information.

[0088] Step 340: Use the fine-tuned pre-trained model to classify and identify the code snippets of open-source components, and output the final label, indicating whether the open-source component is malicious by marking 0 or 1.

[0089] Experimental verification:

[0090] 1. Experimental results on multiple public datasets show that the detection performance of the method of the present invention is better than that of other existing similar methods. Table 2 is a statistical information table of the open-source component datasets used in this experiment, where + in the table represents that the dataset content is malicious components, and - represents benign components. The malicious component datasets are from relevant papers and open-source datasets [1][2][3][4][5] , and the benign components are self-collected. When selecting benign components, this experiment adopted the systematic method used by Zahan N et al. [6] : Extract the top 1919 components from the PyPI download rankings. Given that these components are usually well-maintained and have a high community activity, this experiment can reasonably consider them to be benign. However, this process also brings some challenges. These components with high download volumes usually have complex structures and large file sizes.

[0091] Considering the model's sensitivity to file size and to ensure the scientificity and accuracy of the research, this experiment further screened the open-source PyPI datasets [7] , and selected components containing no more than five Python (.py) files. This strategy aims to enrich the benign component dataset while controlling the potential impact of file size on model performance and ensuring the robustness of experimental results. Finally, this experiment obtained 4143 benign PyPI components. This shows that the present invention maintains the diversity of the dataset while managing data complexity, providing a balanced and comprehensive benign component dataset for model training and analysis.

[0092] Table 2 Statistical information of public datasets

[0093]

[0094] This experiment selected PyPI Malware Check [8] and GuardDog [9] as comparison tools because both of these tools are based on static rules. Among them, PyPI Malware Check is relatively lenient, while GuardDog is more strict. PyPI Malware Check mainly relies on Yara rules for detection, while GuardDog uses Semgrep rules to perform heuristic analysis on the package source code. Yara rules are usually used for pattern matching, based on specific signatures of file content or code snippets. This makes Yara very effective in detecting known malicious patterns and signatures, but its rules are relatively static and rigid, with low heuristics. Semgrep rules focus more on syntax and structure matching. By parsing the syntax tree of the code, it can detect specific code patterns and behaviors. This kind of rule is more flexible when analyzing code logic and context, so it can detect more diverse threats. Through comparison, it aims to reveal the limitations of pure static analysis methods in detection. In addition, these two tools are widely used in the actual detection environment and have a high reputation. As an official PyPI tool, both PyPI Malware Check and GuardDog developed by Datadog are widely used for the detection of malicious components, providing valuable actual data for their detection effectiveness and robustness.

[0095] In terms of configuration, PyPI Malware Check implemented two strategies: one is to only analyze the setup.py file, and the other is to conduct a comprehensive scan of all Python files in the project. GuardDog conducts a detailed check through the command guarddog pypiscan --output-format=json.

[0096] In the evaluation of this experiment, the performance metrics considered include accuracy, precision, recall, F1 score, miss rate, and false positive rate. Table 3 summarizes the results of these comparisons. The method of the present invention is called OCS-BERT (Open Source Code Slicing BERT) and is evaluated under two configurations: FPFT (Full Parameter Fine-Tuning) and PEFT (Parameter-Efficient Fine-Tuning).

[0097] Table 3 Performance Comparison of Different Schemes

[0098]

[0099] 1) The overall results show that the OCS-BERT method achieved an accuracy of 0.969 in the full-parameter fine-tuning (FPFT) configuration and 0.950 in the LoRA fine-tuning (PEFT) configuration, both significantly outperforming the PyPI Check method. The latter had accuracies of 0.681 and 0.795 when comprehensively detecting all files and only detecting the setup.py file, respectively. Although GuardDog performed well with an accuracy of 0.837, OCS-BERT (FPFT) still achieved superiority.

[0100] 2) Comparison of OCS-BERT fine-tuning strategies: On the PyPI dataset, OCS-BERT (FPFT) demonstrated superior performance compared to OCS-BERT (PEFT). This is attributed to the fact that full-parameter fine-tuning (FPFT) enables the model to adapt more precisely to specific tasks, achieving a precision of 0.994 and a recall of 0.943. However, this advantage may come at the cost of sacrificing some language understanding ability, thus affecting the generalization performance of the model. The parameter-efficient fine-tuning (PEFT) method, although having slightly lower accuracy and precision, 0.950 and 0.980 respectively, provides a balanced strategy.

[0101] 2. The method of the present invention was successfully used to scan 25,759 newly released PyPI package versions extracted from the official PyPI repository and the TUNA mirror from April 1, 2024, to July 23, 2024, and accurately detected 107 malicious packages, demonstrating the practicality and reliability of the method of the present invention. Some detection results of the present invention are as follows:

[0102] Table 4 Partial detection results of applying OCS-BERT in the in-the-wild PyPI dataset

[0103] [[ID=!4]]

[0104] It can be seen that the method for detecting malicious behaviors of open-source components proposed by the present invention can identify malicious components in an efficient and highly accurate manner, while significantly reducing the false positive rate.

[0105] Based on the same inventive concept, an embodiment of the present invention also provides a system for detecting malicious behaviors of open-source components, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, the steps of the above method are implemented.

[0106] Parts not elaborated in the present invention belong to the well-known techniques in the art.

[0107] References:

[0108] [1] Guo W, Xu Z, Liu C, et al. An Empirical Study of Malicious Code InPyPI Ecosystem[C] / / 2023 38th IEEE / ACM International Conference on Automated Software Engineering(ASE). IEEE, 2023:166 - 177.

