Publications

  • My Google Scholar profile

  • I am one of the authoring member of the v3/3.1 First.org/NIST Common Vulnerability Scoring System Standard. First.org CVSS Special Interest Group (Authoring member). Common Vulnerability Scoring System (CVSS) v3. Published at http://www.first.org/cvss.

Some highlights

  • Glas, M., Kersten, L., Mulders, T., Pernul, G., & Allodi, L. (2026). T1GER: An Instructional Re-Design of a Cyber Range Exercise in a Commercial Security Operations Center. In Proceedings of the 2026 CHI Conference on Human Factors in Computing Systems (pp. 1-22). Publisher Code
  • Teuwen, K. T. W., Mulders, T., Zambon, E., & Allodi, L. (2025). Ruling the Unruly: Designing Effective, Low-Noise Network Intrusion Detection Rules for Security Operations Centers. In Proceedings of the 20th ACM Asia Conference on Computer and Communications Security (ASIA CCS 2025) (pp. 1428-1441). Publisher Code
  • Weinz, M., Zannone, N., Allodi, L., & Apruzzese, G. (2025). The Impact of Emerging Phishing Threats: Assessing Quishing and LLM-generated Phishing Emails against Organizations. In Proceedings of the 20th ACM Asia Conference on Computer and Communications Security (ASIA CCS 2025) (pp. 1550-1566).
  • Kersten, L., Darré, S., Mulders, T., Zambon, E., Caselli, M., Snijders, C., & Allodi, L. (2024). A Security Alert Investigation Tool Supporting Tier 1 Analysts in Contextualizing and Understanding Network Security Events. In 2024 Annual Computer Security Applications Conference (ACSAC 2024) (pp. 890-905). IEEE. PDF
  • Campobasso, M. and Allodi, L. (2023), Know Your Cybercriminal: Evaluating Attacker Preferences by Measuring Profile Sales on an Active, Leading Criminal Market for User Impersonation at Scale. In Proceedings of USENIX Security 2023. Preprint
  • Kersten, L., Mulders, T., Zambon, E., Snijders, C., & Allodi, L. (2023). ‘Give Me Structure’: Synthesis and Evaluation of a (Network) Threat Analysis Process Supporting Tier 1 Investigations in a Security Operation Center. In Nineteenth Symposium on Usable Privacy and Security (USENIX SOUPS 2023) (pp. 97-111). PDF
  • Marin, I. and Burda, P. and Zannone, N. and Allodi, L. (2023), The Influence of Human Factors on the Intention to Report Phishing Emails. In Proceedings of the 2023 ACM CHI Conference on Human Factors in Computing Systems. Preprint

Preprints

  • Allodi, L., Ricaldi, R., Wientjes, J., & Radu, A. (2024). Where is Dmitry going? Framing ‘migratory’ decisions in the criminal underground. arXiv preprint arXiv:2411.16291. Preprint PDF

Journals

  • Burda, P., Allodi, L., Serebrenik, A., & Zannone, N. (2026). Phishing reporting in organizations: What motivates employees to take action? Information & Computer Security, 34(4), 562-589.
  • Burda, P., Allodi, L., & Zannone, N. (2024). Cognition in social engineering empirical research: a systematic literature review. ACM Transactions on Computer-Human Interaction, 31(2), 1-55. PDF
  • Genga, L., Allodi, L., & Zannone, N. (2022). Association Rule Mining Meets Regression Analysis: An Automated Approach to Unveil Systematic Biases in Decision-Making Processes. Journal of Cybersecurity and Privacy, 2(1), 191-219. Publisher
  • Allodi, L., Massacci, F., Williams, J. The Work-Averse Cyber Attacker Model: Theory and Evidence From Two Million Attack Signatures. (2021) Risk Analysis. DOI
  • Allodi, L., Cremonini, M., Massacci, F. et al. Measuring the accuracy of software vulnerability assessments: experiments with students and professionals. Empirical Software Engineering (2020). DOI
  • Allodi, L. and Massacci, F. (2017), Security Events and Vulnerability Data for Cybersecurity Risk Estimation. Risk Analysis, 37: 1606–1627. DOI Preprint
  • Luca Allodi, Marco Corradin, Fabio Massacci. Then and Now: On The Maturity of the Cybercrime Markets. The lesson black-hat marketeers learned. IEEE Transactions on Emerging Topics in Computing, 4(1):35–46, 2016. Preprint
  • Luca Allodi, Fabio Massacci. Comparing vulnerability severity and exploits using case-control studies. ACM Transactions on Information and System Security (TISSEC). 17(1), Article 1 (2014), 20 pages. PDF

