{"id":"https://openalex.org/W4385208592","doi":"https://doi.org/10.1109/sp46215.2023.10179304","title":"SoK: Taxonomy of Attacks on Open-Source Software Supply Chains","display_name":"SoK: Taxonomy of Attacks on Open-Source Software Supply Chains","publication_year":2023,"publication_date":"2023-05-01","ids":{"openalex":"https://openalex.org/W4385208592","doi":"https://doi.org/10.1109/sp46215.2023.10179304"},"language":"en","primary_location":{"id":"doi:10.1109/sp46215.2023.10179304","doi":"https://doi.org/10.1109/sp46215.2023.10179304","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp46215.2023.10179304","pdf_url":null,"source":{"id":"https://openalex.org/S4210233669","display_name":"IEEE Symposium on Security and Privacy (S&P)","issn_l":"1081-6011","issn":["1081-6011","2375-1207"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","norway-2"],"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://inria.hal.science/hal-04423761v1/file/2204.04008.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5006458254","display_name":"Piergiorgio Ladisa","orcid":"https://orcid.org/0000-0003-0850-4054","observed_orcids":["https://orcid.org/0000-0003-0850-4054"]},"institutions":[{"id":"https://openalex.org/I4210125512","display_name":"Systems, Applications & Products in Data Processing (Switzerland)","ror":"https://ror.org/036z4j470","country_code":"CH","type":"company","lineage":["https://openalex.org/I4210125512","https://openalex.org/I4210132444"]},{"id":"https://openalex.org/I4210133614","display_name":"Systems, Applications & Products in Data Processing (United Kingdom)","ror":"https://ror.org/04k7gd586","country_code":"GB","type":"company","lineage":["https://openalex.org/I4210132444","https://openalex.org/I4210133614"]}],"countries":["CH","GB"],"is_corresponding":false,"raw_author_name":"Piergiorgio Ladisa","raw_affiliation_strings":["SAP Security Research"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"SAP Security Research","institution_ids":["https://openalex.org/I4210125512","https://openalex.org/I4210133614"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5064821194","display_name":"Henrik Plate","orcid":"https://orcid.org/0000-0001-8862-3488","observed_orcids":["https://orcid.org/0000-0001-8862-3488"]},"institutions":[{"id":"https://openalex.org/I4210125512","display_name":"Systems, Applications & Products in Data Processing (Switzerland)","ror":"https://ror.org/036z4j470","country_code":"CH","type":"company","lineage":["https://openalex.org/I4210125512","https://openalex.org/I4210132444"]},{"id":"https://openalex.org/I4210133614","display_name":"Systems, Applications & Products in Data Processing (United Kingdom)","ror":"https://ror.org/04k7gd586","country_code":"GB","type":"company","lineage":["https://openalex.org/I4210132444","https://openalex.org/I4210133614"]}],"countries":["CH","GB"],"is_corresponding":false,"raw_author_name":"Henrik Plate","raw_affiliation_strings":["SAP Security Research"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"SAP Security Research","institution_ids":["https://openalex.org/I4210125512","https://openalex.org/I4210133614"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100762798","display_name":"Mat\u00edas Mart\u00ednez","orcid":"https://orcid.org/0000-0002-2945-866X","observed_orcids":["https://orcid.org/0000-0002-2945-866X"]},"institutions":[{"id":"https://openalex.org/I70348806","display_name":"Universit\u00e9 Polytechnique Hauts-de-France","ror":"https://ror.org/02ezch769","country_code":"FR","type":"education","lineage":["https://openalex.org/I70348806"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Matias Martinez","raw_affiliation_strings":["Université Polytechnique Hauts-de-France"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Université Polytechnique Hauts-de-France","institution_ids":["https://openalex.org/I70348806"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5002785466","display_name":"Olivier Barais","orcid":"https://orcid.org/0000-0002-4551-8562","observed_orcids":["https://orcid.org/0000-0002-4551-8562"]},"institutions":[{"id":"https://openalex.org/I1326498283","display_name":"Institut