{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,18]],"date-time":"2025-11-18T12:18:57Z","timestamp":1763468337827,"version":"3.40.3"},"publisher-location":"Cham","reference-count":35,"publisher":"Springer International Publishing","isbn-type":[{"type":"print","value":"9783319336299"},{"type":"electronic","value":"9783319336305"}],"license":[{"start":{"date-parts":[[2016,1,1]],"date-time":"2016-01-01T00:00:00Z","timestamp":1451606400000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2016,1,1]],"date-time":"2016-01-01T00:00:00Z","timestamp":1451606400000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2016]]},"DOI":"10.1007\/978-3-319-33630-5_16","type":"book-chapter","created":{"date-parts":[[2016,5,10]],"date-time":"2016-05-10T08:10:12Z","timestamp":1462867812000},"page":"227-242","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["An Information Flow-Based Taxonomy to Understand the Nature of Software Vulnerabilities"],"prefix":"10.1007","author":[{"given":"Daniela","family":"Oliveira","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jedidiah","family":"Crandall","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Harry","family":"Kalodner","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Nicole","family":"Morin","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Megan","family":"Maher","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jesus","family":"Navarro","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Felix","family":"Emiliano","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2016,5,11]]},"reference":[{"unstructured":"National Vulnerability Database. \n                    http:\/\/nvd.nist.gov\/home.cfm","key":"16_CR1"},{"unstructured":"Open Source Vulnerability Database. \n                    http:\/\/www.osvdb.org\/","key":"16_CR2"},{"unstructured":"Security Focus Vulnerability Notes, bugtraq id 66483. \n                    http:\/\/www.securityfocus.com\/bid\/66483","key":"16_CR3"},{"unstructured":"SecurityFocus. \n                    http:\/\/www.securityfocus.com\/","key":"16_CR4"},{"unstructured":"Symantec - Internet Security Threat Report. \n                    http:\/\/www.symantec.com\/content\/en\/us\/enterprise\/other_resources\/b-istr_main_report_v19_21291018.en-us.pdf","key":"16_CR5"},{"unstructured":"The Common Weakness Enumeration (CWE). \n                    http:\/\/nvd.nist.gov\/cwe.cfm","key":"16_CR6"},{"doi-asserted-by":"crossref","unstructured":"Abbot, R.P., Chin, J.S., Donnelley, J.E., Konigsford, W.L., Webb, D.A.: Security Analysis and Enhancements of Computer Operating Systems. NBSIR 76\u20131041, Institute for Computer Sciences and Technology, National Bureau of Standards (1976)","key":"16_CR7","DOI":"10.6028\/NBS.IR.76-1041"},{"unstructured":"Aslam, T.: A Taxonomy of Security Faults in the UNIX Operating System (1995)","key":"16_CR8"},{"doi-asserted-by":"crossref","unstructured":"Bishop, M., Bailey, D.: A Critical Analysis of Vulnerability Taxonomies. Technical Report CSE-96-11, University of California at Davis (1996)","key":"16_CR9","DOI":"10.21236\/ADA453251"},{"unstructured":"Borisov, N., Johnson, R., Sastry, N., Wagner, D.: Fixing races for fun and profit: how to abuse atime. In Proceedings of the 14th conference on USENIX Security Symposium, SSYM 2005, vol. 14, Berkeley, CA, USA. USENIX Association, p. 20 (2005)","key":"16_CR10"},{"unstructured":"Bratus, S., Locasto, M.E., Patterson, M.L., Sassaman, L., Shubina, A.: Exploit programming.: From buffer overflows to \u201cWeird Machines\u201d and theory of computation. USENIX: login, December 2011","key":"16_CR11"},{"unstructured":"Brumley, D., Boneh, D.: Remote timing attacks are practical. USENIX Security (2003)","key":"16_CR12"},{"doi-asserted-by":"crossref","unstructured":"Chen, S., Wang, R., Wang, X., Zhang, K.: Side-channel leaks in web applications: A reality today, a challenge tomorrow. In: IEEE Symposium on Security and Privacy (2010)","key":"16_CR13","DOI":"10.1109\/SP.2010.20"},{"unstructured":"Chen, S., Xu, J., Sezer, E.: Non-control-hijacking attacks are realistic threats. In: USENIX Security (2005)","key":"16_CR14"},{"unstructured":"Cohen, F.: Computer viruses: Theory and experiments. In: 7th DoD\/NBS Computer Security Conference Proceedings, pp. 240\u2013263, September 1984","key":"16_CR15"},{"doi-asserted-by":"crossref","unstructured":"Crandall, J., Oliveira, D.: Holographic vulnerability studies: Vulnerabilities as fractures in terpretation as information flows across abstraction boundaries. In: New Security Paradigms Workshop (NSPW) (2012)","key":"16_CR16","DOI":"10.1145\/2413296.2413309"},{"unstructured":"Dean, D., Hu, A.J.: Fixing races for fun, profit: How to use access(2). In: Proceedings of the 13th Conference on USENIX Security Symposium, Berkeley, CA, USA, vol. 13, p. 14. USENIX Association (2004)","key":"16_CR17"},{"unstructured":"Bisbey II, R., Hollingsworth, D.: Protection Analysis Project Final Report. ISI\/RR-78-13, DTIC AD A056816, USC\/Information Sciences Institute (1978)","key":"16_CR18"},{"doi-asserted-by":"crossref","unstructured":"Jana, S., Shmatikov, V.: Memento: Learning secrets from process footprints. In: IEEE Symposium on Security and Privacy (2012)","key":"16_CR19","DOI":"10.1109\/SP.2012.19"},{"issue":"5","key":"16_CR20","first-page":"423","volume":"33","author":"L Kyung-Suk","year":"2002","unstructured":"Kyung-Suk, L., Chapin, S.J.: Buffer overflow, format string overflow vulnerabilities. Softw. Pract. Experience 33(5), 423\u2013460 (2002)","journal-title":"Softw. Pract. Experience"},{"issue":"3","key":"16_CR21","doi-asserted-by":"publisher","first-page":"211","DOI":"10.1145\/185403.185412","volume":"26","author":"CE Landwehr","year":"1994","unstructured":"Landwehr, C.E., Bull, A.R., McDermott, J.P., Choi, W.S.: A taxonomy of computer program security flaws. ACM Comput. Surv. 26(3), 211\u2013254 (1994)","journal-title":"ACM Comput. Surv."