Publications

@inproceedings{khodayari2026indirect,
  title = {Indirect prompt injection in the wild: An empirical study of prevalence, techniques, and objectives},
  author = {Khodayari, Soheil and Zhang, Xuenan and Acharya, Bhupendra and Pellegrino, Giancarlo},
  booktitle = {Proceedings of the 2026 ACM SIGSAC Conference on Computer and Communications Security},
  year = {2026},
  series = {ACM CCS 2026},
}

@inproceedings{mengascini2026omniscience,
  title = {Omniscience for the Masses: New Threats in the Metaverse's Democratized World Creation},
  author = {Mengascini, Andrea and Aurelio, Ryan and Polakis, Jason and Pellegrino, Giancarlo},
  booktitle = {Proceedings of the 2026 ACM SIGSAC Conference on Computer and Communications Security},
  year = {2026},
  series = {ACM CCS 2026},
}

@inproceedings{zhang2026you,
  title = {You Get What You Sample: Evaluating Sampling Strategies for Web Security Measurements},
  author = {Zhang, Xuenan and Yang, Yuqing and Pellegrino, Giancarlo},
  booktitle = {Proceedings of the 2026 ACM SIGSAC Conference on Computer and Communications Security},
  year = {2026},
  series = {ACM CCS 2026},
}

@inproceedings{behind_curtain_sp26,
  author = {Stivala, Giada and Mrowczynski, Rafael and Hellenthal, Maria and Pellegrino, Giancarlo},
  title = {Behind the Curtain: How Shared Hosting Providers Respond to Vulnerability Notifications},
  booktitle = {Proceedings of the 47th IEEE Symposium on Security and Privacy},
  series = {IEEE S\&P 2026},
  year = {2026},
  organization = {IEEE},
}

@inproceedings{dom_we_trust,
  author = {Drescher, Jan and Mirzaei, Sepehr and Khodayari, Soheil and Klein, David and Barber, Thomas and Johns, Martin and Pellegrino, Giancarlo},
  title = {In the DOM We Trust: Exploring the Hidden Dangers of Reading from the DOM on the Web},
  booktitle = {Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security},
  series = {ACM CCS 2025},
  year = {2025},
  organization = {ACM},
}

@inproceedings{elbitar2025permission,
  series = {CHI 2025},
  title = {Permission Rationales in the Web Ecosystem: An Exploration of Rationale Text and Design Patterns},
  author = {Elbitar, Yusra and Khodayari, Soheil and Harbach, Marian and De Stefano, Gianluca and Engedy, Balazs Csaba and Pellegrino, Giancarlo and Bugiel, Sven},
  booktitle = {Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems},
  year = {2025},
}

@inproceedings{charon_eurosp25,
  author = {Scholtes, Raoul and Khodayari, Soheil and Staicu, Cristian-Alexandru and Pellegrino, Giancarlo},
  title = {CHARON: Polyglot Code Analysis for Detecting Vulnerabilities in Scripting Languages Native Extensions},
  booktitle = {Proceedings of the 10th IEEE European Symposium on Security and Privacy},
  series = {EuroS\&P 2025},
  year = {2025},
  organization = {IEEE},
}

@inproceedings{vr_design_space_eurosp25,
  author = {Mengascini, Andrea and Walle, Annabelle and Weil, Rebecca and Steimle, J\"{u}rgen and Pellegrino, Giancarlo},
  title = {Exploring the Design Space for Security Warnings in Immersive Environments},
  booktitle = {Proceedings of the 10th IEEE European Symposium on Security and Privacy},
  series = {EuroS\&P 2025},
  year = {2025},
  organization = {IEEE},
}

@inproceedings{less_is_more_dsn,
  author = {Cazzaro, Lorenzo and Calzavara, Stefano and Kovalkovm, Maksim and Stafeev, Aleksei and Pellegrino, Giancarlo},
  title = {Less is More: Boosting Coverage of Web Crawling through Adversarial Multi-Armed Bandit},
  booktitle = {The 55th Annual IEEE/IFIP International Conference on Dependable Systems and Networks},
  series = {DSN 2025},
  year = {2025},
  organization = {IEEE},
}

