Technical Summary: Bridging Expert Reasoning and LLM Detection (IntelGuard)

Problem Statement

Open-source ecosystems like NPM and PyPI are increasingly targeted by supply chain attacks, yet current detection methods face significant limitations. Rule-based approaches rely on fragile, handcrafted rules that require extensive manual maintenance and fail to capture evolving attack semantics. Data-driven machine learning methods suffer from concept drift, becoming outdated as threat patterns evolve, leading to degraded accuracy and high false positive rates. While Large Language Model (LLM)-based detectors offer a paradigm shift by analyzing program behavior at a higher abstraction level, they face two critical hurdles: inherent hallucinations leading to unreliable predictions, and a lack of access to systematic expert reasoning and contextual threat intelligence. Consequently, they struggle to analyze sophisticated or context-dependent malicious packages, often misclassifying legitimate packages with uncommon structures.

The core challenge lies in bridging the gap between human analytical reasoning—where experts assess code behavior consistency against intended functionality and reconstruct attack logic—and automated detection systems. This expert knowledge remains trapped in unstructured threat intelligence reports (PDFs, blogs), inaccessible to automated tools.

Methodology: IntelGuard Framework

The authors propose IntelGuard, a retrieval-augmented generation (RAG) based framework that integrates expert analytical reasoning from threat intelligence reports into an automated malicious package detection pipeline. The framework operates in two primary phases:

1. Knowledge Construction Phase

This phase transforms unstructured threat intelligence into a structured, machine-interpretable knowledge base.

• Data Preprocessing: The system collects 8,024 pages from 22 security vendors (e.g., ReversingLabs, Trend Micro). It employs OCR to extract code from screenshots and reconstructs the document layout to preserve the semantic alignment between code snippets and expert explanations.
• Extraction and Validation: An LLM extracts structured knowledge, including malicious code snippets, execution contexts (triggers, permissions), behavioral summaries, and the expert reasoning chains explaining why specific behaviors violate security principles. A human-in-the-loop validation step, involving security experts, ensures the fidelity of extracted reasoning and behavioral descriptions.
• Hierarchical Clustering: To handle diverse implementations of the same malicious intent, the system performs two-level clustering:
  • Syntactic Level: Clusters code embeddings to group snippets with similar structures.
  • Behavioral Level: Clusters behavioral embeddings derived from expert reasoning to group functionally equivalent but syntactically distinct attacks.
• Knowledge Base Schema: The final knowledge base stores entries as tuples containing the code snippet, context, behavioral description, expert reasoning, and dual embeddings (syntactic and behavioral) for efficient retrieval.

2. Malicious Package Detection Phase

When analyzing a new package, IntelGuard performs the following steps:

• Sensitive Code Slicing: Instead of analyzing the entire package, the system identifies sensitive API calls (e.g., file system access, network communication, process execution) and performs backward data-flow and control-flow slicing. This extracts self-contained functional units from the entry point to the sensitive API, capturing the complete execution context.
• RAG-based Retrieval: The system generates code and behavioral embeddings for the extracted slices. It queries the knowledge base to retrieve semantically similar malicious examples and their associated expert reasoning chains, balancing syntactic and behavioral similarity.
• LLM-Guided Reasoning: An LLM analyzes the target slice alongside the retrieved expert knowledge. It assesses whether the observed behaviors align with intended functionality or violate security principles based on the retrieved reasoning chains.
• Aggregation: A package is classified as malicious if any of its sensitive slices receives a malicious verdict. The system outputs a binary label and an interpretable reasoning report.

Key Contributions

1. Knowledge-Driven Detection Approach: The paper presents the first RAG-based LLM framework for malicious package analysis that extracts expert reasoning from threat intelligence reports and applies it to enable interpretable, zero-shot detection.
2. Comprehensive Knowledge Base: The authors constructed a structured knowledge base from 8,024 threat reports, containing 4,420 malicious code contexts. This includes behavioral descriptions and expert reasoning chains that explain security violations through functional boundaries, execution contexts, and attack pattern principles.
3. Robust Performance: The framework demonstrates state-of-the-art performance, achieving 99.0% accuracy with a 0.50% false positive rate on a dataset of 4,087 packages. Crucially, it maintains 96.50% accuracy on obfuscated code, a significant improvement over direct LLM analysis (52.82%).

Experimental Results

The evaluation was conducted on datasets comprising 2,000 PyPI and 2,027 npm packages, including a specific set of obfuscated samples.

• Accuracy: IntelGuard achieved 99% accuracy on PyPI and 98.72% on npm, outperforming the best baselines (rule-based, ML, and LLM-based) by 4–9 percentage points.
• Obfuscation Robustness: On obfuscated PyPI packages, IntelGuard maintained 96.50% accuracy. In contrast, direct LLM analysis dropped to 52.82%, and machine learning baselines suffered severe performance degradation (e.g., SAP-RF dropped by 23.17 points).
• False Positive Reduction: The false positive rate was reduced from up to 6.5% in baselines to 0.50%.
• Real-World Deployment: Between July and September 2025, IntelGuard was deployed to scan PyPI.org, discovering 54 previously unreported malicious packages. Of these, 24 were confirmed and removed by the PyPI security team, while the remaining 30 were independently removed prior to submission.

Significance and Claims

The paper claims that IntelGuard successfully bridges the gap between human expert reasoning and automated detection by transforming unstructured analytical knowledge into actionable detection capabilities. Its significance lies in:

• Interpretability: Unlike "black box" models, IntelGuard provides reasoning reports that explain decisions based on expert-validated logic and historical threat intelligence.
• Robustness: By relying on behavioral abstractions and expert reasoning rather than syntactic features, the system remains effective against code obfuscation techniques that typically defeat traditional ML and rule-based detectors.
• Practical Impact: The successful real-world deployment and discovery of unreported malicious packages demonstrate the framework's viability for continuous, real-time monitoring of open-source ecosystems.

The authors emphasize that the system does not replace human analysts but rather operationalizes their reasoning patterns, allowing automated systems to adapt to diverse attack patterns without manual rule encoding.