In recent years, software supply chain attacks have become increasingly prevalent, prompting considerable research into detecting malicious packages within relevant repositories. With the popularity bolstered by the widespread adoption of open-source practices, Java become one of the preferred languages among modern developers. However, the issue of malware detection in Java components remains unresolved. Most prior approaches suffer from insufficient code coverage and coarse-grained representation, making them unsuitable for Java components. In this paper, we propose an innovative solution called Shear tailored for detecting malicious Java components. Shear firstly analyzes all methods in the component and locates potential malicious code snippets based on sensitive calls, as slice-level analysis provides a better understanding of the specific malicious activities. Secondly, statements depending on sensitive call sites are extracted and embedded into vectors for further detection instead of function-level representation which is coarse-grained facing the dynamic features in Java. The corresponding experimental results show that Shear effectively identifies the malicious semantics hidden in the code slices by leveraging the neural network model, outperforming currently available tools to a great extent. Through real-world validation, Shear detected 51 components with malicious characteristics out of 68,273, demonstrating its practical feasibility. This study introduces the first Java malicious component detection method suitable for real-world scenarios, carrying considerable practical significance in bolstering defenses within the software supply chain.

Vulnerability is a significant security threat to information systems, drawing widespread concern from researchers. In recent years, owing to continuous advancements in defense technologies, the success rate of exploiting a single N-day vulnerability for attacking has gradually decreased. Attackers are now attempting to exploit multiple vulnerabilities simultaneously to achieve their objectives. This phenomenon is referred to as the vulnerability co-exploitation. Limited by strict vulnerability triggering conditions, successful attacks via vulnerability co-exploitation are infrequent. Due to the low proportion of co-exploitation cases among all vulnerabilities, few studies have focused on co-exploitation relationships or investigated co-exploitation under the condition of extreme data imbalance. In additon, existing work lacks sufficient multidimensional features, which are crucial for accurately identifying and understanding co-exploitation scenarios. However, the prediction of vulnerability co-exploitation remains valuable as it aids practitioners in identifying potential critical risk points within the system. In this article, we propose a framework named CoExpMiner, based on the attributed heterogeneous information network, for mining potential vulnerability co-exploitation under the extreme data imbalance condition. CoExpMiner utilizes structure and attribute features of the attributed heterogeneous graph to predict vulnerability co-exploitation, with employing a prefilter structure to accelerate the process and reduce the computational cost. Experimental results demonstrate that CoExpMiner can effectively predict co-exploitation despite the challenges posed by extreme data imbalance.