{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T05:01:27Z","timestamp":1785474087707,"version":"3.56.0"},"reference-count":200,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T00:00:00Z","timestamp":1782864000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,7]]},"DOI":"10.1109\/eurosp68448.2026.00059","type":"proceedings-article","created":{"date-parts":[[2026,7,30]],"date-time":"2026-07-30T19:08:34Z","timestamp":1785438514000},"page":"836-859","source":"Crossref","is-referenced-by-count":0,"title":["SoK: A Defense-Oriented Evaluation of Software Supply Chain Security"],"prefix":"10.1109","author":[{"given":"Eman Abu","family":"Ishgair","sequence":"first","affiliation":[{"name":"Purdue University","place":["West Lafayette, USA"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Juanita","family":"Gomez","sequence":"additional","affiliation":[{"name":"University of California, Santa Cruz","place":["Santa Cruz, USA"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Marcela S.","family":"Melara","sequence":"additional","affiliation":[{"name":"Corporate Technology Office Intel Corporation","place":["Hillsboro, USA"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Alvaro","family":"Cardenas","sequence":"additional","affiliation":[{"name":"University of California, Santa Cruz","place":["Santa Cruz, USA"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Santiago","family":"Torres-Arias","sequence":"additional","affiliation":[{"name":"Purdue University","place":["West Lafayette, USA"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","volume-title":"Certificate Transparency Version"},{"key":"ref2","volume-title":"How OpenID Connect Works"},{"key":"ref3","volume-title":"in-toto Attestation Framework"},{"key":"ref4","volume-title":"left-pad\/left-pad"},{"key":"ref5","volume-title":"[meta] Binary Transparency on Firefox"},{"key":"ref6","volume-title":"PGP signatures on PyPI: worse than useless"},{"key":"ref7","volume-title":"ReproducibleBuilds\/BuildinfoFiles - Debian Wiki"},{"key":"ref8","volume-title":"SELinux Project"},{"key":"ref9","journal-title":"SolarWinds hack was \u2019largest and most sophisticated attack\u2019 ever: Microsoft president"},{"key":"ref10","article-title":"Apple\u2019s App Store infected with XcodeGhost malware in China","year":"2015","journal-title":"BBC News"},{"key":"ref11","volume-title":"GitHub \u2022 Build and ship software on a single, collaborative platform","year":"2025"},{"key":"ref12","year":"2025","journal-title":"IQTLabs\/software-supply-chain-compromises"},{"key":"ref13","volume-title":"AMD64 Architecture Programmer\u2019s Manual Volume 2: System Programming"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/3607199.3607233"},{"key":"ref15","doi-asserted-by":"crossref","volume-title":"Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)","author":"Adams","DOI":"10.17487\/rfc3161"},{"key":"ref16","volume-title":"AMD Secure Encrypted Virtualization (SEV)"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3196494.3196523"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00305-0_8"},{"key":"ref19","first-page":"267","article-title":"On the Design and Misuse of Microcoded (Embedded) Processors \u2014 A Cautionary Note","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Albartus"},{"key":"ref20","first-page":"3457","article-title":"SandDriller: A Fully-Automated approach for testing Language-Based JavaScript sandboxes","volume-title":"32nd USENIX Security Symposium (USENIX Security 23","author":"AlHamdan"},{"key":"ref21","author":"Alves","year":"2004","journal-title":"Trustzone : Integrated hardware and software security"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833582"},{"key":"ref23","volume-title":"CVE-2021-44832"},{"key":"ref24","volume-title":"Aqua Trivy: Vulnerability and Misconfiguration Scanning"},{"key":"ref25","article-title":"The Software Release Life Cycle in DevOps: Why Reinvent The Model?","author":"Bandyopadhyay"},{"key":"ref26","volume-title":"An Architecture for Trustworthy and Transparent Digital Supply Chains","author":"Birkholz","year":"2022"},{"key":"ref27","volume-title":"Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies","author":"Birsan","year":"2023"},{"key":"ref28","article-title":"Trojan source: invisible vulnerabilities","volume-title":"Proceedings of the 32nd USENIX Conference on Security Symposium","author":"Boucher"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/3639476.3639775"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/3607199.3607226"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417892"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/1455770.1455841"},{"key":"ref33","article-title":"Strategies