Pith. sign in

REVIEW 88 references

Stylometric Defenses Against Author Impersonation in Software Repositories

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2608.02695 v1 pith:GSOANXZG submitted 2026-08-03 cs.CR cs.LGcs.SE

Leonid Ravich , Michael Fire This is my paper
classification cs.CRcs.LGcs.SE
keywords patch-levelstylometricauthorauthorshipbehavioralcommitcommitscross-modal
verification ladder T0 review T1 audit T2 compute T3 formal
0 comments
read the original abstract

Software supply-chain attacks increasingly exploit an identity gap where compromised maintainer accounts authorize malicious changes. This work evaluates patch-level authorship verification as a behavioral defense layer, showing that stylometric analysis can operate not only on full source files but also on patch-level commits. We fine-tune a cross-modal transformer on more than 20 years of Linux kernel commit history to embed code diffs and commit messages into a unified stylometric space, achieving ROC AUC of 0.93 for open-world authorship verification. We then use these representations in a streaming anomaly detector suited to continuous integration and deployment (CI/CD) settings. We validate the pipeline on two retrospective supply-chain incidents involving different patch characteristics: the 2021 PHP backdoor and the 2026 ForceMemo/GlassWorm campaign. Without retraining, the proposed detector surfaces both PHP forged commits within approximately 1% of the maintainer audit queue and ranks the 28 scoreable ForceMemo spoofs with a median per-repository review burden of 0.8%. These results indicate that cross-modal patch-level embeddings can support behavioral triage against author impersonation in real-world repositories.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

88 extracted references · 41 canonical work pages

  1. [1]

    Secure Software Development Framework (SSDF) version 1.1 : recommendations for mitigating the risk of software vulnerabilities

    Souppaya, Murugiah, Scarfone, Karen, and Dodson, Donna. Secure Software Development Framework (SSDF) version 1.1 : recommendations for mitigating the risk of software vulnerabilities. Technical Report NIST SP 800-218, National Institute of Standards and Technology (U.S.), Gaithersburg, MD, February 2022. URL https://nvlpubs.nist.gov/nistpub s/SpecialPubli...

    2022

  2. [2]

    Devphish: Exploring so- cial engineering in software supply chain attacks on de- velopers

    Siadati, Hossein, Jafarikhah, Sima, Sahin, Elif, Hernan- dez, Terrence Brent, Tripp, Elijah Lorenzo, Khryashchev, Denis, and Kharraz, Amin. Devphish: Exploring so- cial engineering in software supply chain attacks on de- velopers. In2024 IEEE 15th Annual Ubiquitous Com- puting, Electronics and Mobile Communication Confer- ence (UEMCON), pages 517–523. IEE...

    arXiv 2024

  3. [3]

    Research directions in software supply chain security.ACM Transactions on Software Engineering and Methodology, 34(5):1–38, 2025

    Williams, Laurie, Benedetti, Giacomo, Hamer, Sivana, Paramitha, Ranindya, Rahman, Imranur, Tamanna, Mahz- abin, Tystahl, Greg, Zahan, Nusrat, Morrison, Patrick, Acar, Yasemin, Cukier, Michel, K”astner, Christian, Kapravelos, Alexandros, Wermke, Dominik, and Enck, William. Research directions in software supply chain security.ACM Transactions on Software E...

    doi:10.1145/3714464 2025

  4. [4]

    Update on git.php.net incident, April 2021

    Popov, Nikita. Update on git.php.net incident, April 2021. URL https://news-web.php.net/php.int ernals/113981. php.internals mailing list, accessed 2026-05-12

    2021

  5. [5]

    git.php.net server compromised, move to GitHub, and delayed updates, March 2021

    PHP.Watch. git.php.net server compromised, move to GitHub, and delayed updates, March 2021. URLhttps: //php.watch/news/2021/03/git-php-net -hack. Early incident report. Later mechanism details were revised in Popov’s official incident update. Accessed 2026-05-12

    2021

  6. [6]

    Re- ported supply chain compromise affecting xz utils data compression library, cve-2024-3094, 2024

    Cybersecurity and Agency, Infrastructure Security. Re- ported supply chain compromise affecting xz utils data compression library, cve-2024-3094, 2024. URLhttps: //www.cisa.gov/news-events/alerts/202 4/03/29/reported-supply-chain-comprom ise-affecting-xz-utils-data-compressi on-library-cve-2024-3094

