{"id":"https://openalex.org/W2467256108","doi":null,"title":"Empirically developing a security test pattern catalog using a grounded theory approach","display_name":"Empirically developing a security test pattern catalog using a grounded theory approach","publication_year":2012,"publication_date":"2012-01-01","ids":{"openalex":"https://openalex.org/W2467256108","mag":"2467256108"},"language":"en","primary_location":{"id":"mag:2467256108","doi":null,"is_oa":false,"landing_page_url":"https://repository.lib.ncsu.edu/handle/1840.16/7943","pdf_url":null,"source":null,"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":null},"volume":null,"type":"article","is_traditional":true,"indexed_in":[],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5063701349","display_name":"Laurie Willliams","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I137902535","display_name":"North Carolina State University","ror":"https://ror.org/04tj63d06","country_code":"US","type":"education","lineage":["https://openalex.org/I137902535"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Laurie Willliams","raw_affiliation_strings":["North Carolina State University ,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"North Carolina State University ,","institution_ids":["https://openalex.org/I137902535"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5102803376","display_name":"Benjamin Smith","orcid":"https://orcid.org/0000-0002-6633-4033","observed_orcids":["https://orcid.org/0000-0002-6633-4033"]},"institutions":[{"id":"https://openalex.org/I137902535","display_name":"North Carolina State University","ror":"https://ror.org/04tj63d06","country_code":"US","type":"education","lineage":["https://openalex.org/I137902535"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Benjamin Smith","raw_affiliation_strings":["North Carolina State University ,"],"raw_orcid":"https://orcid.org/0000-0002-6633-4033","affiliations":[{"raw_affiliation_string":"North Carolina State University ,","institution_ids":["https://openalex.org/I137902535"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I137902535"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.39373516,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.6284000277519226,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.6284000277519226,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.3630000054836273,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.0012000000569969416,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/software-security-testing","display_name":"software security testing","score":0.9340000152587891},{"id":"https://openalex.org/keywords/grounded-theory","display_name":"grounded theory","score":0.6399999856948853},{"id":"https://openalex.org/keywords/software-vulnerabilities","display_name":"software vulnerabilities","score":0.6299999952316284},{"id":"https://openalex.org/keywords/vulnerability-types","display_name":"vulnerability types","score":0.4320000112056732},{"id":"https://openalex.org/keywords/test-templates","display_name":"test templates","score":0.7149999737739563},{"id":"https://openalex.org/keywords/black-box-testing","display_name":"black-box testing","score":0.734000027179718},{"id":"https://openalex.org/keywords/test-planning","display_name":"test planning","score":0.7360000014305115},{"id":"https://openalex.org/keywords/natural-language-requirements","display_name":"natural language requirements","score":0.6830000281333923},{"id":"https://openalex.org/keywords/electronic-health-records","display_name":"electronic health records","score":0.8450000286102295},{"id":"https://openalex.org/keywords/requirements-specification","display_name":"requirements specification","score":0.3440000116825104},{"id":"https://openalex.org/keywords/software-testing-process","display_name":"software testing process","score":0.35899999737739563},{"id":"https://openalex.org/keywords/test-suite-adequacy","display_name":"test suite