Detecting Malicious Code via VCS Commit History Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Software supply chain attacks, particularly those targeting reused components, pose a significant threat as they can infect multiple downstream applications by compromising open source or commercial repositories, exploiting trust in automated build systems and dependency managers, leading to a larger attack surface and increased social engineering risks.
Innovation Solution
A system that detects malicious code in distributed software components by referencing a Versioning Control System (VCS) to inspect source code files and lines for commit history information, using a risk assessor to generate a probability of maliciousness based on features like file extensions and API calls, and providing an analysis report for manual review.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If automated build systems and dependency managers are used to adopt open source components, then software development efficiency is improved, but the attack surface increases and supply chain security risks worsen
Solution Approach 1:
The system performs preliminary verification of open source components by checking commit history and code provenance before they are integrated into the software build process. This proactive approach identifies potentially malicious code early, preventing supply chain attacks while maintaining automated build efficiency
Solution Approach 2:
The system introduces an intermediary verification layer between the dependency manager and the build system. This intermediary checks commit history and code provenance information, acting as a security gate that filters out malicious components while allowing legitimate ones to pass through the automated build process
2Measurement precision
If commit history verification is performed on all code lines, then detection precision is improved, but processing time increases
Solution Approach 1:
The system segments the codebase into discrete units (individual commit history entries and code lines) and verifies them systematically. By processing code in manageable segments rather than as a monolithic whole, the system maintains high detection precision while enabling parallel processing to reduce overall inspection time
Solution Approach 2:
The system performs verification on code lines that are most critical or suspicious based on initial analysis, rather than uniformly verifying every single line. This selective approach maintains high detection precision for the most important code while reducing overall processing time by focusing resources where they are most needed
Data Source
AI summary
Embodiments detect malicious code in distributed software components. A detector element references a source code repository (e.g., open source, commercial) containing lines of various files of a distributed artifact. Subject to certain possible optimizations, the detector inspects the individual files and lines of the artifact file-by-file and line-by-line, to identify whether any commit history information is available from a Versioning Control System (VCS). A risk assessor element receives from the detector element, results identifying those lines and/or files for which no VCS commit history is available. The risk assessor then references code features (e.g., file extension, security-critical API calls) in the results, to generate a probability of the malicious nature of the source code lacking VCS commit history information. An analysis report including this probability and additional relevant information, is offered to a user to conduct further manual review (e.g., to detect false positives attributable to benign/legitimate source code modification).