    2024

  7. [7]

    ForceMemo: Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push, March 2026

    Sharma, Varun. ForceMemo: Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push, March 2026. URL https://www.st epsecurity.io/blog/forcememo-hundred s-of-github-python-repos-compromised -via-account-takeover-and-force-push . Accessed 2026-05-15

    2026

  8. [8]

    De-anonymizing programmers via code stylometry

    Caliskan-Islam, Aylin, Harang, Richard E., Liu, Andrew, Narayanan, Arvind, V oss, Clare R., Yamaguchi, Fabian, and Greenstadt, Rachel. De-anonymizing programmers via code stylometry. In24th USENIX Security Sympo- sium, pages 255–270. USENIX Association, 2015

    2015

Show all 88 references
  1. [9]

    Git blame who?: Stylistic author- ship attribution of small, incomplete source code frag- ments.Proceedings on Privacy Enhancing Technologies, 2019(3):389–408, 2019

    Dauber, Edwin, Caliskan, Aylin, Harang, Richard, Shearer, Gregory, Weisman, Michael, Nelson, Frederica, and Greenstadt, Rachel. Git blame who?: Stylistic author- ship attribution of small, incomplete source code frag- ments.Proceedings on Privacy Enhancing Technologies, 2019(3...

    2019 doi

  2. [10]

    Authorship attribution of source code: a language-agnostic approach and applicability in software engineering

    Bogomolov, Egor, Kovalenko, Vladimir, Rebryk, Yurii, Bacchelli, Alberto, and Bryksin, Timofey. Authorship attribution of source code: a language-agnostic approach and applicability in software engineering. InESEC/FSE ’21: 29th ACM Joint European Software Engineering Conference...

    2021

  3. [11]

    Unixcoder: Unified cross-modal pre-training for code representation

    Guo, Daya, Lu, Shuai, Duan, Nan, Wang, Yanlin, Zhou, Ming, and Yin, Jian. Unixcoder: Unified cross-modal pre-training for code representation. InProceedings of the 60th Annual Meeting of the Association for Compu- tational Linguistics (ACL), pages 7212–7225, 2022. doi: 10.1865...

    2022 doi

  4. [12]

    SoK: Taxonomy of attacks on open- source software supply chains

    Ladisa, Piergiorgio, Plate, Henrik, Martinez, Matias, and Barais, Olivier. SoK: Taxonomy of attacks on open- source software supply chains. In2023 IEEE Symposium on Security and Privacy (SP), pages 1509–1526. IEEE,

  5. [13]

    Backstabber’s knife collection: A review of Stylometric Defenses Against Author Impersonation in Software Repositories — 16/24 open source software supply chain attacks

    Ohm, Marc, Plate, Henrik, Sykosch, Arnold, and Meier, Michael. Backstabber’s knife collection: A review of Stylometric Defenses Against Author Impersonation in Software Repositories — 16/24 open source software supply chain attacks. InDetec- tion of Intrusions and Malware, and...

    2020 doi

  6. [14]

    A comparison of code–similarity analysers.Em- pirical Software Engineering, 23(4):2464–2519, 2018

    Ragkhitwetsagul, Chaiyong, Krinke, Jens, and Clark, David. A comparison of code–similarity analysers.Em- pirical Software Engineering, 23(4):2464–2519, 2018. doi: 10.1007/s10664-017-9564-7. URL https: //doi.org/10.1007/s10664-017-9564-7

    2018 doi

  7. [15]

    Detecting suspicious package updates

    Garrett, Kalil, Ferreira, Gabriel, Jia, Limin, Sunshine, Joshua, and K”astner, Christian. Detecting suspicious package updates. In2019 IEEE/ACM 41st International Conference on Software Engineering: New Ideas and Emerging Results (ICSE–NIER), pages 13–16, 2019. doi: 10.1109/IC...

