<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-01369556</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-21T07:17:10+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">An Information Flow-Based Taxonomy to Understand the Nature of Software Vulnerabilities</title>
            <author role="aut">
              <persName>
                <forename type="first">Daniela</forename>
                <surname>Oliveira</surname>
              </persName>
              <email type="md5">ff402bc39200af45c32650ffac904ea9</email>
              <email type="domain">ece.ufl.edu</email>
              <idno type="idhal" notation="numeric">989243</idno>
              <idno type="halauthorid" notation="string">1060762-989243</idno>
              <affiliation ref="#struct-302308"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Jedidiah</forename>
                <surname>Crandall</surname>
              </persName>
              <idno type="halauthorid">1060763-0</idno>
              <affiliation ref="#struct-117472"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Harry</forename>
                <surname>Kalodner</surname>
              </persName>
              <idno type="halauthorid">1060764-0</idno>
              <affiliation ref="#struct-46584"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Nicole</forename>
                <surname>Morin</surname>
              </persName>
              <idno type="halauthorid">152392-0</idno>
              <affiliation ref="#struct-466801"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Megan</forename>
                <surname>Maher</surname>
              </persName>
              <idno type="halauthorid">1060765-0</idno>
              <affiliation ref="#struct-466801"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Jesus</forename>
                <surname>Navarro</surname>
              </persName>
              <idno type="halauthorid">56944-0</idno>
              <affiliation ref="#struct-466802"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Felix</forename>
                <surname>Emiliano</surname>
              </persName>
              <idno type="halauthorid">1060766-0</idno>
              <affiliation ref="#struct-466801"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Hal</forename>
                <surname>Ifip</surname>
              </persName>
              <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
              <email type="domain">inria.fr</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2016-09-21 10:56:29</date>
              <date type="whenModified">2025-02-28 16:20:02</date>
              <date type="whenReleased">2016-09-21 11:21:11</date>
              <date type="whenProduced">2016-05-30</date>
              <date type="whenEndEmbargoed">2019-01-01</date>
              <ref type="file" target="https://inria.hal.science/hal-01369556v1/document">
                <date notBefore="2019-01-01"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://inria.hal.science/hal-01369556v1/file/421518_1_En_16_Chapter.pdf" id="file-1369556-1450732">
                <date notBefore="2019-01-01"/>
              </ref>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="200187">
                <persName>
                  <forename>Hal</forename>
                  <surname>Ifip</surname>
                </persName>
                <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
                <email type="domain">inria.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-01369556</idno>
            <idno type="halUri">https://inria.hal.science/hal-01369556</idno>
            <idno type="halBibtex">oliveira:hal-01369556</idno>
            <idno type="halRefHtml">&lt;i&gt;31st IFIP International Information Security and Privacy Conference (SEC)&lt;/i&gt;, May 2016, Ghent, Belgium. pp.227-242, &lt;a target="_blank" href="https://dx.doi.org/10.1007/978-3-319-33630-5_16"&gt;&amp;#x27E8;10.1007/978-3-319-33630-5_16&amp;#x27E9;&lt;/a&gt;</idno>
            <idno type="halRef">31st IFIP International Information Security and Privacy Conference (SEC), May 2016, Ghent, Belgium. pp.227-242, &amp;#x27E8;10.1007/978-3-319-33630-5_16&amp;#x27E9;</idno>
            <availability status="restricted">
              <licence target="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0 - Attribution<ref corresp="#file-1369556-1450732"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="IFIP">IFIP - International Federation for Information Processing</idno>
            <idno type="stamp" n="IFIP-AICT" corresp="IFIP">IFIP Advances in Information and Communication Technology</idno>
            <idno type="stamp" n="IFIP-TC" corresp="IFIP">IFIP Technical Committees </idno>
            <idno type="stamp" n="IFIP-TC11" corresp="IFIP-TC">IFIP TC11: Security and Privacy Protection in Information Processing Systems</idno>
            <idno type="stamp" n="IFIP-SEC" corresp="IFIP"> International Information Security Conference</idno>
            <idno type="stamp" n="IFIP-AICT-471" corresp="IFIP-AICT">ICT Systems Security and Privacy Protection</idno>
          </seriesStmt>
          <notesStmt>
            <note type="commentary">Part 6: Software Vulnerabilities</note>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">An Information Flow-Based Taxonomy to Understand the Nature of Software Vulnerabilities</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Daniela</forename>
                    <surname>Oliveira</surname>
                  </persName>
                  <email type="md5">ff402bc39200af45c32650ffac904ea9</email>
                  <email type="domain">ece.ufl.edu</email>
                  <idno type="idhal" notation="numeric">989243</idno>
                  <idno type="halauthorid" notation="string">1060762-989243</idno>
                  <affiliation ref="#struct-302308"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Jedidiah</forename>
                    <surname>Crandall</surname>
                  </persName>
                  <idno type="halauthorid">1060763-0</idno>
                  <affiliation ref="#struct-117472"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Harry</forename>
                    <surname>Kalodner</surname>
                  </persName>
                  <idno type="halauthorid">1060764-0</idno>