Policy (white) papers

  • Winnona DeSombre, James Shires, JD Work, Robert Morgus, Patrick Howell O’Neill, Luca Allodi, and Trey Herr. Countering cyber proliferation: Zeroing in on Access-as-a-Service. Atlantic Council, 2021. Report
  • Winnona DeSombre, Michele Campobasso, Luca Allodi, Dr. James Shires, JD Work, Robert Morgus, Patrick Howell O’Neill, and Dr. Trey Herr. A primer on the proliferation of offensive cyber capabilities. Atlantic Council, 2021. Report

Conferences

2026

  • Glas, M., Kersten, L., Mulders, T., Pernul, G., & Allodi, L. (2026). T1GER: An Instructional Re-Design of a Cyber Range Exercise in a Commercial Security Operations Center. In Proceedings of the 2026 CHI Conference on Human Factors in Computing Systems (pp. 1-22). Publisher Code
  • Teuwen, K. T. W., Zambon, E., & Allodi, L. (2026). How It’s Made: Uncovering Detection Engineering Processes for Network Intrusion Detection Rules. In Proceedings of the 2026 Workshop on Traffic Measurements for Cybersecurity (WTMC 2026). ACM. Publisher Preprint
  • Ricaldi, R., Asanache, V., & Allodi, L. (2026). TeleHunt: A Framework and Tool for Efficient Cybercriminal Community Discovery on Telegram. In International Conference on Availability, Reliability and Security (ARES 2026) (pp. 261-279). Springer. Preprint Code
  • Majaiti, F., Breve, B., Allodi, L., & Zannone, N. (2026). Weaponizing Social Networks for Phishing Target Selection at Scale. In International Conference on Availability, Reliability and Security (ARES 2026) (pp. 280-299). Springer.
  • Ricaldi, R., Schäfer, M., Zech, P., Allodi, L., Groner, R., & Pekaric, I. (2026). Topical Shifts in the Dark Web: A Longitudinal Analysis of Content from the Cybercrime Ecosystem. In 2026 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) (pp. 93-107). IEEE.

2025

  • Ricaldi, R., Marjanov, T., Allodi, L., & Hutchings, A. (2025). Uncovering the Trust Signals Supporting Telegram’s Cybercrime Economy. In 2025 APWG Symposium on Electronic Crime Research (eCrime) (pp. 1-17). IEEE. Publisher
  • Teuwen, K. T. W., Mulders, T., Zambon, E., & Allodi, L. (2025). Ruling the Unruly: Designing Effective, Low-Noise Network Intrusion Detection Rules for Security Operations Centers. In Proceedings of the 20th ACM Asia Conference on Computer and Communications Security (ASIA CCS 2025) (pp. 1428-1441). Publisher Code
  • Weinz, M., Zannone, N., Allodi, L., & Apruzzese, G. (2025). The Impact of Emerging Phishing Threats: Assessing Quishing and LLM-generated Phishing Emails against Organizations. In Proceedings of the 20th ACM Asia Conference on Computer and Communications Security (ASIA CCS 2025) (pp. 1550-1566).
  • Teuwen, K. T. W., Zambon, E., & Allodi, L. (2025). POSTER: SuriCap - A Measurement Platform to Study and Evaluate Intrusion Detection Rule Engineering. In Proceedings of the 20th ACM Asia Conference on Computer and Communications Security (ASIA CCS 2025) (pp. 1818-1820).
  • Kersten, L., Beelen, K., Zambon, E., Snijders, C., & Allodi, L. (2025). A Field Study to Uncover and a Tool to Support the Alert Investigation Process of Tier-1 Analysts. In Symposium on Usable Security and Privacy (USEC 2025).
  • Radu, A., Kersten, L., Wosyka, R., Mulders, T., Zambon, E., & Allodi, L. (2025). A Test Tool to Evaluate the Skill Sets of Tier-1 Security Analysts in a SOC Environment: A Case Study from Recruitment to Operations. In Proceedings of the 2025 Workshop on Security Operation Center Operations and Construction, San Diego, CA, USA. Internet Society.
  • Teuwen, K. T. W., Baggen, S., Zambon, E., & Allodi, L. (2025). On the Effect of Ruleset Tuning and Data Imbalance on Explainable Network Security Alert Classifications: a Case-Study on DeepCASE. In 2025 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) (pp. 16-29). IEEE.
  • Ricaldi, R., Yalamov, Y., Campobasso, M., Allodi, L., Kool, H., Moneva, A., & Leukfeldt, E. R. (2025). An Experimental Design to Investigate Attacker Actions on an Access-as-a-Service ‘Criminal’ Platform. In 2025 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) (pp. 109-114). IEEE.

