{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,7,23]],"date-time":"2024-07-23T22:33:52Z","timestamp":1721774032344},"reference-count":50,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2023,8,1]],"date-time":"2023-08-01T00:00:00Z","timestamp":1690848000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2024,3,31]],"date-time":"2024-03-31T00:00:00Z","timestamp":1711843200000},"content-version":"am","delay-in-days":243,"URL":"http:\/\/www.elsevier.com\/open-access\/userlicense\/1.0\/"},{"start":{"date-parts":[[2023,8,1]],"date-time":"2023-08-01T00:00:00Z","timestamp":1690848000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2023,8,1]],"date-time":"2023-08-01T00:00:00Z","timestamp":1690848000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2023,8,1]],"date-time":"2023-08-01T00:00:00Z","timestamp":1690848000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2023,8,1]],"date-time":"2023-08-01T00:00:00Z","timestamp":1690848000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2023,8,1]],"date-time":"2023-08-01T00:00:00Z","timestamp":1690848000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/100000180","name":"U.S. Department of Homeland Security","doi-asserted-by":"publisher","award":["FA8702-15-D-0002"],"id":[{"id":"10.13039\/100000180","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100008047","name":"Carnegie Mellon University","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100008047","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000005","name":"U.S. Department of Defense","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100000005","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Computers & Security"],"published-print":{"date-parts":[[2023,8]]},"DOI":"10.1016\/j.cose.2023.103191","type":"journal-article","created":{"date-parts":[[2023,4,1]],"date-time":"2023-04-01T15:03:44Z","timestamp":1680361424000},"page":"103191","update-policy":"http:\/\/dx.doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":4,"special_numbering":"C","title":["An analysis of how many undiscovered vulnerabilities remain in information systems"],"prefix":"10.1016","volume":"131","author":[{"ORCID":"http:\/\/orcid.org\/0000-0001-9356-219X","authenticated-orcid":false,"given":"Jonathan M.","family":"Spring","sequence":"first","affiliation":[]}],"member":"78","reference":[{"issue":"3","key":"10.1016\/j.cose.2023.103191_bib0001","doi-asserted-by":"crossref","first-page":"17","DOI":"10.1109\/MSEC.2021.3059167","article-title":"What we have here is failure to validate: summer of langsec","volume":"19","author":"Ali","year":"2021","journal-title":"IEEE Secur. Privacy"},{"key":"10.1016\/j.cose.2023.103191_bib0002","series-title":"Protecting systems from exploits using language-theoretic security","author":"Anantharaman","year":"2022"},{"key":"10.1016\/j.cose.2023.103191_bib0003","series-title":"Computer Security Applications Conference","first-page":"358","article-title":"Why information security is hard: an economic perspective","author":"Anderson","year":"2001"},{"issue":"4","key":"10.1016\/j.cose.2023.103191_bib0004","doi-asserted-by":"crossref","first-page":"431","DOI":"10.1145\/357146.357150","article-title":"Ten years of Hoare\u2019s logic: a survey\u2014Part I","volume":"3","author":"Apt","year":"1981","journal-title":"ACM Trans. Program. Lang.Syst. (TOPLAS)"},{"key":"10.1016\/j.cose.2023.103191_bib0005","series-title":"Tech. Rep. SP 800-57r5","article-title":"Recommendation for key Management: Part 1 \u2013 General","author":"Barker","year":"2020"},{"key":"10.1016\/j.cose.2023.103191_bib0006","article-title":"Sub-turing islands in the wild","author":"Barr","year":"2019","journal-title":"CoRR"},{"key":"10.1016\/j.cose.2023.103191_bib0007","series-title":"Tech. Rep. ver. 