{"id":"https://openalex.org/W7161420317","doi":"https://doi.org/10.1016/j.cose.2026.104959","title":"Automatic selection of protections to mitigate risks against software applications","display_name":"Automatic selection of protections to mitigate risks against software applications","publication_year":2026,"publication_date":"2026-05-16","ids":{"openalex":"https://openalex.org/W7161420317","doi":"https://doi.org/10.1016/j.cose.2026.104959"},"language":"en","primary_location":{"id":"doi:10.1016/j.cose.2026.104959","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.cose.2026.104959","pdf_url":null,"source":{"id":"https://openalex.org/S12529635","display_name":"Computers & Security","issn_l":"0167-4048","issn":["0167-4048","1872-6208"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers & Security","raw_type":"journal-article"},"type":"article","indexed_in":["arxiv","crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1016/j.cose.2026.104959","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5033220404","display_name":"Daniele Canavese","orcid":"https://orcid.org/0000-0002-4265-7743"},"institutions":[{"id":"https://openalex.org/I4210137033","display_name":"Istituto di Matematica Applicata e Tecnologie Informatiche","ror":"https://ror.org/03m0n3c07","country_code":"IT","type":"education","lineage":["https://openalex.org/I4210137033","https://openalex.org/I4210155236"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Daniele Canavese","raw_affiliation_strings":["Istituto di Matematica Applicata e Tecnologie Informatiche \u201cE. Magenes\u201d (IMATI), Consiglio Nazionale delle Ricerche, Via de Marini, 6, 16149, Genova, Italy"],"raw_orcid":"https://orcid.org/0000-0002-4265-7743","affiliations":[{"raw_affiliation_string":"Istituto di Matematica Applicata e Tecnologie Informatiche \u201cE. Magenes\u201d (IMATI), Consiglio Nazionale delle Ricerche, Via de Marini, 6, 16149, Genova, Italy","institution_ids":["https://openalex.org/I4210137033"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5064107592","display_name":"Leonardo Regano","orcid":"https://orcid.org/0000-0002-9259-5157"},"institutions":[{"id":"https://openalex.org/I172446870","display_name":"University of Cagliari","ror":"https://ror.org/003109y17","country_code":"IT","type":"education","lineage":["https://openalex.org/I172446870"]}],"countries":["IT"],"is_corresponding":true,"raw_author_name":"Leonardo Regano","raw_affiliation_strings":["Dipartimento di Ingegneria Elettrica e Elettronica, Universit\u00e0 di Cagliari, Via Marengo 3, 09123, Cagliari, Italy"],"raw_orcid":"https://orcid.org/0000-0002-9259-5157","affiliations":[{"raw_affiliation_string":"Dipartimento di Ingegneria Elettrica e Elettronica, Universit\u00e0 di Cagliari, Via Marengo 3, 09123, Cagliari, Italy","institution_ids":["https://openalex.org/I172446870"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5015749928","display_name":"Cataldo Basile","orcid":"https://orcid.org/0000-0002-8016-1490"},"institutions":[{"id":"https://openalex.org/I177477856","display_name":"Politecnico di Torino","ror":"https://ror.org/00bgk9508","country_code":"IT","type":"education","lineage":["https://openalex.org/I177477856"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Cataldo Basile","raw_affiliation_strings":["Dipartimento di Automatica e Informatica, Politecnico di Torino, Corso Duca degli Abruzzi, 24, 10129, Torino, Italy"],"raw_orcid":"https://orcid.org/0000-0002-8016-1490","affiliations":[{"raw_affiliation_string":"Dipartimento di Automatica e Informatica, Politecnico di Torino, Corso Duca degli Abruzzi, 24, 10129, Torino, Italy","institution_ids":["https://openalex.org/I177477856"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5090947977","display_name":"Bjorn De Sutter","orcid":"https://orcid.org/0000-0003-0317-2089"},"institutions":[{"id":"https://openalex.org/I32597200","display_name":"Ghent University","ror":"https://ror.org/00cv9y106","country_code":"BE","type":"education","lineage":["https://openalex.org/I32597200"]}],"countries":["BE"],"is_corresponding":false,"raw_author_name":"Bjorn