2024

  • Kersten, L., Darré, S., Mulders, T., Zambon, E., Caselli, M., Snijders, C., & Allodi, L. (2024). A Security Alert Investigation Tool Supporting Tier 1 Analysts in Contextualizing and Understanding Network Security Events. In 2024 Annual Computer Security Applications Conference (ACSAC) (pp. 890-905). IEEE. PDF
  • Burda, P., Allodi, L., Serebrenik, A., & Zannone, N. (2024). ‘Protect and Fight Back’: A Case Study on User Motivations to Report Phishing Emails. In European Symposium on Usable Security. ACM Press. PDF
  • Burda, P., Kokkini, M. E., Allodi, L., & Zannone, N. (2024). The (Relative) Impact of Email Cues on the Perceived Threat of Phishing Attacks: A User Perspective on Phishing Deceptiveness. In 2024 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) (pp. 67-84). IEEE. Publisher
  • Rosso, M., Allodi, L., Zambon, E., & den Hartog, J. (2024). A Methodology to Measure the “Cost” of CPS Attacks: Not all CPS Networks are Created Equal. In 2024 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) (pp. 112-129). IEEE. Publisher
  • Kempinski, S., Sciancalepore, S., Zambon, E., & Allodi, L. (2024). Attacking Operational Technology Without Specialized Knowledge: The Unspecialized OT Threat Actor Profile. In 2024 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) (pp. 146-159). IEEE. Publisher

2023

  • Burda, P., Altawekji, A. M., Allodi, L., & Zannone, N. (2023). The Peculiar Case of Tailored Phishing against SMEs: Detection and Collective Defense Mechanisms at a Small IT Company. In 2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) (pp. 232-243). Publisher
  • Campobasso, M., Rădulescu, R., Brons, S., & Allodi, L. (2023). You can tell a cybercriminal by the company they keep: A framework to infer the relevance of underground communities to the threat landscape. Presented at the 22nd Workshop on Economics of Information Security (WEIS 2023). Preprint
  • Kersten, L., Mulders, T., Zambon, E., Snijders, C., & Allodi, L. (2023). ‘Give Me Structure’: Synthesis and Evaluation of a (Network) Threat Analysis Process Supporting Tier 1 Investigations in a Security Operation Center. In Nineteenth Symposium on Usable Privacy and Security (SOUPS 2023) (pp. 97-111). PDF
  • Campobasso, M. and Allodi, L. (2023), Know Your Cybercriminal: Evaluating Attacker Preferences by Measuring Profile Sales on an Active, Leading Criminal Market for User Impersonation at Scale. In Proceedings of USENIX Security 2023. Preprint
  • Marin, I. and Burda, P. and Zannone, N. and Allodi, L. (2023), The Influence of Human Factors on the Intention to Report Phishing Emails In Proceedings of the 2023 ACM CHI Conference on Human Factors in Computing Systems. Preprint

2022

  • Campobasso, Michele, and Luca Allodi. THREAT/crawl: a Trainable, Highly-Reusable, and Extensible Automated Method and Tool to Crawl Criminal Underground Forums. In Proceedings of APWG eCrime (2022). Preprint
  • Zangrandi, L. M., Van Ede, T., Booij, T., Sciancalepore, S., Allodi, L., & Continella, A. (2022). Stepping out of the MUD: Contextual threat information for IoT devices with manufacturer-provided behaviour profiles. In 38th Annual Computer Security Applications Conference, ACSAC 2022 (pp. 467-480). Preprint
  • Meijer, M., Petrucci, G. T., Schotsman, M., Morgese, L., van Ede, T., Continella, A., … & Sciancalepore, S. (2022). Federated Lab (FedLab): An Open-source Distributed Platform for Internet of Things (IoT) Research and Experimentation. In IEEE World Forum on IoT. Preprint
  • Kersten, L., Burda, P., Allodi, L., & Zannone, N. (2022). Investigating the Effect of Phishing Believability on Phishing Reporting. In 2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) (pp. 117-128). IEEE. Publisher
  • Tommasini, M., Rosso, M., Zambon, E., Allodi, L., & den Hartog, J. (2022). Characterizing Building Automation System Attacks and Attackers. In 2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) (pp. 139-149). IEEE. Publisher

