{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T22:39:39Z","timestamp":1785537579565,"version":"3.56.0"},"publisher-location":"New York, NY, USA","reference-count":44,"publisher":"ACM","license":[{"start":{"date-parts":[[2020,10,12]],"date-time":"2020-10-12T00:00:00Z","timestamp":1602460800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2020,10,12]]},"DOI":"10.1145\/3419111.3421303","type":"proceedings-article","created":{"date-parts":[[2020,10,13]],"date-time":"2020-10-13T04:40:25Z","timestamp":1602564025000},"page":"358-371","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":18,"title":["Automatically detecting risky scripts in infrastructure code"],"prefix":"10.1145","author":[{"given":"Ting","family":"Dai","sequence":"first","affiliation":[{"name":"IBM Research"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Alexei","family":"Karve","sequence":"additional","affiliation":[{"name":"IBM Research"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Grzegorz","family":"Koper","sequence":"additional","affiliation":[{"name":"IBM GTS"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sai","family":"Zeng","sequence":"additional","affiliation":[{"name":"IBM Research"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2020,10,12]]},"reference":[{"key":"e_1_3_2_2_1_1","unstructured":"2012. Critical Cloud Computing: A CIIP perspective on cloud computing services. https:\/\/resilience.enisa.europa.eu\/cloud-security-and-resilience\/publications\/critical-cloud-computing  2012. Critical Cloud Computing: A CIIP perspective on cloud computing services. https:\/\/resilience.enisa.europa.eu\/cloud-security-and-resilience\/publications\/critical-cloud-computing"},{"key":"e_1_3_2_2_2_1","unstructured":"2013. Human error most likely cause of datacentre downtime finds study. https:\/\/www.computerweekly.com\/news\/2240179651\/Human-error-most-likely-cause-of-datacentre-downtime-finds-study  2013. Human error most likely cause of datacentre downtime finds study. https:\/\/www.computerweekly.com\/news\/2240179651\/Human-error-most-likely-cause-of-datacentre-downtime-finds-study"},{"key":"e_1_3_2_2_3_1","unstructured":"2014. DNS Outage Post Mortem. https:\/\/github.blog\/2014-01-18-dns-outage-post-mortem\/  2014. DNS Outage Post Mortem. https:\/\/github.blog\/2014-01-18-dns-outage-post-mortem\/"},{"key":"e_1_3_2_2_4_1","unstructured":"2017. Amazon And The $150 Million Typo. https:\/\/www.npr.org\/sections\/thetwo-way\/2017\/03\/03\/518322734\/amazon-and-the-150-million-typo  2017. Amazon And The $150 Million Typo. https:\/\/www.npr.org\/sections\/thetwo-way\/2017\/03\/03\/518322734\/amazon-and-the-150-million-typo"},{"key":"e_1_3_2_2_5_1","unstructured":"2017. AWS's S3 outage was so bad Amazon couldn't get into its own dashboard to warn the world. https:\/\/www.theregister.co.uk\/2017\/03\/01\/aws_s3_outage\/  2017. AWS's S3 outage was so bad Amazon couldn't get into its own dashboard to warn the world. https:\/\/www.theregister.co.uk\/2017\/03\/01\/aws_s3_outage\/"},{"key":"e_1_3_2_2_6_1","unstructured":"2017. Cyber Security Is A Business Risk Not Just An IT Problem. https:\/\/www.forbes.com\/sites\/edelmantechnology\/2017\/10\/11\/cyber-security-is-a-business-risk-not-just-an-it-problem  2017. Cyber Security Is A Business Risk Not Just An IT Problem. https:\/\/www.forbes.com\/sites\/edelmantechnology\/2017\/10\/11\/cyber-security-is-a-business-risk-not-just-an-it-problem"},{"key":"e_1_3_2_2_7_1","unstructured":"2017. The Main Difference Between Junior Programmers And Senior Programmers. https:\/\/www.forbes.com\/sites\/quora\/2017\/12\/05\/the-main-difference-between-junior-programmers-and-senior-programmers\/#724b335e67f3  2017. The Main Difference Between Junior Programmers And Senior Programmers. https:\/\/www.forbes.com\/sites\/quora\/2017\/12\/05\/the-main-difference-between-junior-programmers-and-senior-programmers\/#724b335e67f3"},{"key":"e_1_3_2_2_8_1","unstructured":"2017. Summary of the Amazon S3 Service Disruption in the Northern Virginia (US-EAST-1) Region. https:\/\/aws.amazon.com\/message\/41926\/  2017. Summary of the Amazon S3 Service Disruption in the Northern Virginia (US-EAST-1) Region. https:\/\/aws.amazon.com\/message\/41926\/"},{"key":"e_1_3_2_2_9_1","unstructured":"2018. Malicious PowerShell Detection via Machine Learning. https:\/\/www.fireeye.com\/blog\/threat-research\/2018\/07\/malicious-powershell-detection-via-machine-learning.html  2018. Malicious PowerShell Detection via Machine Learning. https:\/\/www.fireeye.com\/blog\/threat-research\/2018\/07\/malicious-powershell-detection-via-machine-learning.html"},{"key":"e_1_3_2_2_10_1","unstructured":"2019. Deep learning rises: New methods for detecting malicious PowerShell. https:\/\/www.microsoft.com\/security\/blog\/2019\/09\/03\/deep-learning-rises-new-methods-for-detecting-malicious-powershell\/  2019. Deep learning rises: New methods for detecting malicious PowerShell. https:\/\/www.microsoft.com\/security\/blog\/2019\/09\/03\/deep-learning-rises-new-methods-for-detecting-malicious-powershell\/"},{"key":"e_1_3_2_2_11_1","unstructured":"2019. A shell script that deleted a database and how ShellCheck could have helped. https:\/\/www.vidarholen.net\/contents\/blog\/?p=746  2019. A shell script that deleted a database and how ShellCheck could have helped. https:\/\/www.vidarholen.net\/contents\/blog\/?p=746"},{"key":"e_1_3_2_2_12_1","unstructured":"2020. Ansible is Simple IT Automation. https:\/\/www.ansible.com\/  2020. Ansible is Simple IT Automation. https:\/\/www.ansible.com\/"},{"key":"e_1_3_2_2_13_1","unstructured":"2020. Ansible-lint: Best practices checker for Ansible. https:\/\/github.com\/ansible\/ansible-lint\/  2020. Ansible-lint: Best practices checker for Ansible. https:\/\/github.com\/ansible\/ansible-lint\/"},{"key":"e_1_3_2_2_14_1","unstructured":"2020. Chef: Deploy new code faster and more frequently. https:\/\/www.chef.io\/  2020. Chef: Deploy new code faster and more frequently. https:\/\/www.chef.io\/"},{"key":"e_1_3_2_2_15_1","unstructured":"2020. Puppet-lint: Check that your Puppet manifests conform to the style guide. https:\/\/github.com\/rodjek\/puppet-lint  2020. Puppet-lint: Check that your Puppet manifests conform to the style guide. https:\/\/github.com\/rodjek\/puppet-lint"},{"key":"e_1_3_2_2_16_1","unstructured":"2020. Puppet: Powerful infrastructure automation and delivery. https:\/\/puppet.com\/  2020. Puppet: Powerful infrastructure automation and delivery. https:\/\/puppet.com\/"},{"key":"e_1_3_2_2_17_1","unstructured":"2020. puppet-strings. https:\/\/rubygems.org\/gems\/puppet-strings  2020. puppet-strings. https:\/\/rubygems.org\/gems\/puppet-strings"},{"key":"e_1_3_2_2_18_1","unstructured":"2020. Secure infrastructure from IBM lets you make sure your data stays safe --- wherever it goes. https:\/\/www.ibm.com\/it-infrastructure\/solutions\/security  2020. Secure infrastructure from IBM lets you make sure your data stays safe --- wherever it goes. https:\/\/www.ibm.com\/it-infrastructure\/solutions\/security"},{"key":"e_1_3_2_2_19_1","unstructured":"2020. Terraform: Use Infrastructure as Code to provision and manage any cloud infrastructure or service. https:\/\/www.terraform.io\/  2020. Terraform: Use Infrastructure as Code to provision and manage any cloud infrastructure or service. https:\/\/www.terraform.io\/"},{"key":"e_1_3_2_2_20_1","unstructured":"2020. Travis CI. https:\/\/travis-ci.org\/  2020. Travis CI. https:\/\/travis-ci.org\/"},{"key":"e_1_3_2_2_21_1","unstructured":"2020. The Xenial Build Environment. https:\/\/docs.travis-ci.com\/user\/reference\/xenial\/  2020. The Xenial Build Environment. https:\/\/docs.travis-ci.com\/user\/reference\/xenial\/"},{"key":"e_1_3_2_2_22_1","unstructured":"2020. YAML Lint: A linter for YAML files. https:\/\/github.com\/adrienverge\/yamllint  2020. YAML Lint: A linter for YAML files. https:\/\/github.com\/adrienverge\/yamllint"},{"key":"e_1_3_2_2_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/TPDS.2018.2858800"},{"key":"e_1_3_2_2_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/3267809.3267844"},{"key":"e_1_3_2_2_25_1","volume-title":"Proc. ACM Program. Lang. 4, POPL, Article 43","author":"Greenberg Michael","year":"2019"},{"key":"e_1_3_2_2_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/2983990.2984000"},{"key":"e_1_3_2_2_27_1","volume-title":"TScope: Automatic Timeout Bug Identification for Server Systems. In 2018 IEEE International Conference on Autonomic Computing, ICAC 2018","author":"He Jingzhu","year":"2018"},{"key":"e_1_3_2_2_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/3196494.3196511"},{"key":"e_1_3_2_2_29_1","unstructured":"Vidar Holen. 