{ "schema": "lri.security-resource-cards.v1", "cards": [ { "id": "molot_system_card", "title": "MOLOT System Card: Malicious Operational Logic Observation Transformer", "path": "sources/resource_cards/01_molot_system_card.md", "status": "direct_public_evidence", "resource_type": "core_model_paper", "resource_chain": "MOLOT 恶意包/恶意文件检测链", "source_url": "https://arxiv.org/abs/2606.07792", "why": "这是用户 JSON 中 MOLOT/PT-AI 线索的最强公开证据：它直接解释 MOLOT 的 SAST 定位、静态调用图、行为序列、BERT 分类、SHAP 定位、Python/JS 包评估和 Open Malicious-Code Bench。", "technical_core": [ "SAST 静态恶意代码检测", "静态调用图", "行为序列文本化", "文件级分类", "BERT / Transformer 二分类", "SHAP 活动归因", "源码位置回溯", "运行时/内存/FPR 工程约束" ], "lri_mapping": [ "Skills/插件安装前扫描", "模型输入代码段扫描", "下载文件执行前门禁", "Agent allow/warn/block/ask-human 策略", "审核证据日志字段" ], "next_actions": [ "抽取论文中的 dataset 表、baseline 表、runtime/memory/FPR 表", "将 Open Malicious-Code Bench 建为独立 benchmark 资源卡", "定义 LRI security_gate_contract 与 MOLOT 输出字段的映射" ], "evidence_references": { "primary_public_url": "https://arxiv.org/abs/2606.07792", "primary_self_reference": null, "markdown_card": "sources/resource_cards/01_molot_system_card.md", "machine_registry_pointer": "security_governance/data/resource_cards.json#/cards/molot_system_card", "workbench_pointer": "security_governance/data/workbench.json#/resource_card_registry/cards/molot_system_card", "status": "direct_public_evidence", "verification_required": false }, "direct_paper_evidence": { "id": "molot_system_card", "evidence_level": "L2_direct_public_evidence", "direct_evidence_scope": "直接支撑 MOLOT 作为 SAST 静态恶意代码检测系统、静态调用图行为序列、BERT/Transformer 分类、SHAP 源码位置映射、Python/JavaScript 包评估和 Open Malicious-Code Bench。", "extracted_claims": [ "MOLOT targets SAST settings where package metadata, maintainer history, and dynamic traces may be unavailable or unreliable.", "MOLOT represents source code as behavior sequences derived from static call graphs.", "MOLOT includes an explanation stage ranking suspicious activities and mapping them back to source locations.", "MOLOT is evaluated on Python and JavaScript packages and compared with open-source detection tools." ], "does_not_support": [ "FCD C/C++ performance table", "PDG binary clone-detection precision/recall", "LRI Agent Gate runtime metrics before implementation" ] } }, { "id": "cerebro_behavior_sequence", "title": "Malicious Package Detection in NPM and PyPI using a Single Model of Malicious Behavior Sequence", "path": "sources/resource_cards/02_cerebro_behavior_sequence.md", "status": "related_behavior_sequence_baseline", "resource_type": "method_predecessor", "resource_chain": "行为序列 + BERT 恶意包检测链", "source_url": "https://arxiv.org/abs/2309.02637", "why": "MOLOT 公开论文将其列为行为序列建模主线的前序工作。它证明跨 NPM/PyPI 的高层恶意行为序列可以用一个 BERT 模型统一建模。", "technical_core": [ "高层恶意行为抽象", "跨语言 NPM/PyPI 行为序列", "BERT fine-tuning", "多生态统一检测" ], "lri_mapping": [ "为 Skills/插件建立语言无关行为 taxonomy", "把 Python/JS/TS 插件行为统一映射到 Agent 风险活动", "作为 MOLOT 行为序列线的历史基准" ], "next_actions": [ "抽取 CEREBRO 的行为类别和序列化规则", "与 MOLOT activity taxonomy 对齐", "评估是否可映射到 LRI