{"id":"https://openalex.org/W3192198953","doi":"https://doi.org/10.1109/tse.2021.3101739","title":"Identifying Challenges for OSS Vulnerability Scanners - A Study & Test Suite","display_name":"Identifying Challenges for OSS Vulnerability Scanners - A Study & Test Suite","publication_year":2021,"publication_date":"2021-08-04","ids":{"openalex":"https://openalex.org/W3192198953","doi":"https://doi.org/10.1109/tse.2021.3101739","mag":"3192198953"},"language":"en","primary_location":{"id":"doi:10.1109/tse.2021.3101739","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tse.2021.3101739","pdf_url":null,"source":{"id":"https://openalex.org/S8351582","display_name":"IEEE Transactions on Software Engineering","issn_l":"0098-5589","issn":["0098-5589","1939-3520","2326-3881"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Software Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5086467510","display_name":"Andreas Dann","orcid":"https://orcid.org/0000-0002-6587-7431"},"institutions":[{"id":"https://openalex.org/I206945453","display_name":"Paderborn University","ror":"https://ror.org/058kzsd48","country_code":"DE","type":"education","lineage":["https://openalex.org/I206945453"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Andreas Dann","raw_affiliation_strings":["Secure Software Engineering group, Heinz Nixdorf Institute, Paderborn University, Paderborn, Germany","Codeshield GmbH, Paderborn, Germany"],"raw_orcid":"https://orcid.org/0000-0002-6587-7431","affiliations":[{"raw_affiliation_string":"Secure Software Engineering group, Heinz Nixdorf Institute, Paderborn University, Paderborn, Germany","institution_ids":["https://openalex.org/I206945453"]},{"raw_affiliation_string":"Codeshield GmbH, Paderborn, Germany","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5064821194","display_name":"Henrik Plate","orcid":"https://orcid.org/0000-0001-8862-3488"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Henrik Plate","raw_affiliation_strings":["SAP Security Research, Mougins, France"],"raw_orcid":"https://orcid.org/0000-0001-8862-3488","affiliations":[{"raw_affiliation_string":"SAP Security Research, Mougins, France","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5027995789","display_name":"Ben Hermann","orcid":"https://orcid.org/0000-0001-9848-2017"},"institutions":[{"id":"https://openalex.org/I200332995","display_name":"TU Dortmund University","ror":"https://ror.org/01k97gp34","country_code":"DE","type":"education","lineage":["https://openalex.org/I200332995"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Ben Hermann","raw_affiliation_strings":["Secure Software Engineering Group, Technische Universität Dortmund, Dortmund, Germany"],"raw_orcid":"https://orcid.org/0000-0001-9848-2017","affiliations":[{"raw_affiliation_string":"Secure Software Engineering Group, Technische Universität Dortmund, Dortmund, Germany","institution_ids":["https://openalex.org/I200332995"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5035492762","display_name":"Serena Elisa Ponta","orcid":"https://orcid.org/0000-0002-6208-4743"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Serena Elisa Ponta","raw_affiliation_strings":["SAP Security Research, Mougins, France"],"raw_orcid":"https://orcid.org/0000-0002-6208-4743","affiliations":[{"raw_affiliation_string":"SAP Security Research, Mougins, France","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5076678278","display_name":"Eric Bodden","orcid":"https://orcid.org/0000-0003-3470-3647"},"institutions":[{"id":"https://openalex.org/I206945453","display_name":"Paderborn University","ror":"https://ror.org/058kzsd48","country_code":"DE","type":"education","lineage":["https://openalex.org/I206945453"]},{"id":"https://openalex.org/I4210093498","display_name":"Fraunhofer Institute for Mechatronic Systems Design","ror":"https://ror.org/004nttc42","country_code":"DE","type":"facility","lineage":["https://openalex.org/I4210093498","https://openalex.org/I4923324"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Eric Bodden","raw_affiliation_strings":["Secure Software Engineering, Department of Computer Science, Paderborn University, Paderborn, Germany","Software Engineering and IT-Security, Fraunhofer IEM, Paderborn, Germany"],"raw_orcid":"https://orcid.org/0000-0003-3470-3647","affiliations":[{"raw_affiliation_string":"Secure Software Engineering, Department of Computer Science, Paderborn University, Paderborn, Germany","institution_ids":["https://openalex.org/I206945453"]},{"raw_affiliation_string":"Software Engineering and IT-Security, Fraunhofer