A Method for the Development of Totally Correct Shared-State Parallel Programs. - Ketil Stølen (CONCUR, 1991)

An Attempt to Reason about Shared-State Concurrency in the Style of VDM. - Ketil Stølen (VDM Europe (1), 1991)

Shared-state design modulo weak and strong process fairness. - Ketil Stølen (FORTE, 1992)

Proving Total Correctness with Respect to a Fair (Shared-State) Parallel Language. - Ketil Stølen (Refine, 1992)

Assumption, commitment rules for networks of asynchronously communicating agents - Ketil Stølen; Frank Dederichs; Rainer Weber (Forschungsberichte, TU Munich, 1993)

Development of a distributed min max component - Max Fuchs; Ketil Stølen (Forschungsberichte, TU Munich, 1993)

Using Relations to Solve the RPC-Memory Specification Problem. - Ketil Stølen (Formal Systems Specification, 1994)

An attempt to embed a restricted version of SDL as a target language in Focus. - Eckhardt Holz; Ketil Stølen (FORTE, 1994)

Specification and Refinement of Finite Dataflow Networks - a Relational Approach. - Manfred Broy; Ketil Stølen (FTRTFT, 1994)

A Refinement Relation Supporting the Transition from Unbounded to Bounded Communication Buffers. - Ketil Stølen (MPC, 1995)

A Model for Mobile Point-to-Point Data-flow Networks without Channel Sharing. - Radu Grosu; Ketil Stølen (AMAST, 1996)

Assumption/Commitment Rules for Dataflow Networks - With an Emphasis on Completeness. - Ketil Stølen (ESOP, 1996)

Specification and Refinement of Networks of Asynchronously Communicating Agents Using the Assumption/Commitment Paradigm. - Ketil Stølen; Frank Dederichs; Rainer Weber (Formal Aspects Comput., 1996)

Refinement Principles Supporting the Transition from Asynchronous to Synchronous Communication. - Ketil Stølen (Sci. Comput. Program., 1996)

An Exercise in Conditional Refinement. - Ketil Stølen; Max Fuchs (Prospects for Hardware Foundations, 1998)

Specification of Dynamic Reconfiguration in the Context of Input/Output Relations. - Ketil Stølen (FMOODS, 1999)

Experience from Using MSC, UML and SDL in the Development of the FAME Communication Manager. - Ketil Stølen; P. Mohn (SAM, 2000)

Stream-Based Specification of Mobile Systems. - Radu Grosu; Ketil Stølen (Formal Aspects Comput., 2001)

Specification and Development of Interactive Systems - Focus on Streams, Interfaces, and Refinement - Manfred Broy; Ketil Stølen (Springer, 2001)

The coras approach for model-based risk management applied to e-commerce domain. - Dimitris Raptis; Theodosis Dimitrakos; Bjørn Axel Gran; Ketil Stølen (Communications and Multimedia Security, 2002)

Model-Based Risk Assessment to Improve Enterprise Security. - Jan Øyvind Aagedal; Folker den Braber; Theodosis Dimitrakos; Bjørn Axel Gran; Dimitris Raptis; Ketil Stølen (EDOC, 2002)

Model Based Security Risk Analysis for Web Applications. - Theodosis Dimitrakos; Dimitris Raptis; Brian Ritchie; Ketil Stølen (EuroWeb, 2002)

Integrating Model-based Security Risk Management into eBusiness Systems Development: The CORAS Approach. - Theodosis Dimitrakos; Brian Ritchie; Dimitris Raptis; Jan Øyvind Aagedal; Folker den Braber; Ketil Stølen; Siv Hilde Houmb (I3E, 2002)

The CORAS Framework for a Model-Based Risk Management Process. - Rune Fredriksen; Monica Kristiansen; Bjørn Axel Gran; Ketil Stølen; Tom Arthur Opperud; Theodosis Dimitrakos (SAFECOMP, 2002)

Maintaining Results from Security Assessment. - Mass Soldal Lund; Folker den Braber; Ketil Stølen (CSMR, 2003)

Why Timed Sequence Diagrams Require Three-Event Semantics. - Øystein Haugen; Knut Eilif Husa; Ragnhild Kobro Runde; Ketil Stølen (Scenarios: Models, Transformations and Tools, 2003)

The CORAS approach for model-based risk management applied to a telemedicine service. - Yannis C. Stamatiou; Eva Skipenes; Eva Henriksen; Nikos Stathiakis; Adamantios Sikianakis; Eliana Charalambous; Nikos Antonakis; Ketil Stølen; Folker den Braber; Mass Soldal Lund; Katerina Papadaki 003; George Valvis (MIE, 2003)

