Pith. sign in

REVIEW 4 major objections 6 minor 2 cited by

This paper claims that runtime behaviors of open-source packages, captured in sandboxed executions, can be turned into a ranked list of concrete artifacts—file paths, commands, DNS hosts, and sockets—that guide security analysts toward the

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 11:12 UTC pith:QLAKCBSJ

load-bearing objection Solid, well-engineered triage system for runtime traces, but the 'real-world alignment' validation leans on its own dataset; needs external incident labels before the headline holds. the 4 major comments →

arxiv 2601.06948 v2 pith:QLAKCBSJ submitted 2026-01-11 cs.CR

Operational Runtime Behavior Mining for Open-Source Supply Chain Security

Zhuoran Tan , Ke Xiao , Jeremy Singer , Christos Anagnostopoulos This is my paper
classification cs.CR
keywords open-source software securitysoftware supply chainruntime behavior analysissandbox-based analysisthreat huntingheterogeneous graph learninggraph attention networkanalyst-in-the-loop triage
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Open-source packages often run code that security teams cannot easily read, so they must rely on what the code does at runtime. This paper argues that those runtime observations—file accesses, network connections, DNS queries, and executed commands—can be converted into a ranked list of concrete artifacts that point an analyst to the most suspicious behaviors. Its central claim is that an attention-based graph model, trained on labeled sandbox executions across five ecosystems, surfaces top-ranked entities that align with real-world vulnerabilities and attack trends. If that holds, security teams could triage unknown packages by inspecting a short list of ranked paths, hosts, and commands instead of wading through noisy event logs.

Core claim

The paper introduces HeteroGAT-Rank, a system that models each software package as a one-hop star-shaped heterogeneous graph rooted at a package node and connected to typed runtime entities: file paths, commands, DNS hosts, and socket endpoints. A type-aware GATv2 attention network learns to predict whether the package is malicious, while simultaneously producing node- and edge-level attention scores. Those scores are aggregated into rankings, augmented by a Grad-CAM-style gradient signal, so that for any given package the system outputs a small set of behavioral indicators ranked by relevance. The authors extend a published cross-ecosystem dataset of sandboxed runtime traces with additional

What carries the argument

The load-bearing object is the one-hop heterogeneous behavior graph: each package is a root node with typed edges to its direct runtime interactions—read/write/delete actions on paths, command executions, DNS queries, and socket connections. The mechanism that makes it work is type-aware GATv2 attention, which computes per-edge importance scores; an ensemble loss (classification, contrastive, entropy, sparsity) shapes those attention weights toward decisive and compact evidence. This combination converts a raw execution trace into a short ranked list of inspectable entities.

Load-bearing premise

The load-bearing premise is that the labels in the extended dataset are correct and consistently applied; because this paper inherits the labeling criteria from the base dataset without describing them, the model could be ranking patterns that correlate with labeling noise rather than with security-relevant behavior.

What would settle it

Retrieve the executed packages for the malicious instances added by the paper and check whether the top-ranked entities (e.g., a specific /tmp path, a custom *.js file, an outbound domain) match the artifacts mentioned in independent, manually confirmed vulnerability reports for those exact package versions. A systematic mismatch, or a match that also appears when the labels are randomly shuffled, would indicate the rankings reflect dataset artifacts rather than true behavioral indicators.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Analysts can take the top-ranked entities and use them directly as search queries in logs and telemetry, turning a noisy trace into a short list of investigation pivots.
  • Because the graph schema only requires file, DNS, socket, and command events, the pipeline can be applied to any comparable sandbox or endpoint telemetry source, not just the five ecosystems tested.
  • The cross-ecosystem training setup encourages the model to learn behavior patterns that generalize, such as install-time script execution and outbound network activity, rather than per-ecosystem quirks.
  • The method is positioned as a high-recall filter for analyst triage; even if precision under a fixed threshold is moderate, the ranked evidence is operationally actionable.
  • Ranked indicators can be exported into machine-readable rules for downstream forensics and monitoring platforms, enabling large-scale hunting across ecosystems.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the rankings are truly behavior-driven, the same attention mechanism could be retargeted to provenance graphs from endpoint detection systems, where process trees and file/network events are the raw evidence.
  • The paper's reliance on inherited labeling criteria means the strongest validation would be a blind test against independently confirmed incident reports for the extended dataset's malicious packages; the authors do not perform this.
  • The interpretability signal (attention and Grad-CAM-style weights) is a proxy for influence, not causality; a natural next step would be counterfactual perturbation of top-ranked entities to measure actual prediction dependence.
  • An implicit, testable prediction is that the top-ranked entities for known supply-chain attacks should overlap with the artifacts named in public writeups; this could be measured on a held-out set of recent attacks.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes HeteroGAT-Rank, a system that transforms sandboxed execution traces of open-source packages into one-hop heterogeneous graphs and uses type-aware GATv2 attention to rank runtime entities (paths, commands, DNS hosts, sockets) as analyst-in-the-loop investigation pivots. The system is evaluated on a 9,758-instance dataset spanning five package ecosystems, with ablations, scalability measurements, and qualitative case studies. The central claim is that the surfaced behavioral indicators are meaningful, interpretable, and aligned with real-world vulnerability and attack trends, supporting practical triage workflows.

