{"id":"https://openalex.org/W4297631420","doi":"https://doi.org/10.1145/3551349.3556969","title":"An Empirical Study of Automation in Software Security Patch Management","display_name":"An Empirical Study of Automation in Software Security Patch Management","publication_year":2022,"publication_date":"2022-10-10","ids":{"openalex":"https://openalex.org/W4297631420","doi":"https://doi.org/10.1145/3551349.3556969"},"language":"en","primary_location":{"id":"doi:10.1145/3551349.3556969","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3551349.3556969","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3551349.3556969","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["arxiv","crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3551349.3556969","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5041959990","display_name":"Nesara Dissanayake","orcid":"https://orcid.org/0000-0002-2873-137X"},"institutions":[{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Nesara Dissanayake","raw_affiliation_strings":["CREST \u2013 Centre for Research on Engineering Software Technologies, The University of Adelaide, Australia"],"raw_orcid":"https://orcid.org/0000-0002-2873-137X","affiliations":[{"raw_affiliation_string":"CREST \u2013 Centre for Research on Engineering Software Technologies, The University of Adelaide, Australia","institution_ids":["https://openalex.org/I5681781"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5032038453","display_name":"Asangi Jayatilaka","orcid":"https://orcid.org/0000-0003-2051-030X"},"institutions":[{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Asangi Jayatilaka","raw_affiliation_strings":["CREST \u2013 Centre for Research on Engineering Software Technologies, The University of Adelaide, Australia"],"raw_orcid":"https://orcid.org/0000-0003-2051-030X","affiliations":[{"raw_affiliation_string":"CREST \u2013 Centre for Research on Engineering Software Technologies, The University of Adelaide, Australia","institution_ids":["https://openalex.org/I5681781"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5049386320","display_name":"Mansooreh Zahedi","orcid":"https://orcid.org/0000-0001-6276-9956"},"institutions":[{"id":"https://openalex.org/I165779595","display_name":"The University of Melbourne","ror":"https://ror.org/01ej9dk98","country_code":"AU","type":"education","lineage":["https://openalex.org/I165779595"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Mansooreh Zahedi","raw_affiliation_strings":["The University of Melbourne, Australia"],"raw_orcid":"https://orcid.org/0000-0001-6276-9956","affiliations":[{"raw_affiliation_string":"The University of Melbourne, Australia","institution_ids":["https://openalex.org/I165779595"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5103075476","display_name":"Muhammad Ali Babar","orcid":"https://orcid.org/0000-0001-9696-3626"},"institutions":[{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Muhammad Ali Babar","raw_affiliation_strings":["CREST \u2013 Centre for Research on Engineering Software Technologies, The University of Adelaide, Australia"],"raw_orcid":"https://orcid.org/0000-0001-9696-3626","affiliations":[{"raw_affiliation_string":"CREST \u2013 Centre for Research on Engineering Software Technologies, The University of Adelaide, Australia","institution_ids":["https://openalex.org/I5681781"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.5071,"has_fulltext":true,"cited_by_count":7,"citation_normalized_percentile":{"value":0.84654772,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"13"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10430","display_name":"Software Engineering Techniques and Practices","score":0.9987000226974487,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10430","display_name":"Software Engineering Techniques and Practices","score":0.9987000226974487,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9979000091552734,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9959999918937683,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/automation","display_name":"Automation","score":0.7531311511993408},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.5705932974815369},{"id":"https://openalex.org/keywords/engineering-management","display_name":"Engineering management","score":0.4315626621246338},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.43072110414505005},{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.4184824526309967},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.41535454988479614},{"id":"https://openalex.org/keywords/process-management","display_name":"Process management","score":0.4082956612110138},{"id":"https://openalex.org/keywords/knowledge-management","display_name":"Knowledge management","score":0.4050154685974121},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.36540359258651733},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.36424142122268677},{"id":"https://openalex.org/keywords/risk-analysis","display_name":"Risk analysis (engineering)","score":0.32843834161758423},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.2804683744907379},{"id":"https://openalex.org/keywords/information-security","display_name":"Information security","score":0.24672561883926392},{"id":"https://openalex.org/keywords/business","display_name":"Business","score":0.22932681441307068},{"id":"https://openalex.org/keywords/security-service","display_name":"Security service","score":0.13415786623954773}],"concepts":[{"id":"https://openalex.org/C115901376","wikidata":"https://www.wikidata.org/wiki/Q184199","display_name":"Automation","level":2,"score":0.7531311511993408},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5705932974815369},{"id":"https://openalex.org/C110354214","wikidata":"https://www.wikidata.org/wiki/Q6314146","display_name":"Engineering management","level":1,"score":0.4315626621246338},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.43072110414505005},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.4184824526309967},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.41535454988479614},{"id":"https://openalex.org/C195094911","wikidata":"https://www.wikidata.org/wiki/Q14167904","display_name":"Process