{"id":"https://openalex.org/W7171647953","doi":"https://doi.org/10.1145/3733827.3765528","title":"Aggregating Security Measures from the Dependency Tree","display_name":"Aggregating Security Measures from the Dependency Tree","publication_year":2025,"publication_date":"2025-10-13","ids":{"openalex":"https://openalex.org/W7171647953","doi":"https://doi.org/10.1145/3733827.3765528"},"language":null,"primary_location":{"id":"doi:10.1145/3733827.3765528","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3733827.3765528","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5082701913","display_name":"Sarah Elder","orcid":"https://orcid.org/0000-0002-5881-4619"},"institutions":[{"id":"https://openalex.org/I137902535","display_name":"North Carolina State University","ror":"https://ror.org/04tj63d06","country_code":"US","type":"education","lineage":["https://openalex.org/I137902535"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Sarah Elder","raw_affiliation_strings":["North Carolina State University, Raleigh, USA"],"raw_orcid":"https://orcid.org/0000-0002-5881-4619","affiliations":[{"raw_affiliation_string":"North Carolina State University, Raleigh, USA","institution_ids":["https://openalex.org/I137902535"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5143976423","display_name":"Alexander Klevans","orcid":"https://orcid.org/0009-0001-5392-2573"},"institutions":[{"id":"https://openalex.org/I137902535","display_name":"North Carolina State University","ror":"https://ror.org/04tj63d06","country_code":"US","type":"education","lineage":["https://openalex.org/I137902535"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Alexander Klevans","raw_affiliation_strings":["North Carolina State University, Raleigh, NC, USA"],"raw_orcid":"https://orcid.org/0009-0001-5392-2573","affiliations":[{"raw_affiliation_string":"North Carolina State University, Raleigh, NC, USA","institution_ids":["https://openalex.org/I137902535"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5057850580","display_name":"Ranindya Paramitha","orcid":"https://orcid.org/0000-0002-6682-4243"},"institutions":[{"id":"https://openalex.org/I137902535","display_name":"North Carolina State University","ror":"https://ror.org/04tj63d06","country_code":"US","type":"education","lineage":["https://openalex.org/I137902535"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ranindya Paramitha","raw_affiliation_strings":["North Carolina State University, Raleigh, NC, USA"],"raw_orcid":"https://orcid.org/0000-0002-6682-4243","affiliations":[{"raw_affiliation_string":"North Carolina State University, Raleigh, NC, USA","institution_ids":["https://openalex.org/I137902535"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5020353093","display_name":"Marcelo d\u2019Amorim","orcid":"https://orcid.org/0000-0002-1323-8769"},"institutions":[{"id":"https://openalex.org/I137902535","display_name":"North Carolina State University","ror":"https://ror.org/04tj63d06","country_code":"US","type":"education","lineage":["https://openalex.org/I137902535"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Marcelo d'Amorim","raw_affiliation_strings":["North Carolina State University, Raleigh, NC, USA"],"raw_orcid":"https://orcid.org/0000-0002-1323-8769","affiliations":[{"raw_affiliation_string":"North Carolina State University, Raleigh, NC, USA","institution_ids":["https://openalex.org/I137902535"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5028171895","display_name":"Laurie Williams","orcid":"https://orcid.org/0000-0003-3300-6540"},"institutions":[{"id":"https://openalex.org/I137902535","display_name":"North Carolina State University","ror":"https://ror.org/04tj63d06","country_code":"US","type":"education","lineage":["https://openalex.org/I137902535"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Laurie Williams","raw_affiliation_strings":["North Carolina State University, Raleigh, NC, USA"],"raw_orcid":"https://orcid.org/0000-0003-3300-6540","affiliations":[{"raw_affiliation_string":"North Carolina State University, Raleigh, NC, USA","institution_ids":["https://openalex.org/I137902535"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I137902535"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"46","last_page":"56"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":null,"topics":[],"keywords":[{"id":"https://openalex.org/keywords/dependency","display_name":"Dependency (UML)","score":0.5572999715805054},{"id":"https://openalex.org/keywords/aggregate","display_name":"Aggregate (composite)","score":0.5083000063896179},{"id":"https://openalex.org/keywords/construct","display_name":"Construct (python library)","score":0.5023999810218811},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.4796999990940094},{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.46639999747276306},{"id":"https://openalex.org/keywords/tree","display_name":"Tree (set theory)","score":0.4648999869823456},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.4593000113964081},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.43140000104904175},{"id":"https://openalex.org/keywords/component","display_name":"Component (thermodynamics)","score":0.4311000108718872},{"id":"https://openalex.org/keywords/relevance","display_name":"Relevance (law)","score":0.4226999878883362}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6949999928474426},{"id":"https://openalex.org/C19768560","wikidata":"https://www.wikidata.org/wiki/Q320727","display_name":"Dependency (UML)","level":2,"score":0.5572999715805054},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5562000274658203},{"id":"https://openalex.org/C4679612","wikidata":"https://www.wikidata.org/wiki/Q866298","display_name":"Aggregate (composite)","level":2,"score":0.5083000063896179},{"id":"https://openalex.org/C2780801425","wikidata":"https://www.wikidata.org/wiki/Q5164392","display_name":"Construct (python library)","level":2,"score":0.5023999810218811},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.4796999990940094},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.46639999747276306},{"id":"https://openalex.org/C113174947","wikidata":"https://www.wikidata.org/wiki/Q2859736","display_name":"Tree (set theory)","level":2,"score":0.4648999869823456},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.4593000113964081},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.43140000104904175},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.4311000108718872},{"id":"https://openalex.org/C158154518","wikidata":"https://www.wikidata.org/wiki/Q7310970","display_name":"Relevance (law)","level":2,"score":0.4226999878883362},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.40700000524520874},{"id":"https://openalex.org/C199004533","wikidata":"https://www.wikidata.org/wiki/Q210127","display_name":"Balanced scorecard","level":2,"score":0.39980000257492065},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.3725000023841858},{"id":"https://openalex.org/C82578977","wikidata":"https://www.wikidata.org/wiki/Q16773055","display_name":"Data aggregator","level":3,"score":0.34779998660087585},{"id":"https://openalex.org/C171078966","wikidata":"https://www.wikidata.org/wiki/Q111029","display_name":"Root (linguistics)","level":2,"score":0.3391999900341034},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.3280999958515167},{"id":"https://openalex.org/C77109596","wikidata":"https://www.wikidata.org/wiki/Q4781497","display_name":"Application security","level":5,"score":0.31139999628067017},{"id":"https://openalex.org/C121822524","wikidata":"https://www.wikidata.org/wiki/Q5157582","display_name":"Computer security model","level":2,"score":0.3093000054359436},{"id":"https://openalex.org/C12174686","wikidata":"https://www.wikidata.org/wiki/Q1058438","display_name":"Risk assessment","level":2,"score":0.3041999936103821},{"id":"https://openalex.org/C84945661","wikidata":"https://www.wikidata.org/wiki/Q7366567","display_name":"Root cause","level":2,"score":0.2935999929904938},{"id":"https://openalex.org/C195518309","wikidata":"https://www.wikidata.org/wiki/Q13424265","display_name":"Security testing","level":5,"score":0.2912999987602234},{"id":"https://openalex.org/C82214349","wikidata":"https://www.wikidata.org/wiki/Q657339","display_name":"Software metric","level":5,"score":0.29019999504089355},{"id":"https://openalex.org/C163797641","wikidata":"https://www.wikidata.org/wiki/Q2067937","display_name":"Tree structure","level":3,"score":0.2896000146865845},{"id":"https://openalex.org/C48372109","wikidata":"https://www.wikidata.org/wiki/Q3913","display_name":"Binary number","level":2,"score":0.28209999203681946},{"id":"https://openalex.org/C2780264999","wikidata":"https://www.wikidata.org/wiki/Q7445032","display_name":"Security domain","level":2,"score":0.28189998865127563},{"id":"https://openalex.org/C2780009758","wikidata":"https://www.wikidata.org/wiki/Q6804172","display_name":"Measure (data