    2019

  8. [16]

    Scalable source code similarity detection in large code repositories.EAI Endorsed Transactions on Scalable Information Systems, 6(22), 2019

    Alomari, Firas and Harbi, Muhammed. Scalable source code similarity detection in large code repositories.EAI Endorsed Transactions on Scalable Information Systems, 6(22), 2019. doi: 10.4108/eai.13-7-2018.159353. URL https://doi.org/10.4108/eai.13-7-201 8.159353

    2019

  9. [17]

    Evaluating automatically generated yara rules and enhancing their effectiveness

    Naik, Nitin, Jenkins, Paul, Cooke, Roger, Gillett, Jonathan, and Jin, Yaochu. Evaluating automatically generated yara rules and enhancing their effectiveness. In2020 IEEE Symposium Series on Computational In- telligence (SSCI), pages 1146–1153. IEEE, 2020. doi: 10.1109/SSCI478...

    2020

  10. [18]

    Malicious source code de- tection using a translation model.Patterns, 4(7):100773,

    Tsfaty, Chen and Fire, Michael. Malicious source code de- tection using a translation model.Patterns, 4(7):100773,

  11. [19]

    SoK: A defense-oriented evaluation of software supply chain security

    Ishgair, Eman Abu, Melara, Marcela S., and Torres-Arias, Santiago. SoK: A defense-oriented evaluation of software supply chain security. arXiv preprint arXiv:2405.14993,

    arXiv

  12. [20]

    URL https://doi.org/10.1016/j.patter.2023

    doi: 10.1016/j.patter.2023.100773. URL https://doi.org/10.1016/j.patter.2023. 100773

    2023

  13. [21]

    Towards robust detection of open source software supply chain poisoning attacks in in- dustry environments

    Zheng, Xinyi, Wei, Chen, Wang, Shenao, Zhao, Yan- jie, Gao, Peiming, Zhang, Yuanchao, Wang, Kailong, and Wang, Haoyu. Towards robust detection of open source software supply chain poisoning attacks in in- dustry environments. In39th IEEE/ACM International Conference on Automat...

    1990

  14. [22]

    Zhang, Junan, Huang, Kaifeng, Huang, Yiheng, Chen, Bihuan, Wang, Ruisi, Wang, Chong, and Peng, Xin. Killing two birds with one stone: Malicious package detection in NPM and PyPI using a single model of mali- cious behavior sequence.ACM Transactions on Software Engineering and ...

    2025 doi

  15. [23]

    A survey of mal- ware detection techniques

    Idika, Nwokedi and Mathur, Aditya P. A survey of mal- ware detection techniques. Technical report, Department of Computer Science, Purdue University, West Lafayette, IN, USA, 2007. URL https://www.cerias.pur due.edu/apps/reports_and_papers/view /4328/

    2007

  16. [24]

    Attributing open-source contributions is critical but difficult: A systematic analysis of github prac- tices and their impact on software supply chain security

    Holtgrave, Jan-Ulrich, Friedrich, Kay, Fischer, Fabian, Huaman, Nicolas, Busch, Niklas, Klemmer, Jan H., Fourn´e, Marcel, Wiese, Oliver, Wermke, Dominik, and Fahl, Sascha. Attributing open-source contributions is critical but difficult: A systematic analysis of github prac- ti...

    2025

  17. [25]

    Integra- tion of static and dynamic code stylometry analysis for programmer de-anonymization

    Wang, Ningfei, Ji, Shouling, and Wang, Ting. Integra- tion of static and dynamic code stylometry analysis for programmer de-anonymization. InProceedings of the 11th ACM Workshop on Artificial Intelligence and Secu- rity (AISec), pages 74–84, New York, NY , USA, 2018. ACM. doi:...

    2018

  18. [26]

    Evading machine learning malware classifiers

    Fleshman, William. Evading machine learning malware classifiers. Blog post on Towards Data Science (Medium),

  19. [27]

    Authorship attribution with topic models.Computational Stylometric Defenses Against Author Impersonation in Software Repositories — 17/24 Linguistics, 40(2):269–310, 2014

    Seroussi, Yanir, Zukerman, Ingrid, and Bohnert, Fabian. Authorship attribution with topic models.Computational Stylometric Defenses Against Author Impersonation in Software Repositories — 17/24 Linguistics, 40(2):269–310, 2014. doi: 10.1162/coli \ a \ 00173

    2014 doi

  20. [28]

    Dataset char- acteristics for reliable code authorship attribution.IEEE Transactions on Dependable and Secure Computing, 20 (1):506–521, 2023

