{"id":"https://openalex.org/W2523437542","doi":"https://doi.org/10.1145/2961111.2962611","title":"Static Analysis and Penetration Testing from the Perspective of Maintenance Teams","display_name":"Static Analysis and Penetration Testing from the Perspective of Maintenance Teams","publication_year":2016,"publication_date":"2016-09-08","ids":{"openalex":"https://openalex.org/W2523437542","doi":"https://doi.org/10.1145/2961111.2962611","mag":"2523437542"},"language":"en","primary_location":{"id":"doi:10.1145/2961111.2962611","is_oa":false,"landing_page_url":"https://doi.org/10.1145/2961111.2962611","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 10th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5019508589","display_name":"Mariano Ceccato","orcid":"https://orcid.org/0000-0001-7325-0316"},"institutions":[{"id":"https://openalex.org/I2277624104","display_name":"Fondazione Bruno Kessler","ror":"https://ror.org/01j33xk10","country_code":"IT","type":"facility","lineage":["https://openalex.org/I2277624104"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Mariano Ceccato","raw_affiliation_strings":["Fondazione Bruno Kessler, Trento, Italy"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Fondazione Bruno Kessler, Trento, Italy","institution_ids":["https://openalex.org/I2277624104"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5012313708","display_name":"Riccardo Scandariato","orcid":"https://orcid.org/0000-0003-3591-7671"},"institutions":[{"id":"https://openalex.org/I66862912","display_name":"Chalmers University of Technology","ror":"https://ror.org/040wg7k59","country_code":"SE","type":"education","lineage":["https://openalex.org/I66862912"]},{"id":"https://openalex.org/I881427289","display_name":"University of Gothenburg","ror":"https://ror.org/01tm6cn81","country_code":"SE","type":"education","lineage":["https://openalex.org/I881427289"]}],"countries":["SE"],"is_corresponding":false,"raw_author_name":"Riccardo Scandariato","raw_affiliation_strings":["Chalmers and University of Gothenburg, Gothenburg, Sweden"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Chalmers and University of Gothenburg, Gothenburg, Sweden","institution_ids":["https://openalex.org/I66862912","https://openalex.org/I881427289"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":16,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12423","display_name":"Software Reliability and Analysis Research","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.9986000061035156,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/static-analysis","display_name":"Static analysis","score":0.810735821723938},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7582762241363525},{"id":"https://openalex.org/keywords/attack-surface","display_name":"Attack surface","score":0.6386922597885132},{"id":"https://openalex.org/keywords/white-box-testing","display_name":"White-box testing","score":0.6203426718711853},{"id":"https://openalex.org/keywords/security-testing","display_name":"Security testing","score":0.6086928844451904},{"id":"https://openalex.org/keywords/penetration","display_name":"Penetration (warfare)","score":0.5759010910987854},{"id":"https://openalex.org/keywords/static-program-analysis","display_name":"Static program analysis","score":0.5481014251708984},{"id":"https://openalex.org/keywords/vulnerability-assessment","display_name":"Vulnerability assessment","score":0.5462777018547058},{"id":"https://openalex.org/keywords/penetration-test","display_name":"Penetration test","score":0.531762421131134},{"id":"https://openalex.org/keywords/application-security","display_name":"Application security","score":0.5154131650924683},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4980926513671875},{"id":"https://openalex.org/keywords/fuzz-testing","display_name":"Fuzz testing","score":0.4940202832221985},{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.48205098509788513},{"id":"https://openalex.org/keywords/black-box-testing","display_name":"Black-box testing","score":0.42682433128356934},{"id":"https://openalex.org/keywords/information-security","display_name":"Information security","score":0.30508700013160706},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.21560338139533997},{"id":"https://openalex.org/keywords/software-development","display_name":"Software development","score":0.15801048278808594},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.1460288166999817},{"id":"https://openalex.org/keywords/cloud-computing-security","display_name":"Cloud