@inproceedings{khodayarinot,
  title = {Do (Not) Follow the White Rabbit: Challenging the Myth of Harmless Open Redirection},
  author = {Khodayari, Soheil and Glauber, Kai and Pellegrino, Giancarlo},
  booktitle = {Proceedings of the 32nd Network and Distributed System Security Symposium},
  series = {NDSS 2025},
  year = {2025},
}

@inproceedings{beluri2024exploration_imc,
  title = {Exploration of the Dynamics of Buy and Sale of Social Media Accounts},
  author = {Beluri, Mario and Acharya, Bhupendra and Khodayari, Soheil and Stivala, Giada and Pellegrino, Giancarlo and Holz, Thorsten},
  booktitle = {ACM Internet Measurement Conference 2025},
  series = {ACM IMC 2025},
  year = {2025},
}

@inproceedings{yura_llm_ndss25,
  title = {{YuraScanner}: Leveraging LLMs for Task-driven Web App Scanning},
  author = {Stafeev, Aleksei and Recktenwald, Tim and De Stefano,Gianluca and Khodayari, Soheil and Pellegrino, Giancarlo},
  booktitle = {Proceedings of the 32nd Network and Distributed System Security Symposium},
  series = {NDSS 2025},
  year = {2025},
}

@inproceedings{beluri2024exploration_arxiv,
  title = {Exploration of the Dynamics of Buy and Sale of Social Media Accounts},
  author = {Beluri, Mario and Acharya, Bhupendra and Khodayari, Soheil and Stivala, Giada and Pellegrino, Giancarlo and Holz, Thorsten},
  journal = {arXiv preprint arXiv:2412.14985},
  year = {2024},
}

@inproceedings{rag_n_roll_arxiv,
  title = {Rag and Roll: An End-to-End Evaluation of Indirect Prompt Manipulations in LLM-based Application Frameworks},
  author = {De Stefano, Gianluca and Sch{\"o}nherr, Lea and Pellegrino, Giancarlo},
  booktitle = {arXiv preprint arXiv:2408.05025},
  organization = {arXiv},
  year = {2024},
}

@inproceedings{web_metaverses_attacks,
  author = {Mengascini, Andrea and Aurelio, Ryan and Pellegrino, Giancarlo},
  title = {The Big Brother's New Playground: Unmasking the Illusion of Privacy in Web Metaverses from a Malicious User's Perspective},
  booktitle = {Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security},
  series = {ACM CCS 2024},
  year = {2024},
  organization = {ACM},
}

@inproceedings{compr_infra,
  author = {Stivala, Giada and De Stefano, Gianluca and Mengascini, Andrea and Graziano, Mariano and Pellegrino, Giancarlo},
  title = {Uncovering the Role of Support Infrastructure in Clickbait PDF Campaigns},
  booktitle = {Proceedings of the 9th IEEE European Symposium on Security and Privacy},
  series = {EuroS\&P 2024},
  year = {2024},
  organization = {IEEE},
}

@inproceedings{malteSSRFUSENIX,
  series = {USENIX Security '24},
  author = {Wessels, Malte and Koch, Simon and Pellegrino, Giancarlo and Johns, Martin},
  title = {SSRF vs. Developers: A Study of SSRF-Defenses in PHP Applications},
  booktitle = {33rd USENIX Security Symposium (USENIX Security 24)},
  year = {2024},
  organization = {USENIX},
}

@inproceedings{aleksei2024SoK_crawlers,
  series = {USENIX Security '24},
  author = {Stafeev, Aleksei and Pellegrino, Giancarlo},
  title = {SoK: State of the Krawlers - Evaluating the Effectiveness of Crawling Algorithms for Web Security Measurements},
  booktitle = {33rd USENIX Security Symposium (USENIX Security 24)},
  year = {2024},
  organization = {USENIX},
}

