RogueOne: Detecting Rogue Updates via Differential Data-flow Analysis Using Trust Domains.
Saved in:
| Title: | RogueOne: Detecting Rogue Updates via Differential Data-flow Analysis Using Trust Domains. |
|---|---|
| Authors: | Sofaer, Raphael J.1 r.j.sofaer@columbia.edu, David, Yaniv1 yaniv.david@columbia.edu, Kang, Mingqing2 mkang31@jhu.edu, Yu, Jianjia2 jyu122@jhu.edu, Cao, Yinzhi2 yinzhi.cao@jhu.edu, Yang, Junfeng1 junfeng@cs.columbia.edu, Nieh, Jason1 nieh@cs.columbia.edu |
| Source: | ICSE: International Conference on Software Engineering. 2024, p1-13. 13p. |
| Subjects: | Data flow computing, Supply chains, Extrapolation, Supply & demand, Malware |
| Abstract: | Rogue updates, an important type of software supply-chain attack in which attackers conceal malicious code inside updates to benign software, are a growing problem due to their stealth and effectiveness. We design and implement RogueOne, a system for detecting rogue updates to JavaScript packages. RogueOne uses a novel differential data-flow analysis to capture how an update changes a package's interactions with external APIs. Using an efficient form of abstract interpretation that can exclude unchanged code in a package, it constructs an object data-flow relationship graph (ODRG) that tracks data-flows among objects. RogueOne then maps objects to trust domains, a novel abstraction which summarizes trust relationships in a package. Objects are assigned a trust domain based on whether they originate in the target package, a dependency, or in a system API. RogueOne uses the ODRG to build a set of data-flows across trust domains. It compares data-flow sets across package versions to detect untrustworthy new interactions with external APIs. We evaluated RogueOne on hundreds of npm packages, demonstrating its effectiveness at detecting rogue updates and distinguishing them from benign ones. RogueOne achieves high accuracy and can be more than seven times as effective in detecting rogue updates and avoiding false positives compared to other systems built to detect malicious packages. [ABSTRACT FROM AUTHOR] |
| Copyright of ICSE: International Conference on Software Engineering is the property of Association for Computing Machinery and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.) | |
| Database: | Engineering Source |
|
Full text is not displayed to guests.
Login for full access.
|
|
| FullText | Links: – Type: pdflink Text: Availability: 1 |
|---|---|
| Header | DbId: egs DbLabel: Engineering Source An: 185196479 AccessLevel: 6 PubType: Conference PubTypeId: conference PreciseRelevancyScore: 0 |
| IllustrationInfo | |
| Items | – Name: Title Label: Title Group: Ti Data: RogueOne: Detecting Rogue Updates via Differential Data-flow Analysis Using Trust Domains. – Name: Author Label: Authors Group: Au Data: <searchLink fieldCode="AR" term="%22Sofaer%2C+Raphael+J%2E%22">Sofaer, Raphael J.</searchLink><relatesTo>1</relatesTo><i> r.j.sofaer@columbia.edu</i><br /><searchLink fieldCode="AR" term="%22David%2C+Yaniv%22">David, Yaniv</searchLink><relatesTo>1</relatesTo><i> yaniv.david@columbia.edu</i><br /><searchLink fieldCode="AR" term="%22Kang%2C+Mingqing%22">Kang, Mingqing</searchLink><relatesTo>2</relatesTo><i> mkang31@jhu.edu</i><br /><searchLink fieldCode="AR" term="%22Yu%2C+Jianjia%22">Yu, Jianjia</searchLink><relatesTo>2</relatesTo><i> jyu122@jhu.edu</i><br /><searchLink fieldCode="AR" term="%22Cao%2C+Yinzhi%22">Cao, Yinzhi</searchLink><relatesTo>2</relatesTo><i> yinzhi.cao@jhu.edu</i><br /><searchLink fieldCode="AR" term="%22Yang%2C+Junfeng%22">Yang, Junfeng</searchLink><relatesTo>1</relatesTo><i> junfeng@cs.columbia.edu</i><br /><searchLink fieldCode="AR" term="%22Nieh%2C+Jason%22">Nieh, Jason</searchLink><relatesTo>1</relatesTo><i> nieh@cs.columbia.edu</i> – Name: TitleSource Label: Source Group: Src Data: <searchLink fieldCode="JN" term="%22ICSE%3A+International+Conference+on+Software+Engineering%22">ICSE: International Conference on Software Engineering</searchLink>. 