[0109] [2] Ohm M, Plate H, Sykosch A, et al. Backstabber’s knife collection: A review of open source software supply chain attacks[C] / / Detection of Intrusions and Malware, and Vulnerability Assessment: 17th International Conference, DIMVA 2020, Lisbon, Portugal, June 24–26, 2020, Proceedings 17. Springer International Publishing, 2020:23 - 43.

[0110] [3] Duan R, Alrawi O, Kasturi R P, et al. Towards measuring supply chain attacks on package managers for interpreted languages[J]. arXiv preprint arXiv:2002.01139, 2020.

[0111] [4] Li N, Wang S, Feng M, et al. MalWuKong: Towards Fast, Accurate, and Multilingual Detection of Malicious Code Poisoning in OSS Supply Chains[C] / / 2023 38th IEEE / ACM International Conference on Automated Software Engineering(ASE). IEEE, 2023:1993 - 2005.

[0112] [5] Obregoso, S. Malicious PyPI packages targeting highly specific MacOS machines[EB / OL]. Datadog Security Labs, [2024-05-23]. https: / / securitylabs.datadoghq.com / articles / malicious-pypi-package-targeting-highly-specific-macos-machines / .

[0113] [6] Zahan N, Burckhardt P, Lysenko M, et al. MalwareBench: Malware samples are not enough[C] / / 2024 IEEE / ACM 21st International Conference on Mining Software Repositories(MSR). IEEE, 2024:728-732.

[0114] [7] Hugging Face. PyPI Raw Dataset by VIKP[EB / OL]. [2024-08-18]. https: / / huggingface.co / datasets / vikp / pypi_raw.

[0115] [8] sedders123. PyPI Malware Check: Documentation on malware checks[EB / OL]. GitHub repository, [2024-08-18].

[0116] https: / / github.com / sedders123 / warehouse / blob / 941078f66c495c240c712d5252f0595714e25864 / docs / develo pment / malware-checks.rst.

[0117] [9]Datadog Security Labs.Open-Source Dataset of Malicious SoftwarePackages[EB / OL].[2024-08-18].https: / / github.com / datadog / malicious-software-packages-dataset.

[0118] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with examples, those of ordinary skill in the art can modify or equivalently replace the technical solutions of the present invention. Without departing from the spirit and scope of the technical solutions of the present invention, they should all be covered by the protection scope of the claims of the present invention.

Claims

1. An open-source component malicious behavior detection method, characterized in that It includes the following steps: 1) Collect open-source component data and sensitive feature data; 2) Group sensitive features based on label propagation; 3) Conduct a structural analysis of the open-source components, extract the setup.py file and the core module with the same name as the component name, and generate a code property graph; 4) Perform taint analysis on the code property graph according to the sensitive feature grouping to identify key node elements; 5) Classify the key node elements, and then perform code slicing to extract sensitive code snippets; 6) Fine-tune the pre-trained model using the sensitive code snippets; 7) Use the fine-tuned pre-trained model to classify the code snippets of the open-source components and detect malicious behaviors of the open-source components.

2. The malicious behavior detection method for open-source components according to claim 1, wherein, The steps of grouping sensitive features based on label propagation in step 2) include: Generate corresponding function descriptions for the sensitive features and convert the function descriptions into word embedding vectors; Use the label propagation algorithm based on variant Gaussian kernel distance to classify the word embedding vectors for sensitive behaviors; Convert the classification results into sensitive feature groupings in the format of [source point, convergence point].

3. The malicious behavior detection method for open-source components according to claim 2, characterized in that Use the label propagation algorithm to classify sensitive behaviors into 7 categories: operations involving file reading and writing, behaviors of executing system commands, code for performing information collection-related tasks, behaviors related to thread allocation and management, operations involving network communication and data transmission, behaviors of dynamically executing code or using code obfuscation techniques, and tasks related to environment cleaning and maintenance.

4. The malicious behavior detection method for open-source components according to claim 2, wherein The steps of taint analysis in step 4) include: capture the data flow path from the source point to the convergence point. If there is a sensitive data flow path, capture the key node elements involved; if not, capture the key node elements at the start of the path.

5. The malicious behavior detection method for open-source components according to claim 1, wherein Classifying the key node elements in step 5) refers to matching according to the following 3 categories: sensitive control flow graph, sensitive code segment, and sensitive regular expression.

6. The malicious behavior detection method for open-source components according to claim 1, characterized in that When performing code slicing in step 5), if the slicing fails, conduct in-depth inspection through manual inspection, intelligent assisted inspection, or online virus scanning service to extract new features to complete feature update; If the slicing is successful, obtain and count the number of code lines corresponding to all key nodes and extract sensitive code snippets.

7. The malicious behavior detection method for open-source components according to claim 1, characterized in that, Before fine-tuning the pre-trained model in step 6), first clean the sensitive code snippets, mark the noise content using regular expressions, and replace it with specific markers.

8. The malicious behavior detection method for open-source components according to claim 1, wherein, The pre-trained model selected in step 6) is the CodeBERT model.

9. The malicious behavior detection method for open-source components according to claim 1, wherein, The fine-tuning of the pre-trained model in step 6) adopts full-parameter fine-tuning or LoRA fine-tuning.

10. An open-source component malicious behavior detection system, characterized in that, It includes a memory and a processor. The memory is used to store a computer program, and the processor is used to execute the computer program to implement the steps of the open-source component malicious behavior detection method described in any one of claims 1-9.

Images