通过无监督签名生成支持软件供应链攻击检测
Supporting the Detection of Software Supply Chain Attacks through Unsupervised Signature Generation
摘要：
在软件供应链攻击中使用的木马化软件包构成了一种新的威胁。不幸的是，仍然缺乏允许自动和及时检测恶意软件包的可扩展方法，因此大多数检测都基于手工劳动和专业知识。然而，已经观察到，大多数攻击活动包括共享相同或相似恶意代码的多个包。我们利用这一事实来自动复制手动识别的已知恶意软件包集群，这些恶意软件包已用于现实世界的攻击，从而减少了对专家知识和手动检查的需求。我们的方法，AST聚类使用MCL模仿专业知识（ACME），产生有希望的结果与$F_{1}$得分为0.99。签名是基于集群中的特征代码片段自动生成的，随后用于扫描整个npm注册表以查找未报告的恶意软件包。我们能够识别并报告六个恶意软件包，这些软件包已经从npm中删除。因此，我们的方法可以通过减少体力劳动来支持分析人员，因此可以用来及时检测可能的软件供应链攻击。
英文摘要：
Trojanized software packages used in software supply chain attacks constitute an emerging threat. Unfortunately, there is still a lack of scalable approaches that allow automated and timely detection of malicious software packages and thus most detections are based on manual labor and expertise. However, it has been observed that most attack campaigns comprise multiple packages that share the same or similar malicious code. We leverage that fact to automatically reproduce manually identified clusters of known malicious packages that have been used in real world attacks, thus, reducing the need for expert knowledge and manual inspection. Our approach, AST Clustering using MCL to mimic Expertise (ACME), yields promising results with a $F_{1}$ score of 0.99. Signatures are automatically generated based on characteristic code fragments from clusters and are subsequently used to scan the whole npm registry for unreported malicious packages. We are able to identify and report six malicious packages that have been removed from npm consequentially. Therefore, our approach can support analysts by reducing manual labor and hence may be employed to timely detect possible software supply chain attacks.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
