Laurie A Williams

Trusting Code in the Wild: Exploring Contributor Reputation Measures to Review Dependencies in the Rust Ecosystem

Hamer, S., Imtiaz, N., Tamanna, M., Shabrina, P., & Williams, L. (2025, March 18). IEEE Transactions on Software Engineering.

Comparing effectiveness and efficiency of Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP) tools in a large java-based system

Seth, A., Bhattacharya, S., Zahan, N., & Williams, L. (2025, February 15). Empirical Software Engineering, Vol. 30.

If you cannot Measure it, you cannot Secure it. A Case Study on Metrics for Informed Choice of Security Controls

Rahman, M. R., Rahman, I., & Williams, L. (2025, May 9). Journal of Information Security and Applications.

It Should Be Easy but... New Users' Experiences and Challenges with Secret Management Tools

Mining temporal attack patterns from cyberthreat intelligence reports

Rahman, M. R., Wroblewski, B., Matthews, Q., Morgan, B., Menzies, T., & Williams, L. (2025, July 22). Knowledge and Information Systems, Vol. 7.

Research Directions in Software Supply Chain Security

Williams, L., Benedetti, G., Hamer, S., Paramitha, R., Rahman, I., Tamanna, M., … Enck, W. (2025, January 27). ACM Transactions on Software Engineering and Methodology, Vol. 34.

SoK: An empirical investigation of malware techniques in advanced persistent threat attacks

Rahman, M. R., Basak, S. K., Hezaveh, R. M., & Williams, L. (2025, August 9). Computers & Security.

Which Is Better For Reducing Outdated and Vulnerable Dependencies: Pinning or Floatingƒ

Rahman, I., Marley, J., Enck, W., & Williams, L. (2025, November 16). (Vol. 11). Vol. 11.

Your Build Scripts Stink: The State of Code Smells in Build Scripts

Tamanna, M., Chandrani, Y., Burrows, M., Wroblewski, B., Williams, L., & Wermke, D. (2025, November 16). Proceedings of the 40th IEEE/ACM International Conference on Automated Software Engineering (ASE), Vol. 11.

A Survey on Software Vulnerability Exploitability Assessment

Rahman, M. R., Fringer, G., Kapoor, K., & Williams, L. (2024, March 20). ACM Computing Surveys.

Just another copy and paste? Comparing the security vulnerabilities of ChatGPT generated code and StackOverflow answers

Hamer, S., d’Amorim, M., & Williams, L. (2024, May 23). PROCEEDINGS 45TH IEEE SYMPOSIUM ON SECURITY AND PRIVACY WORKSHOPS, SPW 2024, pp. 87–94.

MalwareBench: Malware samples are not enough

Zahan, N., Burckhardt, P., Lysenko, M., Aboukhadijeh, F., & Williams, L. (2024, April 15). 2024 IEEE/ACM 21ST INTERNATIONAL CONFERENCE ON MINING SOFTWARE REPOSITORIES, MSR, pp. 728–732.

Narrowing the Software Supply Chain Attack Vectors: The SSDF Is Wonderful but not Enough

Williams, L. (2024, March 1). IEEE Security & Privacy.

Paving a Path for a Combined Family of Feature Toggle and Configuration Option Research

Mahdavi-Hezaveh, R., Fatima, S., & Williams, L. (2024, June 14). ACM Transactions on Software Engineering and Methodology.

Towards a Taxonomy of Challenges in Security Control Implementation

Rahman, M. R., Wroblewski, B., Tamanna, M., Rahman, I., Anufryienak, A., & Williams, L. (2024, December 9).

Are Your Dependencies Code Reviewed?: Measuring Code Review Coverage in Dependency Updates

Imtiaz, N., & Williams, L. (2023, September 28). IEEE Transactions on Software Engineering.

Do Software Security Practices Yield Fewer Vulnerabilities?

Zahan, N., Shohan, S., Harris, D., & Williams, L. (2023, May 1). 2023 IEEE/ACM 45TH INTERNATIONAL CONFERENCE ON SOFTWARE ENGINEERING: SOFTWARE ENGINEERING IN PRACTICE, ICSE-SEIP, pp. 292–303.