IEM, Paderborn, Germany","institution_ids":["https://openalex.org/I4210093498"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":4.5384,"has_fulltext":false,"cited_by_count":25,"citation_normalized_percentile":{"value":0.94838224,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":"48","issue":"9","first_page":"3613","last_page":"3625"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9976999759674072,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12423","display_name":"Software Reliability and Analysis Research","score":0.9966999888420105,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7811563014984131},{"id":"https://openalex.org/keywords/java","display_name":"Java","score":0.7204766273498535},{"id":"https://openalex.org/keywords/open-source","display_name":"Open source","score":0.6862416863441467},{"id":"https://openalex.org/keywords/test-suite","display_name":"Test suite","score":0.6651431918144226},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.5617266893386841},{"id":"https://openalex.org/keywords/dependency","display_name":"Dependency (UML)","score":0.5586366653442383},{"id":"https://openalex.org/keywords/eclipse","display_name":"Eclipse","score":0.5261620879173279},{"id":"https://openalex.org/keywords/suite","display_name":"Suite","score":0.5072922110557556},{"id":"https://openalex.org/keywords/dependency-graph","display_name":"Dependency graph","score":0.49812936782836914},{"id":"https://openalex.org/keywords/source-code","display_name":"Source code","score":0.4704120457172394},{"id":"https://openalex.org/keywords/metadata","display_name":"Metadata","score":0.45873844623565674},{"id":"https://openalex.org/keywords/open-source-software","display_name":"Open source software","score":0.4461968243122101},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.4006238579750061},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.3887614607810974},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.3773390054702759},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.29782241582870483},{"id":"https://openalex.org/keywords/test-case","display_name":"Test case","score":0.2585277557373047},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.24432480335235596},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.17721131443977356}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7811563014984131},{"id":"https://openalex.org/C548217200","wikidata":"https://www.wikidata.org/wiki/Q251","display_name":"Java","level":2,"score":0.7204766273498535},{"id":"https://openalex.org/C3018397939","wikidata":"https://www.wikidata.org/wiki/Q3644502","display_name":"Open source","level":3,"score":0.6862416863441467},{"id":"https://openalex.org/C151552104","wikidata":"https://www.wikidata.org/wiki/Q7705809","display_name":"Test suite","level":4,"score":0.6651431918144226},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.5617266893386841},{"id":"https://openalex.org/C19768560","wikidata":"https://www.wikidata.org/wiki/Q320727","display_name":"Dependency (UML)","level":2,"score":0.5586366653442383},{"id":"https://openalex.org/C2778505590","wikidata":"https://www.wikidata.org/wiki/Q141022","display_name":"Eclipse","level":2,"score":0.5261620879173279},{"id":"https://openalex.org/C79581498","wikidata":"https://www.wikidata.org/wiki/Q1367530","display_name":"Suite","level":2,"score":0.5072922110557556},{"id":"https://openalex.org/C16311509","wikidata":"https://www.wikidata.org/wiki/Q4148050","display_name":"Dependency graph","level":3,"score":0.49812936782836914},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.4704120457172394},{"id":"https://openalex.org/C93518851","wikidata":"https://www.wikidata.org/wiki/Q180160","display_name":"Metadata","level":2,"score":0.45873844623565674},{"id":"https://openalex.org/C2988343187","wikidata":"https://www.wikidata.org/wiki/Q1130645","display_name":"Open source software","level":3,"score":0.4461968243122101},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.4006238579750061},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.3887614607810974},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.3773390054702759},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.29782241582870483},{"id":"https://openalex.org/C128942645","wikidata":"https://www.wikidata.org/wiki/Q1568346","display_name":"Test case","level":3,"score":0.2585277557373047},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.24432480335235596},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.17721131443977356},{"id":"https://openalex.org/C1276947","wikidata":"https://www.wikidata.org/wiki/Q333","display_name":"Astronomy","level":1,"score":0.0},{"id":"https://openalex.org/C166957645","wikidata":"https://www.wikidata.org/wiki/Q23498","display_name":"Archaeology","level":1,"score":0.0},{"id":"https://openalex.org/C152877465","wikidata":"https://www.wikidata.org/wiki/Q208042","display_name":"Regression