{"id":"https://openalex.org/W3094480867","doi":"https://doi.org/10.1145/3419394.3423664","title":"Analyzing Third Party Service Dependencies in Modern Web Services","display_name":"Analyzing Third Party Service Dependencies in Modern Web Services","publication_year":2020,"publication_date":"2020-10-22","ids":{"openalex":"https://openalex.org/W3094480867","doi":"https://doi.org/10.1145/3419394.3423664","mag":"3094480867"},"language":"en","primary_location":{"id":"doi:10.1145/3419394.3423664","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3419394.3423664","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3419394.3423664","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Internet Measurement Conference","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3419394.3423664","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5075478885","display_name":"Aqsa Kashaf","orcid":"https://orcid.org/0000-0002-8244-825X"},"institutions":[{"id":"https://openalex.org/I74973139","display_name":"Carnegie Mellon University","ror":"https://ror.org/05x2bcf33","country_code":"US","type":"education","lineage":["https://openalex.org/I74973139"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Aqsa Kashaf","raw_affiliation_strings":["Carnegie Mellon University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Carnegie Mellon University","institution_ids":["https://openalex.org/I74973139"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5079175103","display_name":"Vyas Sekar","orcid":"https://orcid.org/0000-0001-5452-8976"},"institutions":[{"id":"https://openalex.org/I74973139","display_name":"Carnegie Mellon University","ror":"https://ror.org/05x2bcf33","country_code":"US","type":"education","lineage":["https://openalex.org/I74973139"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Vyas Sekar","raw_affiliation_strings":["Carnegie Mellon University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Carnegie Mellon University","institution_ids":["https://openalex.org/I74973139"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5071257070","display_name":"Yuvraj Agarwal","orcid":"https://orcid.org/0000-0001-9304-6080"},"institutions":[{"id":"https://openalex.org/I74973139","display_name":"Carnegie Mellon University","ror":"https://ror.org/05x2bcf33","country_code":"US","type":"education","lineage":["https://openalex.org/I74973139"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yuvraj Agarwal","raw_affiliation_strings":["Carnegie Mellon University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Carnegie Mellon University","institution_ids":["https://openalex.org/I74973139"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I74973139"],"apc_list":null,"apc_paid":null,"fwci":6.089,"has_fulltext":true,"cited_by_count":45,"citation_normalized_percentile":{"value":0.97747138,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":97,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"634","last_page":"647"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9988999962806702,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/revocation","display_name":"Revocation","score":0.8524185419082642},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7171026468276978},{"id":"https://openalex.org/keywords/revocation-list","display_name":"Revocation list","score":0.646656334400177},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.633344292640686},{"id":"https://openalex.org/keywords/service-provider","display_name":"Service provider","score":0.6007751822471619},{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.573431134223938},{"id":"https://openalex.org/keywords/third-party","display_name":"Third party","score":0.49974632263183594},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.48423099517822266},{"id":"https://openalex.org/keywords/web-service","display_name":"Web service","score":0.4396425783634186},{"id":"https://openalex.org/keywords/certificate","display_name":"Certificate","score":0.4132542312145233},{"id":"https://openalex.org/keywords/internet-privacy","display_name":"Internet privacy","score":0.40486404299736023},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.3881130814552307},{"id":"https://openalex.org/keywords/service","display_name":"Service (business)","score":0.3778719902038574},{"id":"https://openalex.org/keywords/certificate-authority","display_name":"Certificate