OpenSSF Scorecard: On the Path Toward Ecosystem-Wide Automated Security Metrics

Zahan, N., Kanakiya, P., Hambleton, B., Shohan, S., & Williams, L. (2023, June 26). IEEE Security & Privacy, Vol. 21, pp. 76–88.

SecretBench: A Dataset of Software Secrets

Software Supply Chain Security [Guest Editors’ Introduction]

Massacci, F., & Williams, L. (2023, November 1). IEEE Security & Privacy.

What Challenges Do Developers Face About Checked-in Secrets in Software Artifacts?

Basak, S. K., Neil, L., Reaves, B., & Williams, L. (2023, May 1). 2023 IEEE/ACM 45TH INTERNATIONAL CONFERENCE ON SOFTWARE ENGINEERING, ICSE, pp. 1635–1647.

Dazzle

Shu, R., Xia, T., Williams, L., & Menzies, T. (2022, May 23). 2022 MINING SOFTWARE REPOSITORIES CONFERENCE (MSR 2022), pp. 144–155.

Do I really need all this work to find vulnerabilities?

Zahan, N., Shu, R., Metro, M., Kozarev, V., Menzies, T., & Williams, L. (2022, August 6). Empirical Software Engineering, Vol. 27.

Exploring the Shift in Security Responsibility

Weir, C., Migues, S., & Williams, L. (2022, March 10). IEEE Security & Privacy.

Feature toggles as code: Heuristics and metrics for structuring feature toggles

Mahdavi-Hezaveh, R., Ajmeri, N., & Williams, L. (2022, January 14). Information and Software Technology, Vol. 5, pp. 1–14.

Open or Sneaky? Fast or Slow? Light or Heavy?: Investigating Security Releases of Open Source Packages

Imtiaz, N., Khanom, A., & Williams, L. (2022, June 9). IEEE Transactions on Software Engineering.

Top Five Challenges in Software Supply Chain Security: Observations From 30 Industry and Government Organizations

Enck, W., & Williams, L. (2022, March 1). IEEE Security & Privacy, Vol. 20, pp. 96–100.

What Are the Attackers Doing Now? Automating Cyberthreat Intelligence Extraction from Text on Pace with the Changing Threat Landscape: A Survey

Rahman, M. R., Hezaveh, R. M., & Williams, L. (2022, November 22). ACM Computing Surveys.

What are the Practices for Secret Management in Software Artifacts?

What are weak links in the npm supply chain?

Zahan, N., Zimmermann, T., Godefroid, P., Murphy, B., Maddila, C., & Williams, L. (2022, May 21). Proceedings of the 44th International Conference on Software Engineering: Software Engineering in Practice, pp. 331–340.

Why secret detection tools are not enough: It’s not just about false positives - An industrial case study

Rahman, M. R., Imtiaz, N., Storey, M.-A., & Williams, L. (2022, March 17). Empirical Software Engineering.

Different Kind of Smells: Security Smells in Infrastructure as Code Scripts

Rahman, A., & Williams, L. (2021, March 29). IEEE Security & Privacy.

How to Better Distinguish Security Bug Reports (Using Dual Hyperparameter Optimization)

Shu, R., Xia, T., Chen, J., Williams, L., & Menzies, T. (2021, April 5). Empirical Software Engineering, Vol. 26.

Infiltrating Security into Development: Exploring the World' Largest Software Security Study

Omni: automated ensemble with unexpected models against adversarial evasion attack

Shu, R., Xia, T., Williams, L., & Menzies, T. (2021, November 30). Empirical Software Engineering, Vol. 27.

Security Smells in Ansible and Chef Scripts

Rahman, A., Rahman, M. R., Parnin, C., & Williams, L. (2021, January 20). ACM Transactions on Software Engineering and Methodology.

Software development with feature toggles: practices used by practitioners

Mahdavi-Hezaveh, R., Dremann, J., & Williams, L. (2021, January 1). Empirical Software Engineering.