2020. ShellCheck - shell script analysis tool infrastructure or service. https:\/\/www.shellcheck.net\/  Vidar Holen. 2020. ShellCheck - shell script analysis tool infrastructure or service. https:\/\/www.shellcheck.net\/"},{"key":"e_1_3_2_2_30_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-45065-5_19"},{"key":"e_1_3_2_2_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/3341301.3359638"},{"key":"e_1_3_2_2_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/3190508.3190552"},{"key":"e_1_3_2_2_33_1","volume-title":"Proceedings of the 14th Conference on USENIX Security Symposium. USENIX Association, USA.","author":"Benjamin Livshits V."},{"key":"e_1_3_2_2_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/1255329.1255347"},{"key":"e_1_3_2_2_35_1","unstructured":"Microsoft. 2020. PSScriptAnalyzer. https:\/\/github.com\/PowerShell\/PSScriptAnalyzer  Microsoft. 2020. PSScriptAnalyzer. https:\/\/github.com\/PowerShell\/PSScriptAnalyzer"},{"key":"e_1_3_2_2_36_1","volume-title":"SHILL: A Secure Shell Scripting Language. In 11th USENIX Symposium on Operating Systems Design and Implementation (OSDI'14)","author":"Moore Scott","year":"2014"},{"key":"e_1_3_2_2_37_1","unstructured":"PyCQA. 2020. Bandit is a tool designed to find common security issues in Python code. https:\/\/github.com\/PyCQA\/bandit  PyCQA. 2020. Bandit is a tool designed to find common security issues in Python code. https:\/\/github.com\/PyCQA\/bandit"},{"key":"e_1_3_2_2_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2019.00033"},{"key":"e_1_3_2_2_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/2908080.2908083"},{"key":"e_1_3_2_2_40_1","doi-asserted-by":"publisher","DOI":"10.1145\/2901739.2901761"},{"key":"e_1_3_2_2_41_1","doi-asserted-by":"publisher","DOI":"10.1145\/3377811.3380384"},{"key":"e_1_3_2_2_42_1","volume-title":"2018 IEEE 25th International Conference on Software Analysis, Evolution and Reengineering (SANER'18)","author":"van der Bent E."},{"key":"e_1_3_2_2_43_1","doi-asserted-by":"publisher","DOI":"10.5555\/3026877.3026925"},{"key":"e_1_3_2_2_44_1","doi-asserted-by":"crossref","unstructured":"Tianyin Xu and Yuanyuan Zhou. 2015. Systems Approaches to Tackling Configuration Errors: A Survey. ACM Comput. Surv. 47 4 Article 70 (July 2015) 41 pages.  Tianyin Xu and Yuanyuan Zhou. 2015. Systems Approaches to Tackling Configuration Errors: A Survey. ACM Comput. Surv. 47 4 Article 70 (July 2015) 41 pages.","DOI":"10.1145\/2791577"}],"event":{"name":"SoCC '20: ACM Symposium on Cloud Computing","location":"Virtual Event USA","acronym":"SoCC '20","sponsor":["SIGMOD ACM Special Interest Group on Management of Data","SIGOPS ACM Special Interest Group on Operating Systems"]},"container-title":["Proceedings of the 11th ACM Symposium on Cloud Computing"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3419111.3421303","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3419111.3421303","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T21:32:06Z","timestamp":1750195926000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3419111.3421303"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,10,12]]},"references-count":44,"alternative-id":["10.1145\/3419111.3421303","10.1145\/3419111"],"URL":"https:\/\/doi.org\/10.1145\/3419111.3421303","relation":{},"subject":[],"published":{"date-parts":[[2020,10,12]]},"assertion":[{"value":"2020-10-12","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}