management","level":1,"score":0.4082956612110138},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.4050154685974121},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.36540359258651733},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.36424142122268677},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.32843834161758423},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.2804683744907379},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.24672561883926392},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.22932681441307068},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.13415786623954773},{"id":"https://openalex.org/C78519656","wikidata":"https://www.wikidata.org/wiki/Q101333","display_name":"Mechanical engineering","level":1,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3551349.3556969","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3551349.3556969","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3551349.3556969","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2209.01518","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2209.01518","pdf_url":"https://arxiv.org/pdf/2209.01518","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"}],"best_oa_location":{"id":"doi:10.1145/3551349.3556969","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3551349.3556969","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3551349.3556969","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering","raw_type":"proceedings-article"},"sustainable_development_goals":[{"display_name":"Partnerships for the goals","id":"https://metadata.un.org/sdg/17","score":0.4699999988079071}],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4297631420.pdf","grobid_xml":"https://content.openalex.org/works/W4297631420.grobid-xml"},"referenced_works_count":51,"referenced_works":["https://openalex.org/W216996474","https://openalex.org/W335448268","https://openalex.org/W1490011260","https://openalex.org/W1615506555","https://openalex.org/W1646679479","https://openalex.org/W1655081782","https://openalex.org/W1658908529","https://openalex.org/W1919636199","https://openalex.org/W1969618572","https://openalex.org/W1971733255","https://openalex.org/W2000754262","https://openalex.org/W2062536061","https://openalex.org/W2111256197","https://openalex.org/W2114887958","https://openalex.org/W2124939873","https://openalex.org/W2146691185","https://openalex.org/W2155617465","https://openalex.org/W2162739315","https://openalex.org/W2165611922","https://openalex.org/W2263820513","https://openalex.org/W2279491836","https://openalex.org/W2353739181","https://openalex.org/W2367220237","https://openalex.org/W2545997438","https://openalex.org/W2561664829","https://openalex.org/W2617798520","https://openalex.org/W2734941459","https://openalex.org/W2888387191","https://openalex.org/W2889665541","https://openalex.org/W2901418095","https://openalex.org/W2916904544","https://openalex.org/W2938555005","https://openalex.org/W2945760770","https://openalex.org/W2954803031","https://openalex.org/W2957298757","https://openalex.org/W3003663372","https://openalex.org/W3011658999","https://openalex.org/W3022452870","https://openalex.org/W3049077356","https://openalex.org/W3090212251","https://openalex.org/W3107416433","https://openalex.org/W3121734253","https://openalex.org/W3173382863","https://openalex.org/W3214913126","https://openalex.org/W4206624744","https://openalex.org/W4220933101","https://openalex.org/W4229669668","https://openalex.org/W4250201092","https://openalex.org/W4294978736","https://openalex.org/W4321792664","https://openalex.org/W4377081964"],"related_works":["https://openalex.org/W2748952813","https://openalex.org/W2519676117","https://openalex.org/W2218202131","https://openalex.org/W84108837","https://openalex.org/W2155740880","https://openalex.org/W4253249845","https://openalex.org/W2125452230","https://openalex.org/W2148444631","https://openalex.org/W1988425686","https://openalex.org/W971421295"],"abstract_inverted_index":{"Several":[0],"studies":[1],"have":[2,150],"shown":[3],"that":[4,52],"automated":[5,143,163],"support":[6,126,164],"for":[7,19,77,108,156,165],"different":[8,73,89],"activities":[9],"of":[10,75,102,115,121,138,154],"the":[11,59,92,100,112,119,136,139,147],"security":[12,24,78,105,166],"patch":[13,79,106,167],"management":[14,80,107],"process":[15],"has":[16,53],"great":[17],"potential":[18],"reducing":[20],"delays":[21],"in":[22,37,41,58,91,104,117,141],"installing":[23],"patches.":[25],"However,":[26],"it":[27],"is":[28,35],"also":[29],"important":[30],"to":[31,130],"understand":[32],"how":[33,124],"automation":[34,76,103,116,125],"used":[36],"practice,":[38,118],"its":[39],"limitations":[40,120],"meeting":[42],"real-world":[43],"needs":[44],"and":[45,135],"what":[46],"practitioners":[47,86],"really":[48],"need,":[49],"an":[50,67,142],"area":[51],"not":[54],"been":[55],"empirically":[56],"investigated":[57],"existing":[60],"software":[61],"engineering":[62],"literature.":[63],"This":[64],"paper":[65],"reports":[66],"empirical":[68],"study":[69],"aimed":[70,160],"at":[71,161],"investigating":[72],"aspects":[74],"using":[81],"semi-structured":[82],"interviews":[83],"with":[84],"17":[85],"from":[87],"three":[88],"organisations":[90],"healthcare":[93],"domain.":[94],"The":[95],"findings":[96],"are":[97],"focused":[98],"on":[99,146],"role":[101,137],"providing":[109],"insights":[110],"into":[111],"as-is":[113],"state":[114],"current":[122],"automation,":[123],"can":[127],"be":[128],"enhanced":[129],"effectively":[131],"meet":[132],"practitioners\u2019":[133],"needs,":[134],"human":[140],"process.":[144],"Based":[145],"findings,":[148],"we":[149],"derived":[151],"a":[152],"set":[153],"recommendations":[155],"directing":[157],"future":[158],"efforts":[159],"developing":[162],"management.":[168]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":3}],"updated_date":"2026-08-05T07:39:15.569665","created_date":"2025-10-10T00:00:00"}