adequacy","score":0.34700000286102295},{"id":"https://openalex.org/keywords/test-suite-maintainability","display_name":"test suite maintainability","score":0.3529999852180481}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7234394550323486},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.5902354121208191},{"id":"https://openalex.org/C195518309","wikidata":"https://www.wikidata.org/wiki/Q13424265","display_name":"Security testing","level":5,"score":0.5151037573814392},{"id":"https://openalex.org/C2779010991","wikidata":"https://www.wikidata.org/wiki/Q2720909","display_name":"Artifact (error)","level":2,"score":0.47508326172828674},{"id":"https://openalex.org/C172776598","wikidata":"https://www.wikidata.org/wiki/Q7943570","display_name":"Vulnerability management","level":4,"score":0.4688844382762909},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.4501141309738159},{"id":"https://openalex.org/C156325361","wikidata":"https://www.wikidata.org/wiki/Q1152864","display_name":"Grounded theory","level":3,"score":0.4438023865222931},{"id":"https://openalex.org/C128942645","wikidata":"https://www.wikidata.org/wiki/Q1568346","display_name":"Test case","level":3,"score":0.42555463314056396},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.4241655468940735},{"id":"https://openalex.org/C2777267654","wikidata":"https://www.wikidata.org/wiki/Q3519023","display_name":"Test (biology)","level":2,"score":0.41965609788894653},{"id":"https://openalex.org/C7435765","wikidata":"https://www.wikidata.org/wiki/Q7705776","display_name":"Test Management Approach","level":5,"score":0.4161555767059326},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.3980697989463806},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.3937915563583374},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3466462790966034},{"id":"https://openalex.org/C529173508","wikidata":"https://www.wikidata.org/wiki/Q638608","display_name":"Software development","level":3,"score":0.34251636266708374},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.306846022605896},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.25777822732925415},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.24582123756408691},{"id":"https://openalex.org/C186846655","wikidata":"https://www.wikidata.org/wiki/Q3398377","display_name":"Software construction","level":4,"score":0.20254960656166077},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.1618274450302124},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.1595158576965332},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.1447916030883789},{"id":"https://openalex.org/C103377522","wikidata":"https://www.wikidata.org/wiki/Q3493999","display_name":"Security information and event management","level":4,"score":0.12356260418891907},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.07500359416007996},{"id":"https://openalex.org/C184842701","wikidata":"https://www.wikidata.org/wiki/Q370563","display_name":"Cloud computing security","level":3,"score":0.07180243730545044},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.0},{"id":"https://openalex.org/C542102704","wikidata":"https://www.wikidata.org/wiki/Q183257","display_name":"Psychotherapist","level":1,"score":0.0},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C144024400","wikidata":"https://www.wikidata.org/wiki/Q21201","display_name":"Sociology","level":0,"score":0.0},{"id":"https://openalex.org/C137176749","wikidata":"https://www.wikidata.org/wiki/Q4105337","display_name":"Psychological resilience","level":2,"score":0.0},{"id":"https://openalex.org/C152877465","wikidata":"https://www.wikidata.org/wiki/Q208042","display_name":"Regression analysis","level":2,"score":0.0},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.0},{"id":"https://openalex.org/C190248442","wikidata":"https://www.wikidata.org/wiki/Q839486","display_name":"Qualitative research","level":2,"score":0.0},{"id":"https://openalex.org/C36289849","wikidata":"https://www.wikidata.org/wiki/Q34749","display_name":"Social