2","article-title":"Computer Security Incident Response Team (CSIRT) Services Framework","author":"Benetis","year":"2019"},{"key":"10.1016\/j.cose.2023.103191_bib0008","series-title":"Symposium on Security and Privacy","first-page":"483","article-title":"Verified models and reference implementations for the TLS 1.3 standard candidate","author":"Bhargavan","year":"2017"},{"issue":"4","key":"10.1016\/j.cose.2023.103191_bib0009","doi-asserted-by":"crossref","first-page":"345","DOI":"10.1109\/TSE.2015.2487274","article-title":"A probabilistic analysis of the efficiency of automated software testing","volume":"42","author":"B\u00f6hme","year":"2015","journal-title":"Trans. Softw. Eng."},{"key":"10.1016\/j.cose.2023.103191_bib0010","series-title":"Computability and Logic","author":"Boolos","year":"2002"},{"key":"10.1016\/j.cose.2023.103191_bib0011","series-title":"NASA Formal Methods","first-page":"3","article-title":"Moving fast with software verification","volume":"Vol.\u00a09058","author":"Calcagno","year":"2015"},{"key":"10.1016\/j.cose.2023.103191_bib0012","series-title":"Logic in Computer Science","first-page":"366","article-title":"Local action and abstract separation logic","author":"Calcagno","year":"2007"},{"key":"10.1016\/j.cose.2023.103191_bib0013","series-title":"Tech. Rep. CMU\/SEI-2010-TN-028","article-title":"A Taxonomy of Operational Cyber Security Risks","author":"Cebula","year":"2010"},{"key":"10.1016\/j.cose.2023.103191_bib0014","series-title":"Tech. Rep. TA14-098A","article-title":"OpenSSL \u201cHeartbleed\u201d Vulnerability (CVE-2014-0160)","author":"CISA","year":"2014"},{"key":"10.1016\/j.cose.2023.103191_bib0015","series-title":"Security and Privacy Workshops","first-page":"327","article-title":"ICARUS: understanding de facto formats by way of feathers and wax","author":"Cowger","year":"2020"},{"key":"10.1016\/j.cose.2023.103191_sbref0016","series-title":"Workshop on the Economics of Information Security","article-title":"Characterising 0-day exploit brokers","author":"Dellago","year":"2022"},{"issue":"2","key":"10.1016\/j.cose.2023.103191_bib0017","doi-asserted-by":"crossref","first-page":"391","DOI":"10.1109\/TETC.2017.2785299","article-title":"Weird machines, exploitability, and provable unexploitability","volume":"8","author":"Dullien","year":"2017","journal-title":"Trans. Emerg. Top. Comput."},{"issue":"9","key":"10.1016\/j.cose.2023.103191_bib0018","doi-asserted-by":"crossref","first-page":"1048","DOI":"10.1145\/48529.48530","article-title":"Program verification: the very idea","volume":"31","author":"Fetzer","year":"1988","journal-title":"Commun. ACM"},{"issue":"2104","key":"10.1016\/j.cose.2023.103191_bib0019","doi-asserted-by":"crossref","first-page":"20150401","DOI":"10.1098\/rsta.2015.0401","article-title":"The HACMS program: using formal methods to eliminate exploitable bugs","volume":"375","author":"Fisher","year":"2017","journal-title":"Philos. Trans. R. Soc. A Math. Phys. Eng. Sci."},{"issue":"2","key":"10.1016\/j.cose.2023.103191_bib0020","doi-asserted-by":"crossref","first-page":"415","DOI":"10.1145\/234528.234531","article-title":"Software reuse: metrics and models","volume":"28","author":"Frakes","year":"1996","journal-title":"ACM Comput. Surv. (CSUR)"},{"key":"10.1016\/j.cose.2023.103191_bib0021","series-title":"Black Hat USA 2014 (Las Vegas, Nevada), UBM","article-title":"Cybersecurity as realpolitik","author":"Geer","year":"2014"},{"key":"10.1016\/j.cose.2023.103191_bib0022","article-title":"Are we skillful or just lucky? Interpreting the possible histories of vulnerability disclosures","author":"Householder","year":"2021","journal-title":"Digital Threats"},{"key":"10.1016\/j.cose.2023.103191_bib0023","series-title":"Tech. Rep. CMU\/SEI-2017-TR-022","article-title":"The CERT\u00ae\u00a0Guide