# 安全治理公开证据快照 本文件把当前可公开核验的论文证据拆为“能直接支撑什么 / 不能支撑什么 / 下一步怎么升级”。 ## pub_molot_arxiv_snapshot · MOLOT System Card: Malicious Operational Logic Observation Transformer - 来源: https://arxiv.org/abs/2606.07792 - 资源卡: `molot_system_card` - 链路用途: LRI 可把它作为 MOLOT 检测主线的直接论文证据。 ### 可直接支撑 - MOLOT is a static malicious-code detection system designed for SAST settings. - MOLOT represents source code as behavior sequences derived from static call graphs. - MOLOT includes an explanation stage that maps suspicious behavior activities to source-code locations. - MOLOT is evaluated on Python and JavaScript packages and compared with open-source tools. - The paper states Open Malicious-Code Bench is released for reproducible evaluation. ### 不能支撑 / 不得外推 - FCD C/C++ table - PDG binary clone detection metrics - independent Open Malicious-Code Bench repository URL ### 下一步 - 抽取论文表格、benchmark 地址和限制章节；若找到独立 benchmark URL，再把 benchmark 从 paper-stated 升级为 public_artifact. ## pub_cerebro_arxiv_snapshot · Malicious Package Detection in NPM and PyPI using a Single Model of Malicious Behavior Sequence - 来源: https://arxiv.org/abs/2309.02637 - 资源卡: `cerebro_behavior_sequence` - 链路用途: 支撑“行为序列 + BERT”是恶意包检测的公开方法线，作为 MOLOT 前序/旁证。 ### 可直接支撑 - Cerebro detects malicious packages across NPM and PyPI. - It curates high-level malicious behavior abstractions and organizes features into behavior sequences. - It fine-tunes BERT to model malicious behavior semantics. - It reported finding new malicious packages in PyPI and NPM. ### 不能支撑 / 不得外推 - MOLOT performance - Agent Gate execution correctness - PDG/FCD metrics ### 下一步 - 抽取行为 abstraction taxonomy，映射到 LRI malicious_activity_taxonomy. ## pub_pypi_benchmark_snapshot · A Benchmark Comparison of Python Malware Detection Approaches - 来源: https://arxiv.org/abs/2209.13288 - 资源卡: `python_malware_benchmark` - 链路用途: 支撑 LRI Gate 必须将 block 与 ask_human 分离，并为误报建立 budget。 ### 可直接支撑 - The paper builds a benchmark dataset for Python/PyPI malware detection. - It compares PyPI checks, Bandit4Mal, and OSSGadget OSS Detect Backdoor. - It reports repository administrators consider 0.01% false-positive rate too high in PyPI moderation. - Measured tools show high false-positive rates in the evaluated setting. ### 不能支撑 / 不得外推 - NPM ecosystem performance - MOLOT benchmark numbers - binary download scanning ### 下一步 - 抽取具体 baseline 表，建立 false_positive_budget 字段。 ## pub_npm_benchmark_snapshot · Understanding NPM Malicious Package Detection: A Benchmark-Driven Empirical Analysis - 来源: https://arxiv.org/abs/2603.27549 - 资源卡: `npm_malicious_detection_benchmark` - 链路用途: 支撑 LRI 对 JS/TS Skills 插件采用 activity chain 而非 isolated API signal。 ### 可直接支撑 - The paper builds a dataset with malicious and benign NPM packages. - It annotates 11 behavior categories and 8 evasion techniques. - It evaluates 8 tools across 13 variants. - It states a behavioral chain disambiguates malicious purpose better than a single API call. - It reports strategic tool combinations can achieve high accuracy and F1. ### 不能支撑 / 不得外推 - Python-only statement taxonomy - MOLOT direct method - FCD/PDG table ### 下一步 - 抽取 11 behavior categories 和 8 evasion techniques，映射 LRI activity taxonomy. ## pub_oss_malicious_packages_snapshot · OSS Malicious Package Analysis in the Wild - 来源: https://arxiv.org/abs/2404.04991 - 资源卡: `oss_malicious_package_analysis` - 链路用途: 支撑 LRI 建多源 evidence registry，而非单一 benchmark 依赖。 ### 可直接支撑 - The paper curates 23,425 malicious packages from scattered online sources. - It proposes a knowledge graph representation of OSS malware. - It notes low overlap between different online sources. - It describes a lifecycle of changing, release, detection, and removal. ### 不能支撑 / 不得外推 - single detector precision - Agent Gate runtime metrics ### 下一步 - 增加 campaign_context、variant_family、source_overlap 字段候选。 ## pub_backstabbers_snapshot · Backstabber’s Knife Collection - 来源: https://arxiv.org/abs/2005.09535 - 资源卡: `backstabbers_knife_collection` - 链路用途: 支撑 LRI 对 install-time/import-time/runtime 执行阶段分开建模。 ### 可直接支撑 - The paper reviews OSS supply-chain attacks involving malicious code injection into packages. - It presents 174 malicious packages from npm, PyPI, and RubyGems. - It proposes attack trees for dependency-tree injection and execution timing. ### 不能支撑 / 不得外推 - 2026 ecosystem coverage - MOLOT numbers - MCP-specific tool attacks ### 下一步 - 把 attack tree 映射到 artifact_threat_taxonomy 的 execution_phase 字段。 ## pub_statement_taxonomy_snapshot · Unveiling Malicious Logic - 来源: https://arxiv.org/abs/2512.12559 - 资源卡: `unveiling_malicious_logic` - 链路用途: 支撑 LRI 将模型定位结果转化为 statement-level indicator 和 reviewer checklist。 ### 可直接支撑 - The paper builds a statement-level dataset of malicious Python packages. - It labels malicious indicator occurrences at code-statement level. - It derives 47 malicious indicators across 7 types. - It applies sequential pattern mining to recurring indicator sequences. ### 不能支撑 / 不得外推 - JavaScript/NPM coverage - binary clone detection ### 下一步 - 抽取 indicator taxonomy，补 reviewer_evidence_schema 的 indicator_type。 ## pub_llm_pypi_snapshot · Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy? - 来源: https://arxiv.org/abs/2504.13769 - 资源卡: `llm_pypi_malicious_detection` - 链路用途: 支撑 LRI 将 LLM 作为 labeling/review assistant，而非唯一自动 block 信号。 ### 可直接支撑 - The paper evaluates LLMs, RAG, and few-shot learning for malicious PyPI source-code detection. - It integrates YARA rules, GitHub Security Advisories, and malicious code snippets. - It reports RAG performed modestly while few-shot learning was more effective in the evaluation. ### 不能支撑 / 不得外推 - MOLOT direct performance - PDG/FCD metrics ### 下一步 - 建立 LLM-review 与 static evidence 的 disagreement workflow。 ## pub_shap_snapshot · A Unified Approach to Interpreting Model Predictions - 来源: https://arxiv.org/abs/1705.07874 - 资源卡: `shap_unified_approach` - 链路用途: 支撑 explanation_tokens/activity attribution 字段，但不能单独决定安全动作。 ### 可直接支撑 - The paper introduces SHAP as a unified framework for interpreting model predictions. - SHAP assigns each feature an importance value for a particular prediction. - It connects additive feature importance methods with theoretical properties. ### 不能支撑 / 不得外推 - malicious code localization without model-specific mapping - block decision by itself ### 下一步 - 将 SHAP 输出绑定 source_locations 和 reviewer_actions。 ## unresolved_fcd_search_snapshot · FCD / PDG C/C++ performance table search result - 来源: user_provided_json - 资源卡: `fcd_pdg_performance_unresolved` - 链路用途: 阻止将 FCD 表升级为 direct evidence。 ### 可直接支撑 - Queries for the exact c-ares/jasper/openssl/rsync FCD speed table did not return a public original source in this iteration. - The table remains only a user-provided lead. ### 不能支撑 / 不得外推 - any verified precision/recall claim - association with MOLOT or PDG papers ### 下一步 - 继续用 exact project/version/table terms 搜索原始论文、报告或 slide。