{"id":"https://openalex.org/W4403536782","doi":"https://doi.org/10.1145/3691620.3695493","title":"1+1>2: Integrating Deep Code Behaviors with Metadata Features for Malicious PyPI Package Detection","display_name":"1+1>2: Integrating Deep Code Behaviors with Metadata Features for Malicious PyPI Package Detection","publication_year":2024,"publication_date":"2024-10-18","ids":{"openalex":"https://openalex.org/W4403536782","doi":"https://doi.org/10.1145/3691620.3695493"},"language":"en","primary_location":{"id":"doi:10.1145/3691620.3695493","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3691620.3695493","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5006966486","display_name":"Xiaobing Sun","orcid":"https://orcid.org/0000-0001-5165-5080"},"institutions":[{"id":"https://openalex.org/I78978612","display_name":"Yangzhou University","ror":"https://ror.org/03tqb8s11","country_code":"CN","type":"education","lineage":["https://openalex.org/I78978612"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaobing Sun","raw_affiliation_strings":["Yangzhou University, Yangzhou, China"],"raw_orcid":"https://orcid.org/0000-0001-5165-5080","affiliations":[{"raw_affiliation_string":"Yangzhou University, Yangzhou, China","institution_ids":["https://openalex.org/I78978612"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Xingan Gao","orcid":"https://orcid.org/0009-0004-1573-117X"},"institutions":[{"id":"https://openalex.org/I78978612","display_name":"Yangzhou University","ror":"https://ror.org/03tqb8s11","country_code":"CN","type":"education","lineage":["https://openalex.org/I78978612"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xingan Gao","raw_affiliation_strings":["Yangzhou University, Yangzhou, China"],"raw_orcid":"https://orcid.org/0009-0004-1573-117X","affiliations":[{"raw_affiliation_string":"Yangzhou University, Yangzhou, China","institution_ids":["https://openalex.org/I78978612"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5007104924","display_name":"Sicong Cao","orcid":"https://orcid.org/0000-0003-3688-4437"},"institutions":[{"id":"https://openalex.org/I78978612","display_name":"Yangzhou University","ror":"https://ror.org/03tqb8s11","country_code":"CN","type":"education","lineage":["https://openalex.org/I78978612"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Sicong Cao","raw_affiliation_strings":["Yangzhou University, Yangzhou, China"],"raw_orcid":"https://orcid.org/0000-0003-3688-4437","affiliations":[{"raw_affiliation_string":"Yangzhou University, Yangzhou, China","institution_ids":["https://openalex.org/I78978612"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5013537395","display_name":"Lili Bo","orcid":"https://orcid.org/0000-0002-7267-4923"},"institutions":[{"id":"https://openalex.org/I78978612","display_name":"Yangzhou University","ror":"https://ror.org/03tqb8s11","country_code":"CN","type":"education","lineage":["https://openalex.org/I78978612"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lili Bo","raw_affiliation_strings":["Yangzhou University, Yangzhou, China"],"raw_orcid":"https://orcid.org/0000-0002-7267-4923","affiliations":[{"raw_affiliation_string":"Yangzhou University, Yangzhou, China","institution_ids":["https://openalex.org/I78978612"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102926361","display_name":"Xiaoxue Wu","orcid":"https://orcid.org/0009-0009-5432-651X"},"institutions":[{"id":"https://openalex.org/I78978612","display_name":"Yangzhou University","ror":"https://ror.org/03tqb8s11","country_code":"CN","type":"education","lineage":["https://openalex.org/I78978612"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaoxue Wu","raw_affiliation_strings":["Yangzhou University, Yangzhou, China"],"raw_orcid":"https://orcid.org/0009-0009-5432-651X","affiliations":[{"raw_affiliation_string":"Yangzhou University, Yangzhou, China","institution_ids":["https://openalex.org/I78978612"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5011365470","display_name":"Kaifeng Huang","orcid":"https://orcid.org/0009-0000-1513-8254"},"institutions":[{"id":"https://openalex.org/I116953780","display_name":"Tongji University","ror":"https://ror.org/03rc6as71","country_code":"CN","type":"education","lineage":["https://openalex.org/I116953780"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Kaifeng Huang","raw_affiliation_strings":["Tongji University, Shanghai, China"],"raw_orcid":"https://orcid.org/0009-0000-1513-8254","affiliations":[{"raw_affiliation_string":"Tongji University, Shanghai, China","institution_ids":["https://openalex.org/I116953780"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.6686,"has_fulltext":false,"cited_by_count":4,"citation_normalized_percentile":{"value":0.85616438,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"1159","last_page":"1170"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12016","display_name":"Web