Structuring a Comprehensive Software Security Course Around the OWASP Application Security Verification Standard

E., S., Zahan, N., Kozarev, V., Shu, R., Menzies, T., & Williams, L. (2021, May 1). 2021 IEEE/ACM 43RD INTERNATIONAL CONFERENCE ON SOFTWARE ENGINEERING: JOINT TRACK ON SOFTWARE ENGINEERING EDUCATION AND TRAINING (ICSE-JSEET 2021), pp. 95–104.

A Literature Review on Mining Cyberthreat Intelligence from Unstructured Texts

Rahman, M. R., Mahdavi-Hezaveh, R., & Williams, L. (2020, November 1).

Gang of eight

Rahman, A., Farhana, E., Parnin, C., & Williams, L. (2020, June 27).

The ‘as code’ activities: development anti-patterns for infrastructure as code

Rahman, A., Farhana, E., & Williams, L. (2020, August 17). Empirical Software Engineering.

Better together: Comparing vulnerability prediction models

Theisen, C., & Williams, L. (2019, November 5). Information and Software Technology.

How Do Developers Act on Static Analysis Alerts? An Empirical Study of Coverity Usage

Imtiaz, N., Murphy, B., & Williams, L. (2019, October 1).

Improving Vulnerability Inspection Efficiency Using Active Learning

Yu, Z., Theisen, C., Williams, L., & Menzies, T. (2019, October 25). IEEE Transactions on Software Engineering, Vol. 47, pp. 2401–2420.

Share, But be Aware: Security Smells in Python Gists

Rahman, M. R., Rahman, A., & Williams, L. (2019, September 1).

Source code properties of defective infrastructure as code scripts

Rahman, A., & Williams, L. (2019, May 2). Information and Software Technology.

The Seven Sins: Security Smells in Infrastructure as Code Scripts

Rahman, A., Parnin, C., & Williams, L. (2019, May 1).

A systematic mapping study of infrastructure as code research

Rahman, A., Mahdavi-Hezaveh, R., & Williams, L. (2018, December 12). Information and Software Technology.

Are vulnerabilities discovered and resolved like other defects?

Morrison, P. J., Pandita, R., Xiao, X., Chillarege, R., & Williams, L. (2018, May 27).

Attack surface definitions: A systematic literature review

Theisen, C., Munaiah, N., Al-Zyoud, M., Carver, J. C., Meneely, A., & Williams, L. (2018, July 27). Information and Software Technology.

Characterizing Defective Configuration Scripts Used for Continuous Deployment

Rahman, A., & Williams, L. (2018, April 1).

Continuously integrating security

Williams, L. (2018, May 27).

Defect prediction metrics for infrastructure as code scripts in DevOps

Rahman, A., Stallings, J., & Williams, L. (2018, May 27). Proceedings - International Conference on Software Engineering, pp. 414–415.

Identifying security issues in software development

Morrison, P., Oyetoyan, T. D., & Williams, L. (2018, May 27).

Mapping the field of software life cycle security metrics

Morrison, P., Moye, D., Pandita, R., & Williams, L. (2018, May 30). Information and Software Technology.

What questions do programmers ask about configuration as code?

Rahman, A., Partho, A., Morrison, P., & Williams, L. (2018, May 29).

Are vulnerabilities discovered and resolved like other defects?

Morrison, P. J., Pandita, R., Xiao, X., Chillarege, R., & Williams, L. (2017, September 19). Empirical Software Engineering.

Highlights of the ACM student research competition

Williams, L., & Baldwin, D. (2017, October 24). Communications of the ACM.

TMAP: Discovering relevant API methods through text mining of API documentation

Journal of Software: Evolution and Process, 29(12), e1845.

The Top 10 Adages in Continuous Deployment

Parnin, C., Helms, E., Atlee, C., Boughton, H., Ghattas, M., Glover, A., … Williams, L. (2017, May 1). IEEE Software.

The rising tide lifts all boats: the advancement of science in cyber security (invited talk)

Williams, L. (2017, August 2).