De Sutter","raw_affiliation_strings":["Computer Systems Lab, Ghent University, Technologiepark-Zwijnaarde 126, 9052, Gent, Belgium"],"raw_orcid":"https://orcid.org/0000-0003-0317-2089","affiliations":[{"raw_affiliation_string":"Computer Systems Lab, Ghent University, Technologiepark-Zwijnaarde 126, 9052, Gent, Belgium","institution_ids":["https://openalex.org/I32597200"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5064107592"],"corresponding_institution_ids":["https://openalex.org/I172446870"],"apc_list":{"value":3190,"currency":"USD","value_usd":3190},"apc_paid":{"value":3190,"currency":"USD","value_usd":3190},"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.59253424,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"168","issue":null,"first_page":"104959","last_page":"104959"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.8026999831199646,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.8026999831199646,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T13295","display_name":"Safety Systems Engineering in Autonomy","score":0.03869999945163727,"subfield":{"id":"https://openalex.org/subfields/2213","display_name":"Safety, Risk, Reliability and Quality"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.03849999979138374,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.5717999935150146},{"id":"https://openalex.org/keywords/overhead","display_name":"Overhead (engineering)","score":0.5067999958992004},{"id":"https://openalex.org/keywords/resilience","display_name":"Resilience (materials science)","score":0.489300012588501},{"id":"https://openalex.org/keywords/selection","display_name":"Selection (genetic algorithm)","score":0.46619999408721924},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.46309998631477356},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.4307999908924103},{"id":"https://openalex.org/keywords/usable","display_name":"USable","score":0.4293999969959259},{"id":"https://openalex.org/keywords/frame","display_name":"Frame (networking)","score":0.42010000348091125},{"id":"https://openalex.org/keywords/heuristics","display_name":"Heuristics","score":0.41839998960494995},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.38199999928474426}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8148000240325928},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6025000214576721},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.5717999935150146},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.5067999958992004},{"id":"https://openalex.org/C2779585090","wikidata":"https://www.wikidata.org/wiki/Q3457762","display_name":"Resilience (materials science)","level":2,"score":0.489300012588501},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.4693000018596649},{"id":"https://openalex.org/C81917197","wikidata":"https://www.wikidata.org/wiki/Q628760","display_name":"Selection (genetic algorithm)","level":2,"score":0.46619999408721924},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.46309998631477356},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.4366999864578247},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.4307999908924103},{"id":"https://openalex.org/C2780615836","wikidata":"https://www.wikidata.org/wiki/Q2471869","display_name":"USable","level":2,"score":0.4293999969959259},{"id":"https://openalex.org/C126042441","wikidata":"https://www.wikidata.org/wiki/Q1324888","display_name":"Frame (networking)","level":2,"score":0.42010000348091125},{"id":"https://openalex.org/C127705205","wikidata":"https://www.wikidata.org/wiki/Q5748245","display_name":"Heuristics","level":2,"score":0.41839998960494995},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.38199999928474426},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.37689998745918274},{"id":"https://openalex.org/C2779151265","wikidata":"https://www.wikidata.org/wiki/Q1156791","display_name":"Copying","level":2,"score":0.36820000410079956},{"id":"https://openalex.org/C173801870","wikidata":"https://www.wikidata.org/wiki/Q201413","display_name":"Heuristic","level":2,"score":0.3637000024318695},{"id":"https://openalex.org/C71745522","wikidata":"https://www.wikidata.org/wiki/Q2476929","display_name":"Confidentiality","level":2,"score":0.34880000352859497},{"id":"https://openalex.org/C149091818","wikidata":"https://www.wikidata.org/wiki/Q2429814","display_name":"Software