    Abazari, Farzaneh, Branca, Enrico, Ridley, Norah, Stakhanova, Natalia, and Preda, Mila Dalla. Dataset char- acteristics for reliable code authorship attribution.IEEE Transactions on Dependable and Secure Computing, 20 (1):506–521, 2023. doi: 10.1109/TDSC.2021.3138700

    2023

  21. [29]

    Mis- leading authorship attribution of source code using ad- versarial learning

    Quiring, Erwin, Maier, Alwin, and Rieck, Konrad. Mis- leading authorship attribution of source code using ad- versarial learning. In28th USENIX Security Sympo- sium (USENIX Security 19), pages 479–496, Santa Clara, CA, USA, 2019. USENIX Association. URL https: //www.usenix.org...

    2019

  22. [30]

    Overview of the authorship verification task at pan 2023

    Stamatatos, Efstathios, Kredens, Krzysztof, Pezik, Piotr, Heini, Annina, Bevendorff, Janek, Stein, Benno, and Potthast, Martin. Overview of the authorship verification task at pan 2023. InWorking Notes of the Conference and Labs of the Evaluation Forum (CLEF 2023), volume 3497...

    2023

  23. [31]

    URL https://ceur-ws.org/Vol-3497/ paper-199.pdf

  24. [32]

    Code authorship identification using convolutional neural net- works.Future Generation Computer Systems, 95:104– 115, 2019

    Abuhamad, Mohammed, su Rhim, Ji, AbuHmed, Tamer, Ullah, Sana, Kang, Sanggil, and Nyang, DaeHun. Code authorship identification using convolutional neural net- works.Future Generation Computer Systems, 95:104– 115, 2019. doi: 10.1016/j.future.2018.12.038

    2019 doi

  25. [33]

    Deep metric learning for code authorship attribution and verification

    White, Riley and Sprague, Nathan. Deep metric learning for code authorship attribution and verification. In2021 20th IEEE International Conference on Machine Learn- ing and Applications (ICMLA), pages 1089–1093, 2021. doi: 10.1109/ICMLA52953.2021.00178

    2021

  26. [34]

    H., Tian, Yuan, and Song, Leo

    Ou, Weihan, Ding, Steven H. H., Tian, Yuan, and Song, Leo. Scs-gan: Learning functionality-agnostic stylomet- ric representations for source code authorship verification. IEEE Transactions on Software Engineering, 49(4):1426– 1442, 2023. doi: 10.1109/TSE.2022.3177228

    2023

  27. [35]

    SHIELD: Thwarting code authorship attribution.IEEE Transactions on Depend- able and Secure Computing, 22(5):4753–4767, 2025

    Abuhamad, Mohammed, Jung, Changhun, Mohaisen, David, and Nyang, DaeHun. SHIELD: Thwarting code authorship attribution.IEEE Transactions on Depend- able and Secure Computing, 22(5):4753–4767, 2025. doi: 10.1109/TDSC.2025.3553753. URL https: //doi.org/10.1109/TDSC.2025.3553753

    2025

  28. [36]

    Authorship attribution of source code by using back propagation neural network based on particle swarm optimization.PLOS ONE, 12(11):e0187204, November

    Yang, Xinyu, Xu, Guoai, Li, Qi, Guo, Yanhui, and Zhang, Miao. Authorship attribution of source code by using back propagation neural network based on particle swarm optimization.PLOS ONE, 12(11):e0187204, November

  29. [37]

    Codebert: A pre-trained model for programming and natural lan- guages

    Feng, Zhangyin, Guo, Daya, Tang, Duyu, Duan, Nan, Feng, Xiaocheng, Gong, Ming, Shou, Linjun, Qin, Bing, Liu, Ting, Jiang, Daxin, and Zhou, Ming. Codebert: A pre-trained model for programming and natural lan- guages. InFindings of the Association for Computa- tional Linguistics...

    2020 doi

  30. [38]

    Graphcodebert: Pre- training code representations with data flow

    Guo, Daya, Ren, Shuo, Lu, Shuai, Feng, Zhangyin, Tang, Duyu, Liu, Shujie, Zhou, Long, Duan, Nan, Svyatkovskiy, Alexey, Fu, Shengyu, Tufano, Michele, Deng, Shao Kun, Clement, Colin, Drain, Dawn, Sundaresan, Neel, Yin, Jian, Jiang, Daxin, and Zhou, Ming. Graphcodebert: Pre- trai...

