sscs-research-pipeline

Multi-Layer Trust Verification Framework for SSCS

Thesis: "Design and evaluation of a multi-layer trust verification framework for software supply chain security using runtime behavior analysis, provenance graphs, and dependency-chain risk scoring."

Research Question

How can software supply chain security be improved through a combination of dynamic sandboxing, behavior-based classification, provenance analysis, dependency-chain modeling, and package reputation scoring, and how effectively do these methods distinguish trustworthy from untrustworthy packages before deployment?

Pipeline Overview

Key Results

Detection Performance

Trust Score Distribution

Literature Foundation

Based on deep literature review of supply chain security research:

• DySec (Mehedi et al., 2025) — RF + CombinedTraces → 95.99% F1 on 14,271 PyPI packages

  • 6 trace categories: Filetop, Install, Opensnoop, TCP, SystemCall, Pattern
  • 62 candidate features → 36 selected via Pearson + IMS

• Backstabber's Knife Collection (Ohm et al., 2020) — Attack taxonomy with real-world malicious packages across npm, PyPI, Maven, Packagist, RubyGems

• ConfuGuard (2025) — Metadata-based package confusion detection across 6 registries, reducing false positives

• Zahan (2023) — Software Supply Chain Risk Assessment Framework (SSRIAF)

• OpenSSF Malicious Packages — OSV-format vulnerability reports for the community

Identified Research Gaps

1. Static-only limitation — Most tools miss install-time/execution-time behavior
2. Ecosystem fragmentation — Research focuses on single ecosystems
3. Trust estimation gap — No pre-deployment scoring combining behavior + provenance + reputation
4. Dependency-chain reasoning gap — Single packages examined, not transitive chains
5. Runtime realism gap — Synthetic examples instead of real ecosystem data
6. False-positive problem — Overly aggressive static defenses
7. Operational decision gap — No guidance for block/quarantine/approve decisions
8. Dataset gap — Shortage of runtime behavior traces with ground truth

Running the Pipeline

# Install dependencies
pip install -r pipeline/requirements.txt

# Run each stage
python pipeline/stage1_corpus.py     # Build benchmark dataset
python pipeline/stage2_sandbox.py    # Dynamic analysis (ISOLATED ONLY!)
python pipeline/stage3_graphs.py     # Graph construction
python pipeline/stage4_trust.py      # Trust scoring
python pipeline/stage5_models.py     # Model comparison
python pipeline/stage6_package.py    # Package outputs

⚠️ SAFETY: Stage 2 installs and executes packages from PyPI. Only run in fully isolated containers/sandboxes. Never run on production systems.

Connected Repositories

• Benchmark Corpus
• Runtime Traces
• Graph Features
• Trust Scores
• Model Comparison

Novelty Summary

This framework is novel because it:

1. Combines four trust layers (metadata, behavior, provenance, reputation) into a single score
2. Follows the DySec methodology for runtime behavior analysis using eBPF trace categories
3. Incorporates dependency-chain and graph features for transitive risk assessment
4. Provides actionable deployment decisions (block/quarantine/monitor/approve)
5. Is designed for cross-ecosystem generalization (started with PyPI, extensible to npm/Maven)

Suggested First Publication

A paper on the benchmark corpus and comparison of static, dynamic, graph-based, and hybrid detection methods, with the hybrid model as the main contribution.