{"id":"https://openalex.org/W4403536548","doi":"https://doi.org/10.1145/3691620.3695262","title":"Towards Robust Detection of Open Source Software Supply Chain Poisoning Attacks in Industry Environments","display_name":"Towards Robust Detection of Open Source Software Supply Chain Poisoning Attacks in Industry Environments","publication_year":2024,"publication_date":"2024-10-18","ids":{"openalex":"https://openalex.org/W4403536548","doi":"https://doi.org/10.1145/3691620.3695262"},"language":"en","primary_location":{"id":"doi:10.1145/3691620.3695262","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3691620.3695262","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering","raw_type":"proceedings-article"},"type":"preprint","indexed_in":["arxiv","crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2409.09356","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Xinyi Zheng","orcid":"https://orcid.org/0009-0003-5792-8897"},"institutions":[{"id":"https://openalex.org/I47720641","display_name":"Huazhong University of Science and Technology","ror":"https://ror.org/00p991c53","country_code":"CN","type":"education","lineage":["https://openalex.org/I47720641"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Xinyi Zheng","raw_affiliation_strings":["Huazhong University of Science and Technology, Wuhan, China"],"affiliations":[{"raw_affiliation_string":"Huazhong University of Science and Technology, Wuhan, China","institution_ids":["https://openalex.org/I47720641"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Chen Wei","orcid":"https://orcid.org/0009-0006-6312-8601"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chen Wei","raw_affiliation_strings":["MYbank, Ant Group, Hangzhou, China"],"affiliations":[{"raw_affiliation_string":"MYbank, Ant Group, Hangzhou, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5029601880","display_name":"Shenao Wang","orcid":"https://orcid.org/0000-0003-3818-3343"},"institutions":[{"id":"https://openalex.org/I47720641","display_name":"Huazhong University of Science and Technology","ror":"https://ror.org/00p991c53","country_code":"CN","type":"education","lineage":["https://openalex.org/I47720641"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shenao Wang","raw_affiliation_strings":["Huazhong University of Science and Technology, Wuhan, China"],"affiliations":[{"raw_affiliation_string":"Huazhong University of Science and Technology, Wuhan, China","institution_ids":["https://openalex.org/I47720641"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5023970004","display_name":"Yanjie Zhao","orcid":"https://orcid.org/0000-0001-8793-5367"},"institutions":[{"id":"https://openalex.org/I47720641","display_name":"Huazhong University of Science and Technology","ror":"https://ror.org/00p991c53","country_code":"CN","type":"education","lineage":["https://openalex.org/I47720641"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yanjie Zhao","raw_affiliation_strings":["Huazhong University of Science and Technology, Wuhan, China"],"affiliations":[{"raw_affiliation_string":"Huazhong University of Science and Technology, Wuhan, China","institution_ids":["https://openalex.org/I47720641"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5001126748","display_name":"Peiming Gao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Peiming Gao","raw_affiliation_strings":["MYbank, Ant Group, Hangzhou, China"],"affiliations":[{"raw_affiliation_string":"MYbank, Ant Group, Hangzhou, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5065781699","display_name":"Y. Zhang","orcid":"https://orcid.org/0009-0003-8396-8833"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yuanchao Zhang","raw_affiliation_strings":["MYbank, Ant Group, Hangzhou, China"],"affiliations":[{"raw_affiliation_string":"MYbank, Ant Group, Hangzhou, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5000432413","display_name":"Kailong Wang","orcid":"https://orcid.org/0000-0002-3977-6573"},"institutions":[{"id":"https://openalex.org/I47720641","display_name":"Huazhong University of Science and Technology","ror":"https://ror.org/00p991c53","country_code":"CN","type":"education","lineage":["https://openalex.org/I47720641"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Kailong Wang","raw_affiliation_strings":["Huazhong University of Science and Technology, Wuhan, China"],"affiliations":[{"raw_affiliation_string":"Huazhong University of Science and Technology, Wuhan, China","institution_ids":["https://openalex.org/I47720641"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5115695530","display_name":"Haoyu Wang","orcid":"https://orcid.org/0000-0003-1100-8633"},"institutions":[{"id":"https://openalex.org/I47720641","display_name":"Huazhong University of Science and Technology","ror":"https://ror.org/00p991c53","country_code":"CN","type":"education","lineage":["https://openalex.org/I47720641"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Haoyu