  31. [39]

    Wang, Yue, Wang, Weishi, Joty, Shafiq, and Hoi, Steven C. H. Codet5: Identifier-aware unified pre-trained encoder-decoder models for code understanding and gen- eration. InProceedings of the 2021 Conference on Em- pirical Methods in Natural Language Processing, pages 8696–8708...

    2021

  32. [40]

    CommitBERT: Commit message gener- ation using pre-trained programming language model

    Jung, Tae Hwan. CommitBERT: Commit message gener- ation using pre-trained programming language model. In Proceedings of the 1st Workshop on Natural Language Processing for Programming (NLP4Prog 2021), pages 26–33. Association for Computational Linguistics, 2021. doi: 10.18653/...

    2021 doi

  33. [41]

    Large-scale and robust code authorship identification with deep feature learning.ACM Transactions on Privacy and Security, 24(4):23:1–23:35,

    Abuhamad, Mohammed, AbuHmed, Tamer, Mohaisen, David, and Nyang, DaeHun. Large-scale and robust code authorship identification with deep feature learning.ACM Transactions on Privacy and Security, 24(4):23:1–23:35,

  34. [42]

    Code representation learning at scale

    Zhang, Dejiao, Ahmad, Wasi Uddin, Tan, Ming, Ding, Hantian, Nallapati, Ramesh, Roth, Dan, Ma, Xiaofei, and Xiang, Bing. Code representation learning at scale. InThe Twelfth International Conference on Learning Representations (ICLR), 2024. URL https://open review.net/forum?id=...

    2024

  35. [43]

    Ropgen: Towards robust code authorship attribution via automatic coding style transfor- mation

    Li, Zhen, Chen, Guenevere (Qian), Chen, Chen, Zou, Yayi, and Xu, Shouhuai. Ropgen: Towards robust code authorship attribution via automatic coding style transfor- mation. InProceedings of the 44th International Confer- ence on Software Engineering (ICSE), pages 1906–1918,

    1906

  36. [44]

    Clave: A deep learning model for source code authorship verifica- tion with contrastive learning and transformer encoders

    ´Alvarez-Fidalgo, David and Ort´ın, Francisco. Clave: A deep learning model for source code authorship verifica- tion with contrastive learning and transformer encoders. Information Processing & Management, 62(3):104005,

  37. [45]

    Zero-shot source code author identifica- tion: A lexicon and layout independent approach

    Hozhabrierdi, Pegah, Hitos, Dunai Fuentes, and Mohan, Chilukuri K. Zero-shot source code author identifica- tion: A lexicon and layout independent approach. In 2020 International Joint Conference on Neural Networks (IJCNN), pages 1–8, 2020. doi: 10.1109/IJCNN48605.2 020.9207647

    2020 doi

  38. [46]

    Determining if two documents are written by the same author.Journal of the Association for Information Science and Technology, 65(1):178–187, 2014

    Koppel, Moshe and Winter, Yaron. Determining if two documents are written by the same author.Journal of the Association for Information Science and Technology, 65(1):178–187, 2014. doi: 10.1002/asi.22954. URL https://doi.org/10.1002/asi.22954

    2014 doi

  39. [47]

    URL https://openreview.net/forum ?id=jLoC4ez43PZ

  40. [48]

    Pydriller: Python framework for mining software repositories

    Spadini, Davide, Aniche, Maur ´ıcio, and Bacchelli, Al- berto. Pydriller: Python framework for mining software repositories. InProceedings of the 2018 ACM Joint Meet- ing on European Software Engineering Conference and Symposium on the Foundations of Software Engineer- ing, ES...

    2018

  41. [49]

    URL https://aclanthology.org/2021.emnlp-m ain.685/

    doi: 10.18653/v1/2021.emnlp-main.685. URL https://aclanthology.org/2021.emnlp-m ain.685/

    2021 doi

  42. [50]

    Mining email social networks

    Bird, Christian, Gourley, Alex, Devanbu, Prem, Gertz, Michael, and Swaminathan, Anand. Mining email social networks. InProceedings of the 2006 International Work- shop on Mining Software Repositories, MSR ’06, pages 137–143. ACM, 2006. doi: 10.1145/1137983.1138016. URL https:/...

