The DOI matches its Crossref record; 11 of the 11 references it cites were found in a registry or an index.
Security in DevSecOps: Applying Tools and Machine Learning to Verification and Monitoring Steps
Open accessAbstract
Security represents one of the crucial concerns when it comes to DevOps methodology-empowered software development and service delivery process. Considering the adoption of Infrastructure as Code (IaC), even minor flaws could potentially cause fatal consequences, especially in sensitive domains such as healthcare and maritime applications. However, most of the existing solutions tackle either Static Application Security Testing (SAST) or run-time behavior analysis distinctly. In this paper, we propose a) IaC Scan Runner, an open-source solution developed in Python for inspecting a variety of state-of-the-art IaC languages in application design time and b) the run time anomaly detection tool called LOMOS. Both tools work in synergy and provide a valuable contribution to a DevSecOps tool set. The proposed approach is demonstrated and their results will be demonstrated on various case studies showcasing the capabilities of static analysis tool IaC Scan Runner combined with LOMOS - log analysis artificial intelligence-enabled framework.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Highly regulated sectors such as healthcare, finance, and government face additional hurdles due to stringent compliance requirements, further complicating DevSecOps implementation.
“Highly regulated sectors such as healthcare, finance, and government face additional hurdles due to stringent compliance requirements, further complicating DevSecOps implementation.”
From Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review (2025) · cites this paper as [17]
Section 5 (page unavailable) describes checking application compliance with standards as a complex task for auditors, and the Abstract identifies healthcare as a sensitive domain. The paper does not say that stringent compliance requirements create additional DevSecOps implementation hurdles in healthcare, finance, and government. (LLM, conf=0.76)
Experimental — accuracy not yet measuredOrganisations often encounter resistance to change, skill shortages, and the technical complexity of integrating security tools into CI/CD pipelines.
“Organisations often encounter resistance to change, skill shortages, and the technical complexity of integrating security tools into Continuous Integration/Continuous Deployment (CI/CD) pipelines.”
From Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review (2025) · cites this paper as [17]
The Introduction and §2.1 describe DevSecOps workflows, and §3 describes a service that integrates security-scanning tools. None says organisations often face resistance to change, skill shortages, or technical complexity as a barrier to integrating those tools into CI/CD pipelines. Searches for those barriers and for DevSecOps adoption challenges found no supporting passage in our copy. (LLM, conf=0.73)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
LogBERT: Log Anomaly Detection via BERT
Guo, H., Yuan, S., & Wu, X. (2021) · 2021 International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn52387.2021.9534113 · Cited by 454
Detecting code smells using machine learning techniques: Are we there yet?
Nucci, D. D., Palomba, F., Tamburri, D. A., Serebrenik, A., & Lucia, A. D. (2018) · IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER) · doi:10.1109/saner.2018.8330266 · Cited by 304
Unsupervised log message anomaly detection
Farzad, A., & Gulliver, T. A. (2020) · ICT Express · doi:10.1016/j.icte.2020.06.003 · Cited by 135
BERT-Log: Anomaly Detection for System Logs Based on Pre-trained Language Model
Chen, S., & Liao, H. (2022) · Applied Artificial Intelligence · doi:10.1080/08839514.2022.2145642 · Cited by 107
Embracing IaC Through the DevSecOps Philosophy: Concepts, Challenges, and a Reference Framework
Alonso, J., Piliszek, R., & Cankar, M. (2023) · IEEE Software · doi:10.1109/ms.2022.3212194 · Cited by 30
Self-citationAutomated Approach to IaC Code Inspection Using Python-Based DevSecOps Tool
Petrović, N., Cankar, M., & Luzar, A. (2022) · Telecommunications Forum (TELFOR) · doi:10.1109/telfor56187.2022.9983681 · Cited by 15
Self-citationLogBERT: Log Anomaly Detection via BERTPreprint
Guo, H., Yuan, S., & Wu, X. (2021) · arXiv (Cornell University) · doi:10.26076/0567-4901 · Cited by 7
Log analysis and system monitoring with nfer
Kauffman, S. (2022) · Science of Computer Programming · doi:10.1016/j.scico.2022.102909 · Cited by 7
LogBERT: Log Anomaly Detection via BERT
Guo, H., Yuan, S., & Wu, X. (2021) · arXiv · doi:10.48550/arxiv.2103.04475 · Cited by 7
Automatic log analysis with NLP for the CMS workflow handling
Layer, L., Abercrombie, D. R., Bakhshiansohi, H., et al. (2020) · EPJ Web of Conferences · doi:10.1051/epjconf/202024503006 · Cited by 6
Web Log Analysis and Security Assessment Method Based on Data Mining
Jin, J., & Lin, X. (2022) · Computational Intelligence and Neuroscience · doi:10.1155/2022/8485014 · Cited by 2
Flagged first, then by citations
Research works printed but not linked: 5
- Juncal Alonso, Christophe Joubert, Leire Orue-Echevarria, Matteo Pradella, and Daniel Vladu?ic. 2021. Programming trustworthy Infrastructure As Code in a Secure Framework. In First SWForum workshop on Trustworthy Software and Open Source 2021. 1--8.