Significance. If the validation were independent, this would be a useful systems contribution: the one-hop graph schema is simple and operationally motivated, the engineering (decoupled graph construction, streaming, distributed training) is credible, the artifact is released, and the framing as pivot generation rather than automated detection is appropriate. The paper also reports concrete resource costs, which is rare and valuable for practitioners. However, the headline claim of real-world alignment is currently supported mainly by a trend score computed against the same dataset family that supplies the training labels, and by a CVE linkage that the authors themselves label weak. With additional external validation and a clear description of the labeling criteria, the contribution would be solid; without them, the central claim is not established.

major comments (4)
  1. [§4.2, §3.1, Table 6] The Trend Score validation is circular in a way that directly affects the central claim. §4.2 aligns surfaced features with 'threat trend indicators from IOC data [41]', but [41] is the same OSPTrack source from which the base labels are taken and whose collection pipeline and labeling criteria the extension in §3.1 replicates. The model is trained on those labels, then its attention is aligned with trend indicators from the same dataset. Table 6's high Trend Scores therefore do not demonstrate consistency with independent real-world trends; they may simply show that attention tracks the dataset's own label distribution. I ask for validation against an external source not used in training/labeling, e.g., OSV/GitHub Advisories, public IOC feeds, or manually curated attack reports, with a description of how those sources were obtained.
  2. [§4.2, Table 6] The CVE linkage is too weak to bear the 'semantically grounded' conclusion. The authors state that it uses 'lightweight name-level heuristics' with no version resolution, and that reported counts are only 'a weak, lower-bound external validity signal.' Moreover, the method is underspecified: surfaced entities are paths, domains, and commands, so it is unclear how these are mapped to package names for CVE queries. The results are also internally inconsistent: HeteroGAT has CVE count 1 but the highest Trend/Desc scores, while DHeteroGAT/PNHeteroGAT have CVE count 186 but lower Trend/Desc scores. This pattern is compatible with the two metrics measuring different things, but the current text cherry-picks the favorable metric for each variant. Please provide the mapping procedure and a version-resolved CVE/OSV evaluation, or explicitly limit the claim to 'consistency with the authors' own da
  3. [§3.1, Table 1] The labeling criteria for the extended malicious instances are not described. §3.1 says the extension applies 'the same labeling criteria as the base dataset,' but those criteria are inherited from [41] and are not explained in this paper. Because the entire supervised signal—and thus the attention ranking that is the paper's output—depends on these labels, the reader cannot assess whether the model learns security-relevant behavior or labeling artifacts. This concern is amplified by Table 1, where rubygems has an 81.9% malicious rate. Please specify the labeling criteria concretely, report per-ecosystem label distributions for the extended portion, and provide a validation/audit of a sample of labels.
  4. [§5.2, Table 4] The proposed full model (PNHeteroGAT) has AUC 0.736, while the simpler HeteroGAT variant achieves 0.9529; DHeteroGAT is also much lower (0.7234–0.7265). The paper dismisses this as a 'sanity check,' but the model whose attention ranking is the main deliverable is substantially worse at discriminating malicious from benign instances. If the auxiliary objectives intentionally trade detection accuracy for ranking quality, this should be demonstrated rather than assumed—for example, by showing that the top-K indicators from PNHeteroGAT are preferred by independent evaluators or align better with external ground truth. As written, the lower discriminative performance undermines confidence that the attention weights are meaningful beyond the training distribution.
minor comments (6)
  1. [Algorithm 1] The Gaussian noise factor η and top-k values are not reported. Since ranking is the core output, please provide the chosen values and a sensitivity analysis showing that results are not sensitive to the noise scale.
  2. [Table 5] The units for 'Peak GPU Usage' and 'Peak GPU Reserve' are not labeled. They appear to be MB, but please state this explicitly.
  3. [§3.3.1] The text says aggregation into Package_Name nodes is ignored, but Figure 3 shows a package node in the input graph. Please clarify whether the package node is used only as a source and not as a target in message passing, and why this does not lose the root-level context.
  4. [§4.2] The 'unified reliability score' formula is described in words but not given an equation number or a precise definition of how w_i, s_ij, and c_j are computed for each feature and reference. Please provide the full equation and describe the normalization steps.
  5. [Table 6] The CVE Count for Entropy is reported as 87, but the entropy baseline ranks individual tokens such as 'Readline/readline-i.ri'. It is unclear how token-level features are mapped to package names for CVE linkage. Please explain or remove this number.
  6. [Global] There are several grammatical slips, e.g., 'The full implementation is provides in Algorithm 1' and 'Due to small batch size setting up, LayerNorm is implemented...'. A careful proofreading pass is needed.