2021

  • Pavlo Burda, Luca Allodi, Nicola Zannone. Dissecting Social Engineering Attacks Through the Lenses of Cognition. Proceedings of the EuroS&P 2021 3rd Workshop on Attackers and Cybercrime Operatioins (WACCO 2021). Preprint
  • Yoram Meijaard, Peter-Paul Meiler, Luca Allodi. Modelling Disruptive APTs Targeting Critical Infrastructure using Military Theory. Proceedings of the EuroS&P 2021 3rd Workshop on Attackers and Cybercrime Operatioins (WACCO 2021).
  • Bram van Dooremaal, Pavlo Burda, Luca Allodi, and Nicola Zannone. 2021. Combining Text and Visual Features to Improve the Identification of Cloned Webpages for Early Phishing Detection. In The 16th International Conference on Availability, Reliability and Security (ARES 2021). DOI

2020

  • Simone Pirocca, Luca Allodi, Nicola Zannone. A Toolkit for Security Awareness Training Against Targeted Phishing. In proceedings of the 2020 International Conference on Information Systems Security (ICISS 2020) Publisher Preprint
  • Martin Rosso, Michele Campobasso, Ganduulga Gankhuyag, Luca Allodi. SAIBERSOC: Synthetic Attack Injection to Benchmark and Evaluate the Performance of Security Operation Centers. In Proceedings of ACSAC 2020. (acc. rate 23%) Distinguished Paper with Artifacts Award. Preprint
  • Michele Campobasso, Luca Allodi. Impersonation-as-a-Service: Characterizing the Emerging Criminal Infrastructure for User Impersonation at Scale. In Proceedings of the ACM Conference on Computer and Communications Security (ACM CCS 2020). (acc. rate 17%) Preprint
  • Pavlo Burda, Luca Allodi, Nicola Zannone. Don’t Forget the Human: a Crowdsourced Approach to Automate Response and Containment Against Spear Phishing Attacks. In Proceedings of EuroSP WACCO 2020. Publisher
  • Giorgio Di Tizio, Fabio Massacci, Luca Allodi, Stanislav Dashevskyi, Jelena Mirkovic. An Experimental Approach for Estimating Cyber Risk: a Proposal Building upon Cyber Ranges and Capture the Flags. 2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW). Publisher
  • Pavlo Burda, Tzouliano Chotza, Luca Allodi, Nicola Zannone. Testing the effectiveness of tailored phishing techniques in industry and academia: a field experiment. In Proceedings of ARES 2020. Preprint

2019

  • Amber van der Heijden, Luca Allodi. Cognitive Triaging of Phishing Attacks. In Proceedings of Usenix Security 2019 (Acc. rate 16%). Preprint
  • Luca Allodi, Tzouliano Chotza, Ekaterina Panina, and Nicola Zannone. On the need for new anti-phishing measures against spear phishing attacks. IEEE Security & Privacy, 18(2), 23-34 (2019). Preprint
  • Pavlo Burda, Cohen Boot, Luca Allodi. Characterizing the Redundancy of DarkWeb .onion Services. In Proceedings of the 2019 International Conference on Availability, Reliability, and Security (ARES). Publisher
  • Donatello Luna, Luca Allodi, and Marco Cremonini. Productivity and patterns of activity in bug bounty programs: Analysis of hackerone and google vulnerability research. In Proceedings of the 2019 International Conference on Availability, Reliability and Security (ARES)
  • Michele Campobasso, Pavlo Burda, Luca Allodi. CARONTE: Crawling Adversarial Resources Over Non-Trusted, High-Profile Environments. In Proceedings of the 2019 IEEE EuroS&P Workshop on Attackers and Cyber-Crime Operations. Preprint
  • Laura Genga, Luca Allodi, Nicola Zannone. Unveiling Systematic Biases in Decisional Processes. An Application to Discrimination Discovery. In Proceedings of ASIACCS 2019. PDF
  • Roland van Rijswijk-Deij, Gijs Rijnders, Matthijs Bomhoff, Luca Allodi. Privacy-Conscious Threat Intelligence Using DNSBLOOM. 2019 IFIP/IEEE International Symposium on Integrated Network Management (IM 2019). Publisher