for the Integration of Software Supply Chain Security in DevSecOps CI\/CD Pipelines","author":"Chandramouli","year":"2024"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00123"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243746"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243746"},{"key":"ref37","first-page":"1713","article-title":"DECAF: Automatic, adaptive de-bloating and hardening of COTS firmware","volume-title":"29th USENIX Security Symposium (USENIX Security 20)","author":"Christensen"},{"key":"ref38","volume-title":"Software Supply Chain Best Practices v2"},{"key":"ref39","volume-title":"Cyber resilience act","year":"2022"},{"key":"ref40","first-page":"3693","article-title":"GHunter: Universal prototype pollution gadgets in JavaScript runtimes","volume-title":"33rd USENIX Security Symposium (USENIX Security 24)","author":"Cornelissen"},{"key":"ref41","article-title":"Functional package management with guix","author":"Court\u00e8s","year":"2013"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2020.3024562"},{"key":"ref43","volume-title":"SecureApt"},{"key":"ref44","first-page":"692","article-title":"Quantifying security issues in reusable javascript actions in github workflows","volume-title":"2024 IEEE\/ACM 21st International Conference on Mining Software Repositories (MSR)","author":"Delicheh"},{"key":"ref45","article-title":"Malicious packages found to be typo-squatting in Python Package Index","author":"Denbraver","year":"2019"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134059"},{"key":"ref47","volume-title":"Docker Content Trust"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC63791.2024.00090"},{"key":"ref49","volume-title":"28th Annual Network and Distributed System Security Symposium (NDSS)","author":"Duan"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/3634737.3657007"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-25460-4_38"},{"key":"ref52","volume-title":"What is eBPF?"},{"key":"ref53","volume-title":"Isolation - glossary | CSRC"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1145\/3560835.3564549"},{"key":"ref55","article-title":"Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor","year":"2020","journal-title":"FireEye Blogs - Threat Research"},{"key":"ref56","volume-title":"Working with gpg"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179320"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00013"},{"key":"ref59","volume-title":"Git Basics - Viewing the Commit History"},{"key":"ref60","volume-title":"Signing your work"},{"key":"ref61","volume-title":"About commit signature verificaton"},{"key":"ref62","year":"2022","journal-title":"Repository roles for an organization"},{"key":"ref63","volume-title":"Accessing GitHub using two-factor authentication"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3624401"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE-SEIP52600.2021.00035"},{"key":"ref66","article-title":"Hackers backdoor PHP source code after breaching internal git server","author":"Goodin","year":"2021"},{"key":"ref67","article-title":"Go module mirror served backdoor to devs for 3+ years","author":"Goodin","year":"2025"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00253"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1145\/2491055.2491070"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00138"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179471"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179332"},{"key":"ref73","article-title":"Sigl: Securing software installations through deep graph learning","volume-title":"USENIX Security Symposium","author":"Han"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00268"},{"key":"ref75","first-page":"2225","article-title":"RapidPatch: Firmware hotpatching for Real-Time embedded devices","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"He"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1145\/3524842.3528514"},{"key":"ref77","first-page":"341","article-title":"DONAPI: Malicious NPM packages detector using behavior sequence knowledge mapping","volume-title":"33rd USENIX Security Symposium (USENIX Security 24)","author":"Huang"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690372"},{"key":"ref79","article-title":"How We Discovered Vulnerabilities in CI\/CD Pipelines of Popular Open-Source Projects","author":"Ilgayev","year":"2022"},{"key":"ref80","volume-title":"Create in-toto layout"},{"key":"ref81","volume-title":"in-toto - A framework to secure the integrity of software supply chains"},{"key":"ref82","volume-title":"Intel\u00ae Trust Domain Extensions (Intel\u00ae TDX)"},{"key":"ref83","year":"2011","journal-title":"ISO\/IEC 27034-1:2011 Information technology \u2014 Security techniques \u2014 Application security \u2014 Part 1: Overview and concepts"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1145\/3597503.3639080"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1145\/3597503.3639100"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3423346"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1109\/MSR59073.2023.00051"},{"key":"ref88","author":"Karthik","journal-title":"Uptane: Securing Software Updates for Automobiles"},{"key":"ref89","first-page":"161","article-title":"Mistrust plugins you must: A Large-Scale study of malicious plugins in WordPress marketplaces","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Kasturi"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00214"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1145\/3634737.3637659"},{"key":"ref92","first-page":"2747","article-title":"Characterizing the security of github {CI} workflows","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Koishybayev"},{"key":"ref93","article-title":"Characterizing the Security of Github CI Workflows","volume-title":"Proc. USENIX Security \u201922","author":"Koishybayev"},{"key":"ref94","first-page":"2527","article-title":"Pushed by accident: A Mixed-Methods study on strategies of handling secret information in source code repositories","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Krause"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1145\/3560835.3564553"},{"key":"ref96","article-title":"Pep 480 \u2013surviving a compromise of pypi: End-to-end signing of packages","author":"Kuppusamy"},{"key":"ref97","first-page":"567","article-title":"Diplomat: Using delegations to protect community repositories","volume-title":"13th USENIX Symposium on Networked Systems Design and Implementation (NSDI 16)","author":"Kuppusamy"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179304"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1145\/3560835.3564548"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1145\/3627106.3627138"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1145\/3639477.3639724"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3670366"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690294"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1145\/3678890.3678927"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-64171-8_21"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1145\/3597503.3639104"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00038"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1145\/3639478.3639806"},{"key":"ref109","first-page":"97","article-title":"Reproducibility of build environments through space and time","volume-title":"Proceedings of the 2024 ACM\/IEEE 44th International Conference on Software Engineering: New Ideas and Emerging Results, ICSE-NIER\u201924","author":"Malka"},{"key":"ref110","article-title":"Announcing the Secure Software Factory Reference Architecture Paper","author":"Marshall","year":"2022","journal-title":"Cloud Native Compute Foundation Blog"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1145\/2487726.2488368"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-66399-9_16"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3623200"},{"key":"ref114","volume-title":"CIS Software Supply Chain Security Guide","author":"Milner","year":"2022"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1145\/3627106.3627129"},{"key":"ref116","article-title":"Scudo: A proposal for resolving software supply chain insecurities in vehicles","author":"Moore","year":"2022"},{"key":"ref117","first-page":"6983","article-title":"ARGUS: A Framework for Staged Static Taint Analysis of GitHub Workflows and Actions","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Muralee"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.1109\/ICNP.2003.1249783"},{"key":"ref119","doi-asserted-by":"publisher","DOI":"10.1145\/3373376.3378519"},{"key":"ref120","article-title":"Beyond typosquatting: an in-depth look at package confusion","volume-title":"Proceedings of the 32nd USENIX Conference on Security Symposium, SEC \u201923","author":"Neupane"},{"key":"ref121","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560596"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427658"},{"key":"ref123","first-page":"127","article-title":"CHAINIAC: