{"id":"https://openalex.org/W7117147824","doi":"https://doi.org/10.1145/3756681.3757083","title":"ThreMoLIA: Threat Modeling of Large Language Model-Integrated Applications","display_name":"ThreMoLIA: Threat Modeling of Large Language Model-Integrated Applications","publication_year":2025,"publication_date":"2025-06-17","ids":{"openalex":"https://openalex.org/W7117147824","doi":"https://doi.org/10.1145/3756681.3757083"},"language":"en","primary_location":{"id":"doi:10.1145/3756681.3757083","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3756681.3757083","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3756681.3757083?download=true","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 29th International Conference on Evaluation and Assessment in Software Engineering","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3756681.3757083?download=true","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5099088687","display_name":"Felix Viktor Jedrzejewski","orcid":"https://orcid.org/0000-0001-7090-2753"},"institutions":[{"id":"https://openalex.org/I52719799","display_name":"Blekinge Institute of Technology","ror":"https://ror.org/0093a8w51","country_code":"SE","type":"education","lineage":["https://openalex.org/I52719799"]}],"countries":["SE"],"is_corresponding":false,"raw_author_name":"Felix Viktor Jedrzejewski","raw_affiliation_strings":["Blekinge Institute of Technology, Karlskrona, Sweden"],"raw_orcid":"https://orcid.org/0000-0001-7090-2753","affiliations":[{"raw_affiliation_string":"Blekinge Institute of Technology, Karlskrona, Sweden","institution_ids":["https://openalex.org/I52719799"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5023279547","display_name":"Davide Fucci","orcid":"https://orcid.org/0000-0002-0679-4361"},"institutions":[{"id":"https://openalex.org/I52719799","display_name":"Blekinge Institute of Technology","ror":"https://ror.org/0093a8w51","country_code":"SE","type":"education","lineage":["https://openalex.org/I52719799"]}],"countries":["SE"],"is_corresponding":false,"raw_author_name":"Davide Fucci","raw_affiliation_strings":["Blekinge Institute of Technology, Karlskrona, Sweden"],"raw_orcid":"https://orcid.org/0000-0002-0679-4361","affiliations":[{"raw_affiliation_string":"Blekinge Institute of Technology, Karlskrona, Sweden","institution_ids":["https://openalex.org/I52719799"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5121146844","display_name":"Oleksandr Adamov","orcid":null},"institutions":[{"id":"https://openalex.org/I52719799","display_name":"Blekinge Institute of Technology","ror":"https://ror.org/0093a8w51","country_code":"SE","type":"education","lineage":["https://openalex.org/I52719799"]}],"countries":["SE"],"is_corresponding":false,"raw_author_name":"Oleksandr Adamov","raw_affiliation_strings":["Blekinge Institute of Technology, Karlskrona, Sweden"],"raw_orcid":"https://orcid.org/0000-0002-0120-5388","affiliations":[{"raw_affiliation_string":"Blekinge Institute of Technology, Karlskrona, Sweden","institution_ids":["https://openalex.org/I52719799"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I52719799"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":2,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"834","last_page":"839"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.24469999969005585,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.24469999969005585,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.10509999841451645,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.09269999712705612,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/threat-model","display_name":"Threat model","score":0.7408000230789185},{"id":"https://openalex.org/keywords/work","display_name":"Work (physics)","score":0.4348999857902527},{"id":"https://openalex.org/keywords/sociotechnical-system","display_name":"Sociotechnical system","score":0.3799999952316284},{"id":"https://openalex.org/keywords/modeling-language","display_name":"Modeling language","score":0.37369999289512634},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.3612000048160553},{"id":"https://openalex.org/keywords/attack-surface","display_name":"Attack surface","score":0.34549999237060547},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.3422999978065491}],"concepts":[{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.7408000230789185},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6553999781608582},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.555899977684021},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.4348999857902527},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.4154999852180481},{"id":"https://openalex.org/C127627568","wikidata":"https://www.wikidata.org/wiki/Q1639361","display_name":"Sociotechnical system","level":2,"score":0.3799999952316284},{"id":"https://openalex.org/C179603123","wikidata":"https://www.wikidata.org/wiki/Q1941921","display_name":"Modeling language","level":3,"score":0.37369999289512634},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.3612000048160553},{"id":"https://openalex.org/C2776576444","wikidata":"https://www.wikidata.org/wiki/Q303569","display_name":"Attack surface","level":2,"score":0.34549999237060547},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3422999978065491},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.3321000039577484},{"id":"https://openalex.org/C123657996","wikidata":"https://www.wikidata.org/wiki/Q12271","display_name":"Architecture","level":2,"score":0.32760000228881836},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.30230000615119934},{"id":"https://openalex.org/C2778868856","wikidata":"https://www.wikidata.org/wiki/Q18394273","display_name":"Threat