{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:06:39Z","timestamp":1779062799342,"version":"3.51.4"},"publisher-location":"Cham","reference-count":31,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783032200174","type":"print"},{"value":"9783032200181","type":"electronic"}],"license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026]]},"DOI":"10.1007\/978-3-032-20018-1_10","type":"book-chapter","created":{"date-parts":[[2026,5,17]],"date-time":"2026-05-17T23:35:08Z","timestamp":1779060908000},"page":"177-194","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Finding Software Supply Chain Attack Paths with\u00a0Logical Attack Graphs"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0009-0003-8609-1352","authenticated-orcid":false,"given":"Lu\u00eds","family":"Soeiro","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4423-5720","authenticated-orcid":false,"given":"Thomas","family":"Robert","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4576-136X","authenticated-orcid":false,"given":"Stefano","family":"Zacchiroli","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2026,5,1]]},"reference":[{"key":"10_CR1","unstructured":"Security Update Thursday 20 April 2023\u2013Initial Intrusion Vector Found. https:\/\/www.3cx.com\/blog\/news\/mandiant-security-update2\/. Accessed 26 Dec 2024"},{"key":"10_CR2","doi-asserted-by":"publisher","unstructured":"Calleja, A., Tapiador, J., Caballero, J.: A Look into 30 Years of Malware Development from a Software Metrics Perspective, pp. 325\u2013345. Springer International Publishing (2016). https:\/\/doi.org\/10.1007\/978-3-319-45719-2_15","DOI":"10.1007\/978-3-319-45719-2_15"},{"issue":"2","key":"10_CR3","doi-asserted-by":"publisher","first-page":"377","DOI":"10.1109\/tdsc.2017.2777991","volume":"17","author":"L Catuogno","year":"2020","unstructured":"Catuogno, L., Galdi, C., Persiano, G.: Secure dependency enforcement in package management systems. IEEE Trans. Dependable Secur. Comput. 17(2), 377\u2013390 (2020). https:\/\/doi.org\/10.1109\/tdsc.2017.2777991","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"10_CR4","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1109\/tim.2024.3400328","volume":"73","author":"O Duman","year":"2024","unstructured":"Duman, O., Tabiban, A., Wang, L., Debbabi, M.: Measuring and improving the security posture of IEC 61850 substations against supply chain attacks. IEEE Trans. Instrum. Meas. 73, 1\u201320 (2024). https:\/\/doi.org\/10.1109\/tim.2024.3400328","journal-title":"IEEE Trans. Instrum. Meas."},{"key":"10_CR5","doi-asserted-by":"publisher","unstructured":"Durumeric, Z., Li, F., Kasten, J., Amann, J., Beekman, J., Payer, M., Weaver, N., Adrian, D., Paxson, V., Bailey, M., Halderman, J.A.: The matter of heartbleed. In: Proceedings of the 2014 Conference on Internet Measurement Conference, pp. 475\u2013488. IMC \u201914, ACM (2014). https:\/\/doi.org\/10.1145\/2663716.2663755","DOI":"10.1145\/2663716.2663755"},{"key":"10_CR6","doi-asserted-by":"publisher","unstructured":"Everson, D., Cheng, L., Zhang, Z.: Log4shell: redefining the web attack surface. In: Proceedings 2022 Workshop on Measurements, Attacks, and Defenses for the Web. MADWeb 2022. Internet Society (2022). https:\/\/doi.org\/10.14722\/madweb.2022.23010","DOI":"10.14722\/madweb.2022.23010"},{"issue":"14s","key":"10_CR7","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3588999","volume":"55","author":"B Hammi","year":"2023","unstructured":"Hammi, B., Zeadally, S., Nebhen, J.: Security threats, countermeasures, and challenges of digital supply chains. ACM Comput. Surv. 55(14s), 1\u201340 (2023). https:\/\/doi.org\/10.1145\/3588999","journal-title":"ACM Comput. Surv."