{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,13]],"date-time":"2026-05-13T10:19:19Z","timestamp":1778667559831,"version":"3.51.4"},"publisher-location":"New York, NY, USA","reference-count":26,"publisher":"ACM","license":[{"start":{"date-parts":[[2026,4,12]],"date-time":"2026-04-12T00:00:00Z","timestamp":1775952000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"name":"FAPERJ","award":["E-26\/204.268\/2024"],"award-info":[{"award-number":["E-26\/204.268\/2024"]}]},{"name":"CNPq","award":["315106\/2023-9"],"award-info":[{"award-number":["315106\/2023-9"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2026,4,12]]},"DOI":"10.1145\/3786165.3788442","type":"proceedings-article","created":{"date-parts":[[2026,5,13]],"date-time":"2026-05-13T09:49:18Z","timestamp":1778665758000},"page":"41-46","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["An Automated Approach to Generate Attack Graphs with a Case Study on Siemens PCS7 Blueprint"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0008-1589-0209","authenticated-orcid":false,"given":"Lucas Guimar\u00e3es","family":"Miranda","sequence":"first","affiliation":[{"name":"UFRJ, Rio de Janeiro, Brazil"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1576-3863","authenticated-orcid":false,"given":"Carlos Eduardo de Schuller","family":"Banjar","sequence":"additional","affiliation":[{"name":"UFRJ, Rio de Janeiro, Brazil"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8953-4003","authenticated-orcid":false,"given":"Daniel Sadoc","family":"Menasche","sequence":"additional","affiliation":[{"name":"UFRJ, Rio de Janeiro, Brazil"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2549-9146","authenticated-orcid":false,"given":"Anton","family":"Kocheturov","sequence":"additional","affiliation":[{"name":"Siemens, Princeton, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-2755-629X","authenticated-orcid":false,"given":"Gaurav Kumar","family":"Srivastava","sequence":"additional","affiliation":[{"name":"Siemens, Princeton, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8904-0620","authenticated-orcid":false,"given":"Tobias","family":"Limmer","sequence":"additional","affiliation":[{"name":"Siemens, Munich, Germany"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2026,5,13]]},"reference":[{"key":"e_1_3_3_2_2_2","unstructured":"Siemens AG. 2023. Secure Guideline Blue Print \u2013 WWTP (Water \/ Waste Water Treatment Plant) V4.0. https:\/\/cache.industry.siemens.com\/dl\/files\/322\/109780322\/att_1275024\/v1\/Secure_Guideline_Blue_Print-WWTP_V04_en.pdf. Accessed: 2026\/04\/01 19:57:03."},{"key":"e_1_3_3_2_3_2","doi-asserted-by":"publisher","DOI":"10.1145\/3176258.3176339"},{"key":"e_1_3_3_2_4_2","doi-asserted-by":"crossref","unstructured":"Alaa\u00a0T Al\u00a0Ghazo Mariam Ibrahim Hao Ren and Ratnesh Kumar. 2019. A2G2V: Automatic attack graph generation and visualization and its applications to computer and SCADA networks. IEEE Transactions on Systems Man and Cybernetics: Systems 50 10 (2019) 3488\u20133498.","DOI":"10.1109\/TSMC.2019.2915940"},{"key":"e_1_3_3_2_5_2","unstructured":"Carlos\u00a0Eduardo Banjar Lucas Miranda et\u00a0al. 2025. svm-attack-graph-simulation: Datasets and source code for \u201cAn Approach to Generate Attack Graphs with a Case Study on Siemens PCS7 Blueprint\u201d. GitHub repository. https:\/\/github.com\/carloseduardobanjar\/svm-attack-graph-simulation Accessed: 2026-01-19."},{"key":"e_1_3_3_2_6_2","doi-asserted-by":"publisher","DOI":"10.14236\/ewic\/icscsr19.7"},{"key":"e_1_3_3_2_7_2","doi-asserted-by":"crossref","unstructured":"Mart\u00edn Barr\u00e8re and Chris Hankin. 2021. Analysing mission-critical cyber-physical systems with and\/or graphs and maxsat. ACM transactions on cyber-physical systems 5 3 (2021) 1\u201329.","DOI":"10.1145\/3451169"},{"key":"e_1_3_3_2_8_2","doi-asserted-by":"publisher","DOI":"10.1109\/SRDS.2012.4"},{"key":"e_1_3_3_2_9_2","volume-title":"IMC","author":"Durumeric Zakir","year":"2014","unstructured":"Zakir Durumeric and et al.2014. The Matter of Heartbleed. In IMC."},{"key":"e_1_3_3_2_10_2","unstructured":"FIRST. 2019. Common Vulnerability Scoring System v3.1: Specification Document. https:\/\/www.first.org\/cvss\/specification-document."},{"key":"e_1_3_3_2_11_2","unstructured":"FIRST. 2021. EPSS Tech. Doc. https:\/\/www.first.org\/epss."