Detecting advanced typosquatting techniques in software repositories using semantic analysis

A non-transitory computer-readable medium comprising memory with instructions encoded thereon that, when executed by one or more processors, causes the one or more processors to perform operations comprising:

• detecting an untrusted package;
• inputting a name of the untrusted package into a machine learning model;
• receiving, as output from the machine learning model, an embedding vector representing the name of the untrusted package;
• determining a pool of candidate neighbors of the name of the untrusted package by:
• inputting the embedding vector into a plurality of models;
• receiving, as output from the plurality of models:
• an identification of one or more packages that are conceptually similar to the untrusted package;
• and
• a metric associated with an amount of conceptual similarity;
• selecting a subset of the pool of candidate neighbors based on their respective metrics;
• inputting names of each package of the subset into a large language model along with respective data associated with each respective package of the subset;
• identifying one or more packages of the subset that are sensitive based on output of the large language model;
• and
• generating an alert for each sensitive package.

A system comprising:

• memory with instructions encoded thereon;
• and
• one or more processors that, when executing the instructions, are caused to perform operations comprising:
• detecting an untrusted package;
• inputting a name of the untrusted package into a machine learning model;
• receiving, as output from the machine learning model, an embedding vector representing the name of the untrusted package;
• determining a pool of candidate neighbors of the name of the untrusted package by:
• inputting the embedding vector into a plurality of models;
• receiving, as output from the plurality of models:
• an identification of one or more packages that are conceptually similar to the untrusted package;
• and
• a metric associated with an amount of conceptual similarity;
• selecting a subset of the pool of candidate neighbors based on their respective metrics;
• inputting names of each package of the subset into a large language model along with respective data associated with each respective package of the subset;
• identifying one or more packages of the subset that are sensitive based on output of the large language model;
• and
• generating an alert for each sensitive package.