Leveraging Code Cohesion Analysis to Identify Source Code Supply Chain Attacks

TL;DR

This work tackles supply chain attacks by proposing an unsupervised, language-model–driven measure of function-level cohesion, NPC, derived from how well a function’s body aligns with its predicted name. Using CodeBERTCpp, the authors quantify cohesion as the best fill-mask confidence across 1–8 token names and track cohesion changes via CD and OTCD during normal evolution and simulated malware injections. They analyze 369 open-source C++ projects (nearly 55k functions) and show that injected code consistently reduces cohesion, with high-cohesion functions being particularly sensitive; normalization further improves detection. The findings demonstrate that cohesion-based signals, especially when standardized, can effectively identify suspicious code changes at scale, offering a lightweight complement to existing security practices for preserving source-code integrity.

Abstract

Supply chain attacks significantly threaten software security with malicious code injections within legitimate projects. Such attacks are very rare but may have a devastating impact. Detecting spurious code injections using automated tools is further complicated as it often requires deciphering the intention of both the inserted code and its context. In this study, we propose an unsupervised approach for highlighting spurious code injections by quantifying cohesion disruptions in the source code. Using a name-prediction-based cohesion (NPC) metric, we analyze how function cohesion changes when malicious code is introduced compared to natural cohesion fluctuations. An analysis of 54,707 functions over 369 open-source C++ repositories reveals that code injection reduces cohesion and shifts naming patterns toward shorter, less descriptive names compared to genuine function updates. Considering the sporadic nature of real supply-chain attacks, we evaluate the proposed method with extreme test-set imbalance and show that monitoring high-cohesion functions with NPC can effectively detect functions with injected code, achieving a Precision@100 of 36.41% at a 1:1,000 ratio and 12.47% at 1:10,000. These results suggest that automated cohesion measurements, in general, and name-prediction-based cohesion, in particular, may help identify supply chain attacks, improving source code integrity.

Figures (7)

• Figure 1: Overview of cohesion monitoring to detect potential security compromises. By analyzing cohesion metrics over successive version releases, we can identify significant decreases to flag for investigation.
• Figure 2: Example of malware injection into a function.
• Figure 3: Distribution of name prediction confidence across different token counts. Each subplot represents functions grouped by their optimal number of tokens. The solid line shows the mean confidence, while the shaded area represents the 25th to 75th percentile range. The x-axis shows the number of tokens, and the y-axis represents the prediction confidence score.
• Figure 4: Impact of code injection on name prediction confidence. Each subplot shows functions grouped by their original optimal token count. Blue lines represent the original code's confidence scores, while red lines show scores after injection. The x-axis represents the number of tokens, and the y-axis shows the prediction confidence score.
• Figure 5: Distribution of name prediction cohesion (NPC) scores across functions.