Laurie A Williams

Do Software Security Practices Yield Fewer Vulnerabilities?

2023 IEEE/ACM 45TH INTERNATIONAL CONFERENCE ON SOFTWARE ENGINEERING: SOFTWARE ENGINEERING IN PRACTICE, ICSE-SEIP, pp. 292–303.

Open or Sneaky? Fast or Slow? Light or Heavy?: Investigating Security Releases of Open Source Packages

IEEE TRANSACTIONS ON SOFTWARE ENGINEERING, 49(4), 1540–1560.

SecretBench: A Dataset of Software Secrets

2023 IEEE/ACM 20TH INTERNATIONAL CONFERENCE ON MINING SOFTWARE REPOSITORIES, MSR, pp. 347–351.

What Are the Attackers Doing Now? Automating Cyberthreat Intelligence Extraction from Text on Pace with the Changing Threat Landscape: A Survey

ACM COMPUTING SURVEYS, 55(12).

What Challenges Do Developers Face About Checked-in Secrets in Software Artifacts?

2023 IEEE/ACM 45TH INTERNATIONAL CONFERENCE ON SOFTWARE ENGINEERING, ICSE, pp. 1635–1647.

Dazzle: Using Optimized Generative Adversarial Networks to Address Security Data Class Imbalance Issue

2022 MINING SOFTWARE REPOSITORIES CONFERENCE (MSR 2022), pp. 144–155.

Do I really need all this work to find vulnerabilities? An empirical case study comparing vulnerability detection techniques on a Java application

EMPIRICAL SOFTWARE ENGINEERING, 27(6).

Exploring the Shift in Security Responsibility

Weir, C., Migues, S., & Williams, L. (2022, March 9). IEEE SECURITY & PRIVACY.

Feature toggles as code: Heuristics and metrics for structuring feature toggles

INFORMATION AND SOFTWARE TECHNOLOGY, 145.

Omni: automated ensemble with unexpected models against adversarial evasion attack

EMPIRICAL SOFTWARE ENGINEERING, 27(1).

Top Five Challenges in Software Supply Chain Security: Observations From 30 Industry and Government Organizations

IEEE SECURITY & PRIVACY, 20(2), 96–100.

What are Weak Links in the npm Supply Chain?

2022 ACM/IEEE 44TH INTERNATIONAL CONFERENCE ON SOFTWARE ENGINEERING: SOFTWARE ENGINEERING IN PRACTICE (ICSE-SEIP 2022), pp. 331–340.

What are the Practices for Secret Management in Software Artifacts?

2022 IEEE SECURE DEVELOPMENT CONFERENCE (SECDEV 2022), pp. 69–76.

Why secret detection tools are not enough: It's not just about false positives-An industrial case study

EMPIRICAL SOFTWARE ENGINEERING, 27(3).

Different Kind of Smells: Security Smells in Infrastructure as Code Scripts

IEEE SECURITY & PRIVACY, 19(3), 33–41.

How to Better Distinguish Security Bug Reports (Using Dual Hyperparameter Optimization)

EMPIRICAL SOFTWARE ENGINEERING, 26(3).

Improving Vulnerability Inspection Efficiency Using Active Learning

IEEE TRANSACTIONS ON SOFTWARE ENGINEERING, 47(11), 2401–2420.

Infiltrating Security into Development: Exploring the World' Largest Software Security Study

PROCEEDINGS OF THE 29TH ACM JOINT MEETING ON EUROPEAN SOFTWARE ENGINEERING CONFERENCE AND SYMPOSIUM ON THE FOUNDATIONS OF SOFTWARE ENGINEERING (ESEC/FSE '21), pp. 1326–1336.

Security Smells in Ansible and Chef Scripts: A Replication Study

ACM TRANSACTIONS ON SOFTWARE ENGINEERING AND METHODOLOGY, 30(1).

Software development with feature toggles: practices used by practitioners

EMPIRICAL SOFTWARE ENGINEERING, 26(1).

Structuring a Comprehensive Software Security Course Around the OWASP Application Security Verification Standard

2021 IEEE/ACM 43RD INTERNATIONAL CONFERENCE ON SOFTWARE ENGINEERING: JOINT TRACK ON SOFTWARE ENGINEERING EDUCATION AND TRAINING (ICSE-JSEET 2021), pp. 95–104.

A Literature Review on Mining Cyberthreat Intelligence from Unstructured Texts

20TH IEEE INTERNATIONAL CONFERENCE ON DATA MINING WORKSHOPS (ICDMW 2020), pp. 516–525.

Better together: Comparing vulnerability prediction models

INFORMATION AND SOFTWARE TECHNOLOGY, 119.