Circularity Check

1 steps flagged

Trend-score validation is self-referential: the same OSPTrack dataset supplies training labels and the 'IOC' trend indicators used as external alignment; CVE linkage is conceded to be weak.

specific steps
  1. self citation load bearing [Sections 3.1 and 4.2 (and Table 6 'Trend Score' column)]
    "we build on the published cross-ecosystem runtime-trace dataset [41]... we extend the dataset by replaying the same OpenSSF collection pipeline and applying the same labeling criteria as the base dataset... To further validate semantic reliability, we align extracted features with two complementary knowledge sources: (a) threat trend indicators from IOC data [41], and (b) descriptive text from CVE reports."

    The validation chain is not independent of the training signal. Training labels (Sec. 3.1) and the 'IOC data [41]' trend indicators (Sec. 4.2) come from the same OSPTrack dataset, whose authors overlap with the present paper (ref [41]: Tan, Anagnostopoulos, Singer). Since the attention weights that produce ranked features are optimized to separate OSPTrack's malicious/benign labels, high similarity between those features and OSPTrack's attack_type/trigger_mechanism metadata is expected if the model has learned the dataset's own label structure; it does not independently demonstrate 'alignment with real-world vulnerability and attack trends' (Abstract). The only external check, CVE linkage, is explicitly described in Sec. 4.2 as 'a weak, lower-bound external validity signal' using name-leve

full rationale

The paper's core modeling contribution—deterministic construction of one-hop heterogeneous runtime graphs plus attention-based ranking—is internally self-contained: graph construction is a mapping from traces, training uses held-out splits, and scalability is measured directly. Predictive performance in Table 4 is a meaningful sanity check against the dataset, not circular. However, the headline claim of alignment with 'real-world vulnerability and attack trends' rests on Sec. 4.2's Trend Score, which compares model features against IOC data [41]—the authors' own OSPTrack dataset that also supplies the training labels and the labeling criteria inherited for the extension. Therefore the high Trend Scores in Table 6 are at least partly a self-consistency check, not an independent external validation. The CVE-based checks are external but explicitly 'weak, lower-bound', using name-level heuristics and no version resolution. This yields a partial, not total, circularity: the architecture and held-out detection results stand, but the empirical demonstration of real-world alignment is not yet independent of the self-citation chain. Score 5.

Axiom & Free-Parameter Ledger

7 free parameters · 6 axioms · 0 invented entities

The system's contribution rests on the integrity of self-constructed labels, the untested assumption that attention equals security salience, and cross-ecosystem generalization that is not directly measured. The hyperparameters of CompositeLoss are partially unspecified. No new physical or conceptual entities are invented.

