IJCCCS
Call For Paper
Submission Guidelines Plagiarism Policy Processing Charges
Reviewer Guidelines Join as Peer Reviewer
Editorial Board
Latest Issue Past Issue
Home / Archives / Volume 1 Issue 2
RESEARCH ARTICLE

Securing Software Supply Chains by Correlating Cloud Build Logs and Dependency Risk Signals

Dawn Song
IJCCCS Journal Cover
International Journal of Cloud Computing and Cyber Security
© 2026 by IJCCCS
VOLUME Volume 1
ISSUE Issue 2
PUBLICATION November 2026
PAGES 59-72
DOI 10.xxxx/ijcccs.v1i2p03
FULL TEXT Download PDF
CITATION

How to Cite This Article

Dawn Song, 2026. "Securing Software Supply Chains by Correlating Cloud Build Logs and Dependency Risk Signals" , IJCCCS , Volume 1, Issue 2, pp. 59-72.
ARTICLE SUMMARY

Abstract

“”

Software supply chain security has emerged as a major area of focus for many organizations due to increasing reliance on cloud-based build environments, automated continuous integration/continuous delivery (CI/CD) pipelines, open source libraries, and third-party development tools. While traditional security assessments often look at each of these areas independently (i.e., assessing source code, evaluating software dependencies, and reviewing infrastructure configurations), doing so does not account for the fact that some of the most sophisticated types of attacks arise out of interactions among different aspects of the software development process, namely the build activity itself and dependency related risks. In response to this need, this research paper presents a holistic approach to security that links cloud-based build logs to dependency-related risk signals in order to provide better detection, investigation, and prevention capabilities against software supply chain attacks. This approach will utilize several components including: build event monitoring; vulnerability assessment of software dependencies; package provenance verification; behavioral anomaly detection; and contextual risk scoring. Organizations can use these components collectively to help identify when a software production process may have been compromised by identifying unusual build identity; unexpected modifications to a workflow; suspicious downloads of packages; vulnerable dependency versions; and deviations from normal build practices. In addition to presenting an architectural component view, the research also explores correlation techniques, operational issues, and evaluation criteria for deploying this type of approach in a cloud native development environment. Specifically, the research addresses explainability; scalability; reduction of false positives; and how it can integrate into existing DevSecOps practices. Ultimately, this research provides a conceptual framework for achieving greater transparency throughout the entire software production process as well as the dependency ecosystem.

INDEX TERMS

Keywords

“”

Software Supply Chain Security, Cloud Build Logs, Dependency Risk, DevSecOps, Build Provenance, Vulnerability Detection, Behavioral Analytics, Continuous Integration, Risk Correlation, Cloud Security

