Unmasking Supply Chain Attacks via Application Behaviour

## Overview

In this presentation, Colin Estep and Dagmawi Mulugeta from Netskope Threat Labs introduce research inspired by major supply chain incidents like SolarWinds (Sunburst), 3CX, and MOVEit. Recognizing that adversaries can compromise software supply chains at numerous stages—developer credentials, source control, CI/CD pipelines, artifact repositories, and distribution endpoints—the researchers focus on the "use" phase at the endpoint. Rather than attempting to secure every upstream stage, their approach detects supply chain compromises by monitoring deployed applications for anomalous network behavior on client devices. To operationalize this methodology, the speakers released an open-source tool called **Beam** (Behavioral Evaluation of Application Metrics), which models normal network activity per application to detect malicious deviations.

## Research Dataset and Scale

The research and baseline models rely on an extensive empirical dataset gathered by Netskope across real-world enterprise environments: - **Organizations:** Data curated from approximately 2,000 organizations worldwide. - **Transactions:** 56 billion HTTP request-response pairs ("transactions"). - **Devices:** Collected from 4.2 million unique endpoints (laptops, desktops, servers). - **Native Applications:** 1.5 million distinct installed client applications (e.g., Box, Discord, Slack, Spotify). - **User Agent Strings:** 7.5 million distinct user agent variants across different OS platforms and software versions.

## Core Methodology & Architecture

The detection framework operates across three distinct phases:

1. **Attribution:** Every transaction is mapped back to its generating application and version number. Because user agent strings lack standardized formats and have historically been viewed as untrustworthy or difficult to parse, the team uses: - Python parsing libraries. - Built-in Large Language Models (an integrated LLaMA model and an optional Gemini API connector) to translate raw, unstandardized user agent strings into clean application identifiers (e.g., "Box" or "Chrome 134").

2. **Application Behavioral Modeling:** Instead of trying to model an entire organization's diverse network traffic at once, the system profiles each application independently. The speakers developed **185 behavioral signals** extracted from transaction traffic, including: - *Timing metrics:* Request and response duration statistics (minimum, maximum, median, standard deviation). - *Request intervals:* Measuring inter-request timing to distinguish robotic beaconing from bursty, human-driven interaction. - *Request sequences:* Repeating patterns of HTTP methods and target servers (e.g., GET followed by POST). - *HTTP methods and status codes:* Baseline usage profiles of typical verb and response code distributions. - *File transfers:* Volume, frequency, and file types being moved or uploaded.

3. **Anomaly Detection & Explainability:** Incoming transactions are evaluated against the application's established behavioral profile. When an anomaly is detected, the system outputs an overall anomaly probability alongside explainable attribution factors—such as URL entropy deviations (e.g., a 5x increase in odds), unobserved application hosts (e.g., a >4x increase in odds), or unusual path depth/structure (e.g., a 3x increase in odds).

## The Beam Tool & Key Takeaways

- **Turnkey Detection:** Beam is open-sourced and ships with pre-trained behavioral models for eight widely used enterprise applications, allowing organizations to analyze network captures and identify anomalous deviations immediately without requiring a local training or baseline period. - **Tractability through Scoping:** While enterprise-wide anomaly detection often suffers from high noise, scoping behavioral baselines to individual client applications makes anomaly detection tractable and resilient against sophisticated supply chain attacks.