- Kerim Goztepe. 2012. Designing Fuzzy Rule Based Expert System for Cyber Security. International Journal of Information Security Science 1 (01 2012), 13--19.
- 10.1155/2022 · DOI
- 10.1051/epjconf · DOI
- Jina Kim Yukyung Lee and Pilsung Kang. 2021. LAnoBERT: System Log Anomaly Detection based on BERT Masked Language Model. arXiv preprint 211109564 (2021).
Cited by
Sorted by citations
Security in Cloud-Native Services: A Survey
Θεοδωρόπουλος, Θ., Rosa, L., Benzaïd, C., Gray, P., Marin, E., Makris, A., Cordeiro, L., Diego, F., Sorokin, P., Girolamo, M. D., et al. (2023) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp3040034 · Cited by 81
Miller, T. I., Durlik, I., Kostecka, E., Sokołowska, S., Kozlovska, P., & Zwolak, R. (2025) · Electronics · doi:10.3390/electronics14091844 · Cited by 32
Boisrond, K., Tardif, P.-M., & Jaafar, F. (2024) · IEEE Access · doi:10.1109/access.2024.3434618 · Cited by 30
Enhancing DevSecOps practice with Large Language Models and Security Chaos Engineering
Bedoya, M., Palacios, S., Díaz-López, D., Laverde, E., & Nespoli, P. (2024) · International Journal of Information Security · doi:10.1007/s10207-024-00909-w · Cited by 19
Machine Learning-Based Run-Time DevSecOps: ChatGPT Against Traditional Approach
Petrović, N. (2023) · 2023 10th International Conference on Electrical, Electronic and Computing Engineering (IcETRAN) · doi:10.1109/icetran59631.2023.10192161 · Cited by 17
Chat GPT-Based Design-Time DevSecOps
Petrović, N. (2023) · International Scientific Conference on Information, Communication and Energy Systems and Technologies (ICEST) · doi:10.1109/icest58410.2023.10187247 · Cited by 17
Artificial Intelligence in Maritime Anomaly Detection: A Decadal Bibliometric Analysis (2014–2024)
Thakur, A. S., Alex, T. L., & Nighojkar, A. (2025) · Journal of The Institution of Engineers (India) Series C · doi:10.1007/s40032-025-01169-w · Cited by 14
Vulnerabilities in infrastructure as code: what, how many, and who?