@inproceedings{khodayari2024great,
  author = {Khodayari, Soheil and Barber, Thomas and Pellegrino, Giancarlo},
  title = {The Great Request Robbery: An Empirical Study of Client-side Request Hijacking Vulnerabilities on the Web},
  booktitle = {Proceedings of the 45th IEEE Symposium on Security and Privacy},
  series = {IEEE S\&P 2024},
  year = {2024},
  organization = {IEEE},
}

@inproceedings{stivala2023attachments,
  series = {ACSAC 2023},
  title = {From Attachments to SEO: Click Here to Learn More about Clickbait PDFs!},
  author = {Stivala, Giada and Abdelnabi, Sahar and Mengascini, Andrea and Graziano, Mariano and Fritz, Mario and Pellegrino, Giancarlo},
  booktitle = {Proceedings of the 39th Annual Computer Security Applications Conference},
  pages = {14--28},
  year = {2023},
}

@inproceedings{domclob_sp2023,
  author = {Khodayari, Soheil and Pellegrino, Giancarlo},
  title = {It's (DOM) Clobbering Time: Attack Techniques, Prevalence, and Defenses},
  booktitle = {Proceedings of the 44th IEEE Symposium on Security and Privacy},
  series = {IEEE S\&P 2023},
  year = {2023},
  organization = {IEEE},
}

@inproceedings{xsleaks_sp2023,
  title = {The Leaky Web: Automated Discovery of Cross-Site Information Leaks in Browsers and the Web},
  author = {Rautenstrauch, Jannis and Pellegrino, Giancarlo and Stock, Ben},
  booktitle = {Proceedings of the 44th IEEE Symposium on Security and Privacy},
  series = {IEEE S\&P 2023},
  year = {2023},
  organization = {IEEE},
}

@inproceedings{samesite_sp2022,
  author = {Khodayari, Soheil and Pellegrino, Giancarlo},
  title = {The State of the SameSite: Studying the Usage, Effectiveness, and Adequacy of SameSite Cookies},
  booktitle = {Proceedings of the 43rd IEEE Symposium on Security and Privacy},
  series = {IEEE S\&P 2022},
  year = {2022},
  organization = {IEEE},
}

@inproceedings{csrf-web-framework,
  series = {RAID 2021},
  author = {Likaj, Xhelal and Khodayari, Soheil and Pellegrino, Giancarlo},
  title = {Where We Stand (or Fall): An Analysis of CSRF Defenses in Web Frameworks},
  booktitle = {Symposium on Research in Attacks, Intrusions and Defenses (RAID'21), San Sebastian, Spain, October 6-8, 2021},
  year = {2021},
  organization = {ACM},
}

@inproceedings{jaw,
  series = {USENIX Security '21},
  author = {Khodayari, Soheil and Pellegrino, Giancarlo},
  title = {JAW: Studying Client-side CSRF with Hybrid Property Graphs and Declarative Traversals},
  booktitle = {30th USENIX Security Symposium (USENIX Security 21)},
  year = {2021},
  organization = {USENIX},
}

@inproceedings{blackwidow_sp2021,
  author = {Eriksson, Benjamin and Pellegrino, Giancarlo and Sabelfeld, Andrei},
  title = {Black Widow: Blackbox Data-driven Web Scanning},
  booktitle = {Proceedings of the 42nd IEEE Symposium on Security and Privacy},
  series = {IEEE S\&P 2021},
  year = {2021},
  organization = {IEEE},
}

@inproceedings{sentinet_dls,
  series = {DLS 2020},
  author = {Chou, Edward and Tramer, Florian and Pellegrino, Giancarlo},
  title = {SentiNet: Detecting Localized Universal Attack Against Deep Learning Systems},
  booktitle = {Proceedings of the 2020 IEEE Security and Privacy Workshops (SPW)},
  year = {2020},
  organization = {IEEE},
}

