Secrecy and Authenticity Types for Secure Distributed Messaging. - Michele Bugliesi; Stefano Calzavara; Damiano Macedonio (ARSPA-WITS, 2010)

Resource-Aware Authorization Policies for Statically Typed Cryptographic Protocols. - Michele Bugliesi; Stefano Calzavara; Fabienne Eigner; Matteo Maffei (CSF, 2011)

Gran: Model Checking Grsecurity RBAC Policies. - Michele Bugliesi; Stefano Calzavara; Riccardo Focardi; Marco Squarcina (CSF, 2012)

Affine Refinement Types for Authentication and Authorization. - Michele Bugliesi; Stefano Calzavara; Fabienne Eigner; Matteo Maffei (TGC, 2012)

Lintent: Towards Security Type-Checking of Android Applications. - Michele Bugliesi; Stefano Calzavara; Alvise Spanò (FMOODS/FORTE, 2013)

Logical Foundations of Secure Resource Management in Protocol Implementations. - Michele Bugliesi; Stefano Calzavara; Fabienne Eigner; Matteo Maffei (POST, 2013)

Static verification and enforcement of authorization policies. - Stefano Calzavara (2013)

Provably Sound Browser-Based Enforcement of Web Session Integrity. - Michele Bugliesi; Stefano Calzavara; Riccardo Focardi; Wilayat Khan; Mauro Tempesta (CSF, 2014)

Automatic and Robust Client-Side Protection for Cookie-Based Sessions. - Michele Bugliesi; Stefano Calzavara; Riccardo Focardi; Wilayat Khan (ESSoS, 2014)

Client Side Web Session Integrity as a Non-interference Property. - Wilayat Khan; Stefano Calzavara; Michele Bugliesi; Willem De Groef; Frank Piessens (ICISS, 2014)

Quite a mess in my cookie jar!: leveraging machine learning to protect web authentication. - Stefano Calzavara; Gabriele Tolomei; Michele Bugliesi; Salvatore Orlando 001 (WWW, 2014)

Compositional Typed Analysis of ARBAC Policies. - Stefano Calzavara; Alvise Rabitti; Michele Bugliesi (CSF, 2015)

Fine-Grained Detection of Privilege Escalation Attacks on Browser Extensions. - Stefano Calzavara; Michele Bugliesi; Silvia Crafa; Enrico Steffinlongo (ESOP, 2015)

Formal Verification of Liferay RBAC. - Stefano Calzavara; Alvise Rabitti; Michele Bugliesi (ESSoS, 2015)

CookiExt: Patching the browser against session hijacking attacks. - Michele Bugliesi; Stefano Calzavara; Riccardo Focardi; Wilayat Khan (J. Comput. Secur., 2015)

Affine Refinement Types for Secure Distributed Programming. - Michele Bugliesi; Stefano Calzavara; Fabienne Eigner; Matteo Maffei (ACM Trans. Program. Lang. Syst., 2015)

A Supervised Learning Approach to Protect Client Authentication on the Web. - Stefano Calzavara; Gabriele Tolomei; Andrea Casini; Michele Bugliesi; Salvatore Orlando 001 (ACM Trans. Web, 2015)

Content Security Problems?: Evaluating the Effectiveness of Content Security Policy in the Wild. - Stefano Calzavara; Alvise Rabitti; Michele Bugliesi (CCS, 2016)

Micro-policies for Web Session Security. - Stefano Calzavara; Riccardo Focardi; Niklas Grimm; Matteo Maffei (CSF, 2016)

Static Detection of Collusion Attacks in ARBAC-Based Workflow Systems. - Stefano Calzavara; Alvise Rabitti; Enrico Steffinlongo; Michele Bugliesi (CSF, 2016)

HornDroid: Practical and Sound Static Analysis of Android Applications by SMT Solving. - Stefano Calzavara; Ilya Grishchenko; Matteo Maffei (EuroS&P, 2016)

Security protocol specification and verification with AnBx. - Michele Bugliesi; Stefano Calzavara; Sebastian Mödersheim; Paolo Modesti (J. Inf. Secur. Appl., 2016)

A Sound Flow-Sensitive Heap Abstraction for the Static Analysis of Android Applications. - Stefano Calzavara; Ilya Grishchenko; Adrien Koutsos; Matteo Maffei (CSF, 2017)

CCSP: Controlled Relaxation of Content Security Policies by Runtime Policy Composition. - Stefano Calzavara; Alvise Rabitti; Michele Bugliesi (USENIX Security Symposium, 2017)