Proactive software-update transparency via collectively signed skipchains and verified builds","volume-title":"Proceedings of the 26th USENIX Security Symposium (USENIX Security \u201917)","author":"Nikitin"},{"key":"ref124","first-page":"5609","article-title":"Unveiling IoT security in reality: A Firmware-Centric journey","volume-title":"33rd USENIX Security Symposium (USENIX Security 24)","author":"Nino"},{"key":"ref125","volume-title":"Configuring two-factor authentication"},{"key":"ref126","volume-title":"Organization roles and permissions"},{"key":"ref127","volume-title":"npm Registry. left-pad (npm package)","year":"2018"},{"key":"ref128","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3485351"},{"key":"ref129","doi-asserted-by":"publisher","DOI":"10.6028\/nist.sp.800-163r1"},{"key":"ref130","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-52683-2_2"},{"key":"ref131","doi-asserted-by":"publisher","DOI":"10.1145\/3600160.3600162"},{"key":"ref132","doi-asserted-by":"publisher","DOI":"10.1145\/3560835.3564556"},{"key":"ref133","volume-title":"OpenSSF Scorecard"},{"key":"ref134","volume-title":"Open Security Controls Assessment Language (OSCAL)"},{"key":"ref135","doi-asserted-by":"publisher","DOI":"10.1145\/3597503.3639231"},{"key":"ref136","first-page":"3747","article-title":"FV8: A forced execution JavaScript engine for detecting evasive techniques","volume-title":"33rd USENIX Security Symposium (USENIX Security 24)","author":"Pantelaios"},{"key":"ref137","doi-asserted-by":"publisher","DOI":"10.1109\/MSR59073.2023.00073"},{"key":"ref138","doi-asserted-by":"publisher","DOI":"10.1109\/MSR.2019.00064"},{"key":"ref139","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00074"},{"key":"ref140","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3623140"},{"key":"ref141","volume-title":"An investigative update of the cyberattack","author":"Ramakrishna"},{"key":"ref142","article-title":"Urgent security alert for fedora linux 40 and fedora rawhide users","year":"2024"},{"key":"ref143","doi-asserted-by":"publisher","DOI":"10.14722\/vehiclesec.2023.23086"},{"key":"ref144","doi-asserted-by":"publisher","DOI":"10.1109\/PROC.1975.9939"},{"key":"ref145","doi-asserted-by":"publisher","DOI":"10.1145\/1866307.1866315"},{"key":"ref146","volume-title":"kik, left-pad, and npm","author":"Schlueter","year":"2016"},{"key":"ref147","doi-asserted-by":"publisher","DOI":"10.1145\/2420950.2420988"},{"key":"ref148","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00215"},{"key":"ref149","article-title":"Survey reveals AI\u2019s impact on the developer experience","author":"Shani","year":"2023"},{"key":"ref150","volume-title":"Sigstore"},{"key":"ref151","volume-title":"Fulcio: Sigstore Certificate Authority","year":"2024"},{"key":"ref152","volume-title":"Rekor: Sigstore Transparency Log","year":"2024"},{"key":"ref153","volume-title":"Sigstore Security Model","year":"2024"},{"key":"ref154","journal-title":"SLSA Provenance"},{"key":"ref155","doi-asserted-by":"publisher","DOI":"10.1145\/3597503.3639199"},{"key":"ref156","article-title":"NIST Special Publication 800-218 - Secure Software Development Framework (SSDF) Version 1.1","author":"Souppaya","year":"2022","journal-title":"NIST Computer Security Research Center Publications"},{"key":"ref157","volume-title":"SPDX Overview"},{"key":"ref158","first-page":"6133","article-title":"Bilingual problems: Studying the security risks incurred by native extensions in scripting languages","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Staicu"},{"key":"ref159","doi-asserted-by":"publisher","DOI":"10.1145\/3597503.3623347"},{"key":"ref160","doi-asserted-by":"publisher","DOI":"10.1145\/3597503.3639202"},{"key":"ref161","article-title":"Using rekor-monitor to Scan Your Transparency Logs","author":"Sun"},{"key":"ref162","volume-title":"Coverity Static Application Security Testing"},{"key":"ref163","volume-title":"Authenticode digital signatures - windows drivers"},{"key":"ref164","volume-title":"Software Bill of Materials","year":"2021"},{"key":"ref165","volume-title":"Executive Order on Improving the Nation\u2019s Cybersecurity","year":"2021"},{"key":"ref166","volume-title":"NPM Docs: npm publish","author":"Thompson"},{"key":"ref167","article-title":"Towards short-lived certificates","volume-title":"Proc. of Web 2.0 Security & Privacy (W2SP) \u201912","author":"Topalovic"},{"key":"ref168","first-page":"1393","article-title":"in-toto: Providing farm-to-table guarantees for bits and bytes","volume-title":"28th USENIX Security Symposium (USENIX Security 