用静态调用图生成行为序列，实现可解释的恶意代码检测。
MOLOT System Card: Malicious Operational Logic Observation Transformer
- 将源码转为调用图衍生的行为序列进行分析
- 在PyPI和npm上检测准确率优于开源工具，误报率低
- 适合需要可解释性与轻量部署的DevSecOps场景
MOLOT（恶意操作逻辑观测变压器）是一种面向SAST环境的静态恶意代码检测系统，适用于包元数据、维护者历史或动态执行轨迹不可靠的情况。该系统将源码表示为基于静态调用图的行为序列，并包含解释阶段，对可疑行为活动进行排序并映射回源码位置。在PyPI和npm的Python与JavaScript包上进行了评估，对比了开源检测工具，并在真实审核流程中验证了运行时、内存占用和误报率等产品约束条件下的有效性。同时发布了Open Malicious-Code Bench，一个公开基准用于可复现的恶意包检测方法评估。结果表明，静态行为序列建模可在现代DevSecOps流程中提供准确、可解释且可部署的恶意代码检测能力。
原文摘要 · Abstract (English)
MOLOT (Malicious Operational Logic Observation Transformer) is a static malicious-code detection system designed for SAST setup where package metadata, maintainer history, and dynamic execution traces may be unavailable or unreliable. The system represents source code as behavior sequences derived from static call graphs, includes an explanation stage that ranks suspicious behavior activities and maps them back to source-code locations. The approach is evaluated on Python and JavaScript packages from PyPI and npm, compared with opensource detection tools, and validated under product constraints including runtime, memory use, and false-positive rates observed in a real moderation workflow. We also release Open Malicious-Code Bench, a public benchmark for reproducible evaluation of malicious-package detection methods. The results show that static behavior-sequence modeling can provide accurate, explainable, and deployable malicious-code detection for modern DevSecOps workflows.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。