Surviving the Web: A Journey into Web Session Security. - Stefano Calzavara; Riccardo Focardi; Marco Squarcina; Mauro Tempesta (ACM Comput. Surv., 2017)

Formal methods for web security. - Michele Bugliesi; Stefano Calzavara; Riccardo Focardi (J. Log. Algebraic Methods Program., 2017)

Dr Cookie and Mr Token - Web Session Implementations and How to Live with Them. - Stefano Calzavara; Alvise Rabitti; Michele Bugliesi (ITASEC, 2018)

WPSE: Fortifying Web Protocols via Browser-Side Security Monitoring. - Stefano Calzavara; Riccardo Focardi; Matteo Maffei; Clara Schneidewind; Marco Squarcina; Mauro Tempesta (USENIX Security Symposium, 2018)

Semantics-Based Analysis of Content Security Policy Deployment. - Stefano Calzavara; Alvise Rabitti; Michele Bugliesi (ACM Trans. Web, 2018)

Adversarial Training of Gradient-Boosted Decision Trees. - Stefano Calzavara; Claudio Lucchese; Gabriele Tolomei (CIKM, 2019)

Testing for Integrity Flaws in Web Sessions. - Stefano Calzavara; Alvise Rabitti; Alessio Ragazzo; Michele Bugliesi (ESORICS (2), 2019)

Mitch: A Machine Learning Approach to the Black-Box Detection of CSRF Vulnerabilities. - Stefano Calzavara; Mauro Conti; Riccardo Focardi; Alvise Rabitti; Gabriele Tolomei (EuroS&P, 2019)

Semantically Sound Analysis of Content Security Policies. - Stefano Calzavara; Alvise Rabitti; Michele Bugliesi (FORTE, 2019)

Postcards from the Post-HTTP World: Amplification of HTTPS Vulnerabilities in the Web Ecosystem. - Stefano Calzavara; Riccardo Focardi; Matús Nemec; Alvise Rabitti; Marco Squarcina (IEEE Symposium on Security and Privacy, 2019)

Sub-session hijacking on the web: Root causes and prevention. - Stefano Calzavara; Alvise Rabitti; Michele Bugliesi (J. Comput. Secur., 2019)

Language-Based Web Session Integrity. - Stefano Calzavara; Riccardo Focardi; Niklas Grimm; Matteo Maffei; Mauro Tempesta (CSF, 2020)

Certifying Decision Trees Against Evasion Attacks by Program Analysis. - Stefano Calzavara; Pietro Ferrara 001; Claudio Lucchese (ESORICS (2), 2020)

Bulwark: Holistic and Verified Security Monitoring of Web Protocols. - Lorenzo Veronese; Stefano Calzavara; Luca Compagna (ESORICS (1), 2020)

SecWeb 2020 Preface. - Stefano Calzavara; Ben Stock (EuroS&P Workshops, 2020)

On Compliance of Cookie Purposes with the Purpose Specification Principle. - Imane Fouad; Cristiana Santos; Feras Al Kassar; Nataliia Bielova; Stefano Calzavara (EuroS&P Workshops, 2020)

A Hard Lesson: Assessing the HTTPS Deployment of Italian University Websites. - Stefano Calzavara; Riccardo Focardi; Alvise Rabitti; Lorenzo Soligo (ITASEC, 2020)

Complex Security Policy? A Longitudinal Analysis of Deployed Content Security Policies. - Sebastian Roth; Timothy Barron; Stefano Calzavara; Nick Nikiforakis; Ben Stock (NDSS, 2020)

A Tale of Two Headers: A Formal Analysis of Inconsistent Click-Jacking Protection on the Web. - Stefano Calzavara; Sebastian Roth; Alvise Rabitti; Michael Backes 001; Ben Stock (USENIX Security Symposium, 2020)

Can I Take Your Subdomain? Exploring Related-Domain Attacks in the Modern Web. - Marco Squarcina; Mauro Tempesta; Lorenzo Veronese; Stefano Calzavara; Matteo Maffei (CoRR, 2020)

Treant: training evasion-aware decision trees. - Stefano Calzavara; Claudio Lucchese; Gabriele Tolomei; Seyum Assefa Abebe; Salvatore Orlando 001 (Data Min. Knowl. Discov., 2020)

Machine Learning for Web Vulnerability Detection: The Case of Cross-Site Request Forgery. - Stefano Calzavara; Mauro Conti; Riccardo Focardi; Alvise Rabitti; Gabriele Tolomei (IEEE Secur. Priv., 2020)

AMEBA: An Adaptive Approach to the Black-Box Evasion of Machine Learning Models. - Stefano Calzavara; Lorenzo Cazzaro; Claudio Lucchese (AsiaCCS, 2021)