STAIRS - Steps to Analyze Interactions with Refinement Semantics. - Øystein Haugen; Ketil Stølen (UML, 2003)

Using Risk Analysis to Assess User Trust: A Net-Bank Scenario. - Gyrd Brændeland; Ketil Stølen (iTrust, 2004)

Integrating Security in the Development Process with UML. - Folker den Braber; Mass Soldal Lund; Ketil Stølen; Fredrik Vraalsen (Encyclopedia of Information Science and Technology (III), 2005)

The Pragmatics of STAIRS. - Ragnhild Kobro Runde; Øystein Haugen; Ketil Stølen (FMCO, 2005)

Specification and Refinement of Soft Real-Time Requirements Using Sequence Diagrams. - Atle Refsdal; Knut Eilif Husa; Ketil Stølen (FORMATS, 2005)

Graphical Specification of Dynamic Network Structure. - Fredrik Seehusen; Ketil Stølen (ICEIS (3), 2005)

Risk analysis terminology for IT-systems: does it match intuition? - Ida Hogganvik; Ketil Stølen (ISESE, 2005)

The CORAS Tool for Security Risk Analysis. - Fredrik Vraalsen; Folker den Braber; Mass Soldal Lund; Ketil Stølen (iTrust, 2005)

Specifying Legal Risk Scenarios Using the CORAS Threat Modelling Language. - Fredrik Vraalsen; Mass Soldal Lund; Tobias Mahler; Xavier Parent 001; Ketil Stølen (iTrust, 2005)

On the Comprehension of Security Risk Scenarios. - Ida Hogganvik; Ketil Stølen (IWPC, 2005)

Experiences from Using the CORAS Methodology to Analyze a Web Application. - Folker den Braber; Arne Bjørn Mildal; Jone Nes; Ketil Stølen; Fredrik Vraalsen (J. Cases Inf. Technol., 2005)

Refining UML Interactions with Underspecification and Nondeterminism. - Ragnhild Kobro Runde; Øystein Haugen; Ketil Stølen (Nord. J. Comput., 2005)

STAIRS towards formal design with sequence diagrams. - Øystein Haugen; Knut Eilif Husa; Ragnhild Kobro Runde; Ketil Stølen (Softw. Syst. Model., 2005)

Using model-based security analysis in component-oriented system development. - Gyrd Brændeland; Ketil Stølen (QoP, 2006)

A Fully General Operational Semantics for UML 2.0 Sequence Diagrams with Potential and Mandatory Choice. - Mass Soldal Lund; Ketil Stølen (FM, 2006)

Underspecification, Inherent Nondeterminism and Probability in Sequence Diagrams. - Atle Refsdal; Ragnhild Kobro Runde; Ketil Stølen (FMOODS, 2006)

Deriving Tests from UML 2.0 Sequence Diagrams with neg and assert. - Mass Soldal Lund; Ketil Stølen (AST, 2006)

The TrustCoM Approach to Enforcing Agreements between Interoperating Enterprises. - Michael D. Wilson; Alvaro Arenas; David W. Chadwick; Theo Dimitrakos; Jürgen Doser; Pablo Giambiagi; David Golby; Christian Geuer-Pollmann; Jochen Haller; Ketil Stølen; Tobias Mahler; Lorenzo Martino; et al. (I-ESA, 2006)

A Semantic Paradigm for Component-Based Specification Integrating a Notion of Security Risk. - Gyrd Brændeland; Ketil Stølen (Formal Aspects in Security and Trust, 2006)

Maintaining Information Flow Security Under Refinement and Transformation. - Fredrik Seehusen; Ketil Stølen (Formal Aspects in Security and Trust, 2006)

A Graphical Approach to Risk Identification, Motivated by Empirical Investigations. - Ida Hogganvik; Ketil Stølen (MoDELS, 2006)

Information flow property preserving transformation of UML interaction diagrams. - Fredrik Seehusen; Ketil Stølen (SACMAT, 2006)

Using Dependent CORAS Diagrams to Analyse Mutual Dependency. - Gyrd Brændeland; Heidi E. I. Dahl; Iselin Engan; Ketil Stølen (CRITIS, 2007)

Semantics of UML Models for Dynamic Behavior - A Survey of Different Approaches. - Mass Soldal Lund; Atle Refsdal; Ketil Stølen (Model-Based Engineering of Embedded Real-Time Systems, 2007)

Specifying Policies Using UML Sequence Diagrams - An Evaluation Based on a Case Study. - Bjørnar Solhaug; Dag Elgesem; Ketil Stølen (POLICY, 2007)

Compositional Refinement of Policies in UML - Exemplified for Access Control. - Bjørnar Solhaug; Ketil Stølen (ESORICS, 2008)

