{"id":"https://openalex.org/W7169551408","doi":"https://doi.org/10.1007/s10664-026-10873-9","title":"A methodology to perform cross-ecosystems case-control security studies","display_name":"A methodology to perform cross-ecosystems case-control security studies","publication_year":2026,"publication_date":"2026-07-18","ids":{"openalex":"https://openalex.org/W7169551408","doi":"https://doi.org/10.1007/s10664-026-10873-9"},"language":"en","primary_location":{"id":"doi:10.1007/s10664-026-10873-9","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10664-026-10873-9","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10664-026-10873-9.pdf","source":{"id":"https://openalex.org/S109852484","display_name":"Empirical Software Engineering","issn_l":"1382-3256","issn":["1382-3256","1573-7616"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Empirical Software Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://link.springer.com/content/pdf/10.1007/s10664-026-10873-9.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5141112527","display_name":"Yuan Feng","orcid":"https://orcid.org/0009-0007-0641-7260"},"institutions":[{"id":"https://openalex.org/I193223587","display_name":"University of Trento","ror":"https://ror.org/05trd4x28","country_code":"IT","type":"education","lineage":["https://openalex.org/I193223587"]}],"countries":["IT"],"is_corresponding":true,"raw_author_name":"Yuan Feng","raw_affiliation_strings":["University of Trento, Trento, 38122, Italy"],"raw_orcid":"https://orcid.org/0009-0007-0641-7260","affiliations":[{"raw_affiliation_string":"University of Trento, Trento, 38122, Italy","institution_ids":["https://openalex.org/I193223587"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5057850580","display_name":"Ranindya Paramitha","orcid":"https://orcid.org/0000-0002-6682-4243"},"institutions":[{"id":"https://openalex.org/I137902535","display_name":"North Carolina State University","ror":"https://ror.org/04tj63d06","country_code":"US","type":"education","lineage":["https://openalex.org/I137902535"]},{"id":"https://openalex.org/I193223587","display_name":"University of Trento","ror":"https://ror.org/05trd4x28","country_code":"IT","type":"education","lineage":["https://openalex.org/I193223587"]}],"countries":["IT","US"],"is_corresponding":false,"raw_author_name":"Ranindya Paramitha","raw_affiliation_strings":["North Carolina State University, Raleigh, North Carolina, 27695, United States","University of Trento, Trento, 38122, Italy"],"raw_orcid":"https://orcid.org/0000-0002-6682-4243","affiliations":[{"raw_affiliation_string":"North Carolina State University, Raleigh, North Carolina, 27695, United States","institution_ids":["https://openalex.org/I137902535"]},{"raw_affiliation_string":"University of Trento, Trento, 38122, Italy","institution_ids":["https://openalex.org/I193223587"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5026004403","display_name":"Carlos E. Budde","orcid":"https://orcid.org/0000-0001-8807-1548"},"institutions":[{"id":"https://openalex.org/I193223587","display_name":"University of Trento","ror":"https://ror.org/05trd4x28","country_code":"IT","type":"education","lineage":["https://openalex.org/I193223587"]},{"id":"https://openalex.org/I96673099","display_name":"Technical University of Denmark","ror":"https://ror.org/04qtj9h94","country_code":"DK","type":"education","lineage":["https://openalex.org/I96673099"]}],"countries":["DK","IT"],"is_corresponding":false,"raw_author_name":"Carlos E. Budde","raw_affiliation_strings":["Technical University of Denmark, Anker Engelunds Vej 1, Kongens Lyngby, 2800, Denmark","University of Trento, Trento, 38122, Italy"],"raw_orcid":"https://orcid.org/0000-0001-8807-1548","affiliations":[{"raw_affiliation_string":"Technical University of Denmark, Anker Engelunds Vej 1, Kongens Lyngby, 2800, Denmark","institution_ids":["https://openalex.org/I96673099"]},{"raw_affiliation_string":"University of Trento, Trento, 38122, Italy","institution_ids":["https://openalex.org/I193223587"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5085639552","display_name":"Fabio Massacci","orcid":"https://orcid.org/0000-0002-1091-8486"},"institutions":[{"id":"https://openalex.org/I193223587","display_name":"University of Trento","ror":"https://ror.org/05trd4x28","country_code":"IT","type":"education","lineage":["https://openalex.org/I193223587"]},{"id":"https://openalex.org/I865915315","display_name":"Vrije Universiteit Amsterdam","ror":"https://ror.org/008xxew50","country_code":"NL","type":"education","lineage":["https://openalex.org/I865915315"]}],"countries":["IT","NL"],"is_corresponding":false,"raw_author_name":"Fabio Massacci","raw_affiliation_strings":["University of Trento, Trento, 38122, Italy","Vrije Universiteit Amsterdam, Amsterdam, 1081 HV, The Netherlands"],"raw_orcid":"https://orcid.org/0000-0002-1091-8486","affiliations":[{"raw_affiliation_string":"University of Trento, Trento, 