The problem of detecting potentially malicious activity in CI/CD pipelines during the build process using build agent behavior analysis is considered. The limitations of pipeline security tools related to threat detection during builds and promising approaches for detecting malicious activity are identified. A method for detecting potentially malicious activity in pipelines based on behavioral analysis using eBPF technology for build agent profiling is proposed. The accuracy of threat detection is evaluated on a dataset containing the implementation of malicious scenarios associated with the compromise of the build process. The obtained results can be used to build agent protection tools and for further research in the field of CI/CD pipeline security.
Zhukovskii et al. (Mon,) studied this question.