Reining in the Web's Inconsistencies with Site Policy. - Stefano Calzavara; Tobias Urban; Dennis Tatang; Marius Steffens; Ben Stock (NDSS, 2021)

The Remote on the Local: Exacerbating Web Attacks Via Service Workers Caches. - Marco Squarcina; Stefano Calzavara; Matteo Maffei (SP (Workshops), 2021)

Can I Take Your Subdomain? Exploring Same-Site Attacks in the Modern Web. - Marco Squarcina; Mauro Tempesta; Lorenzo Veronese; Stefano Calzavara; Matteo Maffei (USENIX Security Symposium, 2021)

Measuring Web Session Security at Scale. - Stefano Calzavara; Hugo Jonker; Benjamin Krumnow; Alvise Rabitti (Comput. Secur., 2021)

Feature partitioning for robust tree ensembles and their certification in adversarial scenarios. - Stefano Calzavara; Claudio Lucchese; Federico Marcuzzi; Salvatore Orlando 001 (EURASIP J. Inf. Secur., 2021)

The Security Lottery: Measuring Client-Side Web Security Inconsistencies. - Sebastian Roth; Stefano Calzavara; Moritz Wilhelm; Alvise Rabitti; Ben Stock (USENIX Security Symposium, 2022)

Beyond robustness: Resilience verification of tree-based classifiers. - Stefano Calzavara; Lorenzo Cazzaro; Claudio Lucchese; Federico Marcuzzi; Salvatore Orlando 001 (Comput. Secur., 2022)

Cryptographic Web Applications: from Security Engineering to Formal Analysis. - Michele Bugliesi; Stefano Calzavara; Alvise Rabitti (Handb. Formal Anal. Verification Cryptogr., 2023)

Verifiable Learning for Robust Tree Ensembles. - Stefano Calzavara; Lorenzo Cazzaro; Giulio Ermanno Pibiri; Nicola Prezza (CCS, 2023)

You Call This Archaeology? Evaluating Web Archives for Reproducible Web Security Measurements. - Florian Hantke; Stefano Calzavara; Moritz Wilhelm; Alvise Rabitti; Ben Stock (CCS, 2023)

Explainable Global Fairness Verification of Tree-Based Classifiers. - Stefano Calzavara; Lorenzo Cazzaro; Claudio Lucchese; Federico Marcuzzi (SaTML, 2023)

Certifying machine learning models against evasion attacks by program analysis. - Stefano Calzavara; Pietro Ferrara 001; Claudio Lucchese (J. Comput. Secur., 2023)

Special issue: 35th IEEE Computer Security Symposium - CSF 2022. - Stefano Calzavara; David A. Naumann (J. Comput. Secur., 2023)

Web Platform Threats: Automated Detection of Web Security Issues With WPT. - Pedro Bernardo; Lorenzo Veronese; Valentino Dalla Valle; Stefano Calzavara; Marco Squarcina; Pedro Adão; Matteo Maffei (USENIX Security Symposium, 2024)

An Empirical Analysis of Web Storage and Its Applications to Web Tracking. - Zubair Ahmad; Samuele Casarin; Stefano Calzavara (ACM Trans. Web, 2024)

Information flow control for comparative privacy analyses. - Zubair Ahmad; Stefano Calzavara; Samuele Casarin; Ben Stock (Int. J. Inf. Sec., 2024)

Less is More: Boosting Coverage of Web Crawling through Adversarial Multi-Armed Bandit. - Lorenzo Cazzaro; Stefano Calzavara; Maksim Kovalkov; Aleksei Stafeev; Giancarlo Pellegrino (DSN, 2025)

Watermarking Decision Tree Ensembles. - Stefano Calzavara; Lorenzo Cazzaro; Donald Gera; Salvatore Orlando 001 (EDBT, 2025)

Timber! Poisoning Decision Trees. - Stefano Calzavara; Lorenzo Cazzaro; Massimo Vettori (SaTML, 2025)

Verifiable Boosted Tree Ensembles. - Stefano Calzavara; Lorenzo Cazzaro; Claudio Lucchese; Giulio Ermanno Pibiri (SP, 2025)

Dynamic Security Analysis of JavaScript: Are We There Yet? - Stefano Calzavara; Samuele Casarin; Riccardo Focardi (WWW, 2025)

Stochastic Models for Remote Timing Attacks. - Simone Bozzolan; Diletta Olliaro; Stefano Calzavara; Andrea Marin; Gianfranco Balbo; Matteo Sereno (Proc. Priv. Enhancing Technol., 2025)