national de recherche en sciences et technologies du num\u00e9rique","ror":"https://ror.org/02kvxyf05","country_code":"FR","type":"government","lineage":["https://openalex.org/I1326498283"]},{"id":"https://openalex.org/I2802519937","display_name":"Institut de Recherche en Informatique et Syst\u00e8mes Al\u00e9atoires","ror":"https://ror.org/00myn0z94","country_code":"FR","type":"facility","lineage":["https://openalex.org/I1294671590","https://openalex.org/I1326498283","https://openalex.org/I205703379","https://openalex.org/I2802204017","https://openalex.org/I2802519937","https://openalex.org/I28221208","https://openalex.org/I4210127572","https://openalex.org/I4210159245","https://openalex.org/I56067802"]},{"id":"https://openalex.org/I4405258264","display_name":"Universit\u00e9 Rennes 1","ror":"https://ror.org/00crteh33","country_code":"FR","type":"education","lineage":["https://openalex.org/I4405258264","https://openalex.org/I56067802"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Olivier Barais","raw_affiliation_strings":["Université de Rennes 1, Inria, IRISA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Université de Rennes 1, Inria, IRISA","institution_ids":["https://openalex.org/I1326498283","https://openalex.org/I2802519937","https://openalex.org/I4405258264"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":6,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":53.6744,"has_fulltext":true,"cited_by_count":281,"citation_normalized_percentile":{"value":0.99917775,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":93,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"1509","last_page":"1526"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.3813000023365021,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.3813000023365021,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.3131999969482422,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.09529999643564224,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/attack-taxonomy","display_name":"attack taxonomy","score":0.7409999966621399},{"id":"https://openalex.org/keywords/supply-chain-attacks","display_name":"supply chain attacks","score":0.7039999961853027},{"id":"https://openalex.org/keywords/malicious-code-injection","display_name":"malicious code injection","score":0.7480000257492065},{"id":"https://openalex.org/keywords/attack-trees","display_name":"attack trees","score":0.7990000247955322},{"id":"https://openalex.org/keywords/software-supply-chain-security","display_name":"software supply chain security","score":0.5759999752044678},{"id":"https://openalex.org/keywords/security-measures","display_name":"security measures","score":0.5889999866485596},{"id":"https://openalex.org/keywords/developer-survey","display_name":"developer survey","score":0.3779999911785126},{"id":"https://openalex.org/keywords/attack-vectors","display_name":"attack vectors","score":0.3140000104904175}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6366271376609802},{"id":"https://openalex.org/C58642233","wikidata":"https://www.wikidata.org/wiki/Q8269924","display_name":"Taxonomy (biology)","level":2,"score":0.5783081650733948},{"id":"https://openalex.org/C3018397939","wikidata":"https://www.wikidata.org/wiki/Q3644502","display_name":"Open source","level":3,"score":0.5779665112495422},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.5106714367866516},{"id":"https://openalex.org/C2988343187","wikidata":"https://www.wikidata.org/wiki/Q1130645","display_name":"Open source software","level":3,"score":0.510263204574585},{"id":"https://openalex.org/C108713360","wikidata":"https://www.wikidata.org/wiki/Q1824206","display_name":"Supply