@inproceedings{inputscope_sp2020,
  author = {Zhao, Qingchuan and Zuo, Chaoshun and Dolan-Gavitt, Brendan and Pellegrino, Giancarlo and Lin, Zhiqiang},
  title = {Automatic Uncovering of Hidden Behaviors from Input Validation in Mobile Apps},
  booktitle = {Proceedings of the 41st IEEE Symposium on Security and Privacy},
  series = {IEEE S\&P 2020},
  year = {2020},
  organization = {IEEE},
}

@inproceedings{linkpreviews,
  author = {Stivala, Giada and Pellegrino, Giancarlo},
  title = {Deceptive Previews: A Study of the Link Preview Trustworthiness in Social Platforms},
  booktitle = {Proceedings of the 27th Network and Distributed System Security Symposium},
  series = {NDSS 2020},
  year = {2020},
  organization = {Internet Society},
}

@inproceedings{racoon,
  author = {Koch, Simon and Sauer, Tim and Johns, Martin and Pellegrino, Giancarlo},
  title = {Raccoon: Automated Verification of Guarded Race Conditions in Web Applications},
  year = {2020},
  organization = {ACM},
  series = {ACM SAC 2020},
  booktitle = {The 35th ACM/SIGAPP Symposium on Applied Computing},
}

@inproceedings{ad_versarial_ccs,
  author = {Tramer, Florian and Dupre, Pascal and Rusak, Gili and Pellegrino, Giancarlo and Boneh, Dan},
  title = {AdVersarial: Perceptual Ad Blocking meets Adversarial Machine Learning},
  booktitle = {Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security},
  series = {ACM CCS 2019},
  year = {2019},
}

@inproceedings{rhs,
  author = {Zhao, Qingchuan and Zuo, Chaoshun and Pellegrino, Giancarlo and Lin, Zhiqiang},
  title = {Geo-locating Drivers: A Study of Sensitive Data Leakagein Ride-Hailing Services},
  booktitle = {Proceedings of the 26th Network and Distributed System Security Symposium},
  series = {NDSS 2019},
  year = {2019},
  organization = {Internet Society},
}

@inproceedings{fidelius_sp19,
  author = {Eskandarian, Saba and Cogan, Jonathan and Birnbaum, Sawyer and Brandon, Peh and Franke, Dillon and Fraser, Forest and Garcia, Gaspar and Gong, Eric and Nguyen, Hung and Sethi, Taresh and Subbiah, Vishal and Backes, Michael and Pellegrino, Giancarlo and Boneh, Dan},
  title = {Fidelius: Protecting User Secrets from Compromised Browsers},
  booktitle = {Proceedings of the 40th IEEE Symposium on Security and Privacy},
  series = {IEEE S\&P 2019},
  year = {2019},
  organization = {IEEE},
}

@inproceedings{ad_versarial,
  author = {Tramer, Florian and Dupre, Pascal and Rusak, Gili and Pellegrino, Giancarlo and Boneh, Dan},
  title = {AdVersarial: Perceptual Ad Blocking meets Adversarial Machine Learning},
  booktitle = {Arxiv},
  year = {2018},
  organization = {Arxiv},
}

@inproceedings{sentinet,
  author = {Chou, Edward and Tramer, Florian and Pellegrino, Giancarlo},
  title = {SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systems},
  booktitle = {Arxiv},
  year = {2018},
  organization = {Arxiv},
}

@inproceedings{fidelius_arxiv,
  author = {Eskandarian, Saba and Cogan, Jonathan and Birnbaum, Sawyer and Brandon, Peh and Franke, Dillon and Fraser, Forest and Garcia, Gaspar and Gong, Eric and Nguyen, Hung and Sethi, Taresh and Subbiah, Vishal and Backes, Michael and Pellegrino, Giancarlo and Boneh, Dan},
  title = {Fidelius: Protecting User Secrets from Compromised Browsers},
  booktitle = {Arxiv},
  year = {2018},
  organization = {Arxiv},
}

