{"id":"https://openalex.org/W4405569873","doi":"https://doi.org/10.1145/3708533","title":"Software Security Analysis in 2030 and Beyond: A Research Roadmap","display_name":"Software Security Analysis in 2030 and Beyond: A Research Roadmap","publication_year":2024,"publication_date":"2024-12-19","ids":{"openalex":"https://openalex.org/W4405569873","doi":"https://doi.org/10.1145/3708533"},"language":"en","primary_location":{"id":"doi:10.1145/3708533","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3708533","pdf_url":null,"source":{"id":"https://openalex.org/S142627899","display_name":"ACM Transactions on Software Engineering and Methodology","issn_l":"1049-331X","issn":["1049-331X","1557-7392"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Software Engineering and Methodology","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1145/3708533","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5005260100","display_name":"Marcel B\u00f6hme","orcid":"https://orcid.org/0000-0002-4470-1824"},"institutions":[{"id":"https://openalex.org/I4210096592","display_name":"Max Planck Institute for Security and Privacy","ror":"https://ror.org/00bj0r217","country_code":"DE","type":"facility","lineage":["https://openalex.org/I149899117","https://openalex.org/I4210096592"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Marcel B\u00f6hme","raw_affiliation_strings":["Max Planck Institute for Security and Privacy, Bochum, Germany","Max Planck Institute for Security and Privacy, Germany"],"raw_orcid":"https://orcid.org/0000-0002-4470-1824","affiliations":[{"raw_affiliation_string":"Max Planck Institute for Security and Privacy, Bochum, Germany","institution_ids":["https://openalex.org/I4210096592"]},{"raw_affiliation_string":"Max Planck Institute for Security and Privacy, Germany","institution_ids":["https://openalex.org/I4210096592"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5076678278","display_name":"Eric Bodden","orcid":"https://orcid.org/0000-0003-3470-3647"},"institutions":[{"id":"https://openalex.org/I206945453","display_name":"Paderborn University","ror":"https://ror.org/058kzsd48","country_code":"DE","type":"education","lineage":["https://openalex.org/I206945453"]},{"id":"https://openalex.org/I4210093498","display_name":"Fraunhofer Institute for Mechatronic Systems Design","ror":"https://ror.org/004nttc42","country_code":"DE","type":"facility","lineage":["https://openalex.org/I4210093498","https://openalex.org/I4923324"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Eric Bodden","raw_affiliation_strings":["Faculty of Electrical Engineering Computer Science and Mathematics, Department of Computer Science, Software Engineering Group, Paderborn University, Paderborn, Germany","Paderborn University and Fraunhofer IEM, Germany"],"raw_orcid":"https://orcid.org/0000-0003-3470-3647","affiliations":[{"raw_affiliation_string":"Faculty of Electrical Engineering Computer Science and Mathematics, Department of Computer Science, Software Engineering Group, Paderborn University, Paderborn, Germany","institution_ids":["https://openalex.org/I206945453"]},{"raw_affiliation_string":"Paderborn University and Fraunhofer IEM, Germany","institution_ids":["https://openalex.org/I206945453","https://openalex.org/I4210093498"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5039991493","display_name":"Tevfik Bultan","orcid":"https://orcid.org/0000-0003-2993-1215"},"institutions":[{"id":"https://openalex.org/I154570441","display_name":"University of California, Santa Barbara","ror":"https://ror.org/02t274463","country_code":"US","type":"education","lineage":["https://openalex.org/I154570441"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Tevfik Bultan","raw_affiliation_strings":["University of California at Santa Barbara, Santa Barbara, California, United States","University of California, Santa Barbara, USA"],"raw_orcid":"https://orcid.org/0000-0003-2993-1215","affiliations":[{"raw_affiliation_string":"University of California at Santa Barbara, Santa Barbara, California, United States","institution_ids":["https://openalex.org/I154570441"]},{"raw_affiliation_string":"University of California, Santa Barbara, USA","institution_ids":["https://openalex.org/I154570441"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5053355200","display_name":"Cristian Cadar","orcid":"https://orcid.org/0000-0002-3599-7264"},"institutions":[{"id":"https://openalex.org/I47508984","display_name":"Imperial College London","ror":"https://ror.org/041kmwe10","country_code":"GB","type":"education","lineage":["https://openalex.org/I47508984"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Cristian Cadar","raw_affiliation_strings":["Department of Computing, Imperial College London, United Kingdom of Great Britain and Northern Ireland","Imperial College