computing security","score":0.12079790234565735},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.11744531989097595},{"id":"https://openalex.org/keywords/security-service","display_name":"Security service","score":0.11192554235458374},{"id":"https://openalex.org/keywords/security-information-and-event-management","display_name":"Security information and event management","score":0.10883378982543945},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.1030680239200592},{"id":"https://openalex.org/keywords/software-construction","display_name":"Software construction","score":0.08970808982849121},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.07889556884765625}],"concepts":[{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.810735821723938},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7582762241363525},{"id":"https://openalex.org/C2776576444","wikidata":"https://www.wikidata.org/wiki/Q303569","display_name":"Attack surface","level":2,"score":0.6386922597885132},{"id":"https://openalex.org/C162443782","wikidata":"https://www.wikidata.org/wiki/Q1066228","display_name":"White-box testing","level":5,"score":0.6203426718711853},{"id":"https://openalex.org/C195518309","wikidata":"https://www.wikidata.org/wiki/Q13424265","display_name":"Security testing","level":5,"score":0.6086928844451904},{"id":"https://openalex.org/C80107235","wikidata":"https://www.wikidata.org/wiki/Q7162625","display_name":"Penetration (warfare)","level":2,"score":0.5759010910987854},{"id":"https://openalex.org/C137287247","wikidata":"https://www.wikidata.org/wiki/Q1329550","display_name":"Static program analysis","level":4,"score":0.5481014251708984},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.5462777018547058},{"id":"https://openalex.org/C98214672","wikidata":"https://www.wikidata.org/wiki/Q1501923","display_name":"Penetration test","level":3,"score":0.531762421131134},{"id":"https://openalex.org/C77109596","wikidata":"https://www.wikidata.org/wiki/Q4781497","display_name":"Application security","level":5,"score":0.5154131650924683},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4980926513671875},{"id":"https://openalex.org/C111065885","wikidata":"https://www.wikidata.org/wiki/Q1189053","display_name":"Fuzz testing","level":3,"score":0.4940202832221985},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.48205098509788513},{"id":"https://openalex.org/C24169984","wikidata":"https://www.wikidata.org/wiki/Q879969","display_name":"Black-box testing","level":5,"score":0.42682433128356934},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.30508700013160706},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.21560338139533997},{"id":"https://openalex.org/C529173508","wikidata":"https://www.wikidata.org/wiki/Q638608","display_name":"Software development","level":3,"score":0.15801048278808594},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.1460288166999817},{"id":"https://openalex.org/C184842701","wikidata":"https://www.wikidata.org/wiki/Q370563","display_name":"Cloud computing security","level":3,"score":0.12079790234565735},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.11744531989097595},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.11192554235458374},{"id":"https://openalex.org/C103377522","wikidata":"https://www.wikidata.org/wiki/Q3493999","display_name":"Security information and event management","level":4,"score":0.10883378982543945},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.1030680239200592},{"id":"https://openalex.org/C186846655","wikidata":"https://www.wikidata.org/wiki/Q3398377","display_name":"Software construction","level":4,"score":0.08970808982849121},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.07889556884765625},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.0},{"id":"https://openalex.org/C18555067","wikidata":"https://www.wikidata.org/wiki/Q8375051","display_name":"Joint (building)","level":2,"score":0.0},{"id":"https://openalex.org/C542102704","wikidata":"https://www.wikidata.org/wiki/Q183257","display_name":"Psychotherapist","level":1,"score":0.0},{"id":"https://openalex.org/C170154142","wikidata":"https://www.wikidata.org/wiki/Q150737","display_name":"Architectural engineering","level":1,"score":0.0},{"id":"https://openalex.org/C42475967","wikidata":"https://www.wikidata.org/wiki/Q194292","display_name":"Operations