English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

As we increasingly depend on software systems, the consequences of breachesin the software supply chain become more severe. High-profile cyber attackslike those on SolarWinds and ShadowHammer have resulted in significantfinancial and data losses, underlining the need for stronger cybersecurity. Oneway to prevent future breaches is by studying past failures. However,traditional methods of analyzing these failures require manually reading andsummarizing reports about them. Automated support could reduce costs and allowanalysis of more failures. Natural Language Processing (NLP) techniques such asLarge Language Models (LLMs) could be leveraged to assist the analysis offailures. In this study, we assessed the ability of Large Language Models(LLMs) to analyze historical software supply chain breaches. We used LLMs toreplicate the manual analysis of 69 software supply chain security failuresperformed by members of the Cloud Native Computing Foundation (CNCF). Wedeveloped prompts for LLMs to categorize these by four dimensions: type ofcompromise, intent, nature, and impact. GPT 3.5s categorizations had an averageaccuracy of 68% and Bard had an accuracy of 58% over these dimensions. Wereport that LLMs effectively characterize software supply chain failures whenthe source articles are detailed enough for consensus among manual analysts,but cannot yet replace human analysts. Future work can improve LLM performancein this context, and study a broader range of articles and failures.

An Empirical Study on Using Large Language Models to Analyze Software Supply Chain Security Failures