🤖 machine learning

eDySec: A Deep Learning-based Explainable Dynamic Analysis Framework for Detecting Malicious Packages in PyPI Ecosystem

The paper introduces eDySec, a deep learning-based framework that enhances the detection of malicious PyPI packages by leveraging dynamic behavioral analysis to significantly improve accuracy, reduce false positives and negatives, and provide explainable, stable results compared to traditional machine learning methods.

Original authors: Sk Tanzir Mehedi, Raja Jurdak, Chadni Islam, Abu Bakar Siddique Mahi, Gowri Ramachandran

Published 2026-04-30

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Sk Tanzir Mehedi, Raja Jurdak, Chadni Islam, Abu Bakar Siddique Mahi, Gowri Ramachandran

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the world of software as a massive, bustling library called PyPI. Every day, thousands of new books (software packages) are added to the shelves. Most are helpful tools, but some are "poisoned" books designed to steal secrets or break things once opened.

For a long time, librarians (security experts) tried to spot these bad books by looking at the cover (metadata) or reading the text inside (static code analysis). But the bad actors got clever. They started writing books that looked innocent on the cover and in the text, but only revealed their poison when you actually took them off the shelf and started reading them (during installation and after).

This is where the paper introduces eDySec. Think of eDySec not as a librarian reading the text, but as a high-tech security guard with X-ray vision who watches exactly what happens the moment a book is opened and used.

Here is how eDySec works, broken down into simple concepts:

1. The Problem: The "Sleeping" Bad Guys

Traditional security tools are like security guards who only check the book's title and author. They miss the "sleeping" bad guys—malicious code that waits until the package is installed to wake up and cause trouble. These bad guys use tricky tactics like:

Multi-stage attacks: They don't strike all at once; they wait for the right moment.
Dynamic payloads: They change their shape to hide.
Remote activation: They wait for a signal from a hacker far away to start their evil work.

Because these actions happen while the software is running, old tools can't see them.

2. The Solution: The "X-Ray" Security Guard (eDySec)

The researchers built a new system called eDySec. Instead of just reading the book, this system puts every new package in a safe, isolated sandbox (a digital playpen) and watches it like a hawk.

The Watchlist: It records every tiny move the package makes: which files it touches, what network connections it tries to make, and what system commands it whispers to the computer's brain (kernel).
The Brain (Deep Learning): This is where the magic happens. Instead of using simple rules (like "if it touches a file, it's bad"), eDySec uses a Deep Learning brain. Think of this brain as a master detective who has seen millions of movies. It doesn't just look for one specific clue; it learns the patterns of how bad guys behave. It can spot the subtle, complex dance of a malicious package that a simple rule would miss.

3. The "Filter" (Feature Selection)

The security guard sees everything, which creates a massive amount of noise. If you tried to listen to every single sound in a crowded stadium, you'd go crazy.

The Problem: The data is huge and messy (high-dimensional).
The Fix: eDySec uses a smart filter (called FLAML) to pick out only the 17 most important "sounds" out of the original 36. It's like tuning a radio to cut out the static and hear only the clear voice of the culprit. This makes the system faster and more accurate.

4. The "Trust Me" Factor (Explainability & Stability)

In the past, Deep Learning was like a black box: you put data in, and a result came out, but no one knew why. In security, you can't just say "I think this is bad"; you need to know why so you can trust the decision.

Stability: The researchers made sure the system doesn't flip-flop. If you run the test 10 times, it gives the same answer every time. It's not a coin toss; it's a reliable scale.
Explainability (XAI): eDySec comes with a translator. When it flags a package as bad, it points to the specific actions that gave it away (e.g., "This package tried to open a secret file and call a strange phone number"). This makes the decision transparent and trustworthy.

5. The Results: Faster, Smarter, and More Accurate

The paper claims eDySec is a huge upgrade over the current best tools (like a system called DySec):

Simpler: It uses half the data (52% fewer features) but gets better results.
Fewer Mistakes: It cuts down on "false alarms" (accusing good packages of being bad) by 82% and misses fewer actual bad packages (false negatives) by 79%.
Speed: It makes a decision in just 170 milliseconds per package. That's faster than a human can blink.
Accuracy: It achieves 99% accuracy, which is near-perfect.

The Bottom Line

The paper argues that to catch modern, sneaky software attacks, we need to stop just reading the "cover" and start watching the "action." eDySec is a new, super-fast, and transparent system that watches software behave in real-time, uses a smart AI brain to spot the bad guys, and explains exactly why it caught them, all while making fewer mistakes than any previous system.

1. Problem Statement

The security of open-source software repositories, particularly the Python Package Index (PyPI), is increasingly threatened by next-generation software supply chain attacks. Unlike traditional malware, these attacks often employ:

Multiphase execution: Malicious logic that remains dormant until specific triggers (e.g., install-time or post-installation).
Dynamic payload generation: Code that generates payloads only during execution.
Evasion techniques: Geofencing and conditional triggers that bypass static analysis.

Limitations of Existing Solutions:

Static/Metadata Analysis: Traditional Machine Learning (ML) detectors relying on static code or metadata fail to detect behaviors that only manifest during execution.
Dynamic Analysis Challenges: While dynamic analysis captures runtime behavior (system calls, network traffic, file I/O), the resulting data is high-dimensional, sparse, and heterogeneous.
ML Inadequacy: Conventional ML models struggle to model these complex, high-dimensional patterns, leading to high false positives (FP) and false negatives (FN).
Lack of Robustness: Existing studies often lack rigorous stability analysis (consistency across runs) and explainability (understanding why a model made a decision), creating a "black box" that is difficult to trust in security-critical environments.

