University of Madeira
Abstract
As people become more conscious of their health and the environment, the
demand for organic food is expected to increase. However, distinguishing
organic products from conventionally produced ones can be hard, creating a
problem where producers may have the incentive to label their conventional
products as organic to sell them at a higher price. Game theory can help to
analyze the strategic interactions between producers and consumers in order to
help consumers verifying these claims. Through a game theory analysis approach,
this paper provides evidence of the need for a third party to equalize markets
and foster trust in organic supply chains. Therefore, government regulation,
including regular and random monitoring and certification requirements, plays a
crucial role in achieving the desired level of trust and information exchange
among supply chain agents, which ultimately determines the growth trajectory of
the sector.
Abstract
Supply chain attacks significantly threaten software security with malicious
code injections within legitimate projects. Such attacks are very rare but may
have a devastating impact. Detecting spurious code injections using automated
tools is further complicated as it often requires deciphering the intention of
both the inserted code and its context. In this study, we propose an
unsupervised approach for highlighting spurious code injections by quantifying
cohesion disruptions in the source code. Using a name-prediction-based cohesion
(NPC) metric, we analyze how function cohesion changes when malicious code is
introduced compared to natural cohesion fluctuations. An analysis of 54,707
functions over 369 open-source C++ repositories reveals that code injection
reduces cohesion and shifts naming patterns toward shorter, less descriptive
names compared to genuine function updates. Considering the sporadic nature of
real supply-chain attacks, we evaluate the proposed method with extreme
test-set imbalance and show that monitoring high-cohesion functions with NPC
can effectively detect functions with injected code, achieving a Precision@100
of 36.41% at a 1:1,000 ratio and 12.47% at 1:10,000. These results suggest that
automated cohesion measurements, in general, and name-prediction-based
cohesion, in particular, may help identify supply chain attacks, improving
source code integrity.