    2006

  43. [51]

    Commitbart: A large pre-trained model for github com- mits.arXiv preprint arXiv:2208.08100, 2022

    Liu, Shangqing, Li, Yanzhou, Xie, Xiaofei, and Liu, Yang. Commitbart: A large pre-trained model for github com- mits.arXiv preprint arXiv:2208.08100, 2022. URL https://arxiv.org/abs/2208.08100

    2022 arXiv

  44. [52]

    Cc2vec: distributed representations of code changes

    Hoang, Thong, Kang, Hong Jin, Lo, David, and Lawall, Julia. Cc2vec: distributed representations of code changes. InProceedings of the ACM/IEEE 42nd Inter- national Conference on Software Engineering, ICSE ’20, pages 518–529, New York, NY , USA, 2020. Associa- tion for Computin...

    2020

  45. [53]

    Ocean: Open-world Stylometric Defenses Against Author Impersonation in Software Repositories — 18/24 contrastive authorship identification

    M”achtle, Felix, Serr, Jan-Niclas, Loose, Nils, Sander, Jonas, and Eisenbarth, Thomas. Ocean: Open-world Stylometric Defenses Against Author Impersonation in Software Repositories — 18/24 contrastive authorship identification. arXiv preprint arXiv:2412.05049, 2024. URL https:/...

    2024 arXiv

  46. [54]

    Robust and accurate authorship attribution via program normaliza- tion.arXiv preprint arXiv:2007.00772, 2020

    Wang, Yizhen, Alhanahnah, Mohannad, Wang, Ke, Christodorescu, Mihai, and Jha, Somesh. Robust and accurate authorship attribution via program normaliza- tion.arXiv preprint arXiv:2007.00772, 2020. URL https://arxiv.org/abs/2007.00772

    2007 arXiv

  47. [55]

    Supervised contrastive learning

    Khosla, Prannay, Teterwak, Piotr, Wang, Chen, Sarna, Aaron, Tian, Yonglong, Isola, Phillip, Maschinot, Aaron, Liu, Ce, and Krishnan, Dilip. Supervised contrastive learning. InProceedings of the 34th International Con- ference on Neural Information Processing Systems, NIPS ’20,...

    2020

  48. [56]

    Supervised contrastive learning for multi-author writing style analysis

    Ye, Zhanhong, Zhong, Changle, Qi, Haoliang, and Han, Yong. Supervised contrastive learning for multi-author writing style analysis. InWorking Notes of the Conference and Labs of the Evaluation Forum (CLEF 2023), volume 3497 ofCEUR Workshop Proceedings, 2023. URL ht tps://ceur-...

    2023

  49. [57]

    Altakrori, Malik, Cheung, Jackie Chi Kit, and Fung, Ben- jamin C. M. The topic confusion task: A novel evaluation scenario for authorship attribution. InFindings of the As- sociation for Computational Linguistics: EMNLP 2021, pages 4242–4256. Association for Computational Lin-...

    2021 doi

  50. [58]

    A transformer-based approach to highly granular source code authorship attribution.Ap- plied and Computational Engineering, 67:197–202, 2024

    Shi, Chongzheng. A transformer-based approach to highly granular source code authorship attribution.Ap- plied and Computational Engineering, 67:197–202, 2024. doi: 10.54254/2755- 2721/67/20240686. URL https://doi.org/10.54254/2755- 2721/ 67/20240686

    2024 doi

  51. [59]

    Multimodal machine learning: A survey and taxonomy.IEEE Transactions on Pattern Analysis and Machine Intelligence, 41(2):423–443, 2019

    Baltruˇsaitis, Tadas, Ahuja, Chaitanya, and Morency, Louis-Philippe. Multimodal machine learning: A survey and taxonomy.IEEE Transactions on Pattern Analysis and Machine Intelligence, 41(2):423–443, 2019. doi: 10.1109/TPAMI.2018.2798607

    2019

  52. [60]

    Duckdb: An embeddable analytical database

    Raasveldt, Mark and M¨uhleisen, Hannes. Duckdb: An embeddable analytical database. InProceedings of the 2019 International Conference on Management of Data, SIGMOD ’19, pages 1981–1984, Amsterdam, Nether- lands, 2019. ACM. doi: 10.1145/3299869.3320212