2024, p1-13. 13p. – Name: Subject Label: Subjects Group: Su Data: <searchLink fieldCode="DE" term="%22Data+flow+computing%22">Data flow computing</searchLink><br /><searchLink fieldCode="DE" term="%22Supply+chains%22">Supply chains</searchLink><br /><searchLink fieldCode="DE" term="%22Extrapolation%22">Extrapolation</searchLink><br /><searchLink fieldCode="DE" term="%22Supply+%26+demand%22">Supply & demand</searchLink><br /><searchLink fieldCode="DE" term="%22Malware%22">Malware</searchLink> – Name: Abstract Label: Abstract Group: Ab Data: Rogue updates, an important type of software supply-chain attack in which attackers conceal malicious code inside updates to benign software, are a growing problem due to their stealth and effectiveness. We design and implement RogueOne, a system for detecting rogue updates to JavaScript packages. RogueOne uses a novel differential data-flow analysis to capture how an update changes a package's interactions with external APIs. Using an efficient form of abstract interpretation that can exclude unchanged code in a package, it constructs an object data-flow relationship graph (ODRG) that tracks data-flows among objects. RogueOne then maps objects to trust domains, a novel abstraction which summarizes trust relationships in a package. Objects are assigned a trust domain based on whether they originate in the target package, a dependency, or in a system API. RogueOne uses the ODRG to build a set of data-flows across trust domains. It compares data-flow sets across package versions to detect untrustworthy new interactions with external APIs. We evaluated RogueOne on hundreds of npm packages, demonstrating its effectiveness at detecting rogue updates and distinguishing them from benign ones. RogueOne achieves high accuracy and can be more than seven times as effective in detecting rogue updates and avoiding false positives compared to other systems built to detect malicious packages. [ABSTRACT FROM AUTHOR] – Name: AbstractSuppliedCopyright Label: Group: Ab Data: <i>Copyright of ICSE: International Conference on Software Engineering is the property of Association for Computing Machinery and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract.</i> (Copyright applies to all Abstracts.) |
| PLink | https://search.ebscohost.com/login.aspx?direct=true&site=eds-live&db=egs&AN=185196479 |
| RecordInfo | BibRecord: BibEntity: Identifiers: – Type: doi Value: 10.1145/3597503.3639199 Languages: – Code: eng Text: English PhysicalDescription: Pagination: PageCount: 13 StartPage: 1 Subjects: – SubjectFull: Data flow computing Type: general – SubjectFull: Supply chains Type: general – SubjectFull: Extrapolation Type: general – SubjectFull: Supply & demand Type: general – SubjectFull: Malware Type: general Titles: – TitleFull: RogueOne: Detecting Rogue Updates via Differential Data-flow Analysis Using Trust Domains. Type: main BibRelationships: HasContributorRelationships: – PersonEntity: Name: NameFull: Sofaer, Raphael J. – PersonEntity: Name: NameFull: David, Yaniv – PersonEntity: Name: NameFull: Kang, Mingqing – PersonEntity: Name: NameFull: Yu, Jianjia – PersonEntity: Name: NameFull: Cao, Yinzhi – PersonEntity: Name: NameFull: Yang, Junfeng – PersonEntity: Name: NameFull: Nieh, Jason IsPartOfRelationships: – BibEntity: Dates: – D: 01 M: 05 Text: 2024 Type: published Y: 2024 Titles: – TitleFull: ICSE: International Conference on Software Engineering Type: main |
| ResultId | 1 |
