xDECAF: An Extensible Data Flow Diagram Analysis Framework for Information Security Benjamin Arp
Felix Schwickerath
Alexander Vogt
[email protected] Karlsruhe Institute of Technology Germany
[email protected] Karlsruhe Institute of Technology Germany
[email protected] Karlsruhe Institute of Technology Germany
Tom Hüller
Nils Niehues
Nicolas Boltz
[email protected] Karlsruhe Institute of Technology Germany
[email protected] Karlsruhe Institute of Technology Germany
[email protected] Karlsruhe Institute of Technology Germany
Abstract
arXiv:2607.05913v1 [cs.SE] 7 Jul 2026
xdecaf is an extensible tool for architecture-based data flow analysis
with a focus on information security. It combines an extended data flow diagram metamodel of labeled flows and nodes, a domainspecific constraint language with different flow operations, and a browser-based editor backed by an analysis engine. In this paper, we present the xdecaf tool library and a curated catalog of over 20 example models with documented constraints and expected violations, intended as a reusable dataset for the community. The tool has already been adopted by several research lines, providing concrete evidence of its utility. The tool, dataset, and a hosted online editor are publicly available. Screencast: https://youtu.be/L-PGdWoPtlw Code & Dataset: https://github.com/DataFlowAnalysis • https://doi.org/10.5281/zenodo.20083877
Keywords Data Flow Diagram, Data Flow Analysis, Propagation, Constraint Language, Example Catalogue, Tooling, Web Editor ACM Reference Format: Benjamin Arp, Felix Schwickerath, Alexander Vogt, Tom Hüller, Nils Niehues, and Nicolas Boltz. 2026. xDECAF: An Extensible Data Flow Diagram Analysis Framework for Information Security. In Proceedings of 41st IEEE/ACM International Conference on Automated Software Engineering (ASE ’26). ACM, New York, NY, USA, 4 pages. https://doi.org/XXXXXXX.XXXXXXX
1
Introduction
Modern software systems increasingly shape critical parts of everyday life and are rarely confined to a single technical or organizational setting. They commonly span organizational boundaries, heterogeneous technologies, and multiple regulatory contexts, which makes it necessary to assess them systematically against security and compliance requirements. To reason about such properties at Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]. ASE ’26, Munich, Germany © 2026 Copyright held by the owner/author(s). Publication rights licensed to ACM. ACM ISBN 978-1-4503-XXXX-X/2018/06 https://doi.org/XXXXXXX.XXXXXXX
design time, Data Flow Diagrams (DFDs) are a common notation for representing the structure of relevant parts of a system [20, 27]. In this tool paper, we present xdecaf, a DFD-based extensible framework for security modeling and automated analysis, with a focus on information security. xdecaf is intended as a foundation for researchers who want to address data-flow-based analysis problems. They can use its existing capabilities as building blocks or adapt individual aspects of the framework and tooling to support more specialized or advanced research goals. To support this intended use, the core of xdecaf was designed around a general data-flow analysis paradigm. It supports userdefined semantics by allowing label annotations, propagation logic, and data flow constraints to be freely specified. This enables analyses beyond singular security concerns and across different application domains. Reflecting this generality, the tooling surrounding its core is designed for reuse and extension. The analysis provides explicit interfaces using a builder pattern, allowing it to be integrated as an analysis component (e.g., as an oracle) or combined with domain-specific pre-/postprocessing. Core pipeline stages can also be exchanged or reimplemented, e.g., import formats and their interpretation, or data flow identification. xdecaf further provides an extensible online editor with frontend and backend components to support outward-facing, end-user-oriented research, such as improved threat-modeling workflows. The artifacts presented in this tool and dataset paper are: • the xdecaf tool library, with interfaces for reuse and extension, • the online editor with frontend and backend, and • a catalog of example models, provided as a reusable dataset. The utility and validation of these artifacts is supported by research that builds on xdecaf. The underlying analysis foundations of xdecaf, including its scalability, have been described and validated in prior work [4]. Subsequent research has used xdecaf to address additional security-related properties [5], to integrate further architectural modeling languages and DFD datasets [12, 17, 24, 25], and to support analysis composition [22], uncertainty modeling and analysis [10], as well as automated mitigation of data-flow violations [16, 19]. Beyond information security, xdecaf has also been applied to legal compliance scenarios [6, 7]. xdecaf and all artifacts described in this paper are open-source and linked together with the artifacts listed above. In addition, we provide a dataset that captures the current release of all described artifacts [2].