38122, Italy","institution_ids":["https://openalex.org/I193223587"]},{"raw_affiliation_string":"Vrije Universiteit Amsterdam, Amsterdam, 1081 HV, The Netherlands","institution_ids":["https://openalex.org/I865915315"]}]}],"institutions":[],"countries_distinct_count":4,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5141112527"],"corresponding_institution_ids":["https://openalex.org/I193223587"],"apc_list":{"value":2890,"currency":"USD","value_usd":2890},"apc_paid":{"value":2890,"currency":"USD","value_usd":2890},"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.95124445,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":null,"biblio":{"volume":"32","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.3847000002861023,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.3847000002861023,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.20800000429153442,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.13660000264644623,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/python","display_name":"Python (programming language)","score":0.7524999976158142},{"id":"https://openalex.org/keywords/odds","display_name":"Odds","score":0.45680001378059387},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.4526999890804291},{"id":"https://openalex.org/keywords/vulnerability-management","display_name":"Vulnerability management","score":0.4442000091075897},{"id":"https://openalex.org/keywords/scrutiny","display_name":"Scrutiny","score":0.43299999833106995},{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.4163999855518341}],"concepts":[{"id":"https://openalex.org/C519991488","wikidata":"https://www.wikidata.org/wiki/Q28865","display_name":"Python (programming language)","level":2,"score":0.7524999976158142},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7348999977111816},{"id":"https://openalex.org/C143095724","wikidata":"https://www.wikidata.org/wiki/Q515895","display_name":"Odds","level":3,"score":0.45680001378059387},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.4526999890804291},{"id":"https://openalex.org/C172776598","wikidata":"https://www.wikidata.org/wiki/Q7943570","display_name":"Vulnerability management","level":4,"score":0.4442000091075897},{"id":"https://openalex.org/C2776050585","wikidata":"https://www.wikidata.org/wiki/Q7439360","display_name":"Scrutiny","level":2,"score":0.43299999833106995},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.4163999855518341},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4050000011920929},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.38769999146461487},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.3806999921798706},{"id":"https://openalex.org/C19768560","wikidata":"https://www.wikidata.org/wiki/Q320727","display_name":"Dependency (UML)","level":2,"score":0.3319999873638153},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.3278000056743622},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.3165000081062317},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.28279998898506165},{"id":"https://openalex.org/C2780586970","wikidata":"https://www.wikidata.org/wiki/Q1357284","display_name":"Popularity","level":2,"score":0.26460000872612},{"id":"https://openalex.org/C178148461","wikidata":"https://www.wikidata.org/wiki/Q1632136","display_name":"Security controls","level":3,"score":0.2639999985694885},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.26100000739097595}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1007/s10664-026-10873-9","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10664-026-10873-9","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10664-026-10873-9.pdf","source":{"id":"https://openalex.org/S109852484","display_name":"Empirical Software Engineering","issn_l":"1382-3256","issn":["1382-3256","1573-7616"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Empirical Software Engineering","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1007/s10664-026-10873-9","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s10664-026-10873-9","pdf_url":"https://link.springer.com/content/pdf/10.1007/s10664-026-10873-9.pdf","source":{"id":"https://openalex.org/S109852484","display_name":"Empirical Software Engineering","issn_l":"1382-3256","issn":["1382-3256","1573-7616"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Empirical Software Engineering","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Life in Land","score":0.41756463050842285,"id":"https://metadata.un.org/sdg/15"}],"awards":[],"funders":[{"id":"https://openalex.org/F4320322275","display_name":"Universit\u00e0 degli Studi di