    2019

  53. [61]

    A survey on anomaly detection in evolving data.ACM SIGKDD Explorations Newsletter, 20(1):13–23, 2018

    Salehi, Mahsa and Rashidi, Lida. A survey on anomaly detection in evolving data.ACM SIGKDD Explorations Newsletter, 20(1):13–23, 2018. doi: 10.1145/3229329.32 29332. URL https://doi.org/10.1145/3229 329.3229332

    2018 doi

  54. [62]

    Kouters, Erik, Vasilescu, Bogdan, Serebrenik, Alexander, and van den Brand, Mark G. J. Who’s who in GNOME: Using LSA to merge software repository identities. In 2012 28th IEEE International Conference on Software Maintenance (ICSM), pages 592–595. IEEE, 2012. doi: 10.1109/ICSM...

    2012

  55. [63]

    Index for rating diagnostic tests

    Youden, William J. Index for rating diagnostic tests. Cancer, 3(1):32–35, 1950. doi: 10.1002/1097-0142(19 50)3:1⟨32::AID-CNCR2820030106⟩3.0.CO;2-3

    1950 doi

  56. [64]

    Patchnet: A tool for deep patch classification

    Hoang, Thong, Lawall, Julia L., Oentaryo, Richard J., Tian, Yuan, and Lo, David. Patchnet: A tool for deep patch classification. InProceedings of the 41st Inter- national Conference on Software Engineering: Com- panion Proceedings, pages 83–86. IEEE/ACM, 2019. doi: 10.1109/ICS...

    2019

  57. [65]

    Chapman and Hall/CRC, 1993

    Efron, Bradley and Tibshirani, Robert.An Introduction to the Bootstrap. Chapman and Hall/CRC, 1993. ISBN 978-0412042317. doi: 10.1201/9780429246593

    1993 doi

  58. [66]

    The relationship be- tween precision-recall and ROC curves

    Davis, Jesse and Goadrich, Mark. The relationship be- tween precision-recall and ROC curves. InProceed- ings of the 23rd International Conference on Machine Learning, pages 233–240, Pittsburgh, PA, 2006. doi: 10.1145/1143844.1143874

    2006

  59. [67]

    Outside the closed world: On using machine learning for network intrusion detection

    Sommer, Robin and Paxson, Vern. Outside the closed world: On using machine learning for network intrusion detection. In2010 IEEE Symposium on Security and Privacy, pages 305–316. IEEE, 2010. doi: 10.1109/SP.2 010.25

    2010 doi

  60. [68]

    99% false positives: A qualitative study of SOC analysts’ perspectives on security alarms

    Alahmadi, Bushra A., Axon, Louise, and Martinovic, Ivan. 99% false positives: A qualitative study of SOC analysts’ perspectives on security alarms. In31st USENIX Security Symposium (USENIX Security 22), pages 2783– 2800, Boston, MA, August 2022. USENIX Association. URL https:/...

    2022

  61. [69]

    Anwar, El Saddik, Abdul- motaleb, and Kankanhalli, Mohan S

    Atrey, Pradeep K., Hossain, M. Anwar, El Saddik, Abdul- motaleb, and Kankanhalli, Mohan S. Multimodal fusion for multimedia analysis: a survey.Multimedia Systems, 16(6):345–379, 2010. doi: 10.1007/s00530-010-0182-0. Stylometric Defenses Against Author Impersonation in Software...

    2010 doi

  62. [70]

    Springer Series in Statistics

    Good, Phillip I.Permutation, Parametric, and Boot- strap Tests of Hypotheses. Springer Series in Statistics. Springer, 3rd edition, 2005. ISBN 978-0387-20279-2. doi: 10.1007/b138696

    2005 doi

  63. [71]

    Anomaly detection: A survey.ACM Computing Surveys, 41(3), 2009

    Chandola, Varun, Banerjee, Arindam, and Kumar, Vipin. Anomaly detection: A survey.ACM Computing Surveys, 41(3), 2009. doi: 10.1145/1541880.1541882

    2009

  64. [72]

    Overview of the cross-domain authorship attribu- tion task at pan 2019

    Kestemont, Mike, Stamatatos, Efstathios, Manjavacas, Enrique, Daelemans, Walter, Potthast, Martin, and Stein, Benno. Overview of the cross-domain authorship attribu- tion task at pan 2019. InWorking Notes of the Conference and Labs of the Evaluation Forum (CLEF 2019), vol- ume...