19)","author":"Torres-Arias"},{"key":"ref169","first-page":"379","article-title":"On omitting commits and committing omissions: Preventing git metadata tampering that (re) introduces software vulnerabilities","volume-title":"25th USENIX Security Symposium (USENIX Security 16)","author":"Torres-Arias"},{"key":"ref170","volume-title":"Trufflehog"},{"key":"ref171","article-title":"The Log4j Vulnerability: Millions of Attempts Made Per Hour to Exploit Software Flaw","author":"Uberti","year":"2021"},{"key":"ref172","volume-title":"Apparmor","year":"2025"},{"key":"ref173","doi-asserted-by":"publisher","DOI":"10.1109\/MC.2005.163"},{"key":"ref174","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484736"},{"key":"ref175","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3420015"},{"key":"ref176","doi-asserted-by":"publisher","DOI":"10.1145\/168619.168635"},{"key":"ref177","first-page":"299","article-title":"Splinter: Practical private queries on public data","volume-title":"14th USENIX Symposium on Networked Systems Design and Implementation (NSDI 17)","author":"Wang"},{"key":"ref178","first-page":"100","article-title":"Building and maintaining a third-party library supply chain for productive and secure sgx enclave development","volume-title":"2020 IEEE\/ACM 42nd International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP)","author":"Wang"},{"key":"ref179","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3616609"},{"key":"ref180","first-page":"3403","article-title":"Union under duress: Understanding hazards of duplicate resource mismediation in android software supply chain","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Wang"},{"key":"ref181","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2024.24527"},{"key":"ref182","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179378"},{"key":"ref183","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833686"},{"key":"ref184","doi-asserted-by":"publisher","DOI":"10.1145\/2601248.2601268"},{"key":"ref185","first-page":"6541","article-title":"V1SCAN: Discovering 1-day vulnerabilities in reused C\/C++ open-source software components using code classification techniques","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Woo"},{"key":"ref186","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2004.02.003"},{"key":"ref187","doi-asserted-by":"publisher","DOI":"10.1016\/b978-1-59749-266-9.00020-5"},{"key":"ref188","first-page":"5627","article-title":"Your firmware has arrived: A study of firmware update vulnerabilities","volume-title":"33rd USENIX Security Symposium (USENIX Security 24)","author":"Wu"},{"key":"ref189","doi-asserted-by":"publisher","DOI":"10.1145\/3488932.3523262"},{"key":"ref190","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE48619.2023.00219"},{"key":"ref191","doi-asserted-by":"publisher","DOI":"10.1145\/3510457.3513050"},{"key":"ref192","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3691374"},{"key":"ref194","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2024.23038"},{"key":"ref195","volume-title":"YubiKey 5 Series"},{"key":"ref196","first-page":"728","article-title":"Malwarebench: Malware samples are not enough","volume-title":"Proceedings of the 21st International Conference on Mining Software Repositories, MSR \u201924","author":"Zahan"},{"key":"ref197","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE-SEIP58684.2023.00032"},{"key":"ref198","doi-asserted-by":"publisher","DOI":"10.1145\/3510457.3513044"},{"key":"ref199","article-title":"Top cyber security conferences ranking","author":"Zhou"},{"key":"ref200","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00122"},{"key":"ref201","first-page":"995","article-title":"Small world with high risks: A study of security threats in the npm ecosystem","volume-title":"28th USENIX Security Symposium (USENIX Security 19)","author":"Zimmermann"}],"event":{"name":"2026 IEEE 11th European Symposium on Security and Privacy (EuroS&P)","location":"Lisbon, Portugal","start":{"date-parts":[[2026,7,6]]},"end":{"date-parts":[[2026,7,10]]}},"container-title":["2026 IEEE 11th European Symposium on Security and Privacy (EuroS&P)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11624144\/11623655\/11624354.pdf?arnumber=11624354","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T04:54:06Z","timestamp":1785473646000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11624354\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7]]},"references-count":200,"URL":"https:\/\/doi.org\/10.1109\/eurosp68448.2026.00059","relation":{},"subject":[],"published":{"date-parts":[[2026,7]]}}}