                  <affiliation ref="#struct-46584"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Nicole</forename>
                    <surname>Morin</surname>
                  </persName>
                  <idno type="halauthorid">152392-0</idno>
                  <affiliation ref="#struct-466801"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Megan</forename>
                    <surname>Maher</surname>
                  </persName>
                  <idno type="halauthorid">1060765-0</idno>
                  <affiliation ref="#struct-466801"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Jesus</forename>
                    <surname>Navarro</surname>
                  </persName>
                  <idno type="halauthorid">56944-0</idno>
                  <affiliation ref="#struct-466802"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Felix</forename>
                    <surname>Emiliano</surname>
                  </persName>
                  <idno type="halauthorid">1060766-0</idno>
                  <affiliation ref="#struct-466801"/>
                </author>
              </analytic>
              <monogr>
                <title level="m">IFIP Advances in Information and Communication Technology</title>
                <meeting>
                  <title>31st IFIP International Information Security and Privacy Conference (SEC)</title>
                  <date type="start">2016-05-30</date>
                  <date type="end">2016-06-01</date>
                  <settlement>Ghent</settlement>
                  <country key="BE">Belgium</country>
                </meeting>
                <editor>Jaap-Henk Hoepman</editor>
                <editor>Stefan Katzenbeisser</editor>
                <imprint>
                  <biblScope unit="serie">ICT Systems Security and Privacy Protection</biblScope>
                  <biblScope unit="volume">AICT-471</biblScope>
                  <biblScope unit="pp">227-242</biblScope>
                  <date type="datePub">2016</date>
                </imprint>
              </monogr>
              <idno type="doi">10.1007/978-3-319-33630-5_16</idno>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <classCode scheme="halDomain" n="info">Computer Science [cs]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>Despite the emphasis on building secure software, the number of vulnerabilities found in our systems is increasing every year, and well-understood vulnerabilities continue to be exploited. A common response to vulnerabilities is patch-based mitigation, which does not completely address the flaw and is often circumvented by an adversary. The problem actually lies in a lack of understanding of the nature of vulnerabilities. Vulnerability taxonomies have been proposed, but their usability is limited because of their ambiguity and complexity. This paper presents a taxonomy that views vulnerabilities as fractures in the interpretation of information as it flows in the system. It also presents a machine learning study validating the taxonomy’s unambiguity. A manually labeled set of 641 vulnerabilities trained a classifier that automatically categorized more than 70000 vulnerabilities from three distinct databases with an average success rate of 80 %. Important lessons learned are discussed such as (i) approximately 12 % of the studied reports provide insufficient information about vulnerabilities, and (ii) the roles of the reporter and developer are not leveraged, especially regarding information about tools used to find vulnerabilities and approaches to address them.</p>
            </abstract>
            <particDesc>
              <org type="consortium">TC 11</org>
            </particDesc>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="regroupinstitution" xml:id="struct-302308" status="VALID">
          <idno type="ROR">https://ror.org/02y3ad647</idno>
          <orgName>University of Florida [Gainesville]</orgName>
          <orgName type="acronym">UF</orgName>
          <desc>
            <address>
              <addrLine>Gainesville, FL 32611</addrLine>
              <country key="US"/>
            </address>
            <ref type="url">http://www.ufl.edu/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-117472" status="VALID">
          <idno type="ROR">https://ror.org/05fs6jp91</idno>
          <orgName>The University of New Mexico [Albuquerque]</orgName>
          <desc>
            <address>
              <addrLine>Albuquerque, Nouveau-Mexique 87131</addrLine>
              <country key="US"/>
            </address>
            <ref type="url">https://www.unm.edu/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-1205038" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-46584" status="VALID">
          <idno type="ROR">https://ror.org/00hx57361</idno>
          <orgName>Princeton University</orgName>
          <desc>
            <address>
              <addrLine>Princeton, NJ 08544 USA</addrLine>
              <country key="US"/>
            </address>
            <ref type="url">http://www.princeton.edu/main/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-466801" status="VALID">
          <idno type="ROR">https://ror.org/03gh96r95</idno>
          <orgName>Bowdoin College [Brunswick]</orgName>
          <date type="start">2016-09-27</date>
          <desc>
            <address>
              <addrLine>Maine St, Brunswick, ME 04011, USA</addrLine>
              <country key="US"/>
            </address>
            <ref type="url">http://www.bowdoin.edu/</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-466802" status="VALID">
          <orgName>Nvidia Corporation [Santa Clara]</orgName>
          <date type="start">2016-09-27</date>
          <desc>
            <address>
              <addrLine>NVIDIA CORPORATE HEADQUARTERS2701 San Tomas ExpresswaySanta Clara, CA 95050</addrLine>
              <country key="US"/>
            </address>
          </desc>
        </org>
        <org type="regroupinstitution" xml:id="struct-1205038" status="VALID">
          <orgName>New Mexico Consortium</orgName>
          <orgName type="acronym">NMC</orgName>
          <desc>
            <address>
              <addrLine>4200 W. Jemez Rd, Suite 301Los Alamos, NM 87544</addrLine>
              <country key="US"/>
            </address>
            <ref type="url">https://newmexicoconsortium.org</ref>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>