malicious_activity_taxonomy" ], "evidence_references": { "primary_public_url": "https://arxiv.org/abs/2309.02637", "primary_self_reference": null, "markdown_card": "sources/resource_cards/02_cerebro_behavior_sequence.md", "machine_registry_pointer": "security_governance/data/resource_cards.json#/cards/cerebro_behavior_sequence", "workbench_pointer": "security_governance/data/workbench.json#/resource_card_registry/cards/cerebro_behavior_sequence", "status": "related_behavior_sequence_baseline", "verification_required": false }, "direct_paper_evidence": { "id": "cerebro_behavior_sequence", "evidence_level": "L1_public_method_background", "direct_evidence_scope": "直接支撑 NPM/PyPI 恶意包可以通过高层恶意行为抽象、行为序列和 BERT 统一建模。", "extracted_claims": [ "Cerebro detects malicious packages in NPM and PyPI.", "It curates high-level malicious behavior abstractions, organizes features into behavior sequences, and fine-tunes BERT.", "It reported discovery of new malicious PyPI and NPM packages." ], "does_not_support": [ "MOLOT 的具体性能", "FCD/PDG C/C++ 表", "Agent Gate 工程表现" ] } }, { "id": "python_malware_benchmark", "title": "A Benchmark Comparison of Python Malware Detection Approaches", "path": "sources/resource_cards/03_python_malware_benchmark_bandit4mal_ossgadget.md", "status": "baseline_tool_evidence", "resource_type": "benchmark_paper", "resource_chain": "Bandit4Mal / OSSGadget / PyPI moderation baseline", "source_url": "https://arxiv.org/abs/2209.13288", "why": "用户 JSON 提到 bandit4mal 和 OSSGadget 作为对标工具；这篇论文直接比较 PyPI 恶意检测工具，并讨论仓库管理员对误报的严苛要求。", "technical_core": [ "PyPI 恶意包检测 benchmark", "Bandit4Mal", "OSSGadget OSS Detect Backdoor", "误报率约束", "仓库 moderation 需求" ], "lri_mapping": [ "为 LRI 门禁定义 FPR 上限", "作为规则工具 baseline", "解释为什么只靠规则扫描不足以自动 block" ], "next_actions": [ "抽取具体 FPR/TPR 表", "把 Bandit4Mal/OSSGadget 与 MOLOT baseline 表对应", "建立 LRI gate 的 false-positive budget" ], "evidence_references": { "primary_public_url": "https://arxiv.org/abs/2209.13288", "primary_self_reference": null, "markdown_card": "sources/resource_cards/03_python_malware_benchmark_bandit4mal_ossgadget.md", "machine_registry_pointer": "security_governance/data/resource_cards.json#/cards/python_malware_benchmark", "workbench_pointer": "security_governance/data/workbench.json#/resource_card_registry/cards/python_malware_benchmark", "status": "baseline_tool_evidence", "verification_required": false }, "direct_paper_evidence": { "id": "python_malware_benchmark", "evidence_level": "L2_direct_baseline_evidence", "direct_evidence_scope": "直接支撑 PyPI 恶意包检测 benchmark、Bandit4Mal/OSSGadget/PyPI checks 对比、以及仓库 moderation 对误报率极其敏感的约束。", "extracted_claims": [ "The paper builds a benchmark for Python/PyPI malware detection.", "It compares PyPI checks, Bandit4Mal, and OSSGadget OSS Detect Backdoor.", "It reports repository administrators consider even a 0.01% false-positive rate too high in this setting." ], "does_not_support": [ "MOLOT 方法本身", "NPM benchmark 2026 结论", "PDG/FCD 表" ] } }, { "id": "npm_malicious_detection_benchmark", "title": "Understanding NPM Malicious Package Detection: A Benchmark-Driven Empirical Analysis", "path": "sources/resource_cards/04_npm_malicious_detection_benchmark.md", "status": "recent_benchmark_evidence", "resource_type": "benchmark_paper", "resource_chain": "NPM 恶意包行为 taxonomy / 工具对比链", "source_url": "https://arxiv.org/abs/2603.27549", "why": "该论文提供 NPM 恶意包 benchmark、行为类别、规避技术和多工具对比，适合作为 LRI 插件/Skills JS 生态检测的公开基准。", "technical_core": [ "NPM malicious package dataset", "11 