free parameters (7)
  • lambda_ent = 0.01
    Entropy regularizer weight in CompositeLoss (Section 3.3.3); chosen by hand to stabilize training.
  • lambda_sp = 0.01
    Sparsity regularizer weight in CompositeLoss (Section 3.3.3); chosen by hand.
  • lambda_cls = not reported
    Classification loss weight in CompositeLoss; not specified in text.
  • lambda_ctr = not reported
    Contrastive loss weight in CompositeLoss; not specified in text.
  • top_k = 10 (evaluation); not specified for pooling
    K=10 used in Table 6 feature ranking; top-k for attention pooling not specified.
  • noise_factor_eta = not reported
    Gaussian noise factor in Algorithm 1 (Section 4.1).
  • batch_size = 24
    Fixed training protocol (Section 5.2).
axioms (6)
  • domain assumption The OSPTrack labeling criteria (from the authors' prior paper [41]) correctly identify malicious packages
    The extension labels are applied by the authors using 'the same labeling criteria as the base dataset' (Section 3.1); no external audit of labels is provided.
  • domain assumption Sandbox install/import traces are a sufficient proxy for a package's runtime behavior
    The system relies on OpenSSF sandbox traces (Section 3.1); Section 7.2 admits dormant, environment-gated, or time-bombed behaviors are not captured.
  • domain assumption GATv2 attention scores are a valid proxy for security relevance of runtime entities
    The paper uses attention/Grad-CAM as ranking signals (Sections 3.3.4, 4) without counterfactual or causal validation (Section 7.2).
  • domain assumption Cross-ecosystem pooling avoids ecosystem-specific shortcuts
    The paper assumes joint modeling across ecosystems reduces shortcuts (Section 3.1); no experiment isolating ecosystem transfer is presented.
  • standard math Contrastive loss with standard negative sampling improves cross-ecosystem robustness
    Adopted from prior work [31] and added to the loss (Section 3.3.3).
  • ad hoc to paper The Gaussian noise in Algorithm 1 prevents deterministic overfitting
    Section 4.1 adds N(0,η) to attention scores without justification or sensitivity analysis.

pith-pipeline@v1.3.0-alltime-deepseek · 17369 in / 13547 out tokens · 129923 ms · 2026-08-03T11:12:13.537513+00:00 · methodology

0 comments
read the original abstract

Open-source software (OSS) is a critical component of modern software systems, yet supply chain security remains challenging in practice due to unavailable or obfuscated source code. Consequently, security teams often rely on runtime observations collected from sandboxed executions to investigate suspicious third-party components. We present HeteroGAT-Rank, an industry-oriented runtime behavior mining system that supports analyst-in-the-loop supply chain threat investigation. The system models execution-time behaviors of OSS packages as lightweight heterogeneous graphs and applies attention-based graph learning to rank behavioral patterns that are most relevant for security analysis. Rather than aiming for fully automated detection, HeteroGAT-Rank surfaces actionable runtime signals - such as file, network, and command activities - to guide manual investigation and threat hunting. To operate at ecosystem scale, the system decouples offline behavior mining from online analysis and integrates parallel graph construction for efficient processing across multiple ecosystems. An evaluation on a large-scale OSS execution dataset shows that HeteroGAT-Rank effectively highlights meaningful and interpretable behavioral indicators aligned with real-world vulnerability and attack trends, supporting practical security workflows under realistic operational constraints.

Figures

Figures reproduced from arXiv: 2601.06948 by Christos Anagnostopoulos, Jeremy Singer, Ke Xiao, Zhuoran Tan.

Figure 1
Figure 1. Figure 1: Knowledge Graph Construction Pipeline [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Record-to-Graph Example 3.2 Knowledge Graph Creation To analyze runtime behaviors across ecosystems, we transform raw sandbox execution traces into heterogeneous subgraphs that represent each package’s behavioral footprint. The pipeline, sum￾marized in bottom part of [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: HeteroGAT-Rank Framework Why these components. Each term targets a distinct failure mode observed in practice: removing Lcontras reduces embedding sepa￾rability and generalization across ecosystems; removing Lentropy makes attention diffuse and explanations unstable; removing Lsparsity leads to overly large subgraphs that are less actionable. We do not include additional objectives (e.g., reconstruction lo… view at source ↗
Figure 4
Figure 4. Figure 4: Training Loss Comparison Across Models [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Securing the Dark Matter: A Semantic-Enhanced Neuro-Symbolic Framework for Supply Chain Analysis of Opaque Industrial Software

    cs.SE 2026-05 unverdicted novelty 6.0

    A neuro-symbolic framework reconstructs semantics from opaque binaries via abstract interpretation, reflexive LLM prompting, typed knowledge graphs, and Graphormer reasoning to outperform baselines in vulnerability de...

  2. An Evaluation of Large Language Models for Detection of Malicious Python Packages

    cs.CR 2026-02 conditional novelty 5.0

    LLMs detect malicious PyPI packages reasonably at package level but identify specific malicious code indicators poorly, a 'granularity gap' that limits them to triage.