ASE ’26, October 12—16, 2026, Munich, Germany
2
xdecaf Core Concepts
The core of xdecaf is made up of an extended DFD syntax, propagation logic, constraint language, and analysis engine. These concepts have been presented and evaluated in detail in previous work [4]. The DFDs of xdecaf extend the basic notation of nodes and flows with Labels, Pins, and Assignments to facilitate the core label propagation approach. Labels represent discrete values and are used to annotate specific properties/metainformation to either nodes or to data propagated through the system. Labels assigned to nodes may represent node-specific properties, e.g., deployment information or security levels. Data Labels are propagated through the system and represent metainformation about the data, e.g., sensitivity, granularity, or required access levels. Pins are assigned directly to a node and act as the input and output interfaces of said node. Therefore, as shown in Figure 1, flows between nodes start and terminate in Pins. Multiple flows into the same Input Pin represent multiple independent paths data can take to reach that node, while multiple flows into different Output Pin of the same node represent parallel flows. Assignments are part of Output Pins and describe how Labels are propagated along their connected flows. They allow the formulation of conditional logical statements that reference input pins and labels to define whether, or under which conditions, incoming data Labels are modified. After modeling, the propagation logic of xdecaf propagates the labels through the flows of the DFD according to the assignment specifications. The label propagation process identifies all possible routes that label information can take through the system. As a result, xdecaf identifies all independent data flows that connect 𝑛 sources to a sink. If these data flows contain cycles, heuristics are applied to resolve them [3].
Arp et al.
1 data 2 with GrantedRoles.$grantedRoles 3 never flows to 4 node 5 with assignedRoles.$assignedRoles 6 where empty intersection($grantedRoles,$assignedRoles)
Listing 1: xDECAF constraint for role-based access control. the selectors are matched. We support four flow verbs, corresponding to the two quantifiers and their negations of first-order logic: flows ≡ ∃𝑥 𝜑 (𝑥), alwaysFlows ≡ ∀𝑥 𝜑 (𝑥), neverFlows ≡ ¬∃𝑥 𝜑 (𝑥), notAlwaysFlows ≡ ¬∀𝑥 𝜑 (𝑥). Lastly, in the <Conditional> section, relationships between the source and destination sections can be enforced. This is achieved by introducing Variables in the source and destination sections that contain all possible propagated label values. These sets of label values can be used in selectors that implement set operations, like intersection and size operations. A role-based access control constraint, with Conditional and Variables, is shown in Listing 1. It defines that data should only be accessed by a certain granted role, should only flow to nodes with the correct permissions, as denoted by assigned roles. xdecaf also supports the analysis of Palladio Component Model (PCM) instances. The PCM [23] is an Architectural Description Language (ADL) for component-based software systems. An extension of the PCM allows the definition of confidentiality-related properties of components, interfaces, and resource descriptions. A transformation extracts DFDs from the control-flow modeled in PCM instances and uses the confidentiality-related properties as labels in the analysis of xdecaf [12, 25].
3
Figure 1: Extended DFD Example in xDECAF online editor. To analyze the propagated DFDs, xdecaf provides a domainspecific language (DSL)1 for formulating and evaluating data flow constraints. Constraints are evaluated independently for each individual data flow. The constraint language expresses constraints by describing the origin and destination of flows and their relationship in the following structure: <Source> <flowVerb> <Destination> and an additional optional section for additional constraints denoted with where <Conditional>. Both the <Source> and <Destination> sections allow users to define selectors that match elements as sources or destinations. Possible selectors include matching labels of a node or data, as well as the node type, node name, or data name. Additionally, selectors can be combined using logical operators, such as & or |. Each <flowVerb> is interpreted as a quantifier over the set 𝑋 of flows 𝑥 between a matched source 𝑥𝑠𝑟𝑐 and a matched destination 𝑥𝑑𝑠𝑡 : the predicate 𝜑 (𝑥) := 𝜑 (𝑥𝑠𝑟𝑐 , 𝑥𝑑𝑠𝑡 ) holds when
Example Model Catalogue
In addition to the analysis outlined in the previous sections, we provide a reusable dataset [2] that includes models, documentation, data flow constraints, and expected violations. The catalog includes models of different levels of complexity and several domains, which are either derived from other literature in the information security context [1, 23, 26, 29–31], from available documentation [10, 11, 15], industry collaboration [8] and/or are inspired by recent exploits [15, 30]. The provided models illustrate security pitfalls and support researchers as a well-documented foundation for evaluation. Overall, the catalog contains 26 models that range from 7 to 923 nodes and from 4 to 72 individual labels. The complexity of models depends on several factors, mainly the amount of independent data flows and included cycles. For smaller models (e.g., > 20 nodes), xdecaf takes > 1 second to complete an analysis run, and does not exceed 1 minute for our most complex models from the catalog. This collection complements the previously integrated microSecEnD dataset [17, 24], containing security-annotated DFDs derived from the source code of open-source microservice applications. A list of all current models is also found on the xdecaf website2 .
4
Online Editor
To allow easy creation, visualization, and analysis of DFDs without requiring code or a local installation, we provide a publicly available web-based editor3 . The editor is split into a frontend for 2 https://dataflowanalysis.org/examples/models/ (11.05.2026)
1 https://dataflowanalysis.org/wiki/dsl/ (11.05.2026)
3 https://editor.dataflowanalysis.org/ (11.05.2026)
xDECAF: An Extensible Data Flow Diagram Analysis Framework for Information Security
visualization and a backend that runs the analysis and converts from different inputs. The frontend is built on the Eclipse Sprotty4 framework, which manages diagram rendering and maintains the graphical model of the DFD on an interactive SVG-based canvas. Surrounding this canvas are several floating UI panels, including a palette for creating DFDs, a label editor for managing labels, and a constraint editor for defining DSL constraints. The frontend supports modeling of DFDs through drag-and-drop, using three node types (I/O-, Storage-, and Function-