warehouse)","level":2,"score":0.28029999136924744},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.2741999924182892},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.2732999920845032},{"id":"https://openalex.org/C114289077","wikidata":"https://www.wikidata.org/wiki/Q3284399","display_name":"Statistical model","level":2,"score":0.2694999873638153},{"id":"https://openalex.org/C2778334786","wikidata":"https://www.wikidata.org/wiki/Q1586270","display_name":"Variation (astronomy)","level":2,"score":0.25870001316070557},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.257999986410141},{"id":"https://openalex.org/C58489278","wikidata":"https://www.wikidata.org/wiki/Q1172284","display_name":"Data set","level":2,"score":0.2565000057220459}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3733827.3765528","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3733827.3765528","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G5914965034","display_name":"Collaborative Proposal: SaTC: Frontiers: Enabling a Secure and Trustworthy Software Supply Chain","funder_award_id":"2207008","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":23,"referenced_works":["https://openalex.org/W1972978214","https://openalex.org/W2061554433","https://openalex.org/W2099657218","https://openalex.org/W2600390930","https://openalex.org/W2740279154","https://openalex.org/W2889097348","https://openalex.org/W2896375752","https://openalex.org/W2971660263","https://openalex.org/W3000045849","https://openalex.org/W3006571605","https://openalex.org/W3031471692","https://openalex.org/W3106855263","https://openalex.org/W3172189288","https://openalex.org/W4210958308","https://openalex.org/W4224750722","https://openalex.org/W4311714649","https://openalex.org/W4313419628","https://openalex.org/W4313563522","https://openalex.org/W4380982237","https://openalex.org/W4383898619","https://openalex.org/W4392996195","https://openalex.org/W4394769265","https://openalex.org/W4400499041"],"related_works":[],"abstract_inverted_index":{"Metrics":[0],"available":[1],"to":[2,42,52,155,166,211],"practitioners":[3,158],"for":[4,87,179,201],"determining":[5],"the":[6,25,32,40,43,65,73,98,108,123,128,138,172,186,202,226,240],"security":[7,15,29,70,89,146,181],"of":[8,34,48,69,72,85,101,131,188,225],"open-source":[9],"software":[10,56],"packages":[11,121],"often":[12],"overlook":[13],"potential":[14],"issues,":[16],"such":[17,184],"as":[18,185,232,234],"latent":[19],"vulnerabilities,":[20],"that":[21,94,162,168,178],"may":[22],"arise":[23],"in":[24,31,58,111,122,191],"package\u2019s":[26,227],"dependencies.":[27],"However,":[28,200],"risks":[30],"dependencies":[33,228],"a":[35,79,83,102,144,153,192,196],"package":[36,44,103],"can":[37],"still":[38],"increase":[39],"risk":[41,147,182],"itself.":[45],"The":[46,149],"goal":[47],"this":[49],"work":[50],"is":[51],"aid":[53],"developers":[54],"and":[55,67,133],"architects":[57],"making":[59],"good":[60],"component":[61],"choices":[62],"by":[63],"analyzing":[64],"relevance":[66],"utility":[68],"measures":[71,90],"entire":[74],"dependency":[75,99],"tree":[76,100],"associated":[77],"with":[78,141],"package.":[80,174,242],"We":[81,106,126],"propose":[82],"set":[84],"approaches":[86],"aggregating":[88],"from":[91,97],"OpenSSF":[92],"Scorecard":[93],"include":[95],"information":[96],"(aggregate":[104],"scores).":[105],"evaluated":[107],"aggregate":[109,213],"scores":[110],"two":[112],"ways.":[113],"For":[114],"one,":[115],"we":[116],"performed":[117,229,236],"statistical":[118,198],"analysis":[119],"on":[120,171,239],"Go":[124],"ecosystem.":[125],"determined":[127],"effect":[129],"size":[130],"aggregation":[132,136,194],"assessed":[134],"whether":[135,223],"influences":[137],"measure\u2019s":[139],"relationship":[140],"vulnerability":[142],"count,":[143],"common":[145],"measure.":[148],"other":[150],"evaluation":[151],"was":[152],"survey":[154,208],"see":[156],"if":[157],"would":[159],"prefer":[160],"metrics":[161,167],"are":[163],"aggregated":[164],"compared":[165],"focus":[169],"only":[170],"root":[173,241],"Our":[175],"results":[176],"indicate":[177],"some":[180],"measures,":[183],"number":[187],"Binary":[189,204],"Artifacts":[190,205],"package,":[193],"has":[195],"negligible":[197],"effect.":[199],"same":[203],"measure,":[206],"most":[207,217],"participants":[209],"preferred":[210],"have":[212],"scores.":[214],"In":[215],"contrast,":[216],"respondents":[218],"were":[219],"less":[220],"concerned":[221],"about":[222],"maintainers":[224,235],"Code":[230,237],"Review,":[231],"long":[233],"Review":[238]},"counts_by_year":[],"updated_date":"2026-07-31T08:31:51.225901","created_date":"2026-07-30T00:00:00"}