},{"issue":"24","key":"10_CR8","doi-asserted-by":"publisher","first-page":"40051","DOI":"10.1109\/jiot.2024.3450272","volume":"11","author":"T Ji","year":"2024","unstructured":"Ji, T., Fang, B., Cui, X., Wang, T., Zhang, Y., Gu, F., Zheng, C.: Scrutinizing code signing: a study of in-depth threat modeling and defense mechanism. IEEE Internet Things J. 11(24), 40051\u201340069 (2024). https:\/\/doi.org\/10.1109\/jiot.2024.3450272","journal-title":"IEEE Internet Things J."},{"key":"10_CR9","unstructured":"Kalu, K.G., Singla, T., Okafor, C., Torres-Arias, S., Davis, J.C.: An industry interview study of software signing for supply chain security (2024). arXiv:2406.08198"},{"key":"10_CR10","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103602","volume":"137","author":"AM Konsta","year":"2024","unstructured":"Konsta, A.M., Lluch Lafuente, A., Spiga, B., Dragoni, N.: Survey: automatic generation of attack trees and attack graphs. Comput. Secur. 137, 103602 (2024). https:\/\/doi.org\/10.1016\/j.cose.2023.103602","journal-title":"Comput. Secur."},{"key":"10_CR11","doi-asserted-by":"publisher","unstructured":"Ladisa, P., Plate, H., Martinez, M., Barais, O.: Sok: taxonomy of attacks on open-source software supply chains. In: 2023 2023 IEEE Symposium on Security and Privacy (SP), pp. 167\u2013184. IEEE Computer Society, Los Alamitos, CA, USA (2023). https:\/\/doi.org\/10.1109\/SP46215.2023.00010. https:\/\/doi.ieeecomputersociety.org\/10.1109\/SP46215.2023.00010","DOI":"10.1109\/SP46215.2023.00010"},{"issue":"6","key":"10_CR12","doi-asserted-by":"publisher","first-page":"34","DOI":"10.1109\/msec.2023.3302066","volume":"21","author":"P Ladisa","year":"2023","unstructured":"Ladisa, P., Ponta, S.E., Sabetta, A., Martinez, M., Barais, O.: Journey to the center of software supply chain attacks. IEEE Secur. Priv. 21(6), 34\u201349 (2023). https:\/\/doi.org\/10.1109\/msec.2023.3302066","journal-title":"IEEE Secur. Priv."},{"key":"10_CR13","doi-asserted-by":"publisher","DOI":"10.1016\/j.cosrev.2019.100219","volume":"35","author":"HS Lallie","year":"2020","unstructured":"Lallie, H.S., Debattista, K., Bal, J.: A review of attack graph and attack tree visual syntax in cyber security. Comput. Sci. Rev. 35, 100219 (2020). https:\/\/doi.org\/10.1016\/j.cosrev.2019.100219","journal-title":"Comput. Sci. Rev."},{"key":"10_CR14","doi-asserted-by":"publisher","unstructured":"Lin, X., Lei, L., Wang, Y., Jing, J., Sun, K., Zhou, Q.: A measurement study on linux container security: attacks and countermeasures. In: Proceedings of the 34th Annual Computer Security Applications Conference, pp. 418\u2013429. ACSAC \u201918, ACM (2018). https:\/\/doi.org\/10.1145\/3274694.3274720","DOI":"10.1145\/3274694.3274720"},{"key":"10_CR15","doi-asserted-by":"publisher","unstructured":"Lindorfer, M., Di Federico, A., Maggi, F., Comparetti, P.M., Zanero, S.: Lines of malicious code: insights into the malicious software industry. In: Proceedings of the 28th Annual Computer Security Applications Conference, pp. 349\u2013358. ACSAC \u201912, ACM (2012). https:\/\/doi.org\/10.1145\/2420950.2421001","DOI":"10.1145\/2420950.2421001"},{"key":"10_CR16","doi-asserted-by":"publisher","unstructured":"Mart\u00ednez, J., Dur\u00e1n, J.M.: Software supply chain attacks, a threat to global cybersecurity: solarWinds\u2019 case study. Int. J. Saf. Secur. Eng. 11(5), 537\u2013545 (2021). https:\/\/doi.org\/10.18280\/ijsse.110505","DOI":"10.18280\/ijsse.110505"},{"key":"10_CR17","doi-asserted-by":"publisher","unstructured":"Ohm, M., Plate, H., Sykosch, A., Meier, M.: Backstabber\u2019s knife collection: a review of open source software supply chain attacks. In: Detection of Intrusions and Malware, and Vulnerability Assessment, pp. 23\u201343. Springer International Publishing (2020). https:\/\/doi.org\/10.1007\/978-3-030-52683-2_2","DOI":"10.1007\/978-3-030-52683-2_2"},{"key":"10_CR18","unstructured":"Ou, X., Govindavajhala, S., Appel, A.W., et\u00a0al.: Mulval: a logic-based network security analyzer. In: USENIX Security Symposium, vol. 8, pp. 113\u2013128. Baltimore, MD (2005)"},{"key":"10_CR19","doi-asserted-by":"publisher","first-page":"211","DOI":"10.1016\/j.jss.2017.09.009","volume":"134","author":"ME Paschali","year":"2017","unstructured":"Paschali, M.E., Ampatzoglou, A., Bibi, S., Chatzigeorgiou, A., Stamelos, I.: Reusability of open source software across domains: a case study. J. Syst. Softw. 134, 211\u2013227 (2017). https:\/\/doi.org\/10.1016\/j.jss.2017.09.009","journal-title":"J. Syst. Softw."},{"issue":"2","key":"10_CR20","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/2431211.2431216","volume":"45","author":"M Pearce","year":"2013","unstructured":"Pearce, M., Zeadally, S., Hunt, R.: Virtualization: issues, security threats, and solutions. ACM Comput. Surv. 45(2), 1\u201339 (2013). https:\/\/doi.org\/10.1145\/2431211.2431216","journal-title":"ACM Comput. Surv."},{"key":"10_CR21","doi-asserted-by":"publisher","unstructured":"Polamarasetti, A.: Research developments, trends and challenges on the rise of machine learning for detection and classification of malware. In: 2024 International Conference on Intelligent Computing and Emerging Communication Technologies (ICEC), pp.\u00a01\u20135. IEEE (2024). https:\/\/doi.org\/10.1109\/icec59683.2024.10837413","DOI":"10.1109\/icec59683.2024.10837413"},{"key":"10_CR22","doi-asserted-by":"publisher","unstructured":"Rostami\u00a0Mazrae, P., Mens, T., Golzadeh, M., Decan, A.: On the usage, co-usage and migration of ci\/cd tools: a qualitative analysis. Empir. Softw. Eng. 28(2), (2023). https:\/\/doi.org\/10.1007\/s10664-022-10285-5","DOI":"10.1007\/s10664-022-10285-5"},{"key":"10_CR23","doi-asserted-by":"publisher","unstructured":"Ruohonen, J., Saddiqa, M.: A time series analysis of malware uploads to programming language ecosystems (2025). https:\/\/doi.org\/10.48550\/ARXIV.2504.15695","DOI":"10.48550\/ARXIV.2504.15695"},{"key":"10_CR24","doi-asserted-by":"publisher","unstructured":"Saint-Hilaire, K.A., Neal, C., Cuppens, F., Boulahia-Cuppens, N., Bassi, F.: Attack-defense graph generation: instantiating incident response actions on attack graphs. In: 2024 IEEE 23rd International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), pp. 295\u2013305. IEEE (2024). https:\/\/doi.org\/10.1109\/trustcom63139.2024.00063","DOI":"10.1109\/trustcom63139.2024.00063"},{"key":"10_CR25","doi-asserted-by":"publisher","unstructured":"Schorlemmer, T.R., Kalu, K.G., Chigges, L., Ko, K.M., Ishgair, E.A., Bagchi, S., Torres-Arias, S., Davis, J.C.: Signing in four public software package registries: quantity, quality, and influencing factors. In: 2024 IEEE Symposium on Security and Privacy (SP), pp. 1160\u20131178. IEEE (2024). https:\/\/doi.org\/10.1109\/sp54263.2024.00215","DOI":"10.1109\/sp54263.2024.00215"},{"issue":"3","key":"10_CR26","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/2988545","volume":"49","author":"R Shu","year":"2016","unstructured":"Shu, R., Wang, P., Gorski, S.A., III., Andow, B., Nadkarni, A., Deshotels, L., Gionta, J., Enck, W., Gu, X.: A study of security isolation techniques. ACM Comput. Surv. 49(3), 1\u201337 (2016). https:\/\/doi.org\/10.1145\/2988545","journal-title":"ACM Comput. Surv."