A research framework that captures volatile build evidence, binds cryptographic integrity to artifacts, and produces legally admissible chain-of-custody for software supply chains.
$ jenkins.run build #482
# capturing volatile evidence
commit a1f9c2 verified
SBOM generated cyclonedx 1.6
hash 9f3a2b...c41e
signature valid ✓
# sealing chain-of-custody
$ _
Software supply chain attacks are increasing in frequency and sophistication, targeting CI/CD workflows, build systems, and dependency management. Incidents such as SolarWinds and pipeline misconfiguration abuse show that attackers exploit weak oversight and transient runner environments to inject malicious code, manipulate dependencies, and hide persistence.
Forensic readiness is a critical challenge in these environments. Build agents, containers, and runners are ephemeral, so valuable data can disappear immediately after execution. Conventional audit trails capture limited activity but do not preserve the complete forensic chain required for end-to-end reconstruction of incidents.
Integrity assurance is another major gap. Existing pipelines often lack cryptographic binding between artifacts, logs, and dependency metadata. While SBOM adoption has improved transparency and risk management, research highlights weak tamper resistance, untrusted generation paths, and missing verification controls in many practical implementations.
This project addresses the core question: how to design a CI/CD monitoring and evidence collection system that captures volatile forensic data, guarantees cryptographic integrity, reconstructs attack timelines automatically, and generates legally admissible reports with minimal operational overhead and strong compatibility with existing Jenkins workflows.
The proposed framework introduces forensic-ready CI/CD agents, cryptographic integrity verification, automated incident analysis, and a chain-of-custody reporting portal as one integrated architecture.
See DevForensix in action — watch our full system walkthrough below.
Design and develop a forensic-ready CI/CD monitoring and evidence collection system that captures volatile build evidence, protects integrity of artifacts and dependencies, reconstructs incident timelines, and supports legally admissible reporting against software supply chain attacks.
Embed lightweight forensic collectors through plugins or pipeline hooks to preserve real-time runner evidence before job termination.
Automate SBOM generation and apply hashes, signatures, and Merkle linking to create tamper-evident forensic trails.
Use ML and rule-based detection to flag suspicious commits, script tampering, and dependency anomalies with linked incident narratives.
Deliver chain-of-custody dashboards and standards-aligned reports for investigation, compliance, and legal processes.
All assessment milestones, dates, and mark allocations.
8th-12th September 2025
Presentation + proposal report
12% marks
5th-9th January 2026
Module development - 50% progress
15% marks
February 2026
Module integration - 90% progress
18% marks
TBD - 2026
IEEE format publication submission
10% marks
April-May 2026
Complete system demonstration
30% marks
April-May 2026
Individual examination
15% marks
All official project documents.
Summarizing key technical details, evaluations, and findings related to the project or system within a defined scope.
Drive Link →The document contains details like goals, objectives, important dates, milestones and requirements needed to start and complete the project.
Drive Link →Complete research document - 4 individual + 1 main compiled thesis.
Drive Link →Slide decks used in past presentations and placeholders for upcoming ones.
Supervisor
Sri Lanka Institute of Information Technology
Co-Supervisor
Sri Lanka Institute of Information Technology
Team Member 1
Sri Lanka Institute of Information Technology
Student ID
Team Member 2
Sri Lanka Institute of Information Technology
Student ID
Team Member 3
Sri Lanka Institute of Information Technology
Student ID
Team Member 4
Sri Lanka Institute of Information Technology
Student ID
Sri Lanka Institute of Information Technology
Forensic-ready CI/CD monitoring