2018

  • Luca Allodi. Underground Economics for Vulnerability Risk. Usenix ;login: (2018), Vol 43, no. 1. Publisher
  • Luca Allodi, Marco Cremonini, Fabio Massacci, Woohyun Shim. The effect of security education and expertise on security assessments: the case of software vulnerabilities. Presented at WEIS 2018, Innsbruck, AT.
  • Jukka Ruohonen, Luca Allodi. A bug bounty perspective on the disclosure of web vulnerabilities. Presented at WEIS 2018, Innsbruck, AT.
  • Tho Le, Roland van Rijswijk-Deij, Luca Allodi and Nicola Zannone. Economic Incentives on DNSSEC Deployment: Time to Move from Quantity to Quality. Proceedings of the 16th IEEE/IFIP Network Operations and Management Symposium (NOMS 2018). Preprint

2017

  • Luca Allodi and Sandro Etalle. 2017. Towards Realistic Threat Modeling: Attack Commodification, Irrelevant Vulnerabilities, and Unrealistic Assumptions. In Proceedings of the 2017 Workshop on Automated Decision Making for Active Cyber Defense (SafeConfig ‘17). ACM, New York, NY, USA, 23-26. DOI Preprint
  • Luca Allodi. 2017. Economic Factors of Vulnerability Trade and Exploitation. In Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS ‘17). ACM, New York, NY, USA, 1483-1499. (Acc. rate 18%). DOI Preprint
  • Luca Allodi, Fabio Massacci. Attack potential in Impact and Complexity. In the Proceedings of ARES 2017. Preprint
  • Allodi, L., Biagioni, S., Crispo, B., Labunets, K., Massacci, F., & Santos, W. (2017). Estimating the Assessment Difficulty of CVSS Environmental Metrics: An Experiment. In International Conference on Future Data and Security Engineering (pp. 23-39). Springer, Cham.
  • Luca Allodi, Fabio Massacci, Julian Williams. The Work-Averse Cyber Attacker Model. Evidence from two million attack signatures. Presented at WEIS 2017. Preprint

2015

  • Luca Allodi, Fabio Massacci. The Work-Averse Attacker Model. In the Proceedings of the 2015 European Conference on Information Systems (ECIS 2015). PDF
  • Luca Allodi. The Heavy Tails of Vulnerability Exploitation In the Proceedings of ESSoS 2015. PDF

2014

  • Luca Allodi, Luca Chiodi, Marco Cremonini. Self-Organizing Techniques for Knowledge Diffusion in Dynamic Social Networks. in Proceedings of the 5th Workshop on Complex Networks. CompleNET 2014.

2013

  • Luca Allodi. Attacker economics for Internet-scale vulnerability risk assessment (Extended Abstract) Research proposal, in Proceedings of Usenix LEET 2013. PDF
  • Luca Allodi, Vadim Kotov, Fabio Massacci. MalwareLab: Experimentation with Cybercrime Attack Tools. In Proceedings of Usenix CSET 2013. PDF
  • Luca Allodi, Fabio Massacci. How CVSS is DOSsing your patching policy (and wasting your money). Presentation at BlackHat USA 2013.
  • Luca Allodi Fabio Massacci. Analysis of exploits in the wild. Or: do Cybersecurity Standards Make Sense? Poster at IEEE Symposium on Security & Privacy 2013.
  • Luca Allodi, Woohyun Shim, Fabio Massacci. Quantitative assessment of risk reduction with cybercrime black market monitoring. Proceedings of IEEE S&P 2013 International Workshop on Cyber Crime. PDF

2012

  • Woohyun Shim, Luca Allodi, Fabio Massacci. Crime Pays If You Are Just an Average Hacker. Proceedings of IEEE/ASE 2012 Cyber Security Conference. Conference acceptance rate: 9%. Complementary publication in ASE Journal, 2012, Vol. 2. Journal acceptance rate: 3%. Best paper award. PDF
  • Luca Allodi, Fabio Massacci. A Preliminary Analysis of Vulnerability Scores for Attacks in Wild. Proceedings of BADGERS 2012 CCS Workshop. PDF
  • Luca Allodi, Fabio Massacci, Woohuyn Shim. Crime payes if you are just an average hacker. Accepted Poster at GameSec 2012.
  • Luca Allodi. The dark side of vulnerability exploitation. Proceedings of the 2012 ESSoS Conference Doctoral Symposium. PDF

2011

  • Luca Allodi, Marco Cremonini, Luca Chiodi. The asymmetric diffusion of trust between communities: Simulations in dynamic social networks. Proceedings of the 2011 Winter Simulation Conference. Finalist “Best Theoretical Paper Award Wintersim 2011”. Publisher
  • Luca Allodi, Marco Cremonini, Luca Chiodi. Modifying Trust Dynamics through Cooperation and Defection in Evolving Social Networks. Springer LNCS 6740, pp. 131-145, 2011. Publisher