FuseChain: Runtime Evidence Reconstruction for Software Supply-Chain Attacks

What it is

FuseChain (arXiv:2606.15811, Glasgow, June 2026) is a research prototype, not a shipping product. The summary gives the architecture and headline numbers; what it omits is the concrete backbone, the evaluation substrate, and the deployment caveats that decide whether this is actionable today.

How it works

The anomaly backbone is a relation-aware Temporal Graph Network (TGN), not a bespoke model. Heterogeneous telemetry is flattened into a typed event stream e_i = (t̂, u, r, v, a, σ) — source entity, relation, destination, attributes, source id — and each event gets a message vector concatenating projected attributes with a relation-type embedding. Each node holds a temporal memory state.

Training is self-supervised temporal link prediction (SSTL): observed interactions are positives; negatives are generated by corrupting the destination entity. The primary config uses graph-wide random negative sampling (uniform over the global entity set); time-local hard negatives were tested but "did not yield consistent gains," so they're relegated to a sensitivity ablation. Anomaly score is s = −log σ(f_θ(...)) — lower temporal predictability means higher suspicion.

The ontology is fixed and small: node types PKG, PROC, CMD, FILE, NET, HOST, USER, CRED, ARTIFACT, ALERT, SYSCALL; observed edges include DEPEND, LOAD, EXEC, CONNECT, DNS_QUERY, EXFILTRATE, USES_CRED, ALERT_ON, INJECT; plus one rule-derived CAUSE edge.

Preconditions / Affected

This is runtime detection after deployment — it explicitly complements, not replaces, static package analysis, dependency scanning, and SCA. It assumes multi-layer telemetry (package/host/network/cloud/alert). Two operational design points matter:

• Chronological historical-prefix training: the backbone trains only on an earlier prefix, detection runs on the later tail. The prefix is assumed predominantly benign but "may be weakly contaminated" — a self-supervised model can absorb attack traffic present in training into its normal distribution.
• No IOC or stage labels are needed for backbone training; stage labels are used only to train the frozen-backbone decoder.

Caveats

• Evaluation is entirely synthetic. All seven scenarios and every metric come from SynthChain, a synthetic dataset. There is no real-world telemetry validation. Treat the 0.881 Stage Recall@500 as a synthetic-benchmark result.
• FuseChain surfaces and clusters anomalies and reconstructs observable stages; it does not confirm attacks. Final confirmation still relies on "telemetry context, alerts, threat intelligence, IOC matches, or analyst validation."
• The black-box reconstruction numbers use ground-truth IOC-stage mappings as an upper bound; only the deployable decoder path reflects operational conditions.
• Artifact is an anonymized repo (anonymous.4open.science/r/graphchain-detection-DF9C).