Gang of Eight: A Defect Taxonomy for Infrastructure as Code Scripts

2020 ACM/IEEE 42ND INTERNATIONAL CONFERENCE ON SOFTWARE ENGINEERING (ICSE 2020), pp. 752–764.

The 'as code' activities: development anti-patterns for infrastructure as code

EMPIRICAL SOFTWARE ENGINEERING, 25(5), 3430–3467.

A systematic mapping study of infrastructure as code research

INFORMATION AND SOFTWARE TECHNOLOGY, 108, 65–77.

How Do Developers Act on Static Analysis Alerts? An Empirical Study of Coverity Usage

2019 IEEE 30TH INTERNATIONAL SYMPOSIUM ON SOFTWARE RELIABILITY ENGINEERING (ISSRE), pp. 323–333.

Share, But Be Aware: Security Smells in Python Gists

2019 IEEE INTERNATIONAL CONFERENCE ON SOFTWARE MAINTENANCE AND EVOLUTION (ICSME 2019), pp. 536–540.

Source code properties of defective infrastructure as code scripts

INFORMATION AND SOFTWARE TECHNOLOGY, 112, 148–163.

The Seven Sins: Security Smells in Infrastructure as Code Scripts

2019 IEEE/ACM 41ST INTERNATIONAL CONFERENCE ON SOFTWARE ENGINEERING (ICSE 2019), pp. 164–175.

Are Vulnerabilities Discovered and Resolved like Other Defects?

PROCEEDINGS 2018 IEEE/ACM 40TH INTERNATIONAL CONFERENCE ON SOFTWARE ENGINEERING (ICSE), pp. 498–498.

Are vulnerabilities discovered and resolved like other defects?

EMPIRICAL SOFTWARE ENGINEERING, 23(3), 1383–1421.

Attack surface definitions: A systematic literature review

[Review of ]. INFORMATION AND SOFTWARE TECHNOLOGY, 104, 94–103.

Characterizing Defective Configuration Scripts Used for Continuous Deployment

2018 IEEE 11TH INTERNATIONAL CONFERENCE ON SOFTWARE TESTING, VERIFICATION AND VALIDATION (ICST), pp. 34–45.

Continuously Integrating Security

2018 IEEE/ACM 1ST INTERNATIONAL WORKSHOP ON SECURITY AWARENESS FROM DESIGN TO DEPLOYMENT (SEAD), pp. 1–2.

Identifying Security Issues in Software Development: Are Keywords Enough?

PROCEEDINGS 2018 IEEE/ACM 40TH INTERNATIONAL CONFERENCE ON SOFTWARE ENGINEERING - COMPANION (ICSE-COMPANION, pp. 426–427.

Mapping the field of software life cycle security metrics

INFORMATION AND SOFTWARE TECHNOLOGY, 102, 146–159.

Poster: Defect Prediction Metrics for Infrastructure as Code Scripts in DevOps

PROCEEDINGS 2018 IEEE/ACM 40TH INTERNATIONAL CONFERENCE ON SOFTWARE ENGINEERING - COMPANION (ICSE-COMPANION, pp. 414–415.

What Questions Do Programmers Ask About Configuration as Code?

PROCEEDINGS 2018 IEEE/ACM 4TH INTERNATIONAL WORKSHOP ON RAPID CONTINUOUS SOFTWARE ENGINEERING (RCOSE), pp. 16–22.

Highlights of the ACM Student Research Competition

Williams, L., & Baldwin, D. (2017, November). COMMUNICATIONS OF THE ACM, Vol. 60, pp. 5–5.

Identifying the implied: Findings from three differentiated replications on the use of security requirements templates

EMPIRICAL SOFTWARE ENGINEERING, 22(4), 2127–2178.

TMAP: Discovering relevant API methods through text mining of API documentation

Journal of Software: Evolution and Process, 29(12), e1845.

The Rising Tide Lifts All Boats: The Advancement of Science in Cyber Security (Invited Talk)

ESEC/FSE 2017: PROCEEDINGS OF THE 2017 11TH JOINT MEETING ON FOUNDATIONS OF SOFTWARE ENGINEERING, pp. 1–1.

The Top 10 Adages in Continuous Deployment

IEEE SOFTWARE, 34(3), 86–95.

To log, or not to log: using heuristics to identify mandatory log events - a controlled experiment

EMPIRICAL SOFTWARE ENGINEERING, 22(5), 2684–2717.

Twist-3 Distribution Amplitudes of Pion in the Light-Front Quark Model

Few-Body Systems, 58(2).

ICON: Inferring temporal constraints from natural language API descriptions

32nd ieee international conference on software maintenance and evolution (icsme 2016), 378–388.