Reference graph

Works this paper leans on

56 extracted references · 2 canonical work pages · cited by 2 Pith papers

  1. [1]

    [n. d.]. Anonymized Repository: DDGRL-2C32. Anonymous GitHub (4open.science). https://anonymous.4open.science/r/DDGRL-2C32/ Ac- cessed: 2026-01-11

    2026

  2. [2]

    Mahdi Bahaghighat, Majid Ghasemi, and Figen Ozen. 2023. A high-accuracy phishing website detection method based on machine learning.Journal of Infor- mation Security and Applications77 (2023), 103553. doi:10.1016/j.jisa.2023.103553

    arXiv 2023

  3. [3]

    Frederick Barr-Smith, Tim Blazytko, Richard Baker, and Ivan Martinovic. 2022. Exorcist: Automated Differential Analysis to Detect Compromises in Closed- Source Software Supply Chains. InProceedings of the 2022 ACM Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses(Los Angeles, CA, USA)(SCORED’22). Association for Computing Machine...

    arXiv 2022

  4. [4]

    Piotr Bojanowski, Edouard Grave, Armand Joulin, and Tomas Mikolov. 2017. En- riching Word Vectors with Subword Information.Transactions of the Association for Computational Linguistics5 (06 2017), 135–146. doi:10.1162/tacl_a_00051

    doi:10.1162/tacl_a_00051 2017

  5. [5]

    Shaked Brody, Uri Alon, and Eran Yahav. 2022. How Attentive are Graph Atten- tion Networks? International Conference on Learning Representations

    2022

  6. [6]

    Tianqi Chen and Carlos Guestrin. 2016. XGBoost: A Scalable Tree Boosting System. InProceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD ’16). ACM, 785–794. doi:10.1145/29 39672.2939785

    arXiv 2016

  7. [7]

    Matthias Fey and Jan Eric Lenssen. 2019. Fast Graph Representation Learning with PyTorch Geometric. arXiv:1903.02428 [cs.LG] https://arxiv.org/abs/1903.02428

    Pith/arXiv arXiv 2019

  8. [8]

    Fabian Niklas Froh, Matías Federico Gobbi, and Johannes Kinder. 2023. Differ- ential Static Analysis for Detecting Malicious Updates to Open Source Pack- ages. InProceedings of the 2023 Workshop on Software Supply Chain Offen- sive Research and Ecosystem Defenses. ACM, Copenhagen Denmark, 41–49. doi:10.1145/3605770.3625211

    arXiv 2023

  9. [9]

    Yehuda Gelb. 2023. Lazarus Group Launches First Open Source Supply Chain Attacks Targeting Crypto Sector. https://medium.com/checkmarx-security/lazar us-group-launches-first-open-source-supply-chain-attacks-targeting-crypto- sector-cabc626e404e

    2023

  10. [10]

    Yehuda Gelb. 2023. An Ongoing Open Source Attack Reveals Roots Dating Back to 2021. https://medium.com/checkmarx-security/an-ongoing-open-source- attack-reveals-roots-dating-back-to-2021-4a511979fd98 Accessed: 2025-07-07

    2023

  11. [11]

    Yehuda Gelb. 2023. Python Packages Leverage GitHub to Deploy Fileless Malware. https://checkmarx.com/blog/python-packages-leverage-github-to-deploy- fileless-malware/ Accessed: 2025-07-07

    2023

  12. [12]

    Daniele Grattarola, Daniele Zambon, Filippo Maria Bianchi, and Cesare Alippi

  13. [13]

    OpenSSF Securing Critical Projects Working Group. 2024. Package Analysis — open source packages behaviour sandbox. https://github.com/ossf/package- analysis. Accessed: 2025-10-20

    2024

  14. [14]

    Sylvain Gugger, Lysandre Debut, Thomas Wolf, Philipp Schmid, Zachary Mueller, Sourab Mangrulkar, Marc Sun, and Benjamin Bossan. 2022. Accelerate: Training and inference at scale made simple, efficient and adaptable. https://github.com/h uggingface/accelerate

    2022

  15. [15]

    Adam Harwood. 2023. Using Velociraptor for large-scale endpoint visibility and rapid threat hunting. https://www.pentestpartners.com/security-blog/using- velociraptor-for-large-scale-endpoint-visibility-and-rapid-threat-hunting/. Accessed: 2025-10-16

    2023

  16. [16]

    Jiangpeng He, Runyu Mao, Zeman Shao, and Fengqing Zhu. 2020. Incremental Learning in Online Scenario . In2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE Computer Society, Los Alamitos, CA, USA, 13923–13932. doi:10.1109/CVPR42600.2020.01394

    arXiv 2020

  17. [17]

    Xuehai Jia, Junwei Du, Minying Fang, Hao Liu, Yuying Li, and Feng Jiang. 2025. Vulnerability detection with graph enhancement and global dependency rep- resentation learning.Automated Software Engineering32, 1 (May 2025), 14. doi:10.1007/s10515-024-00484-3

    work page doi:10.1007/s10515-024-00484-3 2025

  18. [18]