  1. [1] Adams, B., De Schutter, K., Tromp, H. and De Meuter, W. (2007) ‘The evolution of the Linux build system’, Electronic Communications of the EASST, 8.
  2. [2] Allamanis, M., Barr, E.T., Devanbu, P. and Sutton, C. (2018) ‘A survey of machine learning for big code and naturalness’, ACM Computing Surveys, 51(4), Article 81.
  3. [3] Bass, L., Weber, I. and Zhu, L. (2015) DevOps: A Software Architect’s Perspective. Boston, MA: Addison-Wesley Professional.
  4. [4] Böhme, M., Szekeres, L. and Woo, M. (2017) ‘Transparent and efficient vulnerability assessment for software supply chains’, in Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. New York: ACM.
  5. [5] Cárdenas, A.A., Manadhata, P.K. and Rajan, S.P. (2013) ‘Big data analytics for security’, IEEE Security & Privacy, 11(6), pp. 74–76.
  6. [6] Cloud Native Computing Foundation (2021) Software Supply Chain Best Practices. San Francisco, CA: Cloud Native Computing Foundation.
  7. [7] Cox, B., Collins, J., Goel, S., Hart, M., Jensen, A., Lenz, B., Lindner, M., McIntosh, S., Nguyen, J. and Rafiq, M. (2021) Securing the Software Supply Chain: Recommended Practices Guide for Developers. Washington, DC: National Security Agency.
  8. [8] Decan, A., Mens, T. and Grosjean, P. (2019) ‘An empirical comparison of dependency network evolution in seven software packaging ecosystems’, Empirical Software Engineering, 24, pp. 381–416.
  9. [9] Dey, A.K. (2001) ‘Understanding and using context’, Personal and Ubiquitous Computing, 5, pp. 4–7.
  10. [10] ENISA (2021) Threat Landscape for Supply Chain Attacks. Athens: European Union Agency for Cybersecurity.
  11. [11] European Union Agency for Cybersecurity (2023) ENISA Threat Landscape 2023. Athens: ENISA.
  12. [12] Fenton, N.E. and Neil, M. (2018) Risk Assessment and Decision Analysis with Bayesian Networks. 2nd edn. Boca Raton, FL: CRC Press.
  13. [13] Garfinkel, S.L. and Rosenberg, B. (eds.) (2005) RFID: Applications, Security, and Privacy. Upper Saddle River, NJ: Addison-Wesley.
  14. [14] German, D.M., Adams, B. and Hassan, A.E. (2013) ‘The evolution of the R software ecosystem’, in Proceedings of the 17th European Conference on Software Maintenance and Reengineering. Piscataway, NJ: IEEE.
  15. [15] Ghasemisharif, M., Ramesh, A., Checkoway, S., Kanich, C. and Polakis, J. (2018) ‘O Single Sign-Off, where art thou? An empirical analysis of single sign-on account hijacking and impersonation attacks’, in Proceedings of the 27th USENIX Security Symposium. Berkeley, CA: USENIX Association.
  16. [16] Humble, J. and Farley, D. (2010) Continuous Delivery: Reliable Software Releases through Build, Test, and Deployment Automation. Upper Saddle River, NJ: Addison-Wesley.
  17. [17] ISO/IEC (2022) ISO/IEC 27001:2022 Information Security, Cybersecurity and Privacy Protection—Information Security Management Systems—Requirements. Geneva: International Organization for Standardization.
  18. [18] Kula, R.G., German, D.M., Ouni, A., Ishio, T. and Inoue, K. (2018) ‘Do developers update their library dependencies? An empirical study on the impact of security advisories on library migration’, Empirical Software Engineering, 23, pp. 384–417.
  19. [19] Le, D.M., Link, D., Shahbazian, A. and Medvidovic, N. (2015) ‘An empirical study of architectural decay in open-source software’, in Proceedings of the 12th Working IEEE/IFIP Conference on Software Architecture. Piscataway, NJ: IEEE.
  20. [20] McGraw, G. (2006) Software Security: Building Security In. Boston, MA: Addison-Wesley.
  21. [21] National Institute of Standards and Technology (2022) Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities. NIST Special Publication 800-218. Gaithersburg, MD: NIST.
  22. [22] National Institute of Standards and Technology (2022) Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations. NIST Special Publication 800-161 Revision 1. Gaithersburg, MD: NIST.
  23. [23] National Institute of Standards and Technology (2022) Guide to Computer Security Log Management. NIST Special Publication 800-92. Gaithersburg, MD: NIST.
  24. [24] Open Source Security Foundation (2023) SLSA: Supply-chain Levels for Software Artifacts, Version 1.0. San Francisco, CA: Open Source Security Foundation.
  25. [25] Pashchenko, I., Plate, H., Ponta, S.E. and Sabetta, A. (2018) ‘Vulnerability detection in open-source dependencies with minimal effort’, in Proceedings of the 2018 IEEE/ACM 40th International Conference on Software Engineering: Companion Proceedings. New York: ACM.
  26. [26] Perl, H., Dechand, S., Fahl, S., Acar, Y., Backes, M. and Smith, M. (2015) ‘VCCFinder: Finding potential vulnerabilities in open-source projects to assist code audits’, in Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security. New York: ACM.
  27. [27] Scarfone, K. and Mell, P. (2007) Guide to Intrusion Detection and Prevention Systems (IDPS). NIST Special Publication 800-94. Gaithersburg, MD: National Institute of Standards and Technology.
  28. [28] Souppaya, M., Scarfone, K. and Dodson, D. (2022) Secure Software Development Framework (SSDF) Version 1.1: Recommendations for Mitigating the Risk of Software Vulnerabilities. NIST Special Publication 800-218. Gaithersburg, MD: National Institute of Standards and Technology.
  29. [29] Torres-Arias, S., Afzali, H., Kuppusamy, T.K., Curtmola, R. and Cappos, J. (2019) ‘in-toto: Providing farm-to-table guarantees for bits and bytes’, in Proceedings of the 28th USENIX Security Symposium. Berkeley, CA: USENIX Association.
  30. [30] Zimmermann, M., Staicu, C.-A., Tenny, C. and Pradel, M. (2019) ‘Small world with high risks: A study of security threats in the npm ecosystem’, in Proceedings of the 28th USENIX Security Symposium. Berkeley, CA: USENIX Association.