Source author record

Brendan Murphy

Brendan Murphy appears in the imported research catalog. Authorship, coauthor and topic links are available while profile ownership is still unclaimed.

ResearcherUnclaimed source record

Catalog footprint

What is connected

8works
9topics
4close collaborators

Actions

Connect this record

Log in to claim

Research graph

See the researcher in context

Open full explorer

Inspect adjacent papers, topics, institutions and collaborators without losing the researcher page.

Building this map preview

BZPEER is loading the nearby papers, people, topics and institutions for this page.

Published work

8 published item(s)

preprint2022arXiv

What are Weak Links in the npm Supply Chain?

Modern software development frequently uses third-party packages, raising the concern of supply chain security attacks. Many attackers target popular package managers, like npm, and their users with supply chain attacks. In 2021 there was a 650% year-on-year growth in security attacks by exploiting Open Source Software's supply chain. Proactive approaches are needed to predict package vulnerability to high-risk supply chain attacks. The goal of this work is to help software developers and security specialists in measuring npm supply chain weak link signals to prevent future supply chain attacks by empirically studying npm package metadata. In this paper, we analyzed the metadata of 1.63 million JavaScript npm packages. We propose six signals of security weaknesses in a software supply chain, such as the presence of install scripts, maintainer accounts associated with an expired email domain, and inactive packages with inactive maintainers. One of our case studies identified 11 malicious packages from the install scripts signal. We also found 2,818 maintainer email addresses associated with expired domains, allowing an attacker to hijack 8,494 packages by taking over the npm accounts. We obtained feedback on our weak link signals through a survey responded to by 470 npm package developers. The majority of the developers supported three out of our six proposed weak link signals. The developers also indicated that they would want to be notified about weak links signals before using third-party packages. Additionally, we discussed eight new signals suggested by package developers.

preprint2021arXiv

On the Pinned Distances Problem in Positive Characteristic

We study the Erd\H os-Falconer distance problem for a set $A\subset \mathbb{F}^2$, where $\mathbb{F}$ is a field of positive characteristic $p$. If $\mathbb{F}=\mathbb{F}_p$ and the cardinality $|A|$ exceeds $p^{5/4}$, we prove that $A$ determines an asymptotically full proportion of the feasible $p$ distances. For small sets $A$, namely when $|A|\leq p^{4/3}$ over any $\mathbb{F}$, we prove that either $A$ determines $\gg|A|^{2/3}$. For both large and small sets, the results proved are in fact for pinned distances.

preprint2020arXiv

Growth in Some Finite Three-Dimensional Matrix Groups

We study the growth of product sets in some finite three-dimensional matrix groups. In particular, we prove two results about the group of $2\times 2$ upper triangular matrices over arbitrary finite fields: a product set estimate using techniques from multiplicative combinatorics, and an energy estimate using incidence geometry. The energy method gives better quantitative results, but only applies to small sets. We also prove an energy result for the Heisenberg group.

preprint2015arXiv

Growth Estimates in Positive Characteristic via Collisions

Let $F$ be a field of characteristic $p>2$ and $A\subset F$ have sufficiently small cardinality in terms of $p$. We improve the state of the art of a variety of sum-product type inequalities. In particular, we prove that $$ |AA|^2|A+A|^3 \gg |A|^6,\qquad |A(A+A)|\gg |A|^{3/2}. $$ We also prove several two-variable extractor estimates: ${\displaystyle |A(A+1)| \gg|A|^{9/8},}$ $$ |A+A^2|\gg |A|^{11/10},\; |A+A^3|\gg |A|^{29/28}, \; |A+1/A|\gg |A|^{31/30}.$$ Besides, we address questions of cardinalities $|A+A|$ vs $|f(A)+f(A)|$, for a polynomial $f$, where we establish the inequalities $$ \max(|A+A|,\, |A^2+A^2|)\gg |A|^{8/7}, \;\; \max(|A-A|,\, |A^3+A^3|)\gg |A|^{17/16}. $$ Szemerédi-Trotter type implications of the arithmetic estimates in question are that a Cartesian product point set $P=A\times B$ in $F^2$, of $n$ elements, with $|B|\leq |A|< p^{2/3}$ makes $O(n^{3/4}m^{2/3} + m + n)$ incidences with any set of $m$ lines. In particular, when $|A|=|B|$, there are $\ll n^{9/4}$ collinear triples of points in $P$, $\gg n^{3/2}$ distinct lines between pairs of its points, in $\gg n^{3/4}$ distinct directions. Besides, $P=A\times A$ determines $\gg n^{9/16}$ distinct pair-wise distances. These estimates are obtained on the basis of a new plane geometry interpretation of the incidence theorem between points and planes in three dimensions, which we call collisions of images.

preprint2014arXiv

Variations on the Sum-Product Problem

This paper considers various formulations of the sum-product problem. It is shown that, for a finite set $A\subset{\mathbb{R}}$, $$|A(A+A)|\gg{|A|^{\frac{3}{2}+\frac{1}{178}}},$$ giving a partial answer to a conjecture of Balog. In a similar spirit, it is established that $$|A(A+A+A+A)|\gg{\frac{|A|^2}{\log{|A|}}},$$ a bound which is optimal up to constant and logarithmic factors. We also prove several new results concerning sum-product estimates and expanders, for example, showing that $$|A(A+a)|\gg{|A|^{3/2}}$$ holds for a typical element of $A$.

preprint2013arXiv

Kakeya Configurations in Lie Groups and Homogeneous Spaces

In this paper, we study continuous Kakeya line and needle configurations, of both the oriented and unoriented varieties, in connected Lie groups and some associated homogenous spaces. These are the analogs of Kakeya line (needle) sets (subsets of $\mathbb{R}^n$ where it is possible to turn a line (respectively an interval of unit length) through all directions {\bf continuously, without repeating a "direction"}.) We show under some general assumptions that any such continuous Kakeya line configuration set in a connected Lie group must contain an open neighborhood of the identity, and hence must have positive Haar measure. In connected nilpotent Lie groups $G$, the only subspace of $G$ that contains such an unoriented line configuration is shown to be $G$ itself. Finally some similar questions in homogeneous spaces are addressed. These questions were motivated by work of Z. Dvir in the finite field setting.