    Zian Jia, Yun Xiong, Yuhong Nan, Yao Zhang, Jinjing Zhao, and Mi Wen. 2024. MAGIC: Detecting Advanced Persistent Threats via Masked Graph Represen- tation Learning. In33rd USENIX Security Symposium, USENIX Security 2024. USENIX

    2024

  19. [19]

    Baoxiang Jiang, Tristan Bilot, Nour El Madhoun, Khaldoun Al Agha, Anis Zouaoui, Shahrear Iqbal, Xueyuan Han, and Thomas Pasquier. 2025. ORTHRUS: Achieving High Quality of Attribution in Provenance-based Intrusion Detection Systems. InSecurity Symposium (USENIX Sec’25). USENIX, USENIX

    2025

  20. [20]

    Chen Liang, Qiang Wei, Zirui Jiang, Yisen Wang, and Jiang Du. 2024. A Source Code Vulnerability Detection Method Based on Adaptive Graph Neu- ral Networks. InProceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering Workshops(Sacramento, CA, USA)(ASEW ’24). Association for Computing Machinery, New York, NY, USA, 187–196. ...

    arXiv 2024

  21. [21]

    Guilong Lu, Xiaolin Ju, Xiang Chen, Wenlong Pei, and Zhilong Cai. 2024. GRACE: Empowering LLM-based software vulnerability detection with graph structure and in-context learning.Journal of Systems and Software212 (2024), 112031. doi:10.1016/j.jss.2024.112031

    arXiv 2024

  22. [22]

    Lundberg and Su-In Lee

    Scott M. Lundberg and Su-In Lee. 2017. A unified approach to interpreting model predictions. InProceedings of the 31st International Conference on Neural Information Processing Systems(Long Beach, California, USA)(NIPS’17). Curran Associates Inc., Red Hook, NY, USA, 4768–4777

    2017

  23. [23]

    Chuan Luo, Sizhao Wang, Tianrui Li, Hongmei Chen, Jiancheng Lv, and Zhang Yi. 2023. RHDOFS: A Distributed Online Algorithm Towards Scalable Streaming Feature Selection.IEEE Transactions on Parallel and Distributed Systems34 (2023), 1830–1847. doi:10.1109/TPDS.2023.3265974

    arXiv 2023

  24. [24]

    Jordan, and Ion Stoica

    Philipp Moritz, Robert Nishihara, Stephanie Wang, Alexey Tumanov, Richard Liaw, Eric Liang, Melih Elibol, Zongheng Yang, William Paul, Michael I. Jordan, and Ion Stoica. 2018. Ray: A Distributed Framework for Emerging AI Applications. arXiv:1712.05889 [cs.DC] https://arxiv.org/abs/1712.05889

    Pith/arXiv arXiv 2018

  25. [25]

    Daniel Müllner. 2011. Modern hierarchical, agglomerative clustering algorithms. arXiv:1109.2378 [stat.ML] https://arxiv.org/abs/1109.2378

    Pith/arXiv arXiv 2011

  26. [26]

    Marc Ohm, Henrik Plate, Arnold Sykosch, and Michael Meier. 2020. Backstab- ber’s Knife Collection: A Review of Open Source Software Supply Chain Attacks. InDetection of Intrusions and Malware, and Vulnerability Assessment: 17th Inter- national Conference, DIMV A 2020, Lisbon, Portugal, June 24–26, 2020, Proceedings (Lisbon, Portugal). Springer-Verlag, Ber...

    doi:10.1007/978- 2020

  27. [27]

    Kush Pandya. 2025. 10 npm Typosquatted Packages Deploy Multi-Stage Creden- tial Harvester. Socket Blog (Research Security News). https://socket.dev/blog/10- npm-typosquatted-packages-deploy-credential-harvester Accessed: 2026-01-11

    2025

  28. [28]

    Jeffrey Pennington, Richard Socher, and Christopher Manning. 2014. GloVe: Global Vectors for Word Representation. InProceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP), Alessandro Moschitti, Bo Pang, and Walter Daelemans (Eds.). Association for Computational Linguistics, Doha, Qatar, 1532–1543. doi:10.3115/v1/D14-1162

    doi:10.3115/v1/d14-1162 2014

  29. [29]

    Mario Alfonso Prado-Romero, Bardh Prenkaj, Giovanni Stilo, and Fosca Giannotti

  30. [30]

    J. R. Quinlan. 1986. Induction of decision trees.Machine Learning1, 1 (1986), 81–106. doi:10.1007/BF00116251

    doi:10.1007/bf00116251 1986

  31. [31]