authority","score":0.3543499708175659},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.34419113397598267},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.28233450651168823},{"id":"https://openalex.org/keywords/public-key-cryptography","display_name":"Public-key cryptography","score":0.26826414465904236},{"id":"https://openalex.org/keywords/business","display_name":"Business","score":0.21286076307296753},{"id":"https://openalex.org/keywords/algorithm","display_name":"Algorithm","score":0.07881739735603333},{"id":"https://openalex.org/keywords/encryption","display_name":"Encryption","score":0.07839709520339966}],"concepts":[{"id":"https://openalex.org/C2775892892","wikidata":"https://www.wikidata.org/wiki/Q6509517","display_name":"Revocation","level":3,"score":0.8524185419082642},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7171026468276978},{"id":"https://openalex.org/C147296133","wikidata":"https://www.wikidata.org/wiki/Q196765","display_name":"Revocation list","level":5,"score":0.646656334400177},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.633344292640686},{"id":"https://openalex.org/C116537","wikidata":"https://www.wikidata.org/wiki/Q2169973","display_name":"Service provider","level":3,"score":0.6007751822471619},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.573431134223938},{"id":"https://openalex.org/C2983583741","wikidata":"https://www.wikidata.org/wiki/Q16785388","display_name":"Third party","level":2,"score":0.49974632263183594},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.48423099517822266},{"id":"https://openalex.org/C35578498","wikidata":"https://www.wikidata.org/wiki/Q193424","display_name":"Web service","level":2,"score":0.4396425783634186},{"id":"https://openalex.org/C96865113","wikidata":"https://www.wikidata.org/wiki/Q2946816","display_name":"Certificate","level":2,"score":0.4132542312145233},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.40486404299736023},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.3881130814552307},{"id":"https://openalex.org/C2780378061","wikidata":"https://www.wikidata.org/wiki/Q25351891","display_name":"Service (business)","level":2,"score":0.3778719902038574},{"id":"https://openalex.org/C93636275","wikidata":"https://www.wikidata.org/wiki/Q196776","display_name":"Certificate authority","level":4,"score":0.3543499708175659},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.34419113397598267},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.28233450651168823},{"id":"https://openalex.org/C203062551","wikidata":"https://www.wikidata.org/wiki/Q201339","display_name":"Public-key cryptography","level":3,"score":0.26826414465904236},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.21286076307296753},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.07881739735603333},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.07839709520339966},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C162853370","wikidata":"https://www.wikidata.org/wiki/Q39809","display_name":"Marketing","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3419394.3423664","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3419394.3423664","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3419394.3423664","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Internet Measurement Conference","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3419394.3423664","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3419394.3423664","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3419394.3423664","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Internet Measurement Conference","raw_type":"proceedings-article"},"sustainable_development_goals":[{"display_name":"Industry, innovation and infrastructure","score":0.6499999761581421,"id":"https://metadata.un.org/sdg/9"}],"awards":[{"id":"https://openalex.org/G3308443168","display_name":"SaTC: CORE: Medium: End-to-End Support for Privacy in the Internet -of-things","funder_award_id":"1801472","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G8300720798","display_name":"SDI-CSCS: EP3: A Clean-Slate Software-Defined Approach for Enabling Elastic Security","funder_award_id":"1700521","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G8471042189","display_name":"TWC: Medium: Handling a Trillion Unfixable Flaws on Billions of