system","level":3,"score":0.3456999957561493},{"id":"https://openalex.org/C529173508","wikidata":"https://www.wikidata.org/wiki/Q638608","display_name":"Software development","level":3,"score":0.3352999985218048},{"id":"https://openalex.org/C195518309","wikidata":"https://www.wikidata.org/wiki/Q13424265","display_name":"Security testing","level":5,"score":0.3328999876976013},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.319599986076355},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.29429998993873596},{"id":"https://openalex.org/C76518257","wikidata":"https://www.wikidata.org/wiki/Q271680","display_name":"Software framework","level":5,"score":0.2897000014781952},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.2874999940395355},{"id":"https://openalex.org/C1009929","wikidata":"https://www.wikidata.org/wiki/Q179550","display_name":"Software bug","level":3,"score":0.28209999203681946},{"id":"https://openalex.org/C109905503","wikidata":"https://www.wikidata.org/wiki/Q4828920","display_name":"Avionics software","level":5,"score":0.2800999879837036},{"id":"https://openalex.org/C131275738","wikidata":"https://www.wikidata.org/wiki/Q7445023","display_name":"Security bug","level":5,"score":0.27309998869895935},{"id":"https://openalex.org/C117447612","wikidata":"https://www.wikidata.org/wiki/Q1412670","display_name":"Software quality","level":4,"score":0.26750001311302185},{"id":"https://openalex.org/C186846655","wikidata":"https://www.wikidata.org/wiki/Q3398377","display_name":"Software construction","level":4,"score":0.26510000228881836},{"id":"https://openalex.org/C63116202","wikidata":"https://www.wikidata.org/wiki/Q7676227","display_name":"Taint checking","level":3,"score":0.2590000033378601}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1016/j.cose.2026.104959","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.cose.2026.104959","pdf_url":null,"source":{"id":"https://openalex.org/S12529635","display_name":"Computers & Security","issn_l":"0167-4048","issn":["0167-4048","1872-6208"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers & Security","raw_type":"journal-article"},{"id":"pmh:oai:arXiv.org:2506.18470","is_oa":true,"landing_page_url":"https://arxiv.org/abs/2506.18470","pdf_url":"https://arxiv.org/pdf/2506.18470","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"pmh:oai:iris.unica.it:11584/482945","is_oa":true,"landing_page_url":"https://hdl.handle.net/11584/482945","pdf_url":null,"source":{"id":"https://openalex.org/S4377196293","display_name":"UNICA IRIS Institutional Research Information System (University of Cagliari)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I172446870","host_organization_name":"University of Cagliari","host_organization_lineage":["https://openalex.org/I172446870"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/article"}],"best_oa_location":{"id":"doi:10.1016/j.cose.2026.104959","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.cose.2026.104959","pdf_url":null,"source":{"id":"https://openalex.org/S12529635","display_name":"Computers & Security","issn_l":"0167-4048","issn":["0167-4048","1872-6208"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers & Security","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.7771367430686951,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[{"id":"https://openalex.org/G2858999990","display_name":null,"funder_award_id":"GA 101086308","funder_id":"https://openalex.org/F4320334322","funder_display_name":"HORIZON EUROPE Framework