Graph Learning-Based Behavioral Detection for Software Supply Chain Attacks

Abstract

Software supply chain attacks have emerged as critical threats to modern software ecosystems, exploiting vulnerabilities in package dependencies to inject malicious code. Traditional detection methods struggle with high false positive rates and limited coverage across diverse attack vectors. This work presents a graph-learning-based approach that models dependency relationships as structured graphs and leverages graph neural networks and behavioral sequence analysis for comprehensive threat detection. Our methodology constructs multi-level dependency graphs enriched with metadata, code, and behavioral features, employing graph convolutional layers with attention mechanisms to identify anomalous patterns. Experimental evaluations on real-world npm and PyPI datasets demonstrate detection accuracy of 94.3% with false positive rates below 2.1%, outperforming baseline methods by 17.8% in F1-score while maintaining scalability for repositories containing millions of packages.