Detection of software supply chain attacks in code repositories

• Main Author: Correia, Miguel Luís Pereira
• Publication Date: 2022
• Format: Master thesis
• Language: eng
• Source: Repositórios Científicos de Acesso Aberto de Portugal (RCAAP)
• Download full: http://hdl.handle.net/10773/38716
• topic: Supply chain; Anomaly detection; Repositories; Malicious code; Support vector machines; Simulations

Nowadays, the supply chain concept is something intrinsically deep-rooted in the software development life cycle; from the source code and dependencies that are inserted into the software, to its release. With the growing need to shift security left in the development, every step, and material that influences software needs to be secured. However, not all phases within the software supply chain are protected, and malicious actors exploit this lack of security to insert malicious code in the software code repositories. Through account takeovers, attackers can introduce themselves in the code repositories, and with meticulous planning create trojanized software. The 2019 SolarWinds attack is a perfect example that shows the extent that supply chain attacks can have. This dissertation is presented how malicious actions in the repositories can be classified as anomalies within the developers’ behaviours. From the users’ actions in the repositories, metrics are calculated and utilized to create behaviour profiles that are then used to detect anomalous behaviours.