An official website of the United States government
Package confusion attacks such as typosquatting threaten soft- ware supply chains. Attackers make packages with names that syntactically or semantically resemble legitimate ones, trick- ing engineers into installing malware. While prior work has developed defenses against package confusions in some soft- ware package registries, notably NPM, PyPI, and RubyGems, gaps remain: high false-positive rates, generalization to more software package ecosystems, and insights from real-world deployment. In this work, we introduce ConfuGuard, a state-of-art de- tector for package confusion threats. We begin by presenting the first empirical analysis of benign signals derived from prior package confusion data, uncovering their threat patterns, engineering practices, and measurable attributes. Advancing existing detectors, we leverage package metadata to distin- guish benign packages, and extend support from three up to seven software package registries. Our approach significantly reduces false positive rates (from 80% to 28%), at the cost of an additional 14s average latency to filter out benign pack- ages by analyzing the package metadata. ConfuGuard is used in production at our industry partner, whose analysts have already confirmed 630 real attacks detected by ConfuGuard
more »
« less
Wavefunction database and computation (WfBase)
WfBase is a software package providing an easy way to compute from first-principles various properties depending on the electronic structure of periodic solids. This package can parse user-provided mathematical expressions, in a human-readable format, using the Einstein notation for indices. This package also comes with a built-in database of some simple materials. For more details, please see: https://coh.ucr.edu/wfbase
more »
« less
- Award ID(s):
- 1848074
- PAR ID:
- 10524418
- Publisher / Repository:
- Zenodo
- Date Published:
- Subject(s) / Keyword(s):
- Condensed matter physics
- Format(s):
- Medium: X
- Right(s):
- GNU General Public License v3.0 or later
- Sponsoring Org:
- National Science Foundation
More Like this
-
-
ABSTRACT Voltage‐dependent anion channel (VDAC) is the primary conduit for regulated passage of ions and metabolites into and out of a mitochondrion. Calculating the solvation free energy for VDAC is crucial for understanding its stability, function, and interactions within the cellular environment. In this article, numerical schemes for computing the total solvation free energy for VDAC—comprising electrostatic, ideal gas, and excess free energies plus the nonpolar energy—are developed based on a nonuniform size modified Poisson–Boltzmann ion channel (nuSMPBIC) finite element solver along with tetrahedral meshes for VDAC proteins. The current mesh generation package is also updated to improve mesh quality and accelerate mesh generation. A VDAC Solvation Free Energy Calculation (VSFEC) package is then created by integrating these schemes with the updated mesh package, the nuSMPBIC finite element package, the PDB2PQR package, and the OPM database, as well as one uniform SMPBIC finite element package and one Poisson–Boltzmann ion channel (PBIC) finite element package. With the VSFEC package, many numerical experiments are made using six VDAC proteins, eight ionic solutions containing up to four ionic species, including ATP4−and Ca2+, two reference states, different boundary values, and different permittivity constants. The test results underscore the importance of considering nonuniform ionic size effects to explore the varying patterns of the total solvation free energy, and demonstrate the high performance of the VSFEC package for VDAC solvation free energy calculation.more » « less
-
null (Ed.)The Macaulay2 [5] package AlgebraicOptimization implements methods for determining the algebraic degree of an optimization problem. We describe the structure of an algebraic optimization problem and explain how the methods in this package may be used to determine the respective degrees. Special features include determining Euclidean distance degrees and maximum likelihood degrees. To our knowledge, this is the first comprehensive software package combining different methods in algebraic optimization. The package is available at https://github.com/Macaulay2/Workshop-2020-Cleveland/tree/ISSAC-AlgOpt/alg-stat/AlgebraicOptimization.more » « less
-
Over the past decade, three-dimensional die stacking technology has been considered for building large-scale in-package memory systems. In particular, in-package DRAM cache has been considered as a promising solution for high bandwidth and large-scale cache architectures. There are, however, significant challenges such as limited energy efficiency, costly tag management, and physical limitations for scalability that need to be effectively addressed before one can adopt in-package caches in the real-world applications. This paper proposes R-Cache, an in-package cache made by 3D die stacking of memristive memory arrays to alleviate the above-mentioned challenges. Our simulation results on a set of memory intensive parallel applications indicate that R-Cache outperforms the state-of-the-art proposals for in-package caches. R-Cache improves performance by 38% and 27% over the state-of-the-art direct mapped and set associative cache architectures, respectively. Moreover, R-Cache results in averages of 40% and 27% energy reductions as compared to the direct mapped and set-associative cache systems.more » « less
-
The large amount of third-party packages available in fast-moving software ecosystems, such as Node.js/npm, enables attackers to compromise applications by pushing malicious updates to their package dependencies. Studying the npm repository, we observed that many packages in the npm repository that are used in Node.js applications perform only simple computations and do not need access to filesystem or network APIs. This offers the opportunity to enforce least-privilege design per package, protecting applications and package dependencies from malicious updates. We propose a lightweight permission system that protects Node.js applications by enforcing package permissions at runtime. We discuss the design space of solutions and show that our system makes a large number of packages much harder to be exploited, almost for free.more » « less