A UML-based Method for the Development of Policies to Support Trust Management. - Atle Refsdal; Bjørnar Solhaug; Ketil Stølen (IFIPTM, 2008)

A Transformational Approach to Facilitate Monitoring of High-Level Policies. - Fredrik Seehusen; Ketil Stølen (POLICY, 2008)

Extending UML sequence diagrams to model trust-dependent behavior with the aim to support risk analysis. - Atle Refsdal; Ketil Stølen (Sci. Comput. Program., 2008)

Employing Key Indicators to Provide a Dynamic Risk Picture with a Notion of Confidence. - Atle Refsdal; Ketil Stølen (IFIPTM, 2009)

Simplifying Parametrization of Bayesian Networks in Prediction of System Quality. - Aida Omerovic; Ketil Stølen (SSIRI, 2009)

Information flow security, abstraction and composition. - Fredrik Seehusen; Ketil Stølen (IET Inf. Secur., 2009)

Adherence preserving refinement of trace-set properties in STAIRS: exemplified for information flow properties and policies. - Fredrik Seehusen; Bjørnar Solhaug; Ketil Stølen (Softw. Syst. Model., 2009)

Ad Hoc Networks and Mobile Devices in Emergency Response - A Perfect Match? - (Invited Paper). - Erik G. Nilsson; Ketil Stølen (ADHOCNETS, 2010)

Idea: A Feasibility Study in Model Based Prediction of Impact of Changes on System Quality. - Aida Omerovic; Anette Andresen; Håvard Grindheim; Per Myrseth; Atle Refsdal; Ketil Stølen; Jon Ølnes (ESSoS, 2010)

Evolution in Relation to Risk and Trust Management. - Mass Soldal Lund; Bjørnar Solhaug; Ketil Stølen (Computer, 2010)

Experiences from using a UML-based method for trust analysis in an industrial project on electronic procurement. - Tormod V. Håvaldsrud; Olav S. Ligaarden; Per Myrseth; Atle Refsdal; Ketil Stølen; Jon Ølnes (Electron. Commer. Res., 2010)

Modular analysis and modelling of risk scenarios with dependencies. - Gyrd Brændeland; Atle Refsdal; Ketil Stølen (J. Syst. Softw., 2010)

Model-Driven Risk Analysis - The CORAS Approach. - Mass Soldal Lund; Bjørnar Solhaug; Ketil Stølen (Springer, 2011)

Experiences from Using Indicators to Validate Expert Judgments in Security Risk Analysis. - Olav S. Ligaarden; Atle Refsdal; Ketil Stølen (Metrisec@ESEM, 2011)

A Denotational Model for Component-Based Risk Analysis. - Gyrd Brændeland; Atle Refsdal; Ketil Stølen (FACS, 2011)

Risk Analysis of Changing and Evolving Systems Using CORAS. - Mass Soldal Lund; Bjørnar Solhaug; Ketil Stølen (FOSAD, 2011)

Towards Patterns for Handling Safety Critical Adaptive Control Software. - André Alexandersen Hauge; Ketil Stølen (ICINCO (1), 2011)

An Evaluation of the Graphical Modeling Framework (GMF) Based on the Development of the CORAS Tool. - Fredrik Seehusen; Ketil Stølen (ICMT@TOOLS, 2011)

An architectural pattern for enterprise level monitoring tools. - Olav S. Ligaarden; Mass Soldal Lund; Atle Refsdal; Fredrik Seehusen; Ketil Stølen (MESOCA, 2011)

Generic functionality in user interfaces for emergency response. - Erik G. Nilsson; Ketil Stølen (OZCHI, 2011)

SACS: a pattern language for safe adaptive control software. - André Alexandersen Hauge; Ketil Stølen (PLoP, 2011)

Evaluation of Experiences from Applying the PREDIQT Method in an Industrial Case Study. - Aida Omerovic; Bjørnar Solhaug; Ketil Stølen (SSIRI, 2011)

Uncertainty, Subjectivity, Trust and Risk: How It All Fits together. - Bjørnar Solhaug; Ketil Stølen (STM, 2011)

Preservation of Policy Adherence under Refinement. - Bjørnar Solhaug; Ketil Stølen (Int. J. Softw. Informatics, 2011)

Risk-driven Security Testing versus Test-driven Security Risk Analysis. - Gencer Erdogan; Ketil Stølen (ESSoS Doctoral Symposium, 2012)

Geographic Visualization of Risk as Decision Support in Emergency Situations. - Aslak Wegner Eide; Ketil Stølen (HSI, 2012)

A Pattern-Based Method for Safe Control Systems Exemplified within Nuclear Power Production. - André Alexandersen Hauge; Ketil Stølen (SAFECOMP, 2012)

