Search papers, labs, and topics across Lattice.
The paper introduces SynthChain, a near-production testbed and multi-source runtime dataset designed to evaluate and improve the detection of advanced software supply chain (SSC) attacks. SynthChain simulates seven realistic exploit scenarios across PyPI, npm, and C/C++ supply chains, providing chain-level ground truth and spanning multiple hosts and environments. Analysis of the dataset reveals that no single telemetry source is sufficient for complete chain reconstruction, but minimal two-source fusion significantly boosts coverage and recall, highlighting the importance of multi-source correlation for effective SSC attack detection.
Current telemetry falls woefully short in detecting advanced software supply chain attacks, with even the best single source capturing less than 40% of the attack chain, underscoring the critical need for multi-source data fusion.
Advanced software supply chain (SSC) attacks are increasingly runtime-only and leave fragmented evidence across hosts, services, and build/dependency layers, so any single telemetry stream is inherently insufficient to reconstruct full compromise chains under realistic access and budget limits. We present SynthChain, a near-production testbed and a multi-source runtime dataset with chain-level ground truth, derived from real-world malicious packages and exploit campaigns. SynthChain covers seven representative supply-chain exploit scenarios across PyPI, npm, and a native C/C++ supply-chain case, spanning Windows and Linux, and involving four hosts and one containerized environment. Scenarios span realistic time windows from minutes to hours and are annotated with 14 MITRE ATT&CK tactics and 161 techniques (29-104 techniques per scenario). Beyond releasing the data, we quantify observability constraints by mapping each chain step to the minimum evidence needed for detection and cross-source correlation. With realistic trace availability, no single source is chain-complete: the best single source reaches only 0.391 weighted tag/step coverage and 0.403 mean chain reconstruction. Even minimal two-source fusion boosts coverage to 0.636 and reconstruction to 0.639 (approximately 1.6x gain), with consistent chain coverage/recall improvements (0.545). The corpus contains approximately 0.58M raw multi-source events and 1.50M evaluation rows, enabling controlled studies of detection under constrained telemetry. We release the dataset, ground truth, and artifacts to support reproducible, forensic-aware runtime defenses and to guide efficient detection for software supply chains.