Wang","raw_affiliation_strings":["Huazhong University of Science and Technology, Wuhan, China"],"affiliations":[{"raw_affiliation_string":"Huazhong University of Science and Technology, Wuhan, China","institution_ids":["https://openalex.org/I47720641"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":8,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I47720641"],"apc_list":null,"apc_paid":null,"fwci":2.3908,"has_fulltext":true,"cited_by_count":7,"citation_normalized_percentile":{"value":0.90054048,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":97,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"1990","last_page":"2001"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9980000257492065,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9980000257492065,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.996399998664856,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9824000000953674,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/supply-chain","display_name":"Supply chain","score":0.6054539680480957},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.5916271805763245},{"id":"https://openalex.org/keywords/open-source","display_name":"Open source","score":0.5891606211662292},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5439361333847046},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.5431503653526306},{"id":"https://openalex.org/keywords/open-source-software","display_name":"Open source software","score":0.48332691192626953},{"id":"https://openalex.org/keywords/business","display_name":"Business","score":0.305286169052124},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.15427854657173157}],"concepts":[{"id":"https://openalex.org/C108713360","wikidata":"https://www.wikidata.org/wiki/Q1824206","display_name":"Supply chain","level":2,"score":0.6054539680480957},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5916271805763245},{"id":"https://openalex.org/C3018397939","wikidata":"https://www.wikidata.org/wiki/Q3644502","display_name":"Open source","level":3,"score":0.5891606211662292},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5439361333847046},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.5431503653526306},{"id":"https://openalex.org/C2988343187","wikidata":"https://www.wikidata.org/wiki/Q1130645","display_name":"Open source software","level":3,"score":0.48332691192626953},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.305286169052124},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.15427854657173157},{"id":"https://openalex.org/C162853370","wikidata":"https://www.wikidata.org/wiki/Q39809","display_name":"Marketing","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3691620.3695262","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3691620.3695262","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2409.09356","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2409.09356","pdf_url":"https://arxiv.org/pdf/2409.09356","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2409.09356","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2409.09356","pdf_url":"https://arxiv.org/pdf/2409.09356","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[{"display_name":"Industry, innovation and infrastructure","id":"https://metadata.un.org/sdg/9","score":0.6399999856948853}],"awards":[{"id":"https://openalex.org/G1121271761","display_name":null,"funder_award_id":"Program","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G2087396116","display_name":null,"funder_award_id":"China","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G2802911279","display_name":null,"funder_award_id":"Young","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G2870525900","display_name":null,"funder_award_id":"Wuhan","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G3481324499","display_name":null,"funder_award_id":"62302176","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G391238517","display_name":null,"funder_award_id":", and","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G5285404577","display_name":"Geometry and harmonic analysis related to symmetric spaces","funder_award_id":"0801010","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G5853313636","display_name":null,"funder_award_id":"Knowledge","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G6058138561","display_name":null,"funder_award_id":", No.","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7174558747","display_name":null,"funder_award_id":"Group","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7608752429","display_name":null,"funder_award_id":"Talent","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7659621868","display_name":null,"funder_award_id":"62072046","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320318398","display_name":"Ant