chain","level":2,"score":0.5023987293243408},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.34173932671546936},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.22313031554222107},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.18191954493522644},{"id":"https://openalex.org/C90856448","wikidata":"https://www.wikidata.org/wiki/Q431","display_name":"Zoology","level":1,"score":0.08866104483604431},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C162853370","wikidata":"https://www.wikidata.org/wiki/Q39809","display_name":"Marketing","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/sp46215.2023.10179304","doi":"https://doi.org/10.1109/sp46215.2023.10179304","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp46215.2023.10179304","pdf_url":null,"source":{"id":"https://openalex.org/S4210233669","display_name":"IEEE Symposium on Security and Privacy (S&P)","issn_l":"1081-6011","issn":["1081-6011","2375-1207"],"is_oa":false,"is_in_doaj":false,"is_core":true,"listed_in":["cwts-core","norway-2"],"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2023 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"},{"id":"pmh:oai:HAL:hal-04423761v1","doi":null,"is_oa":true,"landing_page_url":"https://inria.hal.science/hal-04423761","pdf_url":"https://inria.hal.science/hal-04423761v1/file/2204.04008.pdf","source":{"id":"https://openalex.org/S4306402512","display_name":"HAL","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I4405252976","host_organization_name":"Centre pour la Communication Scientifique Directe","host_organization_lineage":["https://openalex.org/I4405252976"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"SP 2023 - IEEE Symposium on Security and Privacy, May 2023, San Francisco, United States. pp.1509-1526, ⟨10.1109/SP46215.2023.10179304⟩","raw_type":"info:eu-repo/semantics/conferenceObject"}],"best_oa_location":{"id":"pmh:oai:HAL:hal-04423761v1","doi":null,"is_oa":true,"landing_page_url":"https://inria.hal.science/hal-04423761","pdf_url":"https://inria.hal.science/hal-04423761v1/file/2204.04008.pdf","source":{"id":"https://openalex.org/S4306402512","display_name":"HAL","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I4405252976","host_organization_name":"Centre pour la Communication Scientifique Directe","host_organization_lineage":["https://openalex.org/I4405252976"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"SP 2023 - IEEE Symposium on Security and Privacy, May 2023, San Francisco, United States. pp.1509-1526, ⟨10.1109/SP46215.2023.10179304⟩","raw_type":"info:eu-repo/semantics/conferenceObject"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4385208592.pdf","grobid_xml":"https://content.openalex.org/works/W4385208592.grobid-xml"},"referenced_works_count":94,"referenced_works":["https://openalex.org/W205609712","https://openalex.org/W947463418","https://openalex.org/W1842756664","https://openalex.org/W1965042175","https://openalex.org/W1979848034","https://openalex.org/W1997816329","https://openalex.org/W2013113775","https://openalex.org/W2014030636","https://openalex.org/W2024170198","https://openalex.org/W2031366243","https://openalex.org/W2050683342","https://openalex.org/W2106956101","https://openalex.org/W2111978054","https://openalex.org/W2112736324","https://openalex.org/W2114016378","https://openalex.org/W2122742966","https://openalex.org/W2126616958","https://openalex.org/W2128200145","https://openalex.org/W2131992911","https://openalex.org/W2134075299","https://openalex.org/W2146024157","https://openalex.org/W2148542607","https://openalex.org/W2149142614","https://openalex.org/W2169975751","https://openalex.org/W2170267084","https://openalex.org/W2187831316","https://openalex.org/W2228230935","https://openalex.org/W2245321558","https://openalex.org/W2476085397","https://openalex.org/W2542877701","https://openalex.org/W2548786785","https://openalex.org/W2560041978","https://openalex.org/W2591793539","https://openalex.org/W2727695697","https://openalex.org/W2734941459","https://openalex.org/W2742244373","https://openalex.org/W2755552262","https://openalex.org/W2780145918","https://openalex.org/W2789570312","https://openalex.org/W2792952820","https://openalex.org/W2809689731","https://openalex.org/W2850437924","https://openalex.org/W2886325293","https://openalex.org/W2888915331","https://openalex.org/W2889097348","https://openalex.org/W2890328489","https://openalex.org/W2920949083","https://openalex.org/W2946009361","https://openalex.org/W2953558274","