Internet-of-Things","funder_award_id":"1564009","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W3094480867.pdf","grobid_xml":"https://content.openalex.org/works/W3094480867.grobid-xml"},"referenced_works_count":42,"referenced_works":["https://openalex.org/W1541722909","https://openalex.org/W2001637908","https://openalex.org/W2019016802","https://openalex.org/W2031489231","https://openalex.org/W2054479920","https://openalex.org/W2090106845","https://openalex.org/W2095968786","https://openalex.org/W2101678831","https://openalex.org/W2114398364","https://openalex.org/W2123539383","https://openalex.org/W2133468529","https://openalex.org/W2154601295","https://openalex.org/W2416597969","https://openalex.org/W2464966933","https://openalex.org/W2489352404","https://openalex.org/W2538863639","https://openalex.org/W2549994809","https://openalex.org/W2550748725","https://openalex.org/W2552360454","https://openalex.org/W2552873532","https://openalex.org/W2602142008","https://openalex.org/W2604258491","https://openalex.org/W2604746202","https://openalex.org/W2605157885","https://openalex.org/W2773056559","https://openalex.org/W2806944993","https://openalex.org/W2887184754","https://openalex.org/W2895807258","https://openalex.org/W2898785760","https://openalex.org/W2902352019","https://openalex.org/W2902383438","https://openalex.org/W2912826586","https://openalex.org/W2913821655","https://openalex.org/W2917878349","https://openalex.org/W2963779160","https://openalex.org/W2981223859","https://openalex.org/W2990002081","https://openalex.org/W3002314550","https://openalex.org/W3003683799","https://openalex.org/W3032408677","https://openalex.org/W3100328669","https://openalex.org/W3177347810"],"related_works":["https://openalex.org/W2152646546","https://openalex.org/W2892927944","https://openalex.org/W4389077034","https://openalex.org/W2389225248","https://openalex.org/W2168592352","https://openalex.org/W4283656462","https://openalex.org/W1517811384","https://openalex.org/W1738323469","https://openalex.org/W791333163","https://openalex.org/W2511525271"],"abstract_inverted_index":{"Many":[0],"websites":[1,109,126],"rely":[2],"on":[3,49,112,186],"third":[4],"parties":[5],"for":[6,81,193],"services":[7,136,148],"(e.g.,":[8,22,30,66,72],"DNS,":[9,54,114,145],"CDN,":[10,55,115,144],"etc.).":[11],"However,":[12],"it":[13],"also":[14,85],"exposes":[15],"them":[16],"to":[17,93,170,183],"shared":[18],"risks":[19],"from":[20],"attacks":[21],"Mirai":[23],"DDoS":[24],"attack":[25],"[24])":[26],"or":[27,116,146],"cascading":[28],"failures":[29],"GlobalSign":[31],"revocation":[32,58],"error":[33],"[21]).":[34],"Motivated":[35],"by":[36,60,168],"such":[37],"incidents,":[38],"we":[39,189],"analyze":[40,63],"the":[41,96,106,132,140,153,160,197],"prevalence":[42],"and":[43,56,70,91,139,165,172,177],"impact":[44,161],"of":[45,105,134,143,152,162],"third-party":[46,113,135,175],"dependencies,":[47],"focusing":[48],"three":[50],"critical":[51],"infrastructure":[52],"services:":[53],"certificate":[57],"checking":[59],"CA.":[61],"We":[62,84],"both":[64],"direct":[65],"Twitter":[67],"uses":[68,74,79],"Dyn)":[69],"indirect":[71,157],"Netflix":[73],"Symantec":[75],"as":[76],"CA":[77,117,147],"which":[78],"Verisign":[80],"DNS)":[82],"dependencies.":[83],"take":[86],"two":[87],"snapshots":[88],"in":[89,196],"2016":[90,182],"2020":[92],"understand":[94],"how":[95],"dependencies":[97,158,176],"evolved.":[98],"Our":[99],"key":[100,191],"findings":[101],"are:":[102],"(1)":[103],"89%":[104],"Alexa":[107],"top-100K":[108,154],"critically":[110],"depend":[111],"providers":[118,122,142,167],"i.e.,":[119],"if":[120],"these":[121,125],"go":[123],"down,":[124],"could":[127],"suffer":[128],"service":[129],"disruption;":[130],"(2)":[131],"use":[133],"is":[137],"concentrated,":[138],"top-3":[141],"can":[149],"affect":[150],"50%-70%":[151],"websites;":[155],"(3)":[156],"amplify":[159],"popular":[163],"CDN":[164],"DNS":[166],"up":[169],"25X;":[171],"(4)":[173],"some":[174],"concentration":[178],"increased":[179],"marginally":[180],"between":[181],"2020.":[184],"Based":[185],"our":[187],"findings,":[188],"derive":[190],"implications":[192],"different":[194],"stakeholders":[195],"web":[198],"ecosystem.":[199]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":6},{"year":2024,"cited_by_count":11},{"year":2023,"cited_by_count":13},{"year":2022,"cited_by_count":8},{"year":2021,"cited_by_count":5}],"updated_date":"2026-08-06T08:24:18.245995","created_date":"2025-10-10T00:00:00"}