behavior categories", "8 evasion techniques", "8 tools / 13 variants", "tool-combination analysis" ], "lri_mapping": [ "扩展 JS/TS 插件风险活动 taxonomy", "为工具组合策略提供依据", "支持 Agent Gate 的 behavior-chain 优先原则" ], "next_actions": [ "抽取 11 类 behavior 和 8 类 evasion", "对齐 malicious_activity_taxonomy", "建立 JS/TS 插件样本集" ], "evidence_references": { "primary_public_url": "https://arxiv.org/abs/2603.27549", "primary_self_reference": null, "markdown_card": "sources/resource_cards/04_npm_malicious_detection_benchmark.md", "machine_registry_pointer": "security_governance/data/resource_cards.json#/cards/npm_malicious_detection_benchmark", "workbench_pointer": "security_governance/data/workbench.json#/resource_card_registry/cards/npm_malicious_detection_benchmark", "status": "recent_benchmark_evidence", "verification_required": false }, "direct_paper_evidence": { "id": "npm_malicious_detection_benchmark", "evidence_level": "L2_direct_benchmark_evidence", "direct_evidence_scope": "直接支撑 NPM 恶意包 benchmark、行为类别、规避技术、多工具对比和行为链优先判断。", "extracted_claims": [ "The paper builds a dataset with malicious and benign NPM packages.", "It annotates behavior categories and evasion techniques.", "It evaluates multiple tools and variants.", "It argues behavioral chains disambiguate malicious purpose better than isolated API calls." ], "does_not_support": [ "Python/PyPI 性能", "MOLOT 论文指标", "FCD/PDG 表" ] } }, { "id": "oss_malicious_package_analysis", "title": "OSS Malicious Package Analysis in the Wild", "path": "sources/resource_cards/05_oss_malicious_package_analysis.md", "status": "dataset_and_lifecycle_evidence", "resource_type": "dataset_analysis_paper", "resource_chain": "OSS 恶意包数据集 / 生命周期 / 攻击活动上下文链", "source_url": "https://arxiv.org/abs/2404.04991", "why": "该论文构建并分析 23,425 个恶意包，强调不同来源的数据重叠少、攻击包常以微小变化重复发布。", "technical_core": [ "large malicious package corpus", "knowledge graph", "malicious package lifecycle", "campaign context", "source diversity" ], "lri_mapping": [ "建立多源恶意样本池", "把重复变体纳入 hash/clone 识别", "为 evidence registry 增加 campaign context" ], "next_actions": [ "抽取生命周期字段", "为 LRI evidence log 增加 campaign_context", "将 package variant 与 PDG/clone 检测关联" ], "evidence_references": { "primary_public_url": "https://arxiv.org/abs/2404.04991", "primary_self_reference": null, "markdown_card": "sources/resource_cards/05_oss_malicious_package_analysis.md", "machine_registry_pointer": "security_governance/data/resource_cards.json#/cards/oss_malicious_package_analysis", "workbench_pointer": "security_governance/data/workbench.json#/resource_card_registry/cards/oss_malicious_package_analysis", "status": "dataset_and_lifecycle_evidence", "verification_required": false }, "direct_paper_evidence": { "id": "oss_malicious_package_analysis", "evidence_level": "L2_direct_dataset_evidence", "direct_evidence_scope": "直接支撑 OSS 恶意包大规模数据集、多来源收集、生命周期和攻击活动上下文的重要性。", "extracted_claims": [ "The paper builds a dataset of 23,425 malicious packages from scattered online sources.", "It uses a knowledge graph to represent the OSS malware corpus.", "It describes a lifecycle of changing, release, detection, and removal, and highlights package variants." ], "does_not_support": [ "某个检测器精度", "MOLOT 方法细节", "FCD/PDG 表" ] } }, { "id": "backstabbers_knife_collection", "title": "Backstabber's