@inproceedings{emailanalysis,
  author = {Speicher, Patrick and Steinmetz, Marcel and Kuennemann, Robert and Simeonovski, Milivoj and Pellegrino, Giancarlo and Hoffmann, Jorg and Backes, Michael},
  title = {Formally Reasoning about the Cost and Efficacy of Securing the Email Infrastructure},
  booktitle = {Proceedings of the 3rd IEEE European Symposium on Security and Privacy},
  series = {EuroS\&P 2018},
  year = {2018},
  organization = {IEEE},
}

@inproceedings{citizendevel,
  author = {Oltrogge, Martin and Derr, Erik and Stransky, Christian and Fahl, Sascha and Acar, Yasemin and Rossow, Christian and Pellegrino, Giancarlo and Bugiel, Sven and Backes, Michael},
  title = {The Rise of the Citizen Developer: Assessing the Security Impact of Online App Generators},
  booktitle = {Proceedings of the 39th IEEE Symposium on Security and Privacy},
  series = {IEEE S\&P 2018},
  year = {2018},
  organization = {IEEE},
}

@inproceedings{didnthearme,
  author = {Stock, Ben and Pellegrino, Giancarlo and Li, Frank and Rossow, Christian and Backes, Michael},
  title = {Didn't You Hear Me? - Towards More Successful Web Vulnerability Notifications},
  booktitle = {Proceedings of the 25th Network and Distributed System Security Symposium},
  series = {NDSS 2018},
  year = {2018},
  organization = {Internet Society},
}

@inproceedings{Pellegrino:2017:DDC:3133956.3133959,
  author = {Pellegrino, Giancarlo and Johns, Martin and Koch, Simon and Backes, Michael and Rossow, Christian},
  title = {Deemon: Detecting CSRF with Dynamic Analysis and Property Graphs},
  booktitle = {Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security},
  series = {ACM CCS 2017},
  year = {2017},
  isbn = {978-1-4503-4946-8},
  location = {Dallas, Texas, USA},
  pages = {1757--1771},
  doi = {10.1145/3133956.3133959},
  publisher = {ACM},
  address = {New York, NY, USA},
  organization = {ACM},
}

@inproceedings{Simeonovski:2017:CIA:3038912.3052587,
  author = {Simeonovski, Milivoj and Pellegrino, Giancarlo and Rossow, Christian and Backes, Michael},
  title = {Who Controls the Internet?: Analyzing Global Threats Using Property Graph Traversals},
  booktitle = {Proceedings of the 26th International Conference on World Wide Web},
  series = {WWW 2017},
  year = {2017},
  isbn = {978-1-4503-4913-0},
  location = {Perth, Australia},
  pages = {647--656},
  doi = {10.1145/3038912.3052587},
  publisher = {International World Wide Web Conferences Steering Committee},
  address = {Republic and Canton of Geneva, Switzerland},
}

@inproceedings{Pellegrino2016,
  series = {RAID 2016},
  author = {Pellegrino, Giancarlo and Catakoglu, Onur and Balzarotti, Davide and Rossow, Christian},
  editor = {Monrose, Fabian and Dacier, Marc and Blanc, Gregory and Garcia-Alfaro, Joaquin},
  title = {Uses and Abuses of Server-Side Requests},
  booktitle = {Research in Attacks, Intrusions, and Defenses: 19th International Symposium, RAID 2016, Paris, France, September 19-21, 2016, Proceedings},
  year = {2016},
  publisher = {Springer International Publishing},
  address = {Cham},
  pages = {393--414},
  isbn = {978-3-319-45719-2},
  doi = {10.1007/978-3-319-45719-2_18},
}