science","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"mag:2467256108","doi":null,"is_oa":false,"landing_page_url":"https://repository.lib.ncsu.edu/handle/1840.16/7943","pdf_url":null,"source":null,"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":null}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":50,"referenced_works":["https://openalex.org/W137364501","https://openalex.org/W397180395","https://openalex.org/W652748195","https://openalex.org/W1508616138","https://openalex.org/W1515532631","https://openalex.org/W1531064568","https://openalex.org/W1533574204","https://openalex.org/W1541128807","https://openalex.org/W1557557006","https://openalex.org/W1604658196","https://openalex.org/W1649645444","https://openalex.org/W1669329984","https://openalex.org/W1755188021","https://openalex.org/W1875598785","https://openalex.org/W1907001450","https://openalex.org/W1975879668","https://openalex.org/W1993040486","https://openalex.org/W2001693166","https://openalex.org/W2022995025","https://openalex.org/W2031459347","https://openalex.org/W2043837581","https://openalex.org/W2052539391","https://openalex.org/W2083331107","https://openalex.org/W2095881341","https://openalex.org/W2096274199","https://openalex.org/W2097154968","https://openalex.org/W2104577574","https://openalex.org/W2107581074","https://openalex.org/W2110653844","https://openalex.org/W2119249385","https://openalex.org/W2119871945","https://openalex.org/W2122483144","https://openalex.org/W2126513753","https://openalex.org/W2131435851","https://openalex.org/W2134646643","https://openalex.org/W2141583720","https://openalex.org/W2146455667","https://openalex.org/W2146863076","https://openalex.org/W2150831828","https://openalex.org/W2151451947","https://openalex.org/W2153222072","https://openalex.org/W2154398797","https://openalex.org/W2154790136","https://openalex.org/W2156168774","https://openalex.org/W2164777277","https://openalex.org/W2164868210","https://openalex.org/W2170478581","https://openalex.org/W2335888457","https://openalex.org/W2798977449","https://openalex.org/W3161918289"],"related_works":["https://openalex.org/W7018896899","https://openalex.org/W2021429806","https://openalex.org/W2910962125","https://openalex.org/W2909612427","https://openalex.org/W4312715343","https://openalex.org/W1499108226","https://openalex.org/W2160964993","https://openalex.org/W2138290214","https://openalex.org/W2424382664","https://openalex.org/W2080482853"],"abstract_inverted_index":{"The":[0,56,80,152,359,637],"goal":[1],"of":[2,15,64,71,118,132,140,167,171,174,208,257,308,328,349,372,446,485,488,515,589,620,624],"this":[3,37,59,72,162,182,602],"research":[4],"is":[5,61,74,164,540,668],"to":[6,11,58,104,116,146,234,261,314,319,330,354,391,398,416,440,465,507,527,532,554,584,606,649,671],"help":[7],"software":[8,27,46,65,154,187,377,384,393,509,519,533,635,644,661],"testers":[9,385,534],"adapt":[10],"the":[12,69,95,119,133,197,226,231,255,258,310,344,347,350,364,370,426,498,508,512,576,598,614,640,660],"evolving":[13],"demands":[14],"security":[16,28,47,66,76,149,155,188,221,378,403,421,495,539,572,629,645,662],"testing":[17],"by":[18,160,191,287,679],"proposing":[19],"and":[20,68,136,179,215,299,511],"evaluating":[21],"an":[22,138,180,306],"empirical":[23,194],"process":[24,42,60,73,81,96,163,195],"for":[25,43,346,434,601],"developing":[26,45],"test":[29,48,77,86,107,111,121,134,150,156,168,177,189,238,266,280,285,290,312,321,333,352,361,379,404,422,443,458,490,559,573,587,646,652,663],"patterns":[30,49,169,190,390,411,428,464,549,574],"using":[31,50,98,192,413,429,462,551,561,575],"a":[32,41,51,62,75,85,90,99,129,142,148,165,176,206,269,315,326,339,355,376,392,400,418,430,442,455,493,518,525,541,556,580,586,632,643,651,672],"grounded":[33,52,100,270],"theory":[34,53,101,271],"approach.":[35,55],"\r\nIn":[36],"dissertation,":[38,183],"we":[39,114,184,274,408,424,452,460,468,521,546,569,595,609,641,666],"propose":[40],"empirically":