Knife Collection: A Review of Open Source Software Supply Chain Attacks", "path": "sources/resource_cards/06_backstabbers_knife_collection.md", "status": "supply_chain_attack_taxonomy", "resource_type": "dataset_and_attack_tree_paper", "resource_chain": "供应链攻击样本 / 攻击树 / 执行时机链", "source_url": "https://arxiv.org/abs/2005.09535", "why": "该论文整理 npm/PyPI/RubyGems 真实恶意包并提出攻击树，有助于解释恶意包如何进入依赖树并在不同阶段执行。", "technical_core": [ "174 malicious packages", "npm/PyPI/RubyGems", "attack trees", "dependency-tree injection", "execution timing" ], "lri_mapping": [ "构造 Skills/插件投毒入口树", "区分 install-time/import-time/runtime 执行", "为 gate policy 增加 execution_phase 字段" ], "next_actions": [ "抽取攻击树为 LRI entry taxonomy", "增加 execution_phase 字段", "补新近供应链事件证据卡" ], "evidence_references": { "primary_public_url": "https://arxiv.org/abs/2005.09535", "primary_self_reference": null, "markdown_card": "sources/resource_cards/06_backstabbers_knife_collection.md", "machine_registry_pointer": "security_governance/data/resource_cards.json#/cards/backstabbers_knife_collection", "workbench_pointer": "security_governance/data/workbench.json#/resource_card_registry/cards/backstabbers_knife_collection", "status": "supply_chain_attack_taxonomy", "verification_required": false }, "direct_paper_evidence": { "id": "backstabbers_knife_collection", "evidence_level": "L1_public_supply_chain_taxonomy", "direct_evidence_scope": "直接支撑真实 OSS 供应链攻击样本、npm/PyPI/RubyGems 恶意包、攻击树和执行时机分析。", "extracted_claims": [ "The paper reviews supply-chain attacks involving injection of malicious code into software packages.", "It presents 174 malicious packages from npm, PyPI, and RubyGems.", "It provides attack trees for injection into dependency trees and execution at different times/conditions." ], "does_not_support": [ "2026 新型攻击覆盖", "MOLOT 性能", "Agent Gate 表现" ] } }, { "id": "unveiling_malicious_logic", "title": "Unveiling Malicious Logic: Towards a Statement-Level Taxonomy and Dataset for Securing Python Packages", "path": "sources/resource_cards/07_unveiling_malicious_logic_statement_taxonomy.md", "status": "statement_level_taxonomy_evidence", "resource_type": "taxonomy_dataset_paper", "resource_chain": "语句级恶意指标 / 代码定位 / 审核证据链", "source_url": "https://arxiv.org/abs/2512.12559", "why": "该论文从 package-level 下探到 statement-level，提供 47 个恶意指标和 7 个类型，非常适合完善 LRI malicious_activity_taxonomy 和 reviewer_evidence_schema。", "technical_core": [ "370 malicious Python packages", "833 files", "90,527 lines", "2,962 labeled malicious indicator occurrences", "47 indicators / 7 types", "sequential pattern mining" ], "lri_mapping": [ "把 SHAP source_location 与 statement-level indicator 对齐", "细化 activity_chain 字段", "提升审核证据粒度" ], "next_actions": [ "抽取 47 indicators", "映射到 LRI malicious_activity_taxonomy", "补 statement-level review checklist" ], "evidence_references": { "primary_public_url": "https://arxiv.org/abs/2512.12559", "primary_self_reference": null, "markdown_card": "sources/resource_cards/07_unveiling_malicious_logic_statement_taxonomy.md", "machine_registry_pointer": "security_governance/data/resource_cards.json#/cards/unveiling_malicious_logic", "workbench_pointer": "security_governance/data/workbench.json#/resource_card_registry/cards/unveiling_malicious_logic", "status": "statement_level_taxonomy_evidence", "verification_required": false }, "direct_paper_evidence": { "id": "unveiling_malicious_logic", "evidence_level": "L2_direct_statement_level_evidence", "direct_evidence_scope": "直接支撑 Python 恶意包语句级标注、47 个恶意指标、7 类类型和 recurring attack workflow 的定位分析。", "extracted_claims": [ "The paper builds a statement-level dataset for malicious Python packages.", "It derives 47 malicious indicators across 7 types.", "It applies sequential pattern mining to recurring indicator sequences." ], "does_not_support": [ "JavaScript/NPM 覆盖", "MOLOT 性能", "PDG/FCD 表" ] } }, { "id": "llm_pypi_malicious_detection", "title": "Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy?", "path": "sources/resource_cards/08_llm_pypi_malicious_detection.md", "status": "llm_detection_and_labeling_reference", "resource_type": "llm_detection_paper", "resource_chain": "LLM 检测 / RAG / few-shot / 文件级辅助标注链", "source_url": "https://arxiv.org/abs/2504.13769", "why": "MOLOT 使用 LLM 辅助文件级标注；该论文可作为 LLM 在 PyPI 恶意源码检测中的参考。", "technical_core": [ "LLM-based malicious source detection", "RAG evaluation", "few-shot learning", "YARA rules", "GitHub Security Advisories" ], "lri_mapping": [ "作为 LLM teacher/labeling 参考", "用少样本提示辅助人工审核", "不要把 LLM 作为自动执行 gate 的唯一信号" ], "next_actions": [ "抽取 prompt/evaluation 设置", "测试 LRI redacted 样例上的 LLM labeler", "评估 LLM 与 MOLOT/规则工具的互补性" ], "evidence_references": { "primary_public_url": "https://arxiv.org/abs/2504.13769", "primary_self_reference": null, "markdown_card": "sources/resource_cards/08_llm_pypi_malicious_detection.md", "machine_registry_pointer": "security_governance/data/resource_cards.json#/cards/llm_pypi_malicious_detection", "workbench_pointer": "security_governance/data/workbench.json#/resource_card_registry/cards/llm_pypi_malicious_detection", "status": "llm_detection_and_labeling_reference", "verification_required": false }, "direct_paper_evidence": { "id": "llm_pypi_malicious_detection", "evidence_level": "L1_public_llm_labeling_evidence", "direct_evidence_scope": "直接支撑 LLM、RAG、few-shot 在 PyPI 恶意源码检测中的比较，以及 RAG 不一定带来改进的经验结果。", "extracted_claims": [ "The paper evaluates LLMs, RAG, and few-shot learning for malicious source code detection in PyPI packages.", "It reports RAG performs only modestly in its evaluation while few-shot learning performs better.", "It integrates YARA rules, GitHub Security Advisories, and malicious code snippets." ], "does_not_support": [ "LLM 可作为自动 block 的唯一依据", "MOLOT 论文指标", "FCD/PDG 表" ] } }, { "id": "pdg_holmes_graph_siamese", "title": "Modeling Functional Similarity in Source Code with Graph-Based Siamese Networks", "path": "sources/resource_cards/09_pdg_holmes_graph_siamese_clone_detection.md", "status": "pdg_clone_detection_background", "resource_type": "graph_clone_detection_paper", "resource_chain": "PDG / HOLMES / 语义 clone 检测链", "source_url": "https://arxiv.org/abs/2011.11228", "why": "用户 JSON 中有 PDG 子图匹配和源码/二进制片段检测线索；该论文直接使用程序依赖图和图网络进行语义代码克隆检测。", "technical_core": [ "program dependency graph", "semantic code clone detection", "graph-based Siamese network", "HOLMES prototype", "geometric neural networks" ], "lri_mapping": [ "支撑 PDG 子图检测线", "作为源码片段相似度卡的背景证据", "与二进制片段检测保持分链核验" ], "next_actions": [ "抽取 PDG 表示和相似度方法", "寻找用户 JSON 中 FCD 表的原始来源", "设计 