to Coordinated Vulnerability Disclosure","author":"Householder","year":"2020"},{"key":"10.1016\/j.cose.2023.103191_bib0024","series-title":"IFIP Congress","first-page":"657","article-title":"What good is temporal logic?","author":"Lamport","year":"1983"},{"key":"10.1016\/j.cose.2023.103191_bib0025","series-title":"Specifying Systems: The TLA+ Language and Tools for Hardware and Software Engineers","author":"Lamport","year":"2002"},{"key":"10.1016\/j.cose.2023.103191_bib0026","series-title":"Cengage Learning Australia","article-title":"Economics for today","author":"Layton","year":"2016"},{"key":"10.1016\/j.cose.2023.103191_bib0027","doi-asserted-by":"crossref","first-page":"193","DOI":"10.56801\/rebicte.v3i.59","article-title":"Spillover effect of ransomware: economic analysis of web vulnerability market","volume":"3","author":"Lee","year":"2017","journal-title":"Res. Briefs Inf. Commun.Technol. Evol."},{"key":"10.1016\/j.cose.2023.103191_bib0028","article-title":"The art, science, and engineering of fuzzing: asurvey","author":"Man\u00e8s","year":"2019","journal-title":"IEEE Trans. Softw. Eng."},{"key":"10.1016\/j.cose.2023.103191_bib0029","series-title":"Security and Privacy Workshops","first-page":"300","article-title":"The parsley data format definition language","author":"Mundkur","year":"2020"},{"key":"10.1016\/j.cose.2023.103191_bib0030","series-title":"Tech. Rep. 8531.01","article-title":"DoD Vulnerability Management","author":"Office of the DoD Chief Information Officer","year":"2020"},{"key":"10.1016\/j.cose.2023.103191_bib0031","series-title":"Logic in Computer Science (LICS)","first-page":"17","article-title":"From categorical logic to facebook engineering","author":"O\u2019Hearn","year":"2015"},{"key":"10.1016\/j.cose.2023.103191_sbref0032","series-title":"USENIX Security Symposium","first-page":"93","article-title":"Milk or wine: does software security improve with age?","volume":"Vol.\u00a015","author":"Ozment","year":"2006"},{"key":"10.1016\/j.cose.2023.103191_bib0033","unstructured":"Peterson D.. Medical cybersecurity & dense vulnerabilities. 2018."},{"issue":"413","key":"10.1016\/j.cose.2023.103191_bib0034","first-page":"225","article-title":"Review papers: modeling capture, recapture, and removal statistics for estimation of demographic parameters for fish and wildlife populations: past, present, and future","volume":"86","author":"Pollock","year":"1991","journal-title":"J Am Stat Assoc"},{"issue":"2","key":"10.1016\/j.cose.2023.103191_bib0035","doi-asserted-by":"crossref","first-page":"339","DOI":"10.1007\/s13347-018-0334-2","article-title":"On malfunction, mechanisms, and malware classification","volume":"32","author":"Primiero","year":"2018","journal-title":"Philos. Technol."},{"key":"10.1016\/j.cose.2023.103191_bib0036","doi-asserted-by":"crossref","first-page":"483","DOI":"10.1007\/s13347-018-0312-8","article-title":"Why separation logic works","volume":"32","author":"Pym","year":"2018","journal-title":"Philos. Technol."},{"key":"10.1016\/j.cose.2023.103191_bib0037","series-title":"The Stanford Encyclopedia of Philosophy","article-title":"G\u00f6del\u2019s incompleteness theorems","author":"Raatikainen","year":"2015"},{"key":"10.1016\/j.cose.2023.103191_bib0038","series-title":"Tech. Rep. AFRL-RI-RS-TR-2015-188","article-title":"Crema","author":"Reilly","year":"2015"},{"issue":"2","key":"10.1016\/j.cose.2023.103191_bib0039","doi-asserted-by":"crossref","first-page":"358","DOI":"10.1090\/S0002-9947-1953-0053041-6","article-title":"Classes of recursively enumerable sets and their decision problems","volume":"74","author":"Rice","year":"1953","journal-title":"Trans. Am. Math. Soc."