    Surv.56, 7, Article 171 (April 2024), 37 pages

    A Survey on Graph Counterfactual Explanations: Definitions, Methods, Evaluation, and Research Challenges.ACM Comput. Surv.56, 7, Article 171 (April 2024), 37 pages. doi:10.1145/3618105

    doi:10.1145/3618105 2024

  32. [32]

    Nils Reimers and Iryna Gurevych. 2019. Sentence-BERT: Sentence Embeddings using Siamese BERT-Networks. arXiv:1908.10084 [cs.CL] https://arxiv.org/abs/ 1908.10084

    Pith/arXiv arXiv 2019

  33. [33]

    Jakub Reha, Giulio Lovisotto, Michele Russo, Alessio Gravina, and Claas Grohn- feldt. 2023. Anomaly Detection in Continuous-Time Temporal Provenance Graphs. InTemporal Graph Learning Workshop @ NeurIPS 2023. MIT Press. https://openreview.net/forum?id=88tGIxxhsf

    2023

  34. [34]

    Kunlun Ren, Weizhong Qiang, Yueming Wu, Yi Zhou, Deqing Zou, and Hai Jin. 2023. An Empirical Study on the Effects of Obfuscation on Static Machine Learning-Based Malicious JavaScript Detectors. InProceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis(Seattle, WA, USA)(ISSTA 2023). Association for Computing Machinery, ...

    arXiv 2023

  35. [35]

    Jiafeng Ren and Rong Geng. 2025. Provenance-based APT campaigns detection via masked graph representation learning.Computers & Security148 (Jan. 2025), 104159. doi:10.1016/j.cose.2024.104159

    arXiv 2025

  36. [36]

    Muhammad Fakhrur Rozi, Tao Ban, Seiichi Ozawa, Akira Yamada, Takeshi Taka- hashi, and Daisuke Inoue. 2024. Securing Code With Context: Enhancing Vulner- ability Detection Through Contextualized Graph Representations.IEEE Access 12 (2024), 142101–142126. doi:10.1109/ACCESS.2024.3467180

    arXiv 2024

  37. [37]

    2024.An Ongoing Open Source Attack Reveals Roots Dating Back to 2021

    Checkmarx Security Research. 2024.An Ongoing Open Source Attack Reveals Roots Dating Back to 2021. https://zero.checkmarx.com/an-ongoing-open- source-attack-reveals-roots-dating-back-to-2021-4a511979fd98 Accessed: 2025-10-15

    2024

  38. [38]

    Shadawck. 2023. MITRE CVE API Client. https://github.com/shadawck/mitrecve. Accessed: 2025-06-29

    2023

  39. [39]

    Schwarte

    Patrick Schober, Christa Boer, and Lothar A. Schwarte. 2018. Correlation Coeffi- cients: Appropriate Use and Interpretation.Anesthesia & Analgesia126, 5 (May 2018), 1763–1768. doi:10.1213/ANE.0000000000002864

    doi:10.1213/ane.0000000000002864 2018

  40. [40]

    Kiruthiga Subramanian and Weizhi Meng. 2021. Threat Hunting Using Elastic Stack: An Evaluation. In2021 IEEE International Conference on Service Operations and Logistics, and Informatics (SOLI). 1–6. doi:10.1109/SOLI54607.2021.9672347

    arXiv 2021

  41. [41]

    Philippe Skolka, Cristian-Alexandru Staicu, and Michael Pradel. 2019. Anything to Hide? Studying Minified and Obfuscated Code in the Web. InThe World Wide Web Conference(San Francisco, CA, USA)(WWW ’19). Association for Computing Machinery, New York, NY, USA, 1735–1746. doi:10.1145/3308558.3313752

    arXiv 2019

  42. [42]

    Reinhard Tartler, Christian Dietrich, Julio Sincero, Wolfgang Schröder-Preikschat, and Daniel Lohmann. 2014. Static Analysis of Variability in System Software: The 90,000#ifdefs Issue. In2014 USENIX Annual Technical Conference (USENIX ATC 14). USENIX Association, Philadelphia, PA, 421–432. https://www.usenix.o rg/conference/atc14/technical-sessions/presen...

