SCFusion
A cross-layer detection framework that fuses build-time and eBPF runtime signals to catch software supply chain attacks that either layer alone would miss.
The problem
Software supply chain attacks show up at different points in the software lifecycle. Some are visible at build time — a suspicious dependency in the manifest, an anomalous file added to a build artifact. Others only surface at runtime — a package that behaves normally until it phones home.
Most existing tools sit on one side of that divide. Build-time scanners miss anything that unfolds at runtime. Runtime monitors miss the structural clues you can only see when the code is being assembled.
What SCFusion is
A union-based cross-layer framework that runs two detectors in parallel:
- Foreman at build time — inspects manifests, lockfiles, and build artifacts
- GoLeash at runtime — eBPF-based syscall observation of a running process
Their outputs are fused with custom coverage metrics (StepR, StepP, ChainR, ChainP, TagCov, ChainCov) that measure per-step recall and precision as well as end-to-end chain coverage.
Results and honest gaps
Evaluated across seven synthetic supply chain attack scenarios in the SynthChain benchmark. The paper documents where each layer contributes signal, where they overlap, and where SCFusion catches attacks that either layer alone would miss. It also honestly documents SC1, SC2, and SC5 as coverage gaps — attack shapes the current implementation does not handle well.
A long abstract based on this work was submitted to IACyC 2026.
Why it matters
Cross-layer detection is not a new idea, but there aren’t many end-to-end implementations that let you compare build-time and runtime signals in the same experiment. SCFusion is a step toward being able to say, quantitatively, which layer catches which class of attack — and where the layers are actually complementary.