},{"issue":"3","key":"10.1016\/j.cose.2023.103191_bib0040","doi-asserted-by":"crossref","first-page":"489","DOI":"10.1109\/JSYST.2012.2222000","article-title":"Security applications of formal language theory","volume":"7","author":"Sassaman","year":"2013","journal-title":"IEEE Syst. J."},{"issue":"1","key":"10.1016\/j.cose.2023.103191_bib0041","doi-asserted-by":"crossref","first-page":"30","DOI":"10.1145\/353323.353382","article-title":"Enforceable security policies","volume":"3","author":"Schneider","year":"2000","journal-title":"Trans. Inf. Syst. Secur.(TISSEC)"},{"key":"10.1016\/j.cose.2023.103191_bib0042","series-title":"Should u.s. hackers fix cybersecurity holes or exploit them?","author":"Schneier","year":"2014"},{"key":"10.1016\/j.cose.2023.103191_bib0043","doi-asserted-by":"crossref","unstructured":"Shirey R.. Internet security glossary, version 2. 2007. RFC 4949 (Informational).","DOI":"10.17487\/rfc4949"},{"key":"10.1016\/j.cose.2023.103191_bib0044","article-title":"Creative malfunction: finding fault with rowhammer","volume":"8","author":"Spencer","year":"2021","journal-title":"Comput. Cult."},{"key":"10.1016\/j.cose.2023.103191_sbref0043","series-title":"New Security Paradigms Workshop","article-title":"On managing vulnerabilities in ML\/AI systems","author":"Spring","year":"2020"},{"key":"10.1016\/j.cose.2023.103191_sbref0044","series-title":"Workshop on the Economics of Information Security","article-title":"Prioritizing vulnerability response: astakeholder-specific vulnerability categorization","author":"Spring","year":"2020"},{"issue":"8","key":"10.1016\/j.cose.2023.103191_bib0047","doi-asserted-by":"crossref","first-page":"1245","DOI":"10.1016\/j.comnet.2010.03.005","article-title":"Resilience and survivability in communication networks: strategies, principles, and survey of disciplines","volume":"54","author":"Sterbenz","year":"2010","journal-title":"Comput. Netw."},{"key":"10.1016\/j.cose.2023.103191_bib0048","series-title":"Intl Conf on Programming Language Design and Implementation","first-page":"31","article-title":"Hardening attack surfaces with formally proven binary format parsers","author":"Swamy","year":"2022"},{"key":"10.1016\/j.cose.2023.103191_bib0049","doi-asserted-by":"crossref","first-page":"787","DOI":"10.2307\/2525963","article-title":"A new proof of the existence and uniqueness of the cournot equilibrium","author":"Szidarovszky","year":"1977","journal-title":"Int. Econ. Rev. (Philadelphia)"},{"issue":"1","key":"10.1016\/j.cose.2023.103191_bib0050","doi-asserted-by":"crossref","first-page":"230","DOI":"10.1112\/plms\/s2-42.1.230","article-title":"On computable numbers, with an application to the entscheidungsproblem","volume":"2","author":"Turing","year":"1936","journal-title":"Proc. London Math. Soc."}],"container-title":["Computers & Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167404823001013?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167404823001013?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2024,3,29]],"date-time":"2024-03-29T00:55:14Z","timestamp":1711673714000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0167404823001013"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,8]]},"references-count":50,"alternative-id":["S0167404823001013"],"URL":"https:\/\/doi.org\/10.1016\/j.cose.2023.103191","relation":{},"ISSN":["0167-4048"],"issn-type":[{"value":"0167-4048","type":"print"}],"subject":[],"published":{"date-parts":[[2023,8]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"An analysis of how many undiscovered vulnerabilities remain in information systems","name":"articletitle","label":"Article Title"},{"value":"Computers & Security","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.cose.2023.103191","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2023 Published by Elsevier Ltd.","name":"copyright","label":"Copyright"}],"article-number":"103191"}}