https://openalex.org/W2955176466","https://openalex.org/W2964466267","https://openalex.org/W2965940576","https://openalex.org/W2967772953","https://openalex.org/W2970044827","https://openalex.org/W2990842415","https://openalex.org/W3000045849","https://openalex.org/W3000784322","https://openalex.org/W3013369813","https://openalex.org/W3028285817","https://openalex.org/W3030378309","https://openalex.org/W3081194266","https://openalex.org/W3094525800","https://openalex.org/W3109094705","https://openalex.org/W3114916308","https://openalex.org/W3120009375","https://openalex.org/W3130743271","https://openalex.org/W3133567395","https://openalex.org/W3135754788","https://openalex.org/W3137262157","https://openalex.org/W3137379587","https://openalex.org/W3138230581","https://openalex.org/W3155859537","https://openalex.org/W3164270826","https://openalex.org/W3173793082","https://openalex.org/W3177301840","https://openalex.org/W3192198953","https://openalex.org/W3196277935","https://openalex.org/W3198845576","https://openalex.org/W3207222260","https://openalex.org/W3207355325","https://openalex.org/W3208494612","https://openalex.org/W3211608049","https://openalex.org/W4205583230","https://openalex.org/W4226410005","https://openalex.org/W4226416841","https://openalex.org/W4233279977","https://openalex.org/W4241491750","https://openalex.org/W4291213652","https://openalex.org/W4384861963","https://openalex.org/W6638894503","https://openalex.org/W6698076488","https://openalex.org/W6742481633","https://openalex.org/W6802935523","https://openalex.org/W6812742317"],"related_works":["https://openalex.org/W4386025879","https://openalex.org/W6894055384","https://openalex.org/W4308562662","https://openalex.org/W7152037952","https://openalex.org/W4414306445","https://openalex.org/W3028285817","https://openalex.org/W4402616477","https://openalex.org/W4378508740","https://openalex.org/W4407147448","https://openalex.org/W6980668832"],"abstract_inverted_index":{"The":[0,19],"widespread":[1],"dependency":[2],"on":[3,62],"open-source":[4,23,45,63],"software":[5,116],"makes":[6],"it":[7,92],"a":[8,28,57],"fruitful":[9],"target":[10],"for":[11,60,133],"malicious":[12,42],"actors,":[13],"as":[14,128,130],"demonstrated":[15],"by":[16,53],"recurring":[17],"attacks.":[18],"complexity":[20],"of":[21,40,67,88,125,144],"today\u2019s":[22],"supply":[24,64,76],"chains":[25],"results":[26],"in":[27],"significant":[29],"attack":[30,90],"surface,":[31],"giving":[32],"attackers":[33],"numerous":[34],"opportunities":[35],"to":[36,82,98,104],"reach":[37],"the":[38,86,120,126,140,145],"goal":[39],"injecting":[41],"code":[43,80],"into":[44],"artifacts":[46],"that":[47],"is":[48],"then":[49],"downloaded":[50],"and":[51,73,102,114,123,142,148],"executed":[52],"victims.This":[54],"work":[55],"proposes":[56],"general":[58],"taxonomy":[59],"attacks":[61],"chains,":[65],"independent":[66],"specific":[68],"programming":[69],"languages":[70],"or":[71],"ecosystems,":[72],"covering":[74],"all":[75],"chain":[77],"stages":[78],"from":[79],"contributions":[81],"package":[83],"distribution.":[84],"Taking":[85],"form":[87],"an":[89],"tree,":[91],"covers":[93],"107":[94],"unique":[95],"vectors,":[96],"linked":[97],"94":[99],"real-world":[100],"incidents,":[101],"mapped":[103],"33":[105],"mitigating":[106],"safeguards.User":[107],"surveys":[108],"conducted":[109],"with":[110],"17":[111],"domain":[112],"experts":[113],"134":[115],"developers":[117],"positively":[118],"validated":[119],"correctness,":[121],"comprehensiveness":[122],"comprehensibility":[124],"taxonomy,":[127],"well":[129],"its":[131],"suitability":[132],"various":[134],"use-cases.":[135],"Survey":[136],"participants":[137],"also":[138],"assessed":[139],"utility":[141],"costs":[143],"identified":[146],"safeguards,":[147],"whether":[149],"they":[150],"are":[151],"used.":[152]},"counts_by_year":[{"year":2026,"cited_by_count":124},{"year":2025,"cited_by_count":72},{"year":2024,"cited_by_count":50},{"year":2023,"cited_by_count":33},{"year":2022,"cited_by_count":2}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2023-07-25T00:00:00"}