🤖 AI Summary
This study addresses the challenge of achieving both high accuracy and interpretability in malicious code detection under static analysis settings where package metadata, maintainer information, and dynamic execution traces are unavailable. To this end, we propose the first interpretable detection framework that derives behavioral sequences from static call graphs, leverages a Transformer architecture to model these sequences, and integrates an explanation module to precisely localize suspicious source code regions. Designed to operate within the practical constraints of real-world DevSecOps pipelines, our approach significantly outperforms existing open-source tools on Python and JavaScript packages from PyPI and npm, meeting production-grade requirements in terms of detection accuracy, runtime overhead, memory consumption, and false positive rate. We also release Open Malicious-Code Bench, an open benchmark accompanying this work.
📝 Abstract
MOLOT (Malicious Operational Logic Observation Transformer) is a static malicious-code detection system designed for SAST setup where package metadata, maintainer history, and dynamic execution traces may be unavailable or unreliable. The system represents source code as behavior sequences derived from static call graphs, includes an explanation stage that ranks suspicious behavior activities and maps them back to source-code locations. The approach is evaluated on Python and JavaScript packages from PyPI and npm, compared with opensource detection tools, and validated under product constraints including runtime, memory use, and false-positive rates observed in a real moderation workflow. We also release Open Malicious-Code Bench, a public benchmark for reproducible evaluation of malicious-package detection methods. The results show that static behavior-sequence modeling can provide accurate, explainable, and deployable malicious-code detection for modern DevSecOps workflows.