2. Methodology: The eDySec Framework

The authors propose eDySec, a framework designed to be efficient, stable, and explainable. It utilizes the QUT-DV25 dataset, which captures 36 dynamic behavioral features (system calls, network traffic, directory access, dependency logs) from 14,271 PyPI packages (7,127 malicious, 7,144 benign) during install-time and post-installation phases.

The framework operates in four distinct phases:

A. Data Preparation & Preprocessing

Trace Collection: Uses eBPF (extended Berkeley Packet Filter) to collect kernel and user-level traces (Filetop, Opensnoop, Install, TCP, SysCall, Pattern).
Heterogeneous Handling:
- Numerical features: Standardized via z-score normalization.
- Categorical/Pattern features: Transformed into TF-IDF representations.
- Sequence models: Serialized into textual sequences, tokenized, and padded.

B. Feature Selection

To address the high dimensionality and sparsity, the framework evaluates multiple feature selection strategies to find the optimal subset:

Statistical: ANOVA, Correlation (CORR).
AutoML: Fast and Lightweight AutoML (FLAML).
Probabilistic Optimization: Particle Swarm Optimization (PSO), Whale Optimization Algorithm (WOA).
Selection Criteria: A weighted objective function balancing predictive performance ( $\alpha$ ) and feature reduction ( $1-\alpha$ ).
Outcome: FLAML was selected as the optimal method, reducing the feature set from 36 to 17 features while maintaining high accuracy.

C. Model Selection & Evaluation

The framework compares three categories of Deep Learning (DL) architectures against traditional ML baselines:

Classical DL: CNN, MLP, LeNet, MDCNN, NN.
Pre-Attention: LSTM, RNN.
Attention-Based: Transformer, BERT, DistilGPT-2.

Training: Models are trained on the reduced feature set using binary cross-entropy loss.
Baseline: Compared against DySec, a state-of-the-art Random Forest (RF) based dynamic analysis framework.

D. Stability & Explainability (XAI)

Stability Analysis: Evaluates model consistency across repeated runs using mean performance, standard deviation, confidence intervals, and rank-based comparisons.
Explainability: Integrates SHAP (SHapley Additive exPlanations) and LIME (Local Interpretable Model-agnostic Explanations) to provide:
- Global Interpretability: Identifying which features drive malicious classification overall.
- Local Interpretability: Explaining specific instance predictions (e.g., why a specific package was flagged).

3. Key Contributions

eDySec Framework: A novel DL-based pipeline that integrates dynamic behavioral analysis with rigorous feature selection, stability assessment, and XAI.
Feature Optimization: Demonstrates that FLAML-based feature selection can reduce dimensionality by 52.78% (36 to 17 features) without sacrificing performance, effectively filtering noise.
Model Superiority: Proves that lightweight Classical DL models (specifically MLP) outperform complex Attention-based models and traditional ML baselines in this specific domain.
Stability & Transparency: Establishes a benchmark for stability in malicious package detection and provides transparent, interpretable decision-making via SHAP/LIME, addressing the "black box" issue.
Empirical Validation: Extensive evaluation on the QUT-DV25 dataset showing significant improvements over the state-of-the-art (DySec).

4. Experimental Results

The evaluation on the QUT-DV25 dataset yielded the following key metrics:

Performance vs. State-of-the-Art (DySec):
- Accuracy: Improved from 96% (DySec) to 99% (eDySec MLP).
- False Positives (FP): Reduced by 82% (from 34 to 6).
- False Negatives (FN): Reduced by 79% (from 52 to 11).
- Feature Dimensionality: Reduced by 52.78% (36 $\to$ 17 features).
Model Efficiency:
- Inference Latency: 170ms per package.
- Training Time: The best MLP model trained in ~318s, significantly faster than large Transformer models (e.g., BERT took ~17,450s).
- Stability: Classical DL models (MLP, MDCNN, NN) achieved near-perfect stability scores (0.996) with very low standard deviation (0.004), whereas complex models like BERT and RNN showed higher variance.
Feature Insights:
- Combined Traces: The combination of all trace types (Filetop, SysCall, etc.) outperformed individual traces.
- Key Drivers: Process Operations and I/O Operations were identified as the most influential features for detecting malicious behavior.
- Weak Features: "Install" traces alone were insufficient, highlighting the need for post-installation monitoring.

5. Significance and Implications

For Security Practitioners: eDySec demonstrates that dynamic analysis is critical for detecting next-gen supply chain attacks that static analysis misses. It proves that lightweight DL models can be deployed efficiently (low latency) without needing massive computational resources.
For Repository Platforms: The framework suggests a layered defense strategy where suspicious packages are escalated to sandboxed dynamic analysis. The inclusion of XAI helps analysts trust automated moderation decisions.
For Researchers: The study highlights that feature quality and representation are often more critical than model complexity. It also establishes a new standard for evaluating security models by requiring stability metrics and explainability, moving beyond simple accuracy scores.
Future Directions: The authors suggest extending the framework to other ecosystems (npm, Maven) and integrating kernel-level AI agent monitoring to capture more complex evasion techniques.

In conclusion, eDySec successfully bridges the gap between high-performance deep learning and the practical needs of software supply chain security by delivering a detector that is not only highly accurate but also stable, efficient, and transparent.