assessment","level":2,"score":0.30219998955726624},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.3012000024318695},{"id":"https://openalex.org/C2780586882","wikidata":"https://www.wikidata.org/wiki/Q7520643","display_name":"Simple (philosophy)","level":2,"score":0.29440000653266907},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.2870999872684479},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.2676999866962433},{"id":"https://openalex.org/C195094911","wikidata":"https://www.wikidata.org/wiki/Q14167904","display_name":"Process management","level":1,"score":0.250900000333786}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3756681.3757083","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3756681.3757083","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3756681.3757083?download=true","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 29th International Conference on Evaluation and Assessment in Software Engineering","raw_type":"proceedings-article"},{"id":"pmh:oai:DiVA.org:bth-29120","is_oa":true,"landing_page_url":"http://urn.kb.se/resolve?urn=urn:nbn:se:bth-29120","pdf_url":null,"source":{"id":"https://openalex.org/S4306401559","display_name":"KTH Publication Database DiVA (KTH Royal Institute of Technology)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/conferenceObject"}],"best_oa_location":{"id":"doi:10.1145/3756681.3757083","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3756681.3757083","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3756681.3757083?download=true","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 29th International Conference on Evaluation and Assessment in Software Engineering","raw_type":"proceedings-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/9","display_name":"Industry, innovation and infrastructure","score":0.5746439099311829}],"awards":[],"funders":[{"id":"https://openalex.org/F4320323802","display_name":"Blekinge Tekniska H\u00f6gskola","ror":"https://ror.org/0093a8w51"}],"has_content":{"grobid_xml":false,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7117147824.pdf"},"referenced_works_count":14,"referenced_works":["https://openalex.org/W2758682319","https://openalex.org/W2921968294","https://openalex.org/W2951165326","https://openalex.org/W3100355250","https://openalex.org/W3213748123","https://openalex.org/W4206637810","https://openalex.org/W4220828776","https://openalex.org/W4295087958","https://openalex.org/W4321786597","https://openalex.org/W4388886073","https://openalex.org/W4392353733","https://openalex.org/W4399530931","https://openalex.org/W4400681147","https://openalex.org/W4401863498"],"related_works":[],"abstract_inverted_index":{"Large":[0],"Language":[1],"Models":[2],"(LLMs)":[3],"are":[4,65],"currently":[5],"being":[6],"integrated":[7],"into":[8],"industrial":[9],"software":[10],"applications":[11],"to":[12,42,66,156,165,195],"help":[13],"users":[14],"perform":[15],"more":[16],"complex":[17],"tasks":[18],"in":[19,78,104,175],"less":[20],"time.":[21],"However,":[22,49],"these":[23,44],"LLM-Integrated":[24],"Applications":[25],"(LIA)":[26],"expand":[27],"the":[28,57,100,128,167,176],"attack":[29],"surface":[30],"and":[31,46,92,126,139,144,152,159,189],"introduce":[32],"new":[33],"kinds":[34],"of":[35,59,113],"threats.":[36],"Threat":[37],"modeling":[38,74,85,116],"is":[39,51],"commonly":[40],"used":[41],"identify":[43],"threats":[45],"suggest":[47],"mitigations.":[48],"it":[50],"a":[52,60,69,83,186],"time-consuming":[53],"practice":[54],"that":[55,87,192],"requires":[56],"involvement":[58],"security":[61,123],"practitioner.":[62],"Our":[63,110,134],"goals":[64],"1)":[67],"provide":[68],"method":[70],"for":[71,75],"performing":[72,114],"threat":[73,84,90,96,115,150,161],"LIAs":[76],"early":[77,181],"their":[79],"lifecycle,":[80],"(2)":[81],"develop":[82],"tool":[86,136,168],"integrates":[88],"existing":[89,149],"models,":[91],"(3)":[93],"ensure":[94],"high-quality":[95],"modeling.":[97],"To":[98],"achieve":[99],"goals,":[101],"we":[102],"work":[103],"collaboration":[105],"with":[106,173,197],"our":[107,198],"industry":[108,119],"partner.":[109],"proposed":[111,135],"way":[112],"will":[117],"benefit":[118],"by":[120],"requiring":[121],"fewer":[122],"experts\u2019":[124],"participation":[125],"reducing":[127],"time":[129],"spent":[130],"on":[131,185],"this":[132],"activity.":[133],"combines":[137],"LLMs":[138],"Retrieval":[140],"Augmented":[141],"Generation":[142],"(RAG)":[143],"uses":[145],"sources":[146],"such":[147],"as":[148],"models":[151],"application":[153],"architecture":[154],"repositories":[155],"continuously":[157],"create":[158],"update":[160],"models.":[162],"We":[163,178],"propose":[164],"evaluate":[166],"offline\u2014i.e.,":[169],"using":[170,183],"benchmarking\u2014and":[171],"online":[172],"practitioners":[174],"field.":[177],"conducted":[179],"an":[180],"evaluation":[182],"ChatGPT":[184],"simple":[187],"LIA":[188],"obtained":[190],"results":[191],"encouraged":[193],"us":[194],"proceed":[196],"research":[199],"efforts.":[200]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":1}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-12-24T00:00:00"}