    2019

  65. [73]

    An introduction to ROC analysis.Pattern Recognition Letters, 27(8):861–874, 2006

    Fawcett, Tom. An introduction to ROC analysis.Pattern Recognition Letters, 27(8):861–874, 2006. doi: 10.1016/ j.patrec.2005.10.010

    2006

  66. [75]

    Es- timation of the youden index and its associated cutoff point.Biometrical Journal, 47(4):458–472, 2005

    Fluss, Ronen, Faraggi, David, and Reiser, Benjamin. Es- timation of the youden index and its associated cutoff point.Biometrical Journal, 47(4):458–472, 2005. doi: 10.1002/bimj.200410135

    2005 doi

  67. [80]

    The base-rate fallacy and the difficulty of intrusion detection.ACM Transactions on Information and System Security, 3(3):186–205, 2000

    Axelsson, Stefan. The base-rate fallacy and the difficulty of intrusion detection.ACM Transactions on Information and System Security, 3(3):186–205, 2000. doi: 10.1145/ 357830.357849

  68. [82]

    Linux kernel source code, 2025

    The Linux Foundation. Linux kernel source code, 2025. URL https://git.kernel.org/pub/scm/l inux/kernel/git/torvalds/linux.git. Git repository

    2025

  69. [84]

    Sys- tematic construction of anomaly detection benchmarks from real data

    Emmott, Andrew F., Das, Shubhomoy, Dietterich, Thomas G., Fern, Alan, and Wong, Weng-Keen. Sys- tematic construction of anomaly detection benchmarks from real data. InProceedings of the ACM SIGKDD Workshop on Outlier Detection and Description, ODD ’13, pages 16–21, Chicago, IL...

    2013 doi

  70. [85]

    Character n-gram features are a standard lexical baseline in authorship evaluation [72]

    Additional Experimental Details A.1 Baseline Architecture Details For the statistical baselines described in Section 3.6.2, we follow the feedforward lexical baselines of OCEAN [43]: a shared MLP on top of TF–IDF character features.FNN TF– IDFused character unigrams with a cap...

  71. [86]

    Input format.The original model operates on whole source files. We replaced the input with our linearized code diff (Section 3), tokenized with a SentencePiece 2Implementation source: https://github.com/L1NNA/SourceCodeAuthorshipAnalysis (branchSCS-Gan, pathsrc/SCS-Gan). Stylo...

  72. [87]

    The verification score is the cosine similarity between the encoder outputs, matching the evaluation protocol for the other baselines

    Architecture and training.We retained SCS-GAN’s original adversarial design, a discriminator with multi- head stylistic attention trained against a generator, and trained it on our patch corpus with the original GAN objective. The verification score is the cosine similarity be...

  73. [88]

    Extending it to commit messages would require revalidating the attention-head design choices, which is outside the scope of this comparison

    Modality.SCS-GAN was evaluated only in code-only mode, as the original model’s multi-head attention ar- chitecture for isolating stylistic tokens was designed for source-code inputs. Extending it to commit messages would require revalidating the attention-head design choices, ...

  74. [2017]

    doi: 10.1371/journal.pone.0 187204

    ISSN 1932-6203. doi: 10.1371/journal.pone.0 187204. URL https://dx.plos.org/10.1371/ journal.pone.0187204

    1932 doi

  75. [2019]

    URL https://medium.com/data-scien ce/evading-machine-learning-malware -classifiers-ce52dabdb713 . This blog post demonstrates techniques for modifying malware samples to evade detection by machine learning malware classi- fiers, highlighting the adversarial nature of detection...

  76. [2021]

    doi: 10.1145/3461666

    doi

  77. [2022]

    doi: 10.1145/3510003.3510181

  78. [2023]

    URL https://doi.org/10.1109/SP46215.2023 .10179304

    doi: 10.1109/SP46215.2023.10179304. URL https://doi.org/10.1109/SP46215.2023 .10179304

    2023

  79. [2024]

    URL https://arxiv.org/abs/2405.1 4993

  80. [2025]

    doi: 10.1016/j.ipm.2024.104005

    2024

Pith tools