War, A., Diallo, A., Habib, A., Klein, J., & Bissyandé, T. F. (2025) · Empirical Software Engineering · doi:10.1007/s10664-025-10672-8 · Cited by 11
Binbeshr, F., & Imam, M. M. (2025) · International Conference on Evaluation and Assessment in Software Engineering (EASE) · doi:10.1145/3727967.3756841 · Cited by 8
Extensive Review of Threat Models for DevSecOps
Nagasundari, S., Manja, P., Mathur, P., & Honnavalli, P. B. (2025) · IEEE Access · doi:10.1109/access.2025.3547932 · Cited by 12
Evolution of DevSecOps and Its Influence on Application Security: A Systematic Literature Review
Mohammed, K., Shanmugam, B., & El-Den, J. (2025) · Technologies · doi:10.3390/technologies13120548 · Cited by 8
Security Vulnerabilities in Infrastructure as Code: What, How Many, and Who?Preprint
War, A., Habib, A., Diallo, A., Klein, J., & Bissyandé, T. F. (2023) · Research Square · doi:10.21203/rs.3.rs-3600645/v1 · Cited by 4
Property-Based Testing for Cybersecurity: Towards Automated Validation of Security Protocols
Reis, M. J. C. S. (2025) · Computers · doi:10.3390/computers14050179 · Cited by 3
Artificial Intelligence for Infrastructure-as-Code—A Systematic Literature Review
Pahl, C., Sezen, Ö. C., & Hofer, F. (2026) · Electronics · doi:10.3390/electronics15040755 · Cited by 2
Firizqi, J. D., & Indrajit, R. E. (2025) · International Conference on Informatics and Computing (ICIC) · doi:10.1109/icic68054.2025.11309501 · Cited by 1
Antić, J., Costa, J. P., Černivec, A., Cankar, M., Martinčič, T., Potočnik, A., Benguria, G., Leligou, H. C., & Boigues, I. T. (2023) · International Conference on the Design of Reliable Communication Networks (DRCN) · doi:10.1109/drcn57075.2023.10108105 · Cited by 2
Self-citationDigital Transformation in Financial Management: Security and Efficiency
Ayuandiani, W., Fausiah, F., Mukhram, M., Listiawati, N., & Indayani, B. (2023) · International Journal of Applied Research and Sustainable Sciences · doi:10.59890/ijarss.v1i3.875 · Cited by 1
Theoretical Approach Of Implementing Blockchain And Artificial Intelligence For Diploma Verification
Rustemi, A., Atanasovski, V. M., Risteski, A., Idrizi, F., & Angelkoska, V. (2024) · Mediterranean Conference on Embedded Computing (MECO) · doi:10.1109/meco62516.2024.10577813
LOMOS: An AI-Based Runtime Security Monitoring System Fit for the Cloud Continuum
Costa, J. P., Ratkajec, H., Vladušič, D., Martinčič, T., Černivec, A., Činkelj, J., Davi, R., Favrin, S., Gorza, L., & di Marco, G. (2025) · Lecture notes in computer science · doi:10.1007/978-3-031-90203-1_1
AI-BASED FRAUD DECTECTION SYSTEM
-, S. N. (2025) · International Journal on Science and Technology · doi:10.71097/ijsat.v16.i2.6435
An AI-powered pipeline for enabling Self-Healing in Software Systems
Siachamis, G., Papadopoulos, G., & Symeonidis, A. L. (2025) · IEEE International Conference on Cyber Security and Resilience (CSR) · doi:10.1109/csr64739.2025.11130137
Integrating Self-Protection into DevSecOps Framework for Defense Against Threat
Nugraha, A. D. P., & Irsan, M. (2025) · International Conference on Software Engineering and Computer Systems · doi:10.1109/icsecs65227.2025.11279258
Security Built-In, not Bolted-On: A Structured Taxonomy for Early Secure Software Development
Goel, S., & Mazzara, M. (2026) · Lecture notes on data engineering and communications technologies · doi:10.1007/978-3-032-23347-9_1
Pasic, A., & González-Zarzosa, S. (2026) · Springer eBooks · doi:10.1007/978-3-032-25917-2_1
Metadata
- Authors
- Cankar, M., Petrovic, N., Pita Costa, J., Cernivec, A., Antic, J., Martincic, T., & Stepec, D.
- Affiliations
- XLAB (Slovenia) (SI)
- XLAB d.o.o. & University of Nis, Ljubljana, Slovenia
- XLAB d.o.o., Ljubljana, Slovenia
- ORCID
- Venue
- Companion of the 2023 ACM/SPEC International Conference on Performance Engineering
- Publisher
- ACM
- Published
- 2023-04-15
- Pages
- 201-205
- OpenAlex
- W4362489974
- Cited by
- 24
- References
- 8
- Citations by year
- 2026: 3 · 2025: 12 · 2024: 3 · 2023: 6
- FWCI
- 7.25
- Type
- conference paper
- Language
- en
- Open access
- hybrid
- doi.org
- Licence
- Locations
- ACM/SPEC International Conference on Performance Engineering (ICPE) (publishedVersion, cc-by)
- Zenodo (CERN European Organization for Nuclear Research) (cc-by)
- Funders
- HORIZON EUROPE Framework Programme (101070177, 101073821, 101095542)
- Horizon 2020 Framework Programme (101000162,952644,952633)
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Software System Performance and Reliability
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Keywords
- DevSecOps, infrastructure as code, static analysis, log analysis, machine learning, security verification, security monitoring, open source tools
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