analysis","level":2,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C95457728","wikidata":"https://www.wikidata.org/wiki/Q309","display_name":"History","level":0,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/tse.2021.3101739","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tse.2021.3101739","pdf_url":null,"source":{"id":"https://openalex.org/S8351582","display_name":"IEEE Transactions on Software Engineering","issn_l":"0098-5589","issn":["0098-5589","1939-3520","2326-3881"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Software Engineering","raw_type":"journal-article"},{"id":"pmh:oai:publica.fraunhofer.de:publica/446503","is_oa":false,"landing_page_url":"https://publica.fraunhofer.de/handle/publica/446503","pdf_url":null,"source":{"id":"https://openalex.org/S4306400318","display_name":"Fraunhofer-Publica (Fraunhofer-Gesellschaft)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I4923324","host_organization_name":"Fraunhofer-Gesellschaft","host_organization_lineage":["https://openalex.org/I4923324"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"journal article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":20,"referenced_works":["https://openalex.org/W19752705","https://openalex.org/W1989385531","https://openalex.org/W2021963610","https://openalex.org/W2022913925","https://openalex.org/W2047988765","https://openalex.org/W2091426289","https://openalex.org/W2095938258","https://openalex.org/W2162739315","https://openalex.org/W2166091242","https://openalex.org/W2757983416","https://openalex.org/W2762844179","https://openalex.org/W2889097348","https://openalex.org/W2955183140","https://openalex.org/W2963321189","https://openalex.org/W2963926786","https://openalex.org/W3005566493","https://openalex.org/W3040158574","https://openalex.org/W3088691441","https://openalex.org/W3121596715","https://openalex.org/W6689585180"],"related_works":["https://openalex.org/W4376877853","https://openalex.org/W4250928611","https://openalex.org/W4232280318","https://openalex.org/W166480398","https://openalex.org/W167327709","https://openalex.org/W4387839566","https://openalex.org/W2054706656","https://openalex.org/W4210922265","https://openalex.org/W4319870556","https://openalex.org/W1985865858"],"abstract_inverted_index":{"The":[0,144],"use":[1],"of":[2,35,50,65,82,101,120,126,149,159],"vulnerable":[3,55,103],"open-source":[4,56,128,179],"dependencies":[5,20,57],"is":[6,152],"a":[7,165],"known":[8],"problem":[9],"in":[10,22,108,111],"today's":[11],"software":[12],"development.":[13],"Several":[14],"vulnerability":[15,66,129],"scanners":[16,130,151],"to":[17,154],"detect":[18],"known-vulnerable":[19],"appeared":[21],"the":[23,33,63,102,118,124,127,150,157,176],"last":[24],"decade,":[25],"however,":[26],"there":[27],"exists":[28],"no":[29],"case":[30],"study":[31,71],"investigating":[32],"impact":[34,61,119],"development":[36],"practices,":[37],"e.g.,":[38],"forking,":[39],"patching,":[40],"re-bundling,":[41,85],"on":[42,62,72,123,178],"their":[43,60],"performance.":[44],"This":[45],"paper":[46],"studies":[47],"(i)":[48],"types":[49,81,158],"modifications":[51,122,160,177],"that":[52,93,147,173],"may":[53],"affect":[54],"and":[58,87,134,140],"(ii)":[59],"performance":[64,125],"scanners.":[67,143],"Through":[68],"an":[69],"empirical":[70],"7,024":[73],"Java":[74,104],"projects":[75],"developed":[76],"atSAP,":[77],"we":[78,91,163],"identified":[79],"four":[80],"modifications:":[83],"re-compilation,":[84],"metadata-removal":[86],"re-packaging.":[88],"In":[89],"particular,":[90],"found":[92],"more":[94],"than":[95],"87":[96],"percent":[97],"(56":[98],"percent,":[99],"resp.)":[100,114],"classes":[105],"considered":[106],"occur":[107],"Maven":[109],"Central":[110],"re-bundled":[112],"(re-packaged,":[113],"form.":[115],"We":[116],"assessed":[117],"these":[121],"OWASP":[131],"Dependency-Check":[132],"(OWASP)":[133],"Eclipse":[135],"Steady,":[136],"GitHub":[137],"Security":[138],"Alerts,":[139],"three":[141],"commercial":[142],"results":[145],"show":[146],"none":[148],"able":[153],"handle":[155],"all":[156],"identified.":[161],"Finally,":[162],"presentAchilles,":[164],"novel":[166],"test":[167,171],"suite":[168],"with":[169],"2,505":[170],"cases":[172],"allow":[174],"replicating":[175],"dependencies.":[180]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":7},{"year":2024,"cited_by_count":10},{"year":2023,"cited_by_count":5},{"year":2022,"cited_by_count":1}],"updated_date":"2026-08-11T07:18:39.950985","created_date":"2025-10-10T00:00:00"}