• home
• current students
• graduate
• events

Presenter: Solomon Ameh
Supervisor:

Date: Tue, September 8, 2026
Time: 11:00:00 - 00:00:00
Place: Zoom - see below.

ABSTRACT

Zoom Details:

Meeting link: https://us04web.zoom.us/j/77409286563?pwd=JskabVMJmHfLJsq0yPbabJdPg2XqRd.1

Meeting ID: 77409286563

Passcode: 7Q0zm5

Abstract:

Supply chain management (SCM) is a dynamic field with varying definitions, diverse terminology, and limited visibility across organizations, making it difficult to represent secure chains. This thesis proposes and defines a production view modeling framework in which the supply chain is represented as a sequence of individual production steps. The framework was designed to preserve more details than producer-level representations and to support structural analysis of where important production steps occur within the chain.

Warfield's partitioning methods are used to describe structural levels, dependence, influence, and independent regions of the supply chain, providing a basis for identifying production steps that may be critical from a security perspective. The framework was evaluated using large-scale software supply chains (SSCs) constructed from the npm, PyPI, and Maven ecosystems, containing 250,944 packages and 1,063,358 dependency relationships. The evaluation focused on previously legitimate packages that were later compromised in recent supply-chain campaigns, including incidents linked to Shai-Hulud and TeamPCP. We compared the production view representation with detectors that rely on package metadata and examined what happens when metadata associated with the assessed package becomes unreliable. When package metadata was complete and unchanged, the npm metadata detector achieved an area under the receiver operating characteristic (ROC-AUC) curve of $0.992$ and an area under the precision–recall (PR-AUC) curve of $0.929$. Under adversarial manipulation, however, performance decreased substantially to $0.435$ ROC-AUC and $0.019$ PR-AUC. In comparison, production view features derived from structural position, centrality, upstream and downstream reach, and relationships with compromised or vulnerable production steps remained comparatively stable, achieving a ROC-AUC of $0.736$ and a PR-AUC of $0.142$. We also used Warfield’s partitioning to evaluate a two-stage detector that propagates risk scores from upstream Warfield’s levels, improving the results to $0.804$ ROC-AUC and $0.201$ PR-AUC.

This work bridges theoretical supply-chain concepts and practical supply-chain security by defining an interpretable framework and demonstrating its application to a large software supply-chain dataset.