NANE: Identifying Misuse Cases Using Temporal Norm Enactments

2016 IEEE 24TH INTERNATIONAL REQUIREMENTS ENGINEERING CONFERENCE (RE), pp. 136–145.

Software Security in DevOps: Synthesizing Practitioners' Perceptions and Practices

INTERNATIONAL WORKSHOP ON CONTINUOUS SOFTWARE EVOLUTION AND DELIVERY, CSED 2016, pp. 70–76.

Stack traces reveal attack surfaces

Perspectives on Data Science for Software Engineering, 73–76.

Towards characterization of photo-excited electron transfer and catalysis in natural and artificial systems using XFELs

FARADAY DISCUSSIONS, 194, 621–638.

Tutorial: text analytics for security

Symposium and Bootcamp on the Science of Security, 124–125.

systematically developing prevention, detection, and response patterns for security requirements

2016 IEEE 24th International Requirements Engineering Conference Workshops (REW), 62–67.

Discovering likely mappings between APIs using text mining

Ieee international working conference on source code analysis and, 231–240.

How have we evaluated software pattern application? A systematic mapping study of research design practices

INFORMATION AND SOFTWARE TECHNOLOGY, 65, 14–38.

Synthesizing Continuous Deployment Practices Used in Software Development

2015 AGILE CONFERENCE, pp. 1–10.

Agile Software Development in Practice

In Lecture Notes in Business Information Processing (pp. 32–45).

Hidden in plain sight: Automatically identifying security requirements from natural language artifacts

2014 ieee 22nd international requirements engineering conference (re), 183–192.

On Coverage-Based Attack Profiles

2014 IEEE EIGHTH INTERNATIONAL CONFERENCE ON SOFTWARE SECURITY AND RELIABILITY - COMPANION (SERE-C 2014), pp. 5–6.

Towards a framework to measure security expertise in requirements analysis

2014 IEEE 1st Workshop on Evolving Security and Privacy Requirements Engineering (ESPRE), 13–18.

A comparison of the efficiency and effectiveness of vulnerability discovery techniques

INFORMATION AND SOFTWARE TECHNOLOGY, 55(7), 1279–1288.

Access Control Policy Extraction from Unconstrained Natural Language Text

2013 ASE/IEEE INTERNATIONAL CONFERENCE ON SOCIAL COMPUTING (SOCIALCOM), pp. 435–440.

Automated extraction of non-functional requirements in available documentation

2013 1st International Workshop on Natural Language Analysis in Software Engineering (NaturaLiSE), 9–16.

Can traditional fault prediction models be used for vulnerability prediction?

EMPIRICAL SOFTWARE ENGINEERING, 18(1), 25–59.

Non-operational testing of software for security issues

2013 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW), 21–22.

Proposing Regulatory-Driven Automated Test Suites

2013 AGILE CONFERENCE (AGILE), pp. 11–21.

Proposing regulatory-driven automated test suites for electronic health record systems

2013 5th international workshop on software engineering in health care (sehc), 46–49.

Towards the prioritization of system test cases

Software Testing, Verification and Reliability, 24(4), 320–337.

Validating Software Metrics: A Spectrum of Philosophies

ACM TRANSACTIONS ON SOFTWARE ENGINEERING AND METHODOLOGY, 21(4).

What Agile Teams Think of Agile Principles

COMMUNICATIONS OF THE ACM, 55(4), 71–76.

A systematic literature review of actionable alert identification techniques for automated static code analysis

[Review of ]. INFORMATION AND SOFTWARE TECHNOLOGY, 53(4), 363–387.

Socio-technical developer networks: Should we trust our measurements?

2011 33rd International Conference on Software Engineering (ICSE), 281–290.

Agile software development methodologies and practices

Advances in Computers, Vol 80, 80, 1–44.

Guest editorial: Special issue on software reliability engineering

Williams, L. (2010, August). EMPIRICAL SOFTWARE ENGINEERING, Vol. 15, pp. 321–322.

Idea: Using System Level Testing for Revealing SQL Injection-Related Error Message Information Leaks

In F. Massacci, D. Wallach, & N. Zannone (Eds.), Engineering Secure Software and Systems. ESSoS 2010 (pp. 192–200).

Idea: Using system level testing for revealing SQL injection-related error message information leaks

Engineering secure software and systems, proceedings, 5965, 192–200.

Protection Poker: The New Software Security "Game"

IEEE SECURITY & PRIVACY, 8(3), 14–20.

On automated prepared statement generation to remove SQL injection vulnerabilities

INFORMATION AND SOFTWARE TECHNOLOGY, 51(3), 589–598.

On guiding the augmentation of an automated test suite via mutation analysis

EMPIRICAL SOFTWARE ENGINEERING, 14(3), 341–369.