PDG/FCD 与 MOLOT 输出融合方式" ], "evidence_references": { "primary_public_url": "https://arxiv.org/abs/2011.11228", "primary_self_reference": null, "markdown_card": "sources/resource_cards/09_pdg_holmes_graph_siamese_clone_detection.md", "machine_registry_pointer": "security_governance/data/resource_cards.json#/cards/pdg_holmes_graph_siamese", "workbench_pointer": "security_governance/data/workbench.json#/resource_card_registry/cards/pdg_holmes_graph_siamese", "status": "pdg_clone_detection_background", "verification_required": false }, "direct_paper_evidence": { "id": "pdg_holmes_graph_siamese", "evidence_level": "L1_public_graph_clone_background", "direct_evidence_scope": "直接支撑程序依赖图和图神经网络用于语义代码 clone detection。", "extracted_claims": [ "The paper addresses semantic code clone detection using program dependency graphs and geometric neural networks.", "It develops HOLMES, a graph-based Siamese prototype.", "It evaluates on clone benchmarks and compares against TBCCD." ], "does_not_support": [ "恶意包检测精度", "FCD C/C++ 表", "MOLOT 性能" ] } }, { "id": "source_code_is_graph", "title": "Source Code is a Graph, Not a Sequence: A Cross-Lingual Perspective on Code Clone Detection", "path": "sources/resource_cards/10_source_code_is_graph_clone_detection.md", "status": "graph_vs_sequence_clone_background", "resource_type": "graph_clone_detection_paper", "resource_chain": "CodeGraph / CodeBERT / 跨语言 clone 检测链", "source_url": "https://arxiv.org/abs/2312.16488", "why": "该论文论证图表示在 code clone detection 中优于序列表示，适合作为 PDG/FCD 线的背景资源。", "technical_core": [ "graph-based source representation", "cross-lingual clone detection", "CodeGraph vs CodeBERT", "BCB / PoolC benchmark" ], "lri_mapping": [ "解释为什么单纯文本/序列不足以覆盖源码/二进制相似片段", "支撑 graph-based resource profile", "用于 PDG/FCD 线的技术定位" ], "next_actions": [ "抽取 graph vs sequence 比较逻辑", "评估是否需要 CodeGraph/CPG 作为 LRI 二级检测面", "补二进制图表示来源" ], "evidence_references": { "primary_public_url": "https://arxiv.org/abs/2312.16488", "primary_self_reference": null, "markdown_card": "sources/resource_cards/10_source_code_is_graph_clone_detection.md", "machine_registry_pointer": "security_governance/data/resource_cards.json#/cards/source_code_is_graph", "workbench_pointer": "security_governance/data/workbench.json#/resource_card_registry/cards/source_code_is_graph", "status": "graph_vs_sequence_clone_background", "verification_required": false }, "direct_paper_evidence": { "id": "source_code_is_graph", "evidence_level": "L1_public_graph_clone_background", "direct_evidence_scope": "直接支撑源码图表示在 code clone detection，尤其跨语言 clone 上，相比序列模型的优势。", "extracted_claims": [ "The paper argues source code is inherently a graph rather than a sequence for clone detection.", "It compares CodeBERT and CodeGraph on clone benchmarks.", "It reports graph-based methods outperform sequence-based methods, especially cross-lingually." ], "does_not_support": [ "恶意代码检测精度", "MOLOT 评估", "FCD C/C++ 表" ] } }, { "id": "shap_unified_approach", "title": "A Unified Approach to Interpreting Model Predictions", "path": "sources/resource_cards/11_shap_unified_approach.md", "status": "explainability_foundation", "resource_type": "explainability_paper", "resource_chain": "SHAP 解释 / 审核证据链", "source_url": "https://arxiv.org/abs/1705.07874", "why": "MOLOT 