Malicious source code detection using a translation model

Area of Science:

• Computer Science
• Software Engineering
• Cybersecurity

Background:

• Open-source software development facilitates code reuse but introduces supply chain vulnerabilities.
• Increasingly sophisticated "supply chain attacks" exploit open-source practices to compromise numerous products.
• Detecting malicious code injections in shared software packages is a critical cybersecurity challenge.

Purpose of the Study:

• To introduce a novel deep-learning-based algorithm for detecting malicious code injections in source code packages.
• To develop an effective method for identifying compromised open-source software components.
• To enhance the security of the software supply chain against malicious code.

Main Methods:

• Developed the Malicious Source code Detection using a Translation model (MSDT) algorithm.
• Utilized deep learning for source code analysis and anomaly detection.
• Employed a dataset of over 600,000 functions, embedding them and applying clustering to identify outlier (malicious) functions.

Main Results:

• MSDT demonstrated high efficacy in detecting real-world code injections.
• The algorithm achieved precision@k values up to 0.909 in experimental evaluations.
• Outlier detection via clustering of embedding vectors successfully identified malicious functions.

Conclusions:

• MSDT is a powerful tool for identifying malicious code within open-source software.
• The deep-learning approach offers a promising solution for securing the software supply chain.
• Further development and application of MSDT can significantly improve software security against supply chain attacks.