},{"key":"10_CR27","doi-asserted-by":"publisher","unstructured":"Soeiro, L., Robert, T., Zacchiroli, S.: Replication package for: finding software supply chain attack paths with logical attack graphs (2025). https:\/\/doi.org\/10.5281\/zenodo.15924456","DOI":"10.5281\/zenodo.15924456"},{"key":"10_CR28","doi-asserted-by":"publisher","unstructured":"Soeiro, L., Robert, T., Zacchiroli, S.: Assessing the threat level of software supply chains with the log model. In: 2023 IEEE International Conference on Big Data (BigData). IEEE (2023). https:\/\/doi.org\/10.1109\/bigdata59044.2023.10386091","DOI":"10.1109\/bigdata59044.2023.10386091"},{"key":"10_CR29","doi-asserted-by":"publisher","first-page":"27974","DOI":"10.1109\/access.2023.3257721","volume":"11","author":"D Tayouri","year":"2023","unstructured":"Tayouri, D., Baum, N., Shabtai, A., Puzis, R.: A survey of mulval extensions and their attack scenarios coverage. IEEE Access 11, 27974\u201327991 (2023). https:\/\/doi.org\/10.1109\/access.2023.3257721","journal-title":"IEEE Access"},{"key":"10_CR30","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.104296","volume":"150","author":"D Tayouri","year":"2025","unstructured":"Tayouri, D., Sgan Cohen, O., Maimon, I., Mimran, D., Elovici, Y., Shabtai, A.: Coral: container online risk assessment with logical attack graphs. Comput. Secur. 150, 104296 (2025). https:\/\/doi.org\/10.1016\/j.cose.2024.104296","journal-title":"Comput. Secur."},{"issue":"5","key":"10_CR31","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3714464","volume":"34","author":"L Williams","year":"2025","unstructured":"Williams, L., Benedetti, G., Hamer, S., Paramitha, R., Rahman, I., Tamanna, M., Tystahl, G., Zahan, N., Morrison, P., Acar, Y., Cukier, M., K\u00e4stner, C., Kapravelos, A., Wermke, D., Enck, W.: Research directions in software supply chain security. ACM Trans. Softw. Eng. Methodol. 34(5), 1\u201338 (2025). https:\/\/doi.org\/10.1145\/3714464","journal-title":"ACM Trans. Softw. Eng. Methodol."}],"container-title":["Lecture Notes in Computer Science","Foundations and Practice of Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-032-20018-1_10","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,17]],"date-time":"2026-05-17T23:35:09Z","timestamp":1779060909000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-032-20018-1_10"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"ISBN":["9783032200174","9783032200181"],"references-count":31,"URL":"https:\/\/doi.org\/10.1007\/978-3-032-20018-1_10","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]},"assertion":[{"value":"1 May 2026","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"FPS","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Symposium on Foundations and Practice of Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Brest","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"France","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2025","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"25 November 2025","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"27 November 2025","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"18","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"fps2025","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/hub.imt-atlantique.fr\/fps2025\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}