London, UK"],"raw_orcid":"https://orcid.org/0000-0002-3599-7264","affiliations":[{"raw_affiliation_string":"Department of Computing, Imperial College London, United Kingdom of Great Britain and Northern Ireland","institution_ids":["https://openalex.org/I47508984"]},{"raw_affiliation_string":"Imperial College London, UK","institution_ids":["https://openalex.org/I47508984"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100355692","display_name":"Yang Liu","orcid":"https://orcid.org/0000-0001-7300-9215"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Yang Liu","raw_affiliation_strings":["Nanyang Technological University, Singapore, Singapore","Nanyang Technological University, Singapore"],"raw_orcid":"https://orcid.org/0000-0001-7300-9215","affiliations":[{"raw_affiliation_string":"Nanyang Technological University, Singapore, Singapore","institution_ids":["https://openalex.org/I172675005"]},{"raw_affiliation_string":"Nanyang Technological University, Singapore","institution_ids":["https://openalex.org/I172675005"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5082957347","display_name":"Giuseppe Scanniello","orcid":"https://orcid.org/0000-0003-0024-7508"},"institutions":[{"id":"https://openalex.org/I131729948","display_name":"University of Salerno","ror":"https://ror.org/0192m2k53","country_code":"IT","type":"education","lineage":["https://openalex.org/I131729948"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Giuseppe Scanniello","raw_affiliation_strings":["Department of Informatics, University of Salerno, Fisciano, Italy","University of Salerno, Italy"],"raw_orcid":"https://orcid.org/0000-0003-0024-7508","affiliations":[{"raw_affiliation_string":"Department of Informatics, University of Salerno, Fisciano, Italy","institution_ids":["https://openalex.org/I131729948"]},{"raw_affiliation_string":"University of Salerno, Italy","institution_ids":["https://openalex.org/I131729948"]}]}],"institutions":[],"countries_distinct_count":5,"institutions_distinct_count":7,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.697,"has_fulltext":false,"cited_by_count":8,"citation_normalized_percentile":{"value":0.85376586,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":97,"max":99},"biblio":{"volume":"34","issue":"5","first_page":"1","last_page":"26"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9988999962806702,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9977999925613403,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7576987743377686},{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.551068902015686},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.45762357115745544},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.44484949111938477},{"id":"https://openalex.org/keywords/systems-engineering","display_name":"Systems engineering","score":0.3596806228160858},{"id":"https://openalex.org/keywords/engineering-management","display_name":"Engineering management","score":0.32343584299087524},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.16600486636161804},{"id":"https://openalex.org/keywords/information-security","display_name":"Information security","score":0.1614016592502594},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.10187441110610962},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.07531747221946716}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7576987743377686},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.551068902015686},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.45762357115745544},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.44484949111938477},{"id":"https://openalex.org/C201995342","wikidata":"https://www.wikidata.org/wiki/Q682496","display_name":"Systems engineering","level":1,"score":0.3596806228160858},{"id":"https://openalex.org/C110354214","wikidata":"https://www.wikidata.org/wiki/Q6314146","display_name":"Engineering management","level":1,"score":0.32343584299087524},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.16600486636161804},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.1614016592502594},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.10187441110610962},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.07531747221946716},{"id":"https://openalex.org/C29983905","wikidata":"https://www.wikidata.org/wiki/Q7445066","display_name":"Security service","level":3,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3708533","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3708533","pdf_url":null,"source":{"id":"https://openalex.org/S142627899","display_name":"ACM Transactions on Software Engineering and Methodology","issn_l":"1049-331X","issn":["1049-331X","1557-7392"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Software Engineering and