Technical Summary: FuseChain

Problem Statement

Software supply-chain (SSC) attacks are increasingly characterized by multi-stage, cross-source, and temporally distributed behaviors. Unlike traditional malware execution, modern SSC attacks fragment evidence across diverse telemetry sources: package logs, process execution, system events, DNS/TLS flows, and network traffic. Individual sources often contain only weak or ambiguous traces; for instance, a network connection may appear benign without process context, or a process execution may seem normal without package provenance.

Existing runtime detection systems typically analyze these sources independently or rely on static graph models that fail to capture event-time dynamics. This fragmentation makes it difficult to identify low-frequency attack evidence or reconstruct the temporal context in which it appears. Furthermore, existing provenance-based intrusion detection systems often target enterprise APT settings with dense, host-centric audit streams, which do not translate well to the sparse, heterogeneous, and multi-source nature of runtime SSC telemetry. A critical challenge identified is that jointly optimizing anomaly detection with attack-stage prediction is ineffective under sparse and imbalanced stage supervision, as stage labels can interfere with the learning of anomaly-centric representations.

Methodology

FuseChain is a runtime detection framework designed to align heterogeneous telemetry into a unified temporal provenance graph. The methodology consists of four primary components:

1. Multi-Source Temporal Provenance Graph

FuseChain normalizes raw security telemetry (from package managers, hosts, networks, and alerts) into a canonical schema of typed temporal events. Each event is represented as a tuple containing unified event time, source/destination entities, relation types, multi-attribute evidence, and the telemetry source identifier. These events are mapped onto a unified event-time axis to construct a temporal heterogeneous graph. The framework supports both observed edges (directly from logs) and derived edges (rule-based temporal dependencies) to enrich graph context without introducing new observations.

2. Self-Supervised Anomaly Detection

The core of FuseChain is a self-supervised temporal graph anomaly detector based on a Temporal Graph Network (TGN).

• Training Protocol: The model is trained on a chronological historical prefix of benign telemetry using temporal link prediction. It learns to predict future interactions based on historical node memory states.
• Label Independence: Crucially, the anomaly backbone is trained without using IOC annotations or attack-stage labels. This prevents sparse and imbalanced stage supervision from corrupting the behavioral representation learning.
• Scoring: Anomaly scores are derived from the negative log-likelihood of observed events under the learned normal dynamics. Events that are difficult to predict receive higher scores.

3. Decoupled Stage Interpretation

To address the challenge of sparse stage labels, FuseChain decouples anomaly detection from stage interpretation.

• Frozen Backbone: After training, the anomaly backbone is frozen.
• Lightweight Decoder: A separate, lightweight decoder is trained on top of the frozen backbone to predict observable attack stages. This design treats stage reconstruction as a downstream interpretation task, preserving the quality of the learned behavioral representations while enabling stage-level classification.

4. Adaptive Retrieval and Reconstruction

To mitigate the issue where high anomaly scores are concentrated in repeated benign structures (redundant evidence), FuseChain employs adaptive retrieval strategies. These strategies (e.g., PairDedupe, SourceQuota, Adaptive) select top-ranked events based on diversity in source, pattern, or entity tuples rather than raw score alone. This ensures that the reconstructed attack chain covers a broader set of observable stages without modifying the underlying detector.

Key Contributions

1. FuseChain Framework: A runtime SSC detection framework that unifies heterogeneous telemetry sources into a temporal provenance graph for cross-source evidence modeling.
2. Self-Supervised Anomaly Learning: A temporal graph detector that learns anomaly-centric representations from benign-prefix telemetry without relying on attack-stage labels during the training phase.
3. Decoupled Architecture: Empirical demonstration that deployable attack-stage reconstruction is more effective when treated as a downstream task over a frozen anomaly backbone, rather than as a jointly optimized objective.
4. IOC Traceability and Reconstruction: Introduction of mechanisms for analyst-facing attack-chain recovery, including explicit links between graph interactions and original telemetry records, and the reconstruction of observable attack stages.
5. Comprehensive Evaluation: Evaluation across seven SSC attack scenarios in the SynthChain dataset, showing significant improvements in stage reconstruction and detection performance.

Experimental Results

The authors evaluated FuseChain on seven SSC attack scenarios using the SynthChain dataset, which contains multi-source runtime telemetry with sparse, multi-stage attack evidence.

• Detection Performance: FuseChain outperformed single-source baselines (audit-only, network-only, alert-only) and static multi-source graph baselines (GraphSAGE, RGCN) in macro-averaged AUROC, AUPRC, and Precision@500.
• Stage Reconstruction:
  • Joint vs. Decoupled: Jointly optimizing anomaly detection and stage prediction yielded a Stage Recall@500 of 0.369. In contrast, the decoupled approach with a frozen backbone decoder achieved a Stage Recall@500 of 0.881.
  • Adaptive Retrieval: Applying adaptive retrieval strategies to the top-ranked events increased the observable-stage recall from 0.524 (baseline by_k) to 0.655 without modifying the detector.
• Generalization: In Leave-One-Scenario-Out (LOSO) cross-scenario evaluation, FuseChain retained useful anomaly-ranking signals, suggesting that temporal provenance patterns can transfer across different SSC scenarios.
• Robustness: Weak-rule updates (e.g., adding rules for setup.py execution) increased coverage of specific behaviors without causing significant detection regression.

Significance and Claims

The paper claims that effective runtime SSC defense requires temporal reasoning over heterogeneous evidence distributed across multiple sources. The primary significance of FuseChain lies in its architectural separation of behavioral anomaly learning from deployable attack-stage interpretation.

The authors assert that sparse and imbalanced stage labels interfere with the learning of robust anomaly representations when used jointly. By freezing the anomaly backbone and treating stage prediction as a downstream task, FuseChain preserves detection quality while significantly improving the ability to reconstruct observable attack stages. The results highlight that decoupling these tasks is essential for handling the sparsity and diversity inherent in real-world software supply-chain telemetry.

The work positions itself as a complement to, rather than a replacement for, static analysis and dependency scanning tools, focusing specifically on the runtime detection phase after deployment. The authors note that reconstruction quality is bounded by telemetry availability; stages without IOC-backed evidence in the collected logs remain unobservable, and the system is designed to fuse complementary runtime sensors rather than act as a standalone source-specific detector.