},{"key":"e_1_3_3_2_12_2","doi-asserted-by":"publisher","DOI":"10.1109\/COMPSAC.2008.88"},{"key":"e_1_3_3_2_13_2","doi-asserted-by":"publisher","DOI":"10.1109\/ARES.2011.18"},{"key":"e_1_3_3_2_14_2","doi-asserted-by":"publisher","unstructured":"Amjad Ibrahim Stevica Bozhinoski and Alexander Pretschner. 2019. Attack graph generation for microservice architecture (SAC \u201919). Association for Computing Machinery New York NY USA 1235\u20131242. 10.1145\/3297280.3297401","DOI":"10.1145\/3297280.3297401"},{"key":"e_1_3_3_2_15_2","doi-asserted-by":"crossref","unstructured":"Mariam Ibrahim Ruba Elhafiz and Abdallah Al-Wadi. 2023. Reinforcement learning-based attack graph analysis for wastewater treatment plant. IEEE Transactions on Industry Applications 59 6 (2023) 7858\u20137867.","DOI":"10.1109\/TIA.2023.3298289"},{"key":"e_1_3_3_2_16_2","doi-asserted-by":"publisher","DOI":"10.1109\/NTMS.2008.ECP.9"},{"key":"e_1_3_3_2_17_2","doi-asserted-by":"publisher","unstructured":"Jay Jacobs Sasha Romanosky Benjamin Edwards Idris Adjerid and Michael Roytman. 2021. Exploit Prediction Scoring System (EPSS). Digital Threats 2 3 Article 20 (July 2021) 17\u00a0pages. 10.1145\/3436242","DOI":"10.1145\/3436242"},{"key":"e_1_3_3_2_18_2","doi-asserted-by":"publisher","DOI":"10.1109\/CNS66487.2025.11194174"},{"key":"e_1_3_3_2_19_2","doi-asserted-by":"publisher","DOI":"10.1109\/CloudCom62794.2024.00023"},{"key":"e_1_3_3_2_20_2","doi-asserted-by":"crossref","unstructured":"Peter Mell Irena Bojanova and Carlos\u00a0Eduardo Galhardo. 2024. Measuring the Exploitation of Weaknesses in the Wild. IT Professional 26 3 (2024) 14\u201321.","DOI":"10.1109\/MITP.2024.3399485"},{"key":"e_1_3_3_2_21_2","volume-title":"USENIX Security Symposium","author":"Ou Xinming","year":"2005","unstructured":"Xinming Ou, Sudhakar Govindavajhala, and Andrew\u00a0W. Appel. 2005. MulVAL: A Logic-based Network Security Analyzer. In USENIX Security Symposium."},{"key":"e_1_3_3_2_22_2","doi-asserted-by":"crossref","unstructured":"Panini\u00a0Sai Patapanchala. 2016. Exploring Security Metrics for Electric Grid Infrastructure Leveraging Attack Graphs. Master\u2019s Thesis: Oregon State University Corvallis OR USA.","DOI":"10.1109\/SusTech.2016.7897148"},{"key":"e_1_3_3_2_23_2","doi-asserted-by":"publisher","unstructured":"Damiano Ravalico Mauro Farina Martino Trevisan and Alberto Bartoli. 2024. Analysing the Temporal Dynamics of the Exploit Prediction Scoring Systems (EPSS). SSRN Electronic Journal (2024). 10.2139\/ssrn.5147459","DOI":"10.2139\/ssrn.5147459"},{"key":"e_1_3_3_2_24_2","doi-asserted-by":"crossref","unstructured":"Raymond\u00a0E. Sawilla and Xinming Ou. 2008. Identifying Critical Attack Assets in Dependency Attack Graphs. ESORICS (2008) 18\u201334.","DOI":"10.1007\/978-3-540-88313-5_2"},{"key":"e_1_3_3_2_25_2","doi-asserted-by":"publisher","DOI":"10.1109\/SECPRI.2002.1004377"},{"key":"e_1_3_3_2_26_2","doi-asserted-by":"publisher","unstructured":"Brandon Wang Xiaoye Li Leandro\u00a0P. de Aguiar Daniel\u00a0S. Menasche and Zubair Shafiq. 2017. Characterizing and Modeling Patching Practices of Industrial Control Systems. Proc. ACM Meas. Anal. Comput. Syst. 1 1 Article 18 (June 2017) 23\u00a0pages. 10.1145\/3084455","DOI":"10.1145\/3084455"},{"key":"e_1_3_3_2_27_2","doi-asserted-by":"crossref","unstructured":"Avishai Wool. 2004. A quantitative study of firewall configuration errors. Computer 37 6 (2004) 62\u201367.","DOI":"10.1109\/MC.2004.2"}],"event":{"name":"SVM '26: 4th International Workshop on Software Vulnerability Management","location":"Rio de Janeiro Brazil","acronym":"SVM '26","sponsor":["SIGSOFT ACM Special Interest Group on Software Engineering"]},"container-title":["Proceedings of the 2026 IEEE\/ACM 4th International Workshop on Software Vulnerability Management"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3786165.3788442","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,13]],"date-time":"2026-05-13T09:50:38Z","timestamp":1778665838000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3786165.3788442"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4,12]]},"references-count":26,"alternative-id":["10.1145\/3786165.3788442","10.1145\/3786165"],"URL":"https:\/\/doi.org\/10.1145\/3786165.3788442","relation":{},"subject":[],"published":{"date-parts":[[2026,4,12]]},"assertion":[{"value":"2026-05-13","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}