Methodology","raw_type":"journal-article"},{"id":"pmh:oai:dr.ntu.edu.sg:10356/206863","is_oa":false,"landing_page_url":"https://hdl.handle.net/10356/206863","pdf_url":null,"source":{"id":"https://openalex.org/S4306402609","display_name":"DR-NTU (Nanyang Technological University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I172675005","host_organization_name":"Nanyang Technological University","host_organization_lineage":["https://openalex.org/I172675005"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Journal Article"}],"best_oa_location":{"id":"doi:10.1145/3708533","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3708533","pdf_url":null,"source":{"id":"https://openalex.org/S142627899","display_name":"ACM Transactions on Software Engineering and Methodology","issn_l":"1049-331X","issn":["1049-331X","1557-7392"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Software Engineering and Methodology","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G434337789","display_name":null,"funder_award_id":"Horizon2020","funder_id":"https://openalex.org/F4320320300","funder_display_name":"European Commission"},{"id":"https://openalex.org/G6176027099","display_name":"Program Analysis for Safe and Secure Software Evolution","funder_award_id":"819141","funder_id":"https://openalex.org/F4320338335","funder_display_name":"H2020 European Research Council"},{"id":"https://openalex.org/G947817967","display_name":null,"funder_award_id":"819141","funder_id":"https://openalex.org/F4320320300","funder_display_name":"European Commission"}],"funders":[{"id":"https://openalex.org/F4320320300","display_name":"European Commission","ror":"https://ror.org/00k4n6c32"},{"id":"https://openalex.org/F4320338335","display_name":"H2020 European Research Council","ror":"https://ror.org/0472cxd90"},{"id":"https://openalex.org/F7311471023","display_name":"NextGenerationEU","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":145,"referenced_works":["https://openalex.org/W89527454","https://openalex.org/W100961009","https://openalex.org/W777621473","https://openalex.org/W1602136775","https://openalex.org/W2026794345","https://openalex.org/W2042033151","https://openalex.org/W2047694629","https://openalex.org/W2052363833","https://openalex.org/W2064070192","https://openalex.org/W2066353350","https://openalex.org/W2089745089","https://openalex.org/W2097444001","https://openalex.org/W2101512909","https://openalex.org/W2107147876","https://openalex.org/W2108104925","https://openalex.org/W2109276114","https://openalex.org/W2111487235","https://openalex.org/W2117798902","https://openalex.org/W2121579803","https://openalex.org/W2136310957","https://openalex.org/W2137351629","https://openalex.org/W2147050153","https://openalex.org/W2150847526","https://openalex.org/W2151497944","https://openalex.org/W2159059513","https://openalex.org/W2170267084","https://openalex.org/W2170737051","https://openalex.org/W2171482413","https://openalex.org/W2216498498","https://openalex.org/W2295244175","https://openalex.org/W2343325785","https://openalex.org/W2350778671","https://openalex.org/W2365883577","https://openalex.org/W2758227629","https://openalex.org/W2769593477","https://openalex.org/W2772336084","https://openalex.org/W2796301966","https://openalex.org/W2804093830","https://openalex.org/W2804700615","https://openalex.org/W2885305518","https://openalex.org/W2900633536","https://openalex.org/W2900990205","https://openalex.org/W2902381500","https://openalex.org/W2911282308","https://openalex.org/W2912203066","https://openalex.org/W2913273467","https://openalex.org/W2943810095","https://openalex.org/W2961642335","https://openalex.org/W2962200727","https://openalex.org/W2963723316","https://openalex.org/W2970862273","https://openalex.org/W2974819274","https://openalex.org/W2978193706","https://openalex.org/W2987246247","https://openalex.org/W3003663372","https://openalex.org/W3004437357","https://openalex.org/W3015912954","https://openalex.org/W3033734688","https://openalex.org/W3033870338","https://openalex.org/W3042714377","https://openalex.org/W3047224978","https://openalex.org/W3049735680","https://openalex.org/W3086100325","https://openalex.org/W3088716235","https://openalex.org/W3088832243","https://openalex.org/W3090843874","https://openalex.org/W3091843707","https://openalex.org/W3095397441","https://openalex.org/W3101228802","https://openalex.org/W3103342397","https://openalex.org/W3106855263","https://openalex.org/W3110647387","https://openalex.org/W3122363971","https://openalex.org/W3133764566","https://openalex.org/W3135317066","https://openalex.org/W3138733102","https://openalex.org/W3162344723","https://openalex.org/W3166095789","https://openalex.org/W3173543662","https://openalex.org/W3174750614","https://openalex.org/W3192198953","https://openalex.org/W3198845576","https://openalex.org/W3201454943","https://