eDySec: A Deep Learning-based Explainable Dynamic Analysis Framework for Detecting Malicious Packages in PyPI Ecosystem

Deep learning can better detect hidden malware in open-source packages: Traditional security tools struggle with sophisticated attacks that hide malicious behavior across multiple phases, but the eDySec framework using deep learning successfully identifies these complex threats by analyzing system calls, network traffic, and file access patterns that simpler tools miss.

Explainability is critical for trustworthy AI security systems: The framework incorporates explainable AI techniques alongside detection capabilities, meaning security teams can understand why the system flagged a package as malicious rather than treating it as a "black box"—essential for responsible deployment of AI in security decisions.

Efficiency matters for practical security deployment: eDySec reduces the amount of data needed for detection by half while maintaining or improving accuracy, making it more practical for real-world use in monitoring the millions of packages in repositories like PyPI without excessive computational overhead.

Supply chain security requires behavioral monitoring at multiple stages: The research emphasizes analyzing both install-time and post-installation behaviors, recognizing that malicious packages may hide their true purpose until after installation—a nuanced threat model that responsible security systems must account for.

Model stability ensures reliable security decisions: Beyond accuracy, the framework tests for stability in its predictions, addressing a key concern for responsible AI: inconsistent or unreliable security alerts could undermine trust in automated detection systems or cause alert fatigue.