MalWuKong: Towards Fast, Accurate, and Multilingual Detection of Malicious Code Poisoning in OSS Supply Chains

Li, Ningke; Wang, Shenao; Feng, Mingxi; Wang, Kailong; Wang, Meizhen; Wang, Haoyu

doi:10.1109/ase56229.2023.00073

2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE) 2023

DOI: 10.1109/ase56229.2023.00073

|View full text |Cite

MalWuKong: Towards Fast, Accurate, and Multilingual Detection of Malicious Code Poisoning in OSS Supply Chains

Ningke Li,

Shenao Wang,

Mingxi Feng

et al.

Help me understand this report

Search citation statements

Order By: Relevance

Paper Sections

Select...

Citation Types

Supporting

Mentioning

Contrasting

Year Published

2024

Publication Types

Select...

Article1

Relationship

Self Cite0

Independent1

Authors

Journals

Cited by 1 publication

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

Beyond Fidelity: Explaining Vulnerability Localization of Learning-Based Detectors

Cheng,

Zhao,

Wang

et al. 2024

ACM Trans. Softw. Eng. Methodol.

View full text Add to dashboard Cite

: Vulnerability detectors based on deep learning (DL) models have proven their effectiveness in recent years. However, the shroud of opacity surrounding the decision-making process of these detectors makes it difficult for security analysts to comprehend. To address this, various explanation approaches have been proposed to explain the predictions by highlighting important features, which have been demonstrated effective in other domains such as computer vision and natural language processing. Unfortunately, an in-depth evaluation of vulnerability-critical features, such as fine-grained vulnerability-related code lines, learned and understood by these explanation approaches remains lacking. In this study, we first evaluate the performance of ten explanation approaches for vulnerability detectors based on graph and sequence representations, measured by two quantitative metrics including fidelity and vulnerability line coverage rate. Our results show that fidelity alone is not sufficient for evaluating these approaches, as fidelity incurs significant fluctuations across different datasets and detectors. We subsequently check the precision of the vulnerability-related code lines reported by the explanation approaches, and find poor accuracy in this task among all of them. This can be attributed to the inefficiency of explainers in selecting important features and the presence of irrelevant artifacts learned by DL-based detectors.

show abstract

Beyond Fidelity: Explaining Vulnerability Localization of Learning-Based Detectors

Cheng,

Zhao,

Wang

et al. 2024

ACM Trans. Softw. Eng. Methodol.

View full text Add to dashboard Cite

show abstract

scite is a Brooklyn-based organization that helps researchers better discover and understand research articles through Smart Citations–citations that display the context of the citation and describe whether the article provides supporting or contrasting evidence. scite is used by students and researchers from around the world and is funded in part by the National Science Foundation and the National Institute on Drug Abuse of the National Institutes of Health.

Contact Info

customersupport@researchsolutions.com

10624 S. Eastern Ave., Ste. A-614

Henderson, NV 89052, USA

Blog Terms and Conditions API Terms Privacy Policy Contact Cookie Preferences Do Not Sell or Share My Personal Information

Made with 💙 for researchers

Part of the Research Solutions Family.

MalWuKong: Towards Fast, Accurate, and Multilingual Detection of Malicious Code Poisoning in OSS Supply Chains

Cited by 1 publication

References 23 publications

Beyond Fidelity: Explaining Vulnerability Localization of Learning-Based Detectors

Beyond Fidelity: Explaining Vulnerability Localization of Learning-Based Detectors

Contact Info

Product

Resources

About