},{"unstructured":"Lindqvist, U., Jonsson, E.: How to systematically classify computer security intrusions. In: IEEE Symposium on Security and Privacy (1997)","key":"16_CR22"},{"issue":"3","key":"16_CR23","doi-asserted-by":"publisher","first-page":"230","DOI":"10.1147\/sj.133.0230","volume":"13","author":"WS McPhee","year":"1974","unstructured":"McPhee, W.S.: Operating system integrity in OS\/VS2. IBM Syst. J. 13(3), 230\u2013252 (1974)","journal-title":"IBM Syst. J."},{"issue":"4","key":"16_CR24","doi-asserted-by":"publisher","first-page":"243","DOI":"10.1108\/14779960911004499","volume":"7","author":"W Pieters","year":"2009","unstructured":"Pieters, W., Consoli, L.: Vulnerabilities and responsibilities: dealing with monsters in computer security. J. Inf. Commun. Ethics Soc. 7(4), 243\u2013257 (2009)","journal-title":"J. Inf. Commun. Ethics Soc."},{"unstructured":"Samuel, M., Erlingsson, U.: Let\u2019s parse to prevent pwnage (invited position paper). In: Proceedings of the 5th USENIX Conference on Large-Scale Exploits and Emergent Threats, LEET 2012, Berkeley, CA, USA, p. 3. USENIX Association (2012)","key":"16_CR25"},{"doi-asserted-by":"crossref","unstructured":"Shacham, H.: The geometry of innocent flesh on the bone: return-into-libc without function calls (on the x86). In: ACM CCS, pp. 552\u2013561 (2007)","key":"16_CR26","DOI":"10.1145\/1315245.1315313"},{"unstructured":"Spadavecchia, L.: A network-based asynchronous architecture for cryptographic devices. Edinburgh Research Archive (2005)","key":"16_CR27"},{"doi-asserted-by":"crossref","unstructured":"Su, Z., Wassermann, G.: The essence of command injection attacks in web applications. In: Conference Record of the 33rd ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL 2006, pp. 372\u2013382. ACM, New York (2006)","key":"16_CR28","DOI":"10.1145\/1111320.1111070"},{"doi-asserted-by":"crossref","unstructured":"Wang, R., Chen, S., Wang, X., Qadeer, S.: How to shop for free online - security analysis of cashier-as-a-service based web stores. In: Proceedings of the 2011 IEEE Symposium on Security and Privacy, SP 2011, pp. 465\u2013480. IEEE Computer Society (2011)","key":"16_CR29","DOI":"10.1109\/SP.2011.26"},{"doi-asserted-by":"crossref","unstructured":"Wassermann, G., Su, Z.: Static detection of cross-site scripting vulnerabilities. In: 30th International Conference on Software Engineering, ICSE 2008. ACM, New York (2008)","key":"16_CR30","DOI":"10.1145\/1368088.1368112"},{"doi-asserted-by":"crossref","unstructured":"Weber, S., Karger, P.A., Paradkar, A.: A software flaw taxonomy: aiming tools at security. In: Software Engineering for Secure Systems (SESS) (2005)","key":"16_CR31","DOI":"10.1145\/1083200.1083209"},{"key":"16_CR32","volume-title":"Data Mining: Practical Machine Learning Tools and Techniques","author":"IW Witten","year":"2005","unstructured":"Witten, I.W., Frank, E.: Data Mining: Practical Machine Learning Tools and Techniques, 2nd edn. Morgan Kaufmann, San Francisco (2005)","edition":"2"},{"unstructured":"Zhang, K., Wang, X.: Peeping tom in the neighborhood: keystroke eavesdropping on multi-user systems. USENIX Security (2009)","key":"16_CR33"},{"doi-asserted-by":"crossref","unstructured":"Zhuang, L., Zhou, F., Tygar, J.D.: Keyboard acoustic emanations revisited. In: ACM Conference on Computer and Communications Security (CCS) (2005)","key":"16_CR34","DOI":"10.1145\/1102120.1102169"},{"unstructured":"Security Focus Vulnerability Notes. bid == Bugtraq ID. \n                    http:\/\/www.securityfocus.com","key":"16_CR35"}],"container-title":["IFIP Advances in Information and Communication Technology","ICT Systems Security and Privacy Protection"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-319-33630-5_16","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2020,5,13]],"date-time":"2020-05-13T00:04:23Z","timestamp":1589328263000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-319-33630-5_16"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2016]]},"ISBN":["9783319336299","9783319336305"],"references-count":35,"URL":"https:\/\/doi.org\/10.1007\/978-3-319-33630-5_16","relation":{},"ISSN":["1868-4238","1868-422X"],"issn-type":[{"type":"print","value":"1868-4238"},{"type":"electronic","value":"1868-422X"}],"subject":[],"published":{"date-parts":[[2016]]},"assertion":[{"value":"11 May 2016","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"This content has been made available to all.","name":"free","label":"Free to read"}]}}