用代码风格分析识别软件仓库中的冒名顶替，提升供应链安全
Stylometric Defenses Against Author Impersonation in Software Repositories
- 通过跨模态模型分析代码差异和提交信息，生成作者风格向量
- 在真实攻击事件中，检测准确率达ROC AUC 0.93，误报率极低
- 适用于CI/CD流水线，可快速定位伪造提交，适合维护团队使用
软件供应链攻击日益利用维护者账户被劫持的漏洞，授权恶意变更。本文评估了基于补丁级别的作者身份验证作为行为防御层的有效性，表明风格分析不仅可作用于完整源文件，也能应用于补丁级提交。我们基于超过20年的Linux内核提交历史，微调一个跨模态Transformer，将代码差异与提交信息嵌入统一风格空间，实现开集作者验证的ROC AUC达0.93。随后，将这些表示用于适配持续集成与部署（CI/CD）环境的流式异常检测器。在两次回溯性供应链攻击事件中验证：2021年PHP后门事件与2026年ForceMemo/GlassWorm攻击。无需重新训练，该检测器在约1%的维护者审计队列中识别出所有伪造的PHP提交，并将28个可评分的ForceMemo伪造提交按仓库排序，平均每个仓库的审查负担仅为0.8%。结果表明，跨模态补丁级嵌入能有效支持真实仓库中对作者冒名的实时行为筛查。
原文摘要 · Abstract (English)
Software supply-chain attacks increasingly exploit an identity gap where compromised maintainer accounts authorize malicious changes. This work evaluates patch-level authorship verification as a behavioral defense layer, showing that stylometric analysis can operate not only on full source files but also on patch-level commits. We fine-tune a cross-modal transformer on more than 20 years of Linux kernel commit history to embed code diffs and commit messages into a unified stylometric space, achieving ROC AUC of 0.93 for open-world authorship verification. We then use these representations in a streaming anomaly detector suited to continuous integration and deployment (CI/CD) settings. We validate the pipeline on two retrospective supply-chain incidents involving different patch characteristics: the 2021 PHP backdoor and the 2026 ForceMemo/GlassWorm campaign. Without retraining, the proposed detector surfaces both PHP forged commits within approximately 1% of the maintainer audit queue and ranks the 28 scoreable ForceMemo spoofs with a median per-repository review burden of 0.8%. These results indicate that cross-modal patch-level embeddings can support behavioral triage against author impersonation in real-world repositories.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。