# Malicious Source Code Detection Using Transformer

**Authors:** Chen Tsfaty, Michael Fire  
**arXiv:** [2209.07957](https://arxiv.org/abs/2209.07957)  
**Date:** 2022-09-16  
**Summary page:** https://www.summarizepaper.com/en/paper/2209.07957v1/

## Key points

- Open source code is commonly used in modern software development
- Reused code presents a risk for supply chain attacks
- Malicious actors can inject malicious code into products that rely on reused code
- Many approaches have been developed to detect vulnerable packages, but detecting malicious code within packages is uncommon
- The Malicious Source Code Detection using Transformers (MSDT) algorithm was introduced to address this issue
- MSDT is a static analysis based on deep learning that detects real-world code injection cases in source code packages
- MSDT uses a dataset with over 600,000 different functions and applies a clustering algorithm to identify outliers and detect malicious functions
- Extensive experiments were conducted to evaluate MSDT's performance, demonstrating its capability to detect functions injected with malicious code with precision@k values of up to 0.909.
- Developing new detection methods for identifying malicious code within open source packages is important to mitigate supply chain attacks in software development.

## Summary

The use of open source code is a common practice in modern software development, but it also presents a risk for supply chain attacks. Bad actors can access a wide community of developers through reused code and inject malicious code into products that rely on it. While many approaches have been developed to detect vulnerable packages, detecting malicious code within packages is uncommon. To address this issue, Chen Tsfaty and Michael Fire introduce the Malicious Source Code Detection using Transformers (MSDT) algorithm. MSDT is a novel static analysis based on deep learning that detects real-world code injection cases in source code packages. The authors used MSDT and a dataset with over 600,000 different functions to embed various functions and applied a clustering algorithm to the resulting vectors, detecting the malicious functions by identifying outliers. Extensive experiments were conducted to evaluate MSDT's performance, demonstrating its capability to detect functions injected with malicious code with precision@k values of up to 0.909. This study highlights the importance of developing new detection methods for identifying malicious code within open source packages in order to mitigate supply chain attacks in software development.