openalex.org/W3211084315","https://openalex.org/W3214251355","https://openalex.org/W3216519235","https://openalex.org/W4200058614","https://openalex.org/W4206817183","https://openalex.org/W4221145571","https://openalex.org/W4223574077","https://openalex.org/W4223937600","https://openalex.org/W4224307896","https://openalex.org/W4226410005","https://openalex.org/W4229530253","https://openalex.org/W4231862715","https://openalex.org/W4233869839","https://openalex.org/W4234542549","https://openalex.org/W4236990373","https://openalex.org/W4238083723","https://openalex.org/W4239249613","https://openalex.org/W4240951837","https://openalex.org/W4244221193","https://openalex.org/W4247245376","https://openalex.org/W4250728693","https://openalex.org/W4250967164","https://openalex.org/W4253752119","https://openalex.org/W4285827657","https://openalex.org/W4287022754","https://openalex.org/W4287673430","https://openalex.org/W4288057765","https://openalex.org/W4293309189","https://openalex.org/W4308562533","https://openalex.org/W4309469221","https://openalex.org/W4312436517","https://openalex.org/W4312467995","https://openalex.org/W4312697115","https://openalex.org/W4313563521","https://openalex.org/W4313563589","https://openalex.org/W4315746341","https://openalex.org/W4321785158","https://openalex.org/W4322760473","https://openalex.org/W4366777370","https://openalex.org/W4382655637","https://openalex.org/W4383749485","https://openalex.org/W4384154537","https://openalex.org/W4385301282","https://openalex.org/W4386027284","https://openalex.org/W4386470654","https://openalex.org/W4386527943","https://openalex.org/W4386982649","https://openalex.org/W4387609318","https://openalex.org/W4388858772","https://openalex.org/W4389158950","https://openalex.org/W4389159643","https://openalex.org/W4389165105","https://openalex.org/W4389364428","https://openalex.org/W4389544232","https://openalex.org/W4397036302","https://openalex.org/W4398775968","https://openalex.org/W4398785926","https://openalex.org/W4399631463","https://openalex.org/W4399632113","https://openalex.org/W4402442868","https://openalex.org/W4403520284","https://openalex.org/W4405183504"],"related_works":["https://openalex.org/W2748952813","https://openalex.org/W2562550268","https://openalex.org/W1589188624","https://openalex.org/W2299966422","https://openalex.org/W2050231625","https://openalex.org/W2504378244","https://openalex.org/W2121513851","https://openalex.org/W2903766092","https://openalex.org/W2126513753","https://openalex.org/W2545999784"],"abstract_inverted_index":{"As":[0,79,103],"our":[1,3,7,45,80,165,173],"lives,":[2],"businesses,":[4],"and":[5,70,130,188,190],"indeed":[6],"world":[8],"economy":[9],"become":[10,82],"increasingly":[11,83],"reliant":[12],"on":[13,108],"the":[14,22,52,55,58,72,109,138,151,197],"secure":[15],"operation":[16],"of":[17,47,54,74,124,178],"many":[18],"interconnected":[19],"software":[20,23,48,104,110,182],"systems,":[21],"engineering":[24],"research":[25,31],"community":[26],"is":[27],"faced":[28],"with":[29,35,175,192],"unprecedented":[30],"challenges,":[32],"but":[33],"also":[34],"exciting":[36],"new":[37,66],"opportunities.":[38],"In":[39],"this":[40],"roadmap":[41,174],"article,":[42],"we":[43,64,85,113,133,145,154,162,171],"outline":[44],"vision":[46],"security":[49,73,158],"analysis":[50],"for":[51,196],"systems":[53,81,105,129],"future.":[56],"Given":[57],"recent":[59,179],"advances":[60,180],"in":[61,127,150,181],"generative":[62],"AI,":[63],"need":[65,86,114],"methods":[67],"to":[68,118],"assess":[69],"maximize":[71],"code":[75],"co-written":[76],"by":[77,99],"machines.":[78],"heterogeneous,":[84],"practical":[87],"approaches":[88],"that":[89,116],"work":[90],"even":[91],"if":[92],"some":[93],"functions":[94],"are":[95,141],"automatically":[96],"generated,":[97],"e.g.,":[98],"deep":[100],"neural":[101],"networks.":[102],"depend":[106],"evermore":[107],"supply":[111],"chain,":[112],"tools":[115],"scale":[117],"an":[119],"entire":[120],"ecosystem.":[121],"What":[122],"kind":[123],"vulnerabilities":[125,147],"exist":[126],"future":[128],"how":[131,143,160],"do":[132,144],"detect":[134],"them?":[135],"When":[136],"all":[137,157],"shallow":[139],"bugs":[140],"found,":[142],"discover":[146],"hidden":[148],"deeply":[149],"system?":[152,166],"Assuming":[153],"cannot":[155],"find":[156],"flaws,":[159],"can":[161],"nevertheless":[163],"protect":[164],"To":[167],"answer":[168],"these":[169],"questions,":[170],"start":[172],"a":[176,193],"survey":[177],"security,":[183],"then":[184],"discuss":[185],"open":[186],"challenges":[187],"opportunities,":[189],"conclude":[191],"long-term":[194],"perspective":[195],"field.":[198]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":6}],"updated_date":"2026-08-03T07:22:36.454288","created_date":"2025-10-10T00:00:00"}