@inproceedings{197118,
  series = {USENIX Security '16},
  author = {Ben Stock and Giancarlo Pellegrino and Christian Rossow and Martin Johns and Michael Backes},
  title = {Hey, You Have a Problem: On the Feasibility of Large-Scale Web Vulnerability Notification},
  booktitle = {25th USENIX Security Symposium (USENIX Security 16)},
  year = {2016},
  isbn = {978-1-931971-32-4},
  address = {Austin, TX},
  pages = {1015--1032},
  publisher = {USENIX Association},
}

@inproceedings{Stock:2016:PML:2976749.2989057,
  author = {Stock, Ben and Pellegrino, Giancarlo and Rossow, Christian and Johns, Martin and Backes, Michael},
  title = {POSTER: Mapping the Landscape of Large-Scale Vulnerability Notifications},
  booktitle = {Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security},
  series = {ACM CCS 2016},
  year = {2016},
  isbn = {978-1-4503-4139-4},
  location = {Vienna, Austria},
  pages = {1787--1789},
  doi = {10.1145/2976749.2989057},
  publisher = {ACM},
  address = {New York, NY, USA},
}

@inproceedings{Pellegrino2015,
  series = {RAID 2015},
  author = {Pellegrino, Giancarlo and Tschuertz, Constantin and Bodden, Eric and Rossow, Christian},
  editor = {Bos, Herbert and Monrose, Fabian and Blanc, Gregory},
  title = {jAEk: Using Dynamic Analysis to Crawl and Test Modern Web Applications},
  booktitle = {Research in Attacks, Intrusions, and Defenses: 18th International Symposium, RAID 2015, Kyoto, Japan,November 2-4, 2015. Proceedings},
  year = {2015},
  publisher = {Springer International Publishing},
  address = {Cham},
  pages = {295--316},
  isbn = {978-3-319-26362-5},
  doi = {10.1007/978-3-319-26362-5_14},
}

@inproceedings{190996,
  series = {USENIX Security '15},
  author = {Giancarlo Pellegrino and Davide Balzarotti and Stefan Winter and Neeraj Suri},
  title = {In the Compression Hornet's Nest: A Security Study of Data Compression in Network Services},
  booktitle = {24th USENIX Security Symposium (USENIX Security 15)},
  year = {2015},
  isbn = {978-1-931971-232},
  address = {Washington, D.C.},
  pages = {801--816},
  publisher = {USENIX Association},
}

@inproceedings{Vateva-Gurova2015,
  series = {ICETE 2014},
  author = {Vateva-Gurova, Tsvetoslava and Luna, Jesus and Pellegrino, Giancarlo and Suri, Neeraj},
  editor = {Obaidat, Mohammad S. and Holzinger, Andreas and Filipe, Joaquim},
  title = {On the Feasibility of Side-Channel Attacks in a Virtualized Environment},
  booktitle = {E-Business and Telecommunications: 11th International Joint Conference, ICETE 2014, Vienna, Austria, August 28-30, 2014, Revised Selected Papers},
  year = {2015},
  publisher = {Springer International Publishing},
  address = {Cham},
  pages = {319--339},
  isbn = {978-3-319-25915-4},
  doi = {10.1007/978-3-319-25915-4_17},
}

@incollection{DBLP:books/daglib/p/MikkelsenDGJGNPPSSZ15,
  author = {Gert Lassøe Mikkelsen and Kasper Damgard and Hans Guldager and Jonas Lindstrøm Jensen and Jesus Luna Garcia and Janus Dam Nielsen and Pascal Paillier and Giancarlo Pellegrino and Michael Bladt Stausholm and Neeraj Suri and Heng Zhang},
  title = {Attribute-based Credentials for Trust: Technical Implementation and Feasibility},
  booktitle = {Attribute-based Credentials for Trust: Identity in the Information Society},
  pages = {255--317},
  year = {2015},
  crossref = {DBLP:books/daglib/0039026},
  doi = {10.1007/978-3-319-14439-9_9},
}

