Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces Lily, an automated system designed to enhance the security of open-source software development by detecting backdoor injections during both commit and release phases. By integrating a backdoor detection mechanism into Continuous Integration (CI) pipelines and release vetting workflows, Lily can identify malicious commits and prevent compromised releases with high accuracy and low false alarm rates. The system employs advanced fuzzing techniques and code change analysis to pinpoint backdoor-revealing code regions, even in extensive codebases, demonstrating its effectiveness against real-world threats.
Lily's automated backdoor detection could have thwarted numerous real-world security incidents in open-source software.
Code-level backdoors-stealthy code changes that grant hidden privileges via secret triggers-pose a persistent threat to opensource software. Known attempts to inject such backdoors into widely used projects through malicious commits, tampered release packages, or compromised third-party dependencies, were stopped only by luck and manual review. Existing Continuous Integration (CI) pipelines cannot detect these attacks, and downstream binary analysis tools require substantial manual effort. In this work, we present Lily, an automated approach that strengthens open-source development and release processes against backdoor injection. Lily integrates a backdoor detection mechanism into (1) CI pipelines to block malicious commits, and (2) release vetting workflows to prevent tampered releases or compromised dependencies from entering large ecosystems, such as Linux distributions. Lily offers two key contributions. First, it enhances CI-compatible fuzzing with the capability to detect triggers of suspicious behavior based on historical and current software executions. This enables fast, precise backdoor detection suitable for both CI and update validation workflows. Second, it combines code change analysis with fuzzing data to precisely point maintainers to backdoor-revealing code regions, even when release updates modify millions of lines of code. We also outline five strategies attackers could use to evade Lily, and evaluate corresponding defenses. Our experiments across hundreds of benign and backdoored commits and releases show that Lily achieves high detection accuracy with low false alarm rates, reliably identifies malicious code, resists adversarial attempts, and would have prevented real-world backdoor incidents.