Assessing practical usefulness and performance of the PREDIQT method: An industrial case study. - Aida Omerovic; Bjørnar Solhaug; Ketil Stølen (Inf. Softw. Technol., 2012)

An Approach to Select Cost-Effective Risk Countermeasures. - Le Minh Sang Tran; Bjørnar Solhaug; Ketil Stølen (DBSec, 2013)

A Systematic Method for Risk-Driven Test Case Design Using Annotated Sequence Diagrams. - Gencer Erdogan; Atle Refsdal; Ketil Stølen (RISK@ICTSS, 2013)

An Approach to Select Cost-Effective Risk Countermeasures Exemplified in CORAS - Le Minh Sang Tran; Bjørnar Solhaug; Ketil Stølen (CoRR, 2013)

Relating computer systems to sequence diagrams: the impact of underspecification and inherent nondeterminism. - Ragnhild Kobro Runde; Atle Refsdal; Ketil Stølen (Formal Aspects Comput., 2013)

Schematic Generation of English-Prose Semantics for a Risk Analysis Language Based on UML Interactions. - Gencer Erdogan; Atle Refsdal; Ketil Stølen (ISSRE Workshops, 2014)

Approaches for the combined use of risk analysis and testing: a systematic literature review. - Gencer Erdogan; Yan Li; Ragnhild Kobro Runde; Fredrik Seehusen; Ketil Stølen (Int. J. Softw. Tools Technol. Transf., 2014)

ISMS-CORAS: A Structured Method for Establishing an ISO 27001 Compliant Information Security Management System. - Kristian Beckers; Maritta Heisel; Bjørnar Solhaug; Ketil Stølen (Engineering Secure Future Internet Services and Systems, 2014)

Divide and Conquer - Towards a Notion of Risk Model Encapsulation. - Atle Refsdal; Øyvind Rideng; Bjørnar Solhaug; Ketil Stølen (Engineering Secure Future Internet Services and Systems, 2014)

Assessing the Usefulness of Testing for Validating and Correcting Security Risk Models Based on Two Industrial Case Studies. - Gencer Erdogan; Fredrik Seehusen; Ketil Stølen; Jon Hofstad; Jan Øyvind Aagedal (Int. J. Secur. Softw. Eng., 2015)

Stepwise refinement of sequence diagrams with soft real-time constraints. - Atle Refsdal; Ragnhild Kobro Runde; Ketil Stølen (J. Comput. Syst. Sci., 2015)

Security risk analysis of system changes exemplified within the oil and gas domain. - Atle Refsdal; Bjørnar Solhaug; Ketil Stølen (Int. J. Softw. Tools Technol. Transf., 2015)

Cyber-Risk Management - Atle Refsdal; Bjørnar Solhaug; Ketil Stølen (Springer, 2015)

Mandatory and Potential Choice: Comparing Event-B and STAIRS. - Atle Refsdal; Ragnhild Kobro Runde; Ketil Stølen (From Action Systems to Distributed Systems, 2016)

A case-based assessment of the FLUIDE framework for specifying emergency response user interfaces. - Erik G. Nilsson; Ketil Stølen (EICS, 2016)

Evaluation of the CORAL Approach for Risk-driven Security Testing based on an Industrial Case Study. - Gencer Erdogan; Ketil Stølen; Jan Øyvind Aagedal (ICISSP, 2016)

The FLUIDE Framework for Specifying Emergency Response User Interfaces Employed to a Search and Rescue Case. - Erik G. Nilsson; Ketil Stølen (ISCRAM, 2016)

Design Decisions in the Development of a Graphical Language for Risk-Driven Security Testing. - Gencer Erdogan; Ketil Stølen (RISK, 2016)

Risk-Based Elicitation of Security Requirements According to the ISO 27005 Standard. - Roman Wirtz; Maritta Heisel; Angela Borchert; Rene Meis; Aida Omerovic; Ketil Stølen (ENASE (Selected Papers), 2018)

Problem-based Elicitation of Security Requirements - The ProCOR Method. - Roman Wirtz; Maritta Heisel; Rene Meis; Aida Omerovic; Ketil Stølen (ENASE, 2018)

Technology Research Explained - Design of Software, Architectures, Methods, and Technology in General - Ketil Stølen (Springer, 2023)

Privacy-Aware IoT: State-of-the-Art and Challenges. - Shukun Tokas; Gencer Erdogan; Ketil Stølen (ICISSP, 2023)

Development of parallel programs on shared data-structures - Revised version. - Ketil Stølen (CoRR, 2024)

Rely-Guarantee Interpretation of Sequence Diagrams. - Ketil Stølen (The Practice of Formal Methods (II), 2024)