Data Mining and Analysis","score":0.9973000288009644,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8584831953048706},{"id":"https://openalex.org/keywords/metadata","display_name":"Metadata","score":0.8372787833213806},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.5743287801742554},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.4297233521938324},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.35775792598724365}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8584831953048706},{"id":"https://openalex.org/C93518851","wikidata":"https://www.wikidata.org/wiki/Q180160","display_name":"Metadata","level":2,"score":0.8372787833213806},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.5743287801742554},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.4297233521938324},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.35775792598724365},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3691620.3695493","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3691620.3695493","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G6904283180","display_name":null,"funder_award_id":"62202414","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":21,"referenced_works":["https://openalex.org/W2963341956","https://openalex.org/W3084489712","https://openalex.org/W3137781054","https://openalex.org/W3138230581","https://openalex.org/W3161685529","https://openalex.org/W3162344723","https://openalex.org/W3196277935","https://openalex.org/W3200811579","https://openalex.org/W3213706029","https://openalex.org/W4221033043","https://openalex.org/W4226416841","https://openalex.org/W4241830954","https://openalex.org/W4281390800","https://openalex.org/W4385080288","https://openalex.org/W4386555848","https://openalex.org/W4386942788","https://openalex.org/W4387448956","https://openalex.org/W4388483305","https://openalex.org/W4390871473","https://openalex.org/W4393973474","https://openalex.org/W4394769458"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2058118494","https://openalex.org/W2392768766","https://openalex.org/W2382021449","https://openalex.org/W2095118173","https://openalex.org/W2106424170","https://openalex.org/W1985426483","https://openalex.org/W2501188010"],"abstract_inverted_index":{"PyPI,":[0],"the":[1,12,25,46,117,129,199],"official":[2],"package":[3,16,32],"registry":[4],"for":[5,139],"Python,":[6],"has":[7],"seen":[8],"a":[9,74,102,151,180,187],"surge":[10],"in":[11,18,30,61,68],"number":[13],"of":[14,27,110,119,131,182,193],"malicious":[15,31,49,87,111,177],"uploads":[17],"recent":[19],"years.":[20],"Prior":[21],"studies":[22],"have":[23,195],"demonstrated":[24],"effectiveness":[26],"learning-based":[28],"solutions":[29],"detection.":[33,142],"However,":[34],"manually-crafted":[35],"expert":[36],"rules":[37],"are":[38,58],"expensive":[39],"and":[40,100,122,136,165,190],"struggle":[41],"to":[42,85,105,127],"keep":[43],"pace":[44],"with":[45,82],"rapidly":[47],"evolving":[48],"behaviors,":[50],"while":[51],"deep":[52,79,107,132],"features":[53,84,109,135,138],"automatically":[54],"extracted":[55],"from":[56,96,179],"code":[57,80,93,133],"still":[59],"inaccurate":[60],"certain":[62],"cases.":[63],"To":[64],"mitigate":[65],"these":[66],"issues,":[67],"this":[69],"paper,":[70],"we":[71,115,171],"propose":[72],"Ea4mp,":[73,170],"novel":[75],"approach":[76],"which":[77],"integrates":[78],"behaviors":[81],"metadata":[83,120,137],"detect":[86],"PyPI":[88,200],"packages.":[89],"Specifically,":[90],"Ea4mp":[91,145,160],"extracts":[92],"behavior":[94,134],"sequences":[95],"all":[97],"script":[98],"files":[99],"fine-tunes":[101],"BERT":[103],"model":[104],"learn":[106],"semantic":[108],"code.":[112],"In":[113],"addition,":[114],"realize":[116],"value":[118],"information":[121],"construct":[123],"an":[124],"ensemble":[125],"classifier":[126],"combine":[128],"strengths":[130],"more":[140],"effective":[141],"We":[143],"evaluated":[144],"against":[146],"three":[147],"state-of-the-art":[148],"baselines":[149],"on":[150],"newly":[152],"constructed":[153],"dataset.":[154],"The":[155],"experimental":[156],"results":[157],"show":[158],"that":[159],"improves":[161],"precision":[162],"by":[163,167,198],"6.9%-24.6%":[164],"recall":[166],"10.5%-18.4%.":[168],"With":[169],"successfully":[172],"identified":[173],"119":[174],"previously":[175],"unknown":[176],"packages":[178,185],"pool":[181],"46,573":[183],"newly-uploaded":[184],"over":[186],"three-week":[188],"period,":[189],"82":[191],"out":[192],"them":[194],"been":[196],"removed":[197],"official.":[201]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":1}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}