research","level":1,"score":0.0},{"id":"https://openalex.org/C137176749","wikidata":"https://www.wikidata.org/wiki/Q4105337","display_name":"Psychological resilience","level":2,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1145/2961111.2962611","is_oa":false,"landing_page_url":"https://doi.org/10.1145/2961111.2962611","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 10th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement","raw_type":"proceedings-article"},{"id":"pmh:oai:research.chalmers.se:237769","is_oa":false,"landing_page_url":"https://research.chalmers.se/en/publication/237769","pdf_url":null,"source":{"id":"https://openalex.org/S4306402469","display_name":"Chalmers Research (Chalmers University of Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I66862912","host_organization_name":"Chalmers University of Technology","host_organization_lineage":["https://openalex.org/I66862912"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":null},{"id":"pmh:oai:tore.tuhh.de:11420/14422","is_oa":false,"landing_page_url":"http://hdl.handle.net/11420/14422","pdf_url":null,"source":{"id":"https://openalex.org/S4306401751","display_name":"tub.dok (Hamburg University of Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I884043246","host_organization_name":"Hamburg University of Technology","host_organization_lineage":["https://openalex.org/I884043246"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Conference Paper"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.75,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[{"id":"https://openalex.org/F4320320300","display_name":"European Commission","ror":"https://ror.org/00k4n6c32"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":15,"referenced_works":["https://openalex.org/W1482321645","https://openalex.org/W1508238955","https://openalex.org/W1612015840","https://openalex.org/W1967931023","https://openalex.org/W1998029707","https://openalex.org/W2009543464","https://openalex.org/W2037124948","https://openalex.org/W2119871945","https://openalex.org/W2143244564","https://openalex.org/W2170655593","https://openalex.org/W2582743722","https://openalex.org/W4229772528","https://openalex.org/W4247714388","https://openalex.org/W4293857795","https://openalex.org/W4300870773"],"related_works":["https://openalex.org/W2252827360","https://openalex.org/W4323054491","https://openalex.org/W2547256600","https://openalex.org/W1486481742","https://openalex.org/W896362041","https://openalex.org/W1040283336","https://openalex.org/W3153868358","https://openalex.org/W3189065608","https://openalex.org/W2620426095","https://openalex.org/W2588656268"],"abstract_inverted_index":{"Static":[0,38],"analysis":[1,39,94],"and":[2,33,54],"penetration":[3,110,137],"testing":[4,17,138],"are":[5],"common":[6],"techniques":[7,40,65],"used":[8],"to":[9,80,124],"discover":[10],"security":[11,36,56,89,106],"bugs":[12],"in":[13,21,42,69,139],"implementation":[14],"code.":[15],"Penetration":[16],"is":[18,95,114],"often":[19],"performed":[20],"black-box":[22],"way":[23,45],"by":[24,46,87,104],"probing":[25],"the":[26,48,63,117,120,142],"attack":[27],"surface":[28],"of":[29,51,59,119,141],"a":[30,43,52,83,88,101,105,126],"running":[31],"system":[32,53],"discovering":[34],"its":[35],"holes.":[37],"operate":[41],"white-box":[44],"analyzing":[47],"source":[49],"code":[50],"identifying":[55],"weaknesses.":[57],"Because":[58],"their":[60,67],"different":[61,71],"nature,":[62],"two":[64,70,143],"report":[66,85,102],"findings":[68],"ways.":[72],"This":[73],"paper":[74],"presents":[75],"an":[76,133],"exploratory":[77],"study":[78],"meant":[79],"determine":[81],"whether":[82],"vulnerability":[84],"generated":[86,103],"tool":[90,107],"based":[91,108],"on":[92,109],"static":[93],"more":[96],"or":[97],"less":[98],"useful":[99],"than":[100],"testing.":[111],"The":[112,129],"usefulness":[113],"judged":[115],"from":[116],"perspective":[118],"developers":[121],"that":[122],"have":[123],"devise":[125],"vulnerability-fixing":[127],"patch.":[128],"initial":[130],"results":[131],"show":[132],"advantage":[134],"when":[135],"using":[136],"one":[140],"cases":[144],"we":[145],"investigated.":[146]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":1},{"year":2022,"cited_by_count":2},{"year":2021,"cited_by_count":1},{"year":2020,"cited_by_count":4},{"year":2019,"cited_by_count":1},{"year":2018,"cited_by_count":1},{"year":2017,"cited_by_count":3}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}