Twist-3 Distribution Amplitudes of Pion in the Light-Front Quark Model

Few-Body Systems, 58(2).

ICON: Inferring temporal constraints from natural language API descriptions

32nd ieee international conference on software maintenance and evolution (icsme 2016), 378–388.

Identifying the implied: Findings from three differentiated replications on the use of security requirements templates

Riaz, M., King, J., Slankas, J., Williams, L., Massacci, F., Quesada-López, C., & Jenkins, M. (2016, December 16). Empirical Software Engineering, Vol. 22, pp. 2127–2178.

NANE: Identifying Misuse Cases Using Temporal Norm Enactments

Kafali, O., Singh, M. P., & Williams, L. (2016, September 1). IEEE 25TH INTERNATIONAL REQUIREMENTS ENGINEERING CONFERENCE (RE), pp. 136–145.

Software security in DevOps

Rahman, A. A. U., & Williams, L. (2016, May 14).

Stack traces reveal attack surfaces

Perspectives on Data Science for Software Engineering, 73–76.

To log, or not to log: using heuristics to identify mandatory log events – a controlled experiment

King, J., Stallings, J., Riaz, M., & Williams, L. (2016, August 24). Empirical Software Engineering, Vol. 22, pp. 2684–2717.

Towards characterization of photo-excited electron transfer and catalysis in natural and artificial systems using XFELs

Alonso-Mori, R., Asa, K., Bergmann, U., Brewster, A. S., Chatterjee, R., Cooper, J. K., … Yano, J. (2016, January 1). Faraday Discussions, Vol. 194, pp. 621–638.

Tutorial: text analytics for security

Symposium and Bootcamp on the Science of Security, 124–125.

systematically developing prevention, detection, and response patterns for security requirements

2016 IEEE 24th International Requirements Engineering Conference Workshops (REW), 62–67.

Discovering likely mappings between APIs using text mining

Pandita, R., Jetley, R. P., Sudarsan, S. D., & Williams, L. (2015, September 1).

How have we evaluated software pattern application? A systematic mapping study of research design practices

Riaz, M., Breaux, T., & Williams, L. (2015, April 11). Information and Software Technology.

Synthesizing Continuous Deployment Practices Used in Software Development

Rahman, A. A. U., Helms, E., Williams, L., & Parnin, C. (2015, August 1).

Agile Software Development in Practice

In Lecture Notes in Business Information Processing (pp. 32–45).

Hidden in plain sight: Automatically identifying security requirements from natural language artifacts

Riaz, M., King, J., Slankas, J., & Williams, L. (2014, August 1). 2014 Ieee 22nd International Requirements Engineering Conference (Re), pp. 183–192.

On Coverage-Based Attack Profiles

Rivers, A. T., Vouk, M. A., & Williams, L. A. (2014, June 1).

Towards a framework to measure security expertise in requirements analysis

Hibshi, H., Breaux, T., Riaz, M., & Williams, L. (2014, August 1).

Access Control Policy Extraction from Unconstrained Natural Language Text

Slankas, J., & Williams, L. (2013, September 1).

Automated extraction of non-functional requirements in available documentation

Slankas, J., & Williams, L. (2013, May 1).

Non-operational testing of software for security issues

Subramani, S., Vouk, M., & Williams, L. (2013, November 1).

Proposing Regulatory-Driven Automated Test Suites

Morrison, P., Holmgreen, C., Massey, A., & Williams, L. (2013, August 1).

Proposing regulatory-driven automated test suites for electronic health record systems

Morrison, P., Holmgreen, C., Massey, A., & Williams, L. (2013, May 1).

Towards the prioritization of system test cases

Software Testing, Verification and Reliability, 24(4), 320–337.

A comparison of the efficiency and effectiveness of vulnerability discovery techniques

Austin, A., Holmgreen, C., & Williams, L. (2012, December 8). Information and Software Technology.

Validating software metrics

Meneely, A., Smith, B., & Williams, L. (2012, November 1). ACM Transactions on Software Engineering and Methodology.

