25 citations · 53 across the 13 of their papers we have counts for
17 papers
Automatic Extraction of Security-Rich Dataflow Diagrams for Microservice Applications written in Java
Simon Schneider, Riccardo Scandariato
Dataflow diagrams (DFDs) are a valuable asset for securing applications, as they are the starting point for many security assessment techniques. Their creation, however, is often d…
LLMSecEval: A Dataset of Natural Language Prompts for Security Evaluations
Catherine Tony, Markus Mutas, Nicolás E. Díaz Ferreyra +1
Large Language Models (LLMs) like Codex are powerful tools for performing code completion and code generation tasks as they are trained on billions of lines of code from publicly a…
Regret, Delete, (Do Not) Repeat: An Analysis of Self-Cleaning Practices on Twitter After the Outbreak of the COVID-19 Pandemic
Nicolás E. Díaz Ferreyra, Gautam Kishore Shahi, Catherine Tony +2
During the outbreak of the COVID-19 pandemic, many people shared their symptoms across Online Social Networks (OSNs) like Twitter, hoping for others' advice or moral support. Prior…
Developers Need Protection, Too: Perspectives and Research Challenges for Privacy in Social Coding Platforms
Nicolás E. Díaz Ferreyra, Abdessamad Imine, Melina Vidoni +1
Social Coding Platforms (SCPs) like GitHub have become central to modern software engineering thanks to their collaborative and version-control features. Like in mainstream Online…
GitHub Considered Harmful? Analyzing Open-Source Projects for the Automatic Generation of Cryptographic API Call Sequences
Catherine Tony, Nicolás E. Díaz Ferreyra, Riccardo Scandariato
GitHub is a popular data repository for code examples. It is being continuously used to train several AI-based tools to automatically generate code. However, the effectiveness of s…
Cybersecurity Discussions in Stack Overflow: A Developer-Centred Analysis of Engagement and Self-Disclosure Behaviour
Nicolás E. Díaz Ferreyra, Melina Vidoni, Maritta Heisel +1
Stack Overflow (SO) is a popular platform among developers seeking advice on various software-related topics, including privacy and security. As for many knowledge-sharing websites…
Conversational DevBots for Secure Programming: An Empirical Study on SKF Chatbot
Catherine Tony, Mohana Balasubramanian, Nicolás E. Díaz Ferreyra +1
Conversational agents or chatbots are widely investigated and used across different fields including healthcare, education, and marketing. Still, the development of chatbots for as…
SoK: Security of Microservice Applications: A Practitioners' Perspective on Challenges and Best Practices
Priyanka Billawa, Anusha Bambhore Tukaram, Nicolás E. Díaz Ferreyra +3
Cloud-based application deployment is becoming increasingly popular among businesses, thanks to the emergence of microservices. However, securing such architectures is a challengin…
Checking Security Compliance between Models and Code
Katja Tuma, Sven Peldszus, Daniel Strüber +2
It is challenging to verify that the planned security mechanisms are actually implemented in the software. In the context of model-based development, the implemented security mecha…
Secure Software Development in the Era of Fluid Multi-party Open Software and Services
Ivan Pashchenko, Riccardo Scandariato, Antonino Sabetta +1
Pushed by market forces, software development has become fast-paced. As a consequence, modern development projects are assembled from 3rd-party components. Security & privacy assur…
Contextualisation of Data Flow Diagrams for security analysis
Shamal Faily, Riccardo Scandariato, Adam Shostack +2
Data flow diagrams (DFDs) are popular for sketching systems for subsequent threat modelling. Their limited semantics make reasoning about them difficult, but enriching them endange…
Security Assurance Cases -- State of the Art of an Emerging Approach
Mazen Mohamad, Jan-Philipp Steghöfer, Riccardo Scandariato
Security Assurance Cases (SAC) are a form of structured argumentation used to reason about the security properties of a system. After the successful adoption of assurance cases for…
Cross-project Classification of Security-related Requirements
Mazen Mohamad, Jan-Philipp Steghöfer, Riccardo Scandariato
We investigate the feasibility of using a classifier for security-related requirements trained on requirement specifications available online. This is helpful in case different req…
Security Assurance Cases for Road Vehicles: an Industry Perspective
Mazen Mohamad, Alexander Åström, Örjan Askerdal +2
Assurance cases are structured arguments that are commonly used to reason about the safety of a product or service. Currently, there is an ongoing push towards using assurance case…
Perception and Acceptance of an Autonomous Refactoring Bot
Marvin Wyrich, Regina Hebig, Stefan Wagner +1
The use of autonomous bots for automatic support in software development tasks is increasing. In the past, however, they were not always perceived positively and sometimes experien…
Finding Security Threats That Matter: An Industrial Case Study
Katja Tuma, Christian Sandberg, Urban Thorsson +2
Recent trends in the software engineering (i.e., Agile, DevOps) have shortened the development life-cycle limiting resources spent on security analysis of software designs. In this…
Inspection Guidelines to Identify Security Design Flaws
Katja Tuma, Danial Hosseini, Kyriakos Malamas +1
Recent trends in the software development practices (Agile, DevOps, CI) have shortened the development life-cycle causing the need for efficient security-by-design approaches. In t…