@inproceedings{191940,
  series = {WOOT '15},
  author = {Giancarlo Pellegrino and Christian Rossow and Fabrice J. Ryba and Thomas C. Schmidt and Matthias Waehlisch},
  title = {Cashing Out the Great Cannon? On Browser-Based DDoS Attacks and Economics},
  booktitle = {9th USENIX Workshop on Offensive Technologies (WOOT 15)},
  year = {2015},
  address = {Washington, D.C.},
  publisher = {USENIX Association},
}

@inproceedings{7509479,
  series = {SECRYPT 2014},
  author = {T. Vateva-Gurova and J. Luna and G. Pellegrino and N. Suri},
  booktitle = {2014 11th International Conference on Security and Cryptography (SECRYPT)},
  title = {Towards a framework for assessing the feasibility of side-channel attacks in virtualized environments},
  year = {2014},
  pages = {1-12},
  month = {Aug},
}

@inproceedings{DBLP:conf/ndss/PellegrinoB14,
  series = {NDSS 2014},
  author = {Giancarlo Pellegrino and Davide Balzarotti},
  title = {Toward Black-Box Detection of Logic Flaws in Web Applications},
  booktitle = {Proceedings of the 21st Network and Distributed System Security Symposium},
  year = {2014},
  crossref = {DBLP:conf/ndss/2014},
}

@article{Armando:2013:AFB:2622673.2622830,
  author = {Armando, Alessandro and Carbone, Roberto and Compagna, Luca and Cuellar, Jorge and Pellegrino, Giancarlo and Sorniotti, Alessandro},
  title = {An Authentication Flaw in Browser-based Single Sign-On Protocols: Impact and Remediations},
  journal = {Computers and Security},
  issue_date = {March, 2013},
  volume = {33},
  month = {March},
  year = {2013},
  issn = {0167-4048},
  pages = {41--58},
  doi = {10.1016/j.cose.2012.08.007},
  publisher = {Elsevier Advanced Technology Publications},
  address = {Oxford, UK, UK},
}

@inproceedings{Pellegrino2013,
  series = {ICTSS 2013},
  author = {Pellegrino, Giancarlo and Compagna, Luca and Morreggia, Thomas},
  editor = {Yeniguen, Huesnue and Yilmaz, Cemal and Ulrich, Andreas},
  title = {A Tool for Supporting Developers in Analyzing the Security of Web-Based Security Protocols},
  booktitle = {Testing Software and Systems: 25th IFIP WG 6.1 International Conference, ICTSS 2013, Istanbul, Turkey, November 13-15, 2013, Proceedings},
  year = {2013},
  publisher = {Springer Berlin Heidelberg},
  address = {Berlin, Heidelberg},
  pages = {277--282},
  isbn = {978-3-642-41707-8},
  doi = {10.1007/978-3-642-41707-8_19},
}

@inproceedings{Armando2012_tap,
  series = {TAP 2012},
  author = {Armando, Alessandro and Pellegrino, Giancarlo and Carbone, Roberto and Merlo, Alessio and Balzarotti, Davide},
  editor = {Brucker, Achim D. and Julliand, Jacques},
  title = {From Model-Checking to Automated Testing of Security Protocols: Bridging the Gap},
  booktitle = {Tests and Proofs: 6th International Conference, TAP 2012, Prague, Czech Republic, May 31 -- June 1, 2012. Proceedings},
  year = {2012},
  publisher = {Springer Berlin Heidelberg},
  address = {Berlin, Heidelberg},
  pages = {3--18},
  isbn = {978-3-642-30473-6},
  doi = {10.1007/978-3-642-30473-6_3},
}