Trento","ror":"https://ror.org/05trd4x28"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7169551408.pdf","grobid_xml":"https://content.openalex.org/works/W7169551408.grobid-xml"},"referenced_works_count":46,"referenced_works":["https://openalex.org/W150078352","https://openalex.org/W1493761956","https://openalex.org/W1577719850","https://openalex.org/W1984052269","https://openalex.org/W1998637589","https://openalex.org/W2003371939","https://openalex.org/W2122401044","https://openalex.org/W2138318139","https://openalex.org/W2150290224","https://openalex.org/W2156204309","https://openalex.org/W2164777277","https://openalex.org/W2165401136","https://openalex.org/W2440056063","https://openalex.org/W2529650839","https://openalex.org/W2536555047","https://openalex.org/W2740279154","https://openalex.org/W2744136779","https://openalex.org/W2800786809","https://openalex.org/W2921355642","https://openalex.org/W2954266827","https://openalex.org/W2963748706","https://openalex.org/W2994210939","https://openalex.org/W2996500226","https://openalex.org/W3089334339","https://openalex.org/W3104089097","https://openalex.org/W3106855263","https://openalex.org/W3121596715","https://openalex.org/W3156588337","https://openalex.org/W3162945305","https://openalex.org/W3177208397","https://openalex.org/W3206977100","https://openalex.org/W4246381858","https://openalex.org/W4286331405","https://openalex.org/W4313195722","https://openalex.org/W4313549796","https://openalex.org/W4360948905","https://openalex.org/W4365505562","https://openalex.org/W4376606877","https://openalex.org/W4384345689","https://openalex.org/W4387603930","https://openalex.org/W4393145380","https://openalex.org/W4394745640","https://openalex.org/W4394769265","https://openalex.org/W4402389591","https://openalex.org/W4405401740","https://openalex.org/W7160289823"],"related_works":[],"abstract_inverted_index":{"Abstract":[0],"The":[1],"choice":[2],"of":[3,10,16,90,95,161,233,245,257,269],"one\u2019s":[4],"programming":[5],"language":[6],"and":[7,33,109,125,144,156,299,305],"relative":[8,42],"ecosystem":[9,87],"libraries":[11,89,124],"can":[12],"affect":[13],"the":[14,23,47,104,114,158,185,196,231,238,243,246,267,303,306],"likelihood":[15],"encountering":[17],"a":[18,27,37,55,68,78,100,135,150,164,172,179,205,262,272,279,288,293],"critical":[19,137,165,217,273],"vulnerability.":[20],"Simply":[21],"counting":[22],"vulnerabilities":[24,105,133],"by":[25,194,230],"mining":[26],"software":[28],"repository":[29],"is":[30,60,167,203,283],"not":[31],"enough,":[32],"case-control":[34,101],"studies":[35],"are":[36],"well-accepted":[38],"methodology":[39],"to":[40,49,63,81,88,177,187,215,277],"determine":[41],"risk.":[43],"Yet,":[44],"they":[45],"require":[46],"ability":[48],"compare":[50,74],"\u2018equals":[51],"with":[52,103,110,132,134,149,163,207,271],"equals\u2019":[53],"as":[54,129,254,311],"library":[56,69,174],"for":[57,70,191,252,287,292],"text":[58],"processing":[59],"likely":[61],"subject":[62],"less":[64],"security":[65,116,235],"scrutiny":[66],"than":[67,221,291],"web":[71],"applications.":[72],"To":[73,296],"libraries,":[75],"we":[76,98,260,301],"implemented":[77],"human-guided":[79],"protocol":[80,307],"transfer":[82],"classification":[83],"categories":[84],"from":[85],"an":[86],"another":[91],"ecosystem.":[92,240],"By":[93,241],"building":[94],"this":[96],"categorization,":[97],"performed":[99],"study":[102],"available":[106,310],"on":[107],"Snyk":[108],"status":[111],"\u2019reviewed\u2019":[112],"in":[113,175,218,222,237,250],"Github":[115],"Advisories":[117],"till":[118],"2024.":[119],"We":[120,154,183],"mapped":[121],"76":[122],"Java/Maven":[123,143,173,219,294],"221":[126],"Python/PyPI":[127,146,223,289],"packages":[128],"\u2019cases\u2019":[130],"(libraries":[131],"CVSS":[136,152,197],"score)":[138],"compared":[139],"them":[140],"against":[141],"58":[142],"166":[145],"\u2019controls\u2019":[147],"(Only":[148],"high":[151,280],"score).":[153],"found":[155,261],"overall":[157],"odds":[159],"ratio":[160],"ending":[162,270],"vulnerability":[166,206,274],"slightly":[168],"higher":[169,213,285],"when":[170],"using":[171,178,195,242],"comparison":[176],"Python/PyPi":[180],"package":[181,290],"(1.13x).":[182],"refine":[184],"analysis":[186],"understand":[188],"possible":[189,201,255],"reasons":[190],"our":[192],"result":[193],"vector":[198],"metric.":[199],"A":[200],"explanation":[202],"that":[204],"low":[208],"attack":[209],"complexity":[210],"has":[211],"disproportionately":[212],"chances":[214],"be":[216,228],"(38.9x)":[220],"(5.9x).":[224],"Such":[225],"results":[226],"might":[227],"explained":[229],"lack":[232],"past":[234],"interest":[236],"Python":[239,253],"introduction":[244],"OWASP":[247],"dependency":[248],"checker":[249],"2023":[251,266],"indication":[256],"community":[258],"interest,":[259],"risk":[263,268],"reversal:":[264],"after":[265],"(as":[275],"opposed":[276],"just":[278],"severity":[281],"one)":[282],"significantly":[284],"(2.4x)":[286],"library.":[295],"allow":[297],"replication":[298],"updates,":[300],"make":[302],"dataset":[304],"individual":[308],"steps":[309],"open":[312],"data.":[313]},"counts_by_year":[],"updated_date":"2026-07-23T08:03:31.855105","created_date":"2026-07-18T00:00:00"}