Home // SOFTENG 2026, The Twelfth International Conference on Advances and Trends in Software Engineering // View article

Towards the Static Detection of Compromised Software Components by Topological Anomalies

Authors:
Oscar Z. de Paiva
Wilson V. Ruggiero
Marcos A. Simplicio Jr.

Keywords: Open-Source Security; Supply Chain Attacks; Malware Detection

Abstract:
Open-source components are critical assets for reducing software development costs and fostering innovation throughout the globe. However, they introduced serious attack venues in modern software supply-chains, as attackers have been able to inject malicious code into these components with relative ease through various means. Such attacks have increased over the past five years and remain frequent despite the various protection mechanisms proposed to prevent or mitigate them. To address this issue, this paper presents a novel protection mechanism aimed at detecting malicious code injected into open-source components and applications via supply-chain attacks. Due to the relevance of technology in corporate environments, we selected Java as the focus of our study. The proposed mechanism is based on a topological static analysis approach: it extracts topological features of uncontaminated programs, and associates these features to normal (i.e., non-malicious) connections of security-critical methods to program parts, and with each other via these parts. These associations are then used to identify the presence of malicious code as topological anomalies in compromised programs. Preliminary results, obtained from a partial implementation of the technique, indicate high detection accuracy (ranging from 86.3% to 99.98% in a publicly-available dataset), and a small number of false-positive classifications -- illustrating that the proposed technique is robust and useful in practice. The paper also discusses some potential limitations of our proposal, as well as possible improvements to address them.

Pages: 29 to 34

Copyright: Copyright (c) IARIA, 2026

Publication date: May 24, 2026

Published in: conference

ISSN: 2519-8394

ISBN: 978-1-68558-398-9

Location: Venice, Italy

Dates: from May 24, 2026 to May 28, 2026