@inproceedings{avantssar,
  series = {TACAS 2012},
  author = {Armando, Alessandro and Arsac, Wihem and Avanesov, Tigran and Barletta, Michele and Calvi, Alberto and Cappai, Alessandro and Carbone, Roberto and Chevalier, Yannick and Compagna, Luca and Cuellar, Jorge and Erzse, Gabriel and Frau, Simone and Minea, Marius and Moedersheim, Sebastian and von Oheimb, David and Pellegrino, Giancarlo and Ponta, Serena Elisa and Rocchetto, Marco and Rusinowitch, Michael and Torabi Dashti, Mohammad and Turuani, Mathieu and Vigano, Luca},
  editor = {Flanagan, Cormac and Koenig, Barbara},
  title = {The AVANTSSAR Platform for the Automated Validation of Trust and Security of Service-Oriented Architectures},
  booktitle = {Tools and Algorithms for the Construction and Analysis of Systems: 18th International Conference, TACAS 2012, Held as Part of the European Joint Conferences on Theory and Practice of Software, ETAPS 2012, Tallinn, Estonia, March 24 -- April 1, 2012. Proceedings},
  year = {2012},
  publisher = {Springer Berlin Heidelberg},
  address = {Berlin, Heidelberg},
  pages = {267--282},
  isbn = {978-3-642-28756-5},
  doi = {10.1007/978-3-642-28756-5_19},
}

@inbook{Armando2011,
  series = {IFIP SEC 2011},
  author = {Armando, Alessandro and Carbone, Roberto and Compagna, Luca and Cuellar, Jorge and Pellegrino, Giancarlo and Sorniotti, Alessandro},
  editor = {Camenisch, Jan and Fischer-Huebner, Simone and Murayama, Yuko and Portmann, Armand and Rieder, Carlos},
  title = {From Multiple Credentials to Browser-Based Single Sign-On: Are We More Secure?},
  chapter = {From Multiple Credentials to Browser-Based Single Sign-On: Are We More Secure?},
  booktitle = {Future Challenges in Security and Privacy for Academia and Industry: 26th IFIP TC 11 International Information Security Conference, SEC 2011, Lucerne, Switzerland, June 7-9, 2011. Proceedings},
  year = {2011},
  publisher = {Springer Berlin Heidelberg},
  address = {Berlin, Heidelberg},
  pages = {68--79},
  isbn = {978-3-642-21424-0},
  doi = {10.1007/978-3-642-21424-0_6},
}

@inbook{Arsac2011,
  series = {ESSoS 2011},
  author = {Arsac, Wihem and Compagna, Luca and Pellegrino, Giancarlo and Ponta, Serena Elisa},
  editor = {Erlingsson, Úlfar and Wieringa, Roel and Zannone, Nicola},
  title = {Security Validation of Business Processes via Model-Checking},
  booktitle = {Engineering Secure Software and Systems: Third International Symposium, ESSoS 2011, Madrid, Spain, February 9-10, 2011. Proceedings},
  chapter = {Security Validation of Business Processes via Model-Checking},
  year = {2011},
  publisher = {Springer Berlin Heidelberg},
  address = {Berlin, Heidelberg},
  pages = {29--42},
  isbn = {978-3-642-19125-1},
  doi = {10.1007/978-3-642-19125-1_3},
}

@incollection{Armando_1automatic,
  author = {Alessandro Armando and Roberto Carbone and Luca Compagna},
  title = {Automatic Security Analysis of SAML-based Single Sign-On Protocols},
  year = {2011},
  chapter = {10},
  booktitle = {Digital Identity and Access Management: Technologies and Framework, Business Science},
}

@inproceedings{5463670,
  series = {ICSTW 2010},
  author = {A. Armando and R. Carbone and L. Compagna and K. Li and G. Pellegrino},
  booktitle = {2010 Third International Conference on Software Testing, Verification, and Validation Workshops},
  title = {Model-Checking Driven Security Testing of Web-Based Applications},
  year = {2010},
  pages = {361-370},
  doi = {10.1109/ICSTW.2010.54},
  month = {April},
}