[44,124],"based":[54,102,217,272,293],"input":[57,219],"set":[63,166],"vulnerabilities,":[67,467,608],"output":[70],"pattern":[78,157,647,664],"catalog.":[79],"involves":[82,97],"first":[83,224],"creating":[84],"case":[87],"that":[88,127,212,240,249,407,451,482,523,545,594,618,639,659],"reveals":[89],"recurring":[91],"vulnerability":[92,210,228],"type.":[93],"Then,":[94],"analysis":[103],"abstract":[105],"these":[106,242,277,388,471,611],"cases":[108,627],"into":[109,282],"general":[110,120,284,311,332,351,360],"templates.":[112,302],"Next,":[113],"add":[115,305,325],"each":[117,170,320,331,503],"templates":[122,239,281,286,291],"(1)":[123],"developed":[125],"keywords":[126,329,373],"signal":[128],"potential":[130,505],"use":[131,225,246,410,454,548,597],"template;":[135],"(2)":[137],"example":[139,307,365],"applying":[141,161,309],"natural":[143,316,340,366,395],"language":[144,317,341,367,396],"artifact":[145,318,368,397],"create":[147],"case.":[151],"initial":[153],"catalog":[158,648,665],"created":[159,461,600],"which":[172],"consists":[173],"keywords,":[175],"template,":[178],"example.\r\nIn":[181],"produce":[185,235,262,399,441],"11":[186,283,389,427,619],"our":[193,414,463,489,552,571,621,625],"on":[196,218,294,474,613],"CWE/SANS":[198,213],"Top":[199,232,259],"25":[200,233,260],"Most":[201],"Dangerous":[202],"Software":[203],"Errors":[204],"[24],":[205],"list":[207,327,371],"generic":[209,227],"descriptions":[211,229],"prioritized":[214],"ranked":[216],"from":[220,230,564,579],"experts.":[222],"We":[223,244,303,323,480,616],"24":[236],"specific":[237,265,279,289,494,670],"reveal":[241,466,607],"vulnerabilities.":[243],"then":[245,275,304,469],"16":[247],"vulnerabilities":[248,516,531,630],"CWE":[250],"lists":[251],"as":[252],"being":[253],"\u201cOn":[254],"Cusp\u201d":[256],"two":[263,655],"additional":[264],"cases.":[267],"Using":[268],"approach,":[273],"abstracted":[276],"26":[278],"grouping":[288],"together":[292],"similarities":[295],"in":[296,338,497,517,538,631,654],"their":[297,382],"procedure":[298],"expected":[300],"results":[301],"template":[313,334,353,362],"template.":[322],"also":[324],"that,":[335],"when":[336],"found":[337,492],"artifact,":[342],"suggest":[343],"need":[345],"application":[348],"system":[356,583,605],"under":[357],"test.":[358],"plus":[363,369],"make":[374],"up":[375],"pattern.":[380],"After":[381],"development,":[383],"can":[386,409,453,547,596],"apply":[387,570],"engineering":[394],"black":[401,419,456,557],"box":[402,420,457,558],"plan.\r\nTo":[405],"demonstrate":[406,450,544,593],"produced":[412,550,667],"methodology":[415,553],"develop":[417,555,650],"plan,":[423],"applied":[425],"public":[431],"requirements":[432,562,577],"specification":[433,578],"electronic":[435],"health":[436],"records":[437],"(EHR)":[438],"systems":[439],"plan":[444,459,560,588,653],"consisting":[445],"117":[447,472],"tests.":[448,591],"To":[449,592],"executed":[470,610],"tests":[473,599,612],"three":[475,499],"open":[476],"source":[477],"EHR":[478,500],"systems.":[479,501],"find":[481,522,617],"65":[483],"out":[484],"351":[486],"(18.5%)":[487],"executions":[491],"exploit":[496],"Given":[502],"vulnerability\u2019s":[504],"damage":[506],"organization,":[510],"sparse":[513],"distribution":[514],"system,":[520],"providing":[524],"technique":[526],"discover":[528],"commonly":[529],"occurring":[530],"with":[535],"no":[536],"expertise":[537],"valuable":[542],"contribution.\r\nTo":[543],"specifications":[563],"more":[565],"than":[566],"one":[567],"source,":[568],"commercial,":[581,603,633],"proprietary":[582,604,634],"form":[585],"125":[590,622],"system.":[615,676],"(9.0%)":[623],"text":[626],"revealed":[628],"product.":[636],"fact":[638],"used":[642],"different":[656],"domains":[657],"indicates":[658],"not":[669],"certain":[673],"domain":[674],"or":[675],"(Abstract":[677],"shortened":[678],"UMI.)":[680]},"counts_by_year":[],"updated_date":"2025-11-06T04:12:42.849631","created_date":"2016-07-22T00:00:00"}