Malicious Code and OSS Package Detection with Cascading LLM Filters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional code scanning methods are inefficient and resource-intensive for detecting malicious code and open-source software packages due to the complexity and scale of modern software projects, and existing Large Language Models (LLMs) are infeasible for widespread use without significant computing power.
Innovation Solution
A method utilizing cascading filters, code and prompt embeddings, and LLM-based detectors to efficiently identify malicious code by preprocessing to filter out benign code, employing heuristics and embeddings to reduce the computational load on LLMs, and using LCPs for scalable detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If LLMs are used to scan all OSS code, then detection accuracy is improved, but computing power requirements become infeasible
Solution Approach 1:
The patent segments the code scanning process into multiple stages: first using lightweight heuristics and embeddings to pre-filter code, then applying LLMs only to the remaining suspicious code. This segmentation allows the system to maintain high detection accuracy while significantly reducing the computational burden on LLMs.
Solution Approach 2:
The patent applies preliminary filtering actions using heuristics and code embeddings before LLM analysis. By pre-assessing code for malicious indicators and generating embeddings to compare against known malicious patterns, the system prepares and prioritizes code for LLM review, ensuring only the most suspicious code undergoes resource-intensive LLM scanning.
2Power
If traditional code scanning methods are used, then computational load is reduced, but detection capability becomes insufficient for modern software complexity
Solution Approach 1:
The patent introduces code embeddings and heuristics as intermediary layers between traditional scanning and LLM analysis. These intermediaries bridge the gap by providing a middle layer of analysis that is more capable than traditional methods but less resource-intensive than direct LLM scanning, enabling enhanced detection capability with manageable computational load.
Solution Approach 2:
The patent creates a composite detection system combining multiple techniques: traditional heuristics, code embeddings, and LLMs. This composite approach leverages the strengths of each component while mitigating their individual weaknesses, achieving superior detection capability for modern software complexity without relying solely on computationally expensive methods.
3Productivity
If code filtering is applied before LLM analysis, then computational efficiency is improved, but potential false negatives may increase
Solution Approach 1:
The patent applies partial filtering using heuristics and embeddings to assess code for malicious indicators. By using multiple filtering criteria and maintaining a probability threshold system, the patent ensures that while computational efficiency is improved, the false negative rate is controlled through excessive action in the filtering stage, catching more potential malicious code before LLM review.
Data Source
AI summary
A method for the efficient use of Large Language Models (LLMs) in malicious code detection, the method including: assessing code and assigning a probability level of being malicious; and running code assessed to be above a predetermined probability level through an LLM to determine if the code is malicious.