What agile teams think of agile principles

Williams, L. (2012, March 23). Communications of the ACM.

Can traditional fault prediction models be used for vulnerability prediction?

Shin, Y., & Williams, L. (2011, December 8). Empirical Software Engineering.

Socio-technical developer networks

Meneely, A., & Williams, L. (2011, May 21).

A systematic literature review of actionable alert identification techniques for automated static code analysis

Heckman, S., & Williams, L. (2010, December 25). Information and Software Technology.

Agile software development methodologies and practices

Advances in Computers, Vol 80, 80, 1–44.

Guest editorial: Special issue on software reliability engineering

Williams, L. (2010, April 25). Empirical Software Engineering.

Idea: Using System Level Testing for Revealing SQL Injection-Related Error Message Information Leaks

In F. Massacci, D. Wallach, & N. Zannone (Eds.), Engineering Secure Software and Systems. ESSoS 2010 (pp. 192–200).

Idea: Using system level testing for revealing SQL injection-related error message information leaks

Engineering secure software and systems, proceedings, 5965, 192–200.

Protection Poker: The New Software Security "Game";

Williams, L., Meneely, A., & Shipley, G. (2010, March 19). IEEE Security & Privacy.

Protection Poker: Structuring Software Security Risk Assessment and Knowledge Transfer

In F. Massacci, S. T. Redwine, & N. Zannone (Eds.), Engineering Secure Software and Systems. ESSoS 2009 (pp. 122–134).

Secure open source collaboration

Meneely, A., & Williams, L. (2009, November 9).

Should software testers use mutation analysis to augment a test set?

Smith, B. H., & Williams, L. (2009, June 25). Journal of Systems and Software.

Toward Non-security Failures as a Predictor of Security Faults and Failures

In F. Massacci, S. T. Redwine, & N. Zannone (Eds.), Engineering Secure Software and Systems. ESSoS 2009. (pp. 135–149).

Addressing diverse needs through a balance of agile and plan-driven software development methodologies in the core software engineering course

International Journal of Engineering Education, 24(4), 659–670.

On automated prepared statement generation to remove SQL injection vulnerabilities

Thomas, S., Williams, L., & Xie, T. (2008, September 29). Information and Software Technology.

On guiding the augmentation of an automated test suite via mutation analysis

Smith, B. H., & Williams, L. (2008, August 20). Empirical Software Engineering.

Realizing quality improvement through test driven development: results and experiences of four industrial teams

Nagappan, N., Maximilien, E. M., Bhat, T., & Williams, L. (2008, February 26). Empirical Software Engineering.

Industry-Research Collaboration Working Group Results

In V. R. Basili, D. Rombach, K. Schneider, B. Kitchenham, D. Pfahl, & R. W. Selby (Eds.), Empirical Software Engineering Issues. Critical Assessment and Future Directions (pp. 153–157).

Roadmapping Working Group 4 Results

In V. R. Basili, D. Rombach, K. Schneider, B. Kitchenham, D. Pfahl, & R. W. Selby (Eds.), Empirical Software Engineering Issues. Critical Assessment and Future Directions (pp. 181–183).

Structuring Families of Industrial Case Studies

In V. R. Basili, D. Rombach, K. Schneider, B. Kitchenham, D. Pfahl, & R. W. Selby (Eds.), Empirical Software Engineering Issues. Critical Assessment and Future Directions (pp. 134–134).

Essential communication practices for Extreme Programming in a global software development team

Layman, L., Williams, L., Damian, D., & Bures, H. (2006, March 10). Information and Software Technology.

Motivations and measurements in an agile case study

Layman, L., Williams, L., & Cunningham, L. (2006, August 3). Journal of Systems Architecture.

On the design of more secure software-intensive systems by use of attack patterns

Gegick, M., & Williams, L. (2006, August 7). Information and Software Technology.

On the value of static analysis for fault detection in software

Zheng, J., Williams, L., Nagappan, N., Snipes, W., Hudepohl, J. P., & Vouk, M. A. (2006, April 1). IEEE Transactions on Software Engineering.