论文标题
部分可观测时空混沌系统的无模型预测
Towards the Detection of Malicious Java Packages
论文作者
论文摘要
开源软件供应链攻击旨在通过中毒开源软件包感染下游用户。食用此类工件的常见方法是通过包装存储库，而审查策略来检测此类攻击是持续的研究。尽管它很受欢迎，但在供应链攻击的背景下，Java生态系统是较少探索的生态系统。 在本文中，我们提出了恶意行为的指标，可以通过对Java字节码的分析在静态上观察到。然后，我们评估当检测恶意代码注射时，此类指标及其组合的性能。我们这样做是通过将来自现实世界中示例的三个恶意有效载荷注入到10个最受欢迎的Java库中的恶意有效载荷。 我们发现，在字节码指令中对恒定池和敏感API中的字符串的分析有助于通过大大减少信息来检测恶意Java套件，从而使手动分类也成为可能。
Open-source software supply chain attacks aim at infecting downstream users by poisoning open-source packages. The common way of consuming such artifacts is through package repositories and the development of vetting strategies to detect such attacks is ongoing research. Despite its popularity, the Java ecosystem is the less explored one in the context of supply chain attacks. In this paper we present indicators of malicious behavior that can be observed statically through the analysis of Java bytecode. Then we evaluate how such indicators and their combinations perform when detecting malicious code injections. We do so by injecting three malicious payloads taken from real-world examples into the Top-10 most popular Java libraries from libraries.io. We found that the analysis of strings in the constant pool and of sensitive APIs in the bytecode instructions aid in the task of detecting malicious Java packages by significantly reducing the information, thus, making also manual triage possible.
