Leveraging Code Cohesion Analysis to Identify Source Code Supply Chain Attacks

2025-10-16

AI Summary

To address the challenge of detecting malicious code injection in source-code supply chain attacks, this paper proposes the Name-Prediction-based Cohesion (NPC) metric—the first unsupervised measure that quantifies shifts in code cohesion by leveraging function naming patterns. Through large-scale static analysis of 369 open-source C++ projects, NPC captures anomalous cohesion fluctuations and naming-feature deviations induced by malicious injections. Evaluated under extreme class imbalance, it achieves a top-100 precision of 36.41% at a benign-to-malicious test ratio of 1:1,000, and 12.47% at 1:10,000. The core contribution lies in jointly modeling naming semantics and cohesion, establishing an interpretable, low-dependency paradigm for automated detection of stealthy supply chain attacks—requiring no labeled data, runtime instrumentation, or external behavioral specifications.

Technology Category

• Natural Language Processing: Code Generation / Program Synthesis from Natural Language
• Constraint Satisfaction and Optimization: Distributed CSP/Optimization
• Cognitive Modeling & Cognitive Systems: Neural Spike Coding

Application Category

• Security and Privacy: Large-scale security measurements
• Graph Algorithms and Modeling for the Web: Representation, reconstruction, and subgraph or motif discovery in Web-related graphs
• Web Mining and Content Analysis: Large pretrained models with web data

Abstract

Supply chain attacks significantly threaten software security with malicious code injections within legitimate projects. Such attacks are very rare but may have a devastating impact. Detecting spurious code injections using automated tools is further complicated as it often requires deciphering the intention of both the inserted code and its context. In this study, we propose an unsupervised approach for highlighting spurious code injections by quantifying cohesion disruptions in the source code. Using a name-prediction-based cohesion (NPC) metric, we analyze how function cohesion changes when malicious code is introduced compared to natural cohesion fluctuations. An analysis of 54,707 functions over 369 open-source C++ repositories reveals that code injection reduces cohesion and shifts naming patterns toward shorter, less descriptive names compared to genuine function updates. Considering the sporadic nature of real supply-chain attacks, we evaluate the proposed method with extreme test-set imbalance and show that monitoring high-cohesion functions with NPC can effectively detect functions with injected code, achieving a Precision@100 of 36.41% at a 1:1,000 ratio and 12.47% at 1:10,000. These results suggest that automated cohesion measurements, in general, and name-prediction-based cohesion, in particular, may help identify supply chain attacks, improving source code integrity.

Problem

• Detecting malicious code injections in software supply chains
• Measuring cohesion disruptions caused by spurious code insertions
• Identifying naming pattern anomalies in compromised source code

Innovation

• Uses unsupervised cohesion disruption analysis
• Employs name-prediction-based cohesion metric
• Monitors high-cohesion functions for detection