Group","ror":null},{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"pdf":true,"grobid_xml":false},"content_urls":{"pdf":"https://content.openalex.org/works/W4403536548.pdf"},"referenced_works_count":25,"referenced_works":["https://openalex.org/W2912248945","https://openalex.org/W2914630606","https://openalex.org/W2953558274","https://openalex.org/W2972552958","https://openalex.org/W3081194266","https://openalex.org/W3094525800","https://openalex.org/W3109094705","https://openalex.org/W3147673361","https://openalex.org/W3194752080","https://openalex.org/W4220682629","https://openalex.org/W4221145571","https://openalex.org/W4226410005","https://openalex.org/W4226416841","https://openalex.org/W4284687350","https://openalex.org/W4301163492","https://openalex.org/W4360603897","https://openalex.org/W4384345699","https://openalex.org/W4385208592","https://openalex.org/W4385687882","https://openalex.org/W4387723777","https://openalex.org/W4388502409","https://openalex.org/W4388502419","https://openalex.org/W4388867344","https://openalex.org/W4391579662","https://openalex.org/W4404711543"],"related_works":["https://openalex.org/W4376877853","https://openalex.org/W1493891899","https://openalex.org/W4250928611","https://openalex.org/W166480398","https://openalex.org/W1612808768","https://openalex.org/W167327709","https://openalex.org/W1977393088","https://openalex.org/W4387839566","https://openalex.org/W4210922265","https://openalex.org/W2288962794"],"abstract_inverted_index":{"The":[0],"exponential":[1],"growth":[2],"of":[3,126,137,163,175,199],"open-source":[4],"package":[5],"ecosystems,":[6],"particularly":[7],"NPM":[8,84,140,178,221,231],"and":[9,33,39,57,85,102,104,129,141,183,222,233,251,263],"PyPI,":[10,144],"has":[11,267],"led":[12],"to":[13,64,181,189,192],"an":[14,134,173],"alarming":[15],"increase":[16],"in":[17,92,139,143,177,185,202,254,271],"software":[18],"supply":[19],"chain":[20],"poisoning":[21,80,256],"attacks.":[22],"Existing":[23],"static":[24],"analysis":[25,46],"methods":[26],"struggle":[27],"with":[28,109,207],"high":[29],"false":[30,169],"positive":[31,170],"rates":[32],"are":[34],"easily":[35],"thwarted":[36],"by":[37,172],"obfuscation":[38],"dynamic":[40,45,78],"code":[41,79,255],"execution":[42],"techniques.":[43],"While":[44],"approaches":[47],"offer":[48],"improvements,":[49],"they":[50],"often":[51],"suffer":[52],"from":[53],"capturing":[54],"non-package":[55],"behaviors":[56],"employing":[58],"simplistic":[59],"testing":[60,98],"strategies":[61],"that":[62,146,266],"fail":[63],"trigger":[65],"sophisticated":[66],"malicious":[67,128,164,230,235],"behaviors.":[68],"To":[69],"address":[70],"these":[71],"challenges,":[72],"we":[73,215],"present":[74],"OSCAR,":[75],"a":[76,93,122,210,261,272],"robust":[77,262],"detection":[81,257],"pipeline":[82],"for":[83,157],"PyPI":[86,186,223,236],"ecosystems.":[87],"OSCAR":[88,116,132,147,166,218],"fully":[89],"executes":[90],"packages":[91,159,232,237],"sandbox":[94],"environment,":[95],"employs":[96],"fuzz":[97],"on":[99,219],"exported":[100],"functions":[101],"classes,":[103],"implements":[105],"aspect-based":[106],"behavior":[107],"monitoring":[108],"tailored":[110],"API":[111],"hook":[112],"points.":[113],"We":[114],"evaluate":[115],"against":[117],"six":[118],"existing":[119],"tools":[120],"using":[121],"comprehensive":[123],"benchmark":[124],"dataset":[125],"real-world":[127,203,273],"benign":[130,158],"packages.":[131],"achieves":[133],"F1":[135],"score":[136],"0.95":[138],"0.91":[142],"confirming":[145],"is":[148],"as":[149,151],"effective":[150],"the":[152,168,197,246],"current":[153],"state-of-the-art":[154],"technologies.":[155],"Furthermore,":[156],"exhibiting":[160],"characteristics":[161],"typical":[162],"packages,":[165],"reduces":[167],"rate":[171],"average":[174],"32.06%":[176],"(from":[179,187],"34.63%":[180],"2.57%)":[182],"39.87%":[184],"41.10%":[188],"1.23%),":[190],"compared":[191],"other":[193],"tools,":[194],"significantly":[195],"reducing":[196],"workload":[198],"manual":[200],"reviews":[201],"deployments.":[204],"In":[205],"cooperation":[206],"Ant":[208],"Group,":[209],"leading":[211],"financial":[212],"technology":[213],"company,":[214],"have":[216],"deployed":[217],"its":[220],"mirrors":[224],"since":[225],"January":[226],"2023,":[227],"identifying":[228],"10,404":[229],"1,235":[234],"over":[238],"18":[239],"months.":[240],"This":[241],"work":[242],"not":[243],"only":[244],"bridges":[245],"gap":[247],"between":[248],"academic":[249],"research":[250],"industrial":[252,274],"application":[253],"but":[258],"also":[259],"provides":[260],"practical":[264],"solution":[265],"been":[268],"thoroughly":[269],"tested":[270],"setting.":[275]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":4}],"updated_date":"2026-04-10T15:06:20.359241","created_date":"2025-10-10T00:00:00"}