Programme"},{"id":"https://openalex.org/G3255061298","display_name":null,"funder_award_id":"101086308","funder_id":"https://openalex.org/F4320334322","funder_display_name":"HORIZON EUROPE Framework Programme"},{"id":"https://openalex.org/G499379581","display_name":null,"funder_award_id":"PE00000014","funder_id":"https://openalex.org/F4320334322","funder_display_name":"HORIZON EUROPE Framework Programme"}],"funders":[{"id":"https://openalex.org/F4320322892","display_name":"Centre National de la Recherche Scientifique","ror":"https://ror.org/02feahw73"},{"id":"https://openalex.org/F4320328356","display_name":"R\u00e9gion Occitanie Pyr\u00e9n\u00e9es-M\u00e9diterran\u00e9e","ror":null},{"id":"https://openalex.org/F4320334322","display_name":"HORIZON EUROPE Framework Programme","ror":null},{"id":"https://openalex.org/F4320338019","display_name":"FP7 Coordination of Research Activities","ror":null}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":19,"referenced_works":["https://openalex.org/W1964962870","https://openalex.org/W1971947926","https://openalex.org/W1999346693","https://openalex.org/W2001383953","https://openalex.org/W2061361563","https://openalex.org/W2068965694","https://openalex.org/W2108424472","https://openalex.org/W2141254179","https://openalex.org/W2331754212","https://openalex.org/W2803311659","https://openalex.org/W2905770568","https://openalex.org/W2962923593","https://openalex.org/W3012294339","https://openalex.org/W3151685851","https://openalex.org/W4206768881","https://openalex.org/W4247686054","https://openalex.org/W4362704894","https://openalex.org/W4380887704","https://openalex.org/W4404006589"],"related_works":[],"abstract_inverted_index":{"This":[0],"paper":[1],"introduces":[2],"a":[3,50,59,69,115,119,173,185],"novel":[4],"approach":[5,171],"for":[6,129,190],"the":[7,25,46,79,84,90,99,105,137,140],"automated":[8,181],"selection":[9,88],"of":[10,68,83,89,139,151],"software":[11,21,41,163,182],"protections":[12,42,63],"to":[13,64,95,133],"mitigate":[14],"Machine-At-The-End":[15],"risks":[16],"against":[17,78,159],"critical":[18],"assets":[19],"within":[20],"applications.":[22],"We":[23,168],"formalize":[24],"key":[26],"elements":[27],"involved":[28],"in":[29,193],"protection":[30,47,157,183],"decision-making":[31],"\u2014":[32,43],"including":[33],"code":[34,66],"artifacts,":[35],"assets,":[36],"security":[37],"requirements,":[38],"attacks,":[39],"and":[40,44,81,153,165,176,187],"frame":[45],"process":[48],"through":[49,114,172],"model":[51],"inspired":[52],"by":[53,76,103,108,155],"game":[54,111],"theory.":[55],"In":[56],"this":[57],"model,":[58],"defender":[60],"strategically":[61],"applies":[62],"various":[65],"artifacts":[67],"target":[70],"application,":[71],"anticipating":[72],"repeated":[73],"attack":[74,160],"attempts":[75],"adversaries":[77],"confidentiality":[80],"integrity":[82],"application\u2019s":[85],"assets.":[86],"The":[87,110],"optimal":[91],"defense":[92],"maximizes":[93],"resistance":[94],"attacks":[96],"while":[97],"ensuring":[98],"application":[100],"remains":[101],"usable":[102],"constraining":[104],"overhead":[106],"introduced":[107],"protections.":[109],"is":[112,136,184],"solved":[113],"heuristic":[116],"based":[117],"on":[118],"mini-max":[120],"depth-first":[121],"exploration":[122],"strategy,":[123],"augmented":[124],"with":[125],"dynamic":[126],"programming":[127],"optimizations":[128],"improved":[130],"efficiency.":[131],"Central":[132],"our":[134,170],"formulation":[135],"introduction":[138],"Software":[141],"Protection":[142],"Index,":[143],"an":[144],"original":[145],"contribution":[146],"that":[147,180],"extends":[148],"existing":[149],"notions":[150],"potency":[152],"resilience":[154],"evaluating":[156],"effectiveness":[158],"paths":[161],"using":[162],"metrics":[164],"expert":[166,177],"assessments.":[167],"validate":[169],"proof-of-concept":[174],"implementation":[175],"evaluations,":[178],"demonstrating":[179],"practical":[186],"effective":[188],"solution":[189],"risk":[191],"mitigation":[192],"software.":[194]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-05-17T00:00:00"}