    2014

  43. [43]

    Zhuoran Tan, Christos Anagnostopoulos, and Jeremy Singer. 2025. OSPtrack: A Labeled Dataset Targeting Simulated Execution of Open-Source Software. In 2025 IEEE/ACM 22nd International Conference on Mining Software Repositories (MSR). IEEE, 659–663. doi:10.1109/MSR66628.2025.00102 FSE ’26, July 5–9, 2026, Montréal, QC, Canada Zhuoran Tan, Ke Xiao, Jeremy Si...

    arXiv 2025

  44. [44]

    Lucija Valentić. 2023. Typosquatting campaign delivers r77 rootkit via npm. ReversingLabs Blog (Threat Research). https://www.reversinglabs.com/blog/r77- rootkit-typosquatting-npm-threat-research Accessed: 2026-01-11

    2023

  45. [45]

    2024.Malicious Modifications Detection: How Sysdig Identifies Open Source Attacks

    Sysdig Security Research Team. 2024.Malicious Modifications Detection: How Sysdig Identifies Open Source Attacks. https://www.sysdig.com/blog/malicious- modifications-detection-sysdig Accessed: 2025-10-15

    2024

  46. [46]

    Wei Xu, Fangfang Zhang, and Sencun Zhu. 2012. The power of obfuscation techniques in malicious JavaScript code: A measurement study. In2012 7th Inter- national Conference on Malicious and Unwanted Software. 9–16. doi:10.1109/MA LWARE.2012.6461002

    arXiv 2012

  47. [47]

    Wenhui Wang, Hangbo Bao, Li Dong, Furu Wei, Nan Yang, Xiaodong Liu, Yu Wang, Jianfeng Gao, Ming Zhou, and Hsiao-Wuen Hon. 2020. MiniLM: Deep Self-Attention Distillation for Task-Agnostic Compression of Pre-Trained Transformers. InAdvances in Neural Information Processing Systems. https: //arxiv.org/abs/2002.10957

    Pith/arXiv arXiv 2020

  48. [48]

    Hamilton, and Jure Leskovec

    Rex Ying, Jiaxuan You, Christopher Morris, Xiang Ren, William L. Hamilton, and Jure Leskovec. 2019. Hierarchical Graph Representation Learning with Differentiable Pooling. arXiv:1806.08804 [cs.LG]

    Pith/arXiv arXiv 2019

  49. [49]

    Jiao Yin, MingJian Tang, Jinli Cao, Mingshan You, Hua Wang, and Mamoun Alazab

  50. [50]

    Tianya Zhang. 2024. Network level spatial temporal traffic forecasting with Hierarchical-Attention-LSTM.Digital Transportation and Safety3, 4 (2024), 233–245. doi:10.48130/dts-0024-0021

    work page doi:10.48130/dts-0024-0021 2024

  51. [51]

    Xiaodong Zhang, Haoyu Guo, Zhiwei Zhang, Guiyuan Tang, Jun Sun, Yulong Shen, and Jianfeng Ma. 2025. Effectively Detecting Software Vulnerabilities via Leveraging Features on Program Slices.IEEE Internet of Things Journal12, 7 (2025), 8033–8048. doi:10.1109/JIOT.2025.3541090

    arXiv 2025

  52. [52]

    Guodong Zhang, Tianyu Yao, Jiawei Qin, Yitao Li, Qiao Ma, and Donghong Sun

  53. [56]

    Xinyi Zheng, Chen Wei, Shenao Wang, Yanjie Zhao, Peiming Gao, Yuanchao Zhang, Kailong Wang, and Haoyu Wang. 2024. Towards Robust Detection of Open Source Software Supply Chain Poisoning Attacks in Industry Environments. InProceedings of the 39th IEEE/ACM International Conference on Automated Soft- ware Engineering(Sacramento, CA, USA)(ASE ’24). Associatio...

    arXiv 2024

  54. [2023]

    doi:10.1109/TII.2022.3192027

    Knowledge-Driven Cybersecurity Intelligence: Software Vulnerability Coexploitation Behavior Discovery.IEEE Transactions on Industrial Informatics 19, 4 (April 2023), 5593–5601. doi:10.1109/TII.2022.3192027

    arXiv 2023

  55. [2024]

    doi:10.1109/TN NLS.2022.3190922

    Understanding Pooling in Graph Neural Networks.IEEE Transactions on Neural Networks and Learning Systems35, 2 (2024), 2708–2718. doi:10.1109/TN NLS.2022.3190922

    arXiv 2024

  56. [2025]

    doi:10.1016/j.jisa.2025.103973

    CodeSAGE: A multi-feature fusion vulnerability detection approach using code attribute graphs and attention mechanisms.Journal of Information Security and Applications89 (2025), 103973. doi:10.1016/j.jisa.2025.103973

    arXiv 2025