Search papers, labs, and topics across Lattice.
FuseChain introduces a novel runtime detection framework that reconstructs evidence from multi-source telemetry in software supply-chain attacks by representing it as a temporal heterogeneous provenance graph. This approach allows for the alignment of diverse data sources, such as package traces and network telemetry, on a unified event-time axis, facilitating the identification of low-frequency attack evidence that may be obscured when analyzed independently. Experiments demonstrate that FuseChain significantly enhances stage recall in attack reconstruction, achieving improvements from 0.369 to 0.881 in Stage Recall@500, showcasing the effectiveness of decoupling anomaly detection from attack-stage interpretation.
By leveraging a unified temporal graph, FuseChain uncovers hidden attack evidence across disparate telemetry sources, achieving a remarkable 2.4x improvement in stage recall for software supply-chain attacks.
Software supply-chain (SSC) attacks are increasingly multi-stage, cross-source, and temporally distributed. A single attack campaign may leave weak and fragmented traces across multi-source telemetry that captures different granularities and perspectives of runtime behavior. Existing runtime detection systems often analyze these sources independently, making it difficult to identify low-frequency attack evidence or reconstruct the temporal context in which it appears. We present FUSECHAIN, a runtime detection framework that represents multi-source software supply-chain telemetry as a temporal heterogeneous provenance graph over a unified event-time axis. By aligning package/runtime traces, process events, network telemetry, DNS/HTTP metadata, and security alerts on a unified temporal graph, FuseChain captures cross-source dependencies and sparse attack evidence that may be ambiguous within any individual source. It learns anomaly-centric temporal representations from benign-prefix telemetry and performs deployable attack-stage reconstruction through a lightweight decoder on top of a frozen anomaly backbone. Our experiments show that jointly optimizing anomaly detection and stage prediction is ineffective under sparse and imbalanced runtime supply-chain telemetry. Across seven SSC attack scenarios, FuseChain improves deployable stage reconstruction from 0.369 to 0.881 Stage Recall@500 with a frozen-backbone decoder, while adaptive retrieval further increases observable-stage recall from 0.524 to 0.655 without modifying the detector. These results highlight the deployable value of decoupling runtime SSC anomaly detection from downstream attack-stage interpretation.