使用 SHAP 将 suspicious activities 映射回源码位置；SHAP 原论文是模型解释方法的基础资源。", "technical_core": [ "SHAP", "Shapley Additive Explanations", "feature attribution", "local explanation", "model interpretability" ], "lri_mapping": [ "把 model_score 转成 reviewer evidence", "构建 explanation_tokens/source_locations 字段", "支持 human confirmation 和 false-positive review" ], "next_actions": [ "定义 SHAP token/activity 输出字段", "对接 reviewer_evidence_schema", "建立 false_positive 复核流程" ], "evidence_references": { "primary_public_url": "https://arxiv.org/abs/1705.07874", "primary_self_reference": null, "markdown_card": "sources/resource_cards/11_shap_unified_approach.md", "machine_registry_pointer": "security_governance/data/resource_cards.json#/cards/shap_unified_approach", "workbench_pointer": "security_governance/data/workbench.json#/resource_card_registry/cards/shap_unified_approach", "status": "explainability_foundation", "verification_required": false }, "direct_paper_evidence": { "id": "shap_unified_approach", "evidence_level": "L1_public_explainability_foundation", "direct_evidence_scope": "直接支撑 SHAP 作为 feature attribution / additive explanation 方法，用于解释复杂模型预测。", "extracted_claims": [ "The paper introduces SHAP as a unified framework for interpreting model predictions.", "SHAP assigns each feature an importance value for a particular prediction.", "The framework connects additive feature-importance measures with desirable theoretical properties." ], "does_not_support": [ "恶意代码定位本身", "MOLOT 性能", "单独决定 block 策略" ] } }, { "id": "fcd_pdg_performance_unresolved", "title": "FCD / PDG C/C++ Performance Table from User JSON", "path": "sources/resource_cards/12_fcd_pdg_performance_unresolved.md", "status": "unresolved_user_json_claim", "resource_type": "pending_verification_card", "resource_chain": "PDG/FCD 源码/二进制相似片段检测链", "source_url": "user_provided_json", "why": "用户 JSON 中包含 c-ares、jasper、openssl、rsync 的 Precision/Recall/RMSE/FCD speed 表，但当前尚未找到公开论文来源。", "technical_core": [ "Fragment PDG", "Project function PDGs", "subgraph matching", "similarity percentage", "detected clones", "FCD speed" ], "lri_mapping": [ "可作为二进制下载文件检测方向候选", "用于提醒不能混入 MOLOT 指标", "后续查证后再升级为 direct evidence" ], "next_actions": [ "搜索 FCD/PDG 原始论文或报告", "核对 c-ares/jasper/openssl/rsync 表格出处", "确认 >95.5% 指标对应任务与数据集" ], "evidence_references": { "primary_public_url": null, "primary_self_reference": "user_provided_json", "markdown_card": "sources/resource_cards/12_fcd_pdg_performance_unresolved.md", "machine_registry_pointer": "security_governance/data/resource_cards.json#/cards/fcd_pdg_performance_unresolved", "workbench_pointer": "security_governance/data/workbench.json#/resource_card_registry/cards/fcd_pdg_performance_unresolved", "status": "unresolved_user_json_claim", "verification_required": true }, "direct_paper_evidence": { "id": "fcd_pdg_performance_unresolved", "evidence_level": "L0_user_input_only", "direct_evidence_scope": "无直接公网论文证据；只保留为用户 JSON 中的待核验 C/C++ FCD/PDG 性能表线索。", "extracted_claims": [ "User JSON includes c-ares, jasper, openssl, and rsync rows with precision, recall, RMSE, and FCD speed.", "No public original paper/report URL has been found for that exact table in this iteration." ], "does_not_support": [ "任何已核验性能结论", "MOLOT 论文指标", "PDG/FCD 方法归属" ] } } ] }