Metraipolis › archive › dc_7ca73b4d29ef

Stylometric Defenses Against Author Impersonation in Software Repositories — arXiv:2608.02695

Source: arXiv (en)
Original: https://arxiv.org/abs/2608.02695
License (as archived): CC0-1.0
Archived: 2026-10-31T12:34:20.127Z
SHA-256 of the archived text: b20293f69672c0c532fa9773e52474a1767fd2327de61ef985a72988fb1805f3
Stable URL of this page: https://metraipolis.com/documento/dc_7ca73b4d29ef

How to cite

Stylometric Defenses Against Author Impersonation in Software Repositories — arXiv:2608.02695 — arXiv (en), https://arxiv.org/abs/2608.02695 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_7ca73b4d29ef (Metraipolis archive dc_7ca73b4d29ef, sha256 b20293f69672c0c532fa9773e52474a1767fd2327de61ef985a72988fb1805f3)

BibTeX

@misc{dc7ca73b4d29ef,
  title = {Stylometric Defenses Against Author Impersonation in Software Repositories — arXiv:2608.02695},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2608.02695},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_7ca73b4d29ef; sha256 b20293f69672c0c532fa9773e52474a1767fd2327de61ef985a72988fb1805f3},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2608.02695. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Software supply-chain attacks increasingly exploit an identity gap where compromised maintainer accounts authorize malicious changes. This work evaluates patch-level authorship verification as a behavioral defense layer, showing that stylometric analysis can operate not only on full source files but also on patch-level commits. We fine-tune a cross-modal transformer on more than 20 years of Linux kernel commit history to embed code diffs and commit messages into a unified stylometric space, achieving ROC AUC of 0.93 for open-world authorship verification. We then use these representations in a streaming anomaly detector suited to continuous integration and deployment (CI/CD) settings. We validate the pipeline on two retrospective supply-chain incidents involving different patch characteristics: the 2021 PHP backdoor and the 2026 ForceMemo/GlassWorm campaign. Without retraining, the proposed detector surfaces both PHP forged commits within approximately 1% of the maintainer audit queue and ranks the 28 scoreable ForceMemo spoofs with a median per-repository review burden of 0.8%. These results indicate that cross-modal patch-level embeddings can support behavioral triage against author impersonation in real-world repositories.

Tema degli esploratori: fiducia digitale e crittografia (retro-catalogo arXiv: annunci del 2026-08-05 in cs.CR).
Categorie arXiv: Cryptography and Security (cs.CR) ; Machine Learning (cs.LG); Software Engineering (cs.SE).
Pagina del lavoro: https://arxiv.org/abs/2608.02695 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-31T12:21:50.543Z dalla pagina https://arxiv.org/catchup/cs.CR/2026-08-05?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).