Protection Poker: Structuring Software Security Risk Assessment and Knowledge Transfer

In F. Massacci, S. T. Redwine, & N. Zannone (Eds.), Engineering Secure Software and Systems. ESSoS 2009 (pp. 122–134).

Secure open source collaboration: An empirical study of linus' law

CCS'09: Proceedings of the 16th ACM Conference on Computer and Communications Security, 453–462.

Should software testers use mutation analysis to augment a test set?

JOURNAL OF SYSTEMS AND SOFTWARE, 82(11), 1819–1832.

Toward Non-security Failures as a Predictor of Security Faults and Failures

In F. Massacci, S. T. Redwine, & N. Zannone (Eds.), Engineering Secure Software and Systems. ESSoS 2009. (pp. 135–149).

Addressing diverse needs through a balance of agile and plan-driven software development methodologies in the core software engineering course

International Journal of Engineering Education, 24(4), 659–670.

Realizing quality improvement through test driven development: results and experiences of four industrial teams

EMPIRICAL SOFTWARE ENGINEERING, 13(3), 289–302.

Industry-Research Collaboration Working Group Results

In V. R. Basili, D. Rombach, K. Schneider, B. Kitchenham, D. Pfahl, & R. W. Selby (Eds.), Empirical Software Engineering Issues. Critical Assessment and Future Directions (pp. 153–157).

On the design of more secure software-intensive systems by use of attack patterns

INFORMATION AND SOFTWARE TECHNOLOGY, 49(4), 381–397.

Roadmapping Working Group 4 Results

In V. R. Basili, D. Rombach, K. Schneider, B. Kitchenham, D. Pfahl, & R. W. Selby (Eds.), Empirical Software Engineering Issues. Critical Assessment and Future Directions (pp. 181–183).

Structuring Families of Industrial Case Studies

In V. R. Basili, D. Rombach, K. Schneider, B. Kitchenham, D. Pfahl, & R. W. Selby (Eds.), Empirical Software Engineering Issues. Critical Assessment and Future Directions (pp. 134–134).

Essential communication practices for Extreme Programming in a global software development team

INFORMATION AND SOFTWARE TECHNOLOGY, 48(9), 781–794.

Motivations and measurements in an agile case study

Layman, L., Williams, L., & Cunningham, L. (2006, November). JOURNAL OF SYSTEMS ARCHITECTURE, Vol. 52, pp. 654–667.

On the value of static analysis for fault detection in software

IEEE TRANSACTIONS ON SOFTWARE ENGINEERING, 32(4), 240–253.

A structured experiment of test-driven development

George, B., & Williams, L. (2004, April 15). INFORMATION AND SOFTWARE TECHNOLOGY, Vol. 46, pp. 337–342.

On understanding compatibility of student pair programmers

Proceedings of the 35th SIGCSE technical symposium on Computer science education - SIGCSE '04. Presented at the the 35th SIGCSE technical symposium.

Pair learning: With an eye toward future success

In Extreme programming and agile methods: XP/Agile Universe 2003: Third XP Agile Universe Conference, New Orleans, LA, USA, August 10-13, 2003 (Vol. 2753, pp. 185–198).

The Economics of Software Development by Pair Programmers

The Engineering Economist, 48(4), 283–319.

The XP programmer: The few-minutes programmer

IEEE SOFTWARE, Vol. 20, pp. 16–20.

Distributed Pair Programming: Empirical Studies and Supporting Environments

(pp. TR02–010). Chapel Hill, NC: Dept. of Computer Science, University of North Carolina.

Extreme programming and agile methods XP/Agile Universe 2002 : Second XP Universe and First Agile Universe Conference, Chicago, IL, USA, August 4-7, 2002 : proceedings

Berlin ;|aNew York: Springer.

In support of paired programming in the introductory computer science course

Computer Science Education, 12(3), 197–212.

Integrating Agile Practices into Software Engineering Courses

Computer Science Education, 12(3), 169–185.

Letters - Try it, you'll like it

Pair programming in an introductory computer science course: Initial results and recommendations

OOPSLA 2002: 17th ACM Conference on Object-Oriented Programming, Systems, Languages, and Applications : conference proceedings: November 4-8, 2002, Washington State Convention and Trade Center, Seattle, Washington, USA. New York, NY: ACM Press.

Teaching PSP: Challenges and lessons learned

IEEE SOFTWARE, Vol. 19, pp. 42-+.

Experiments with Industry's “Pair-Programming” Model in the Computer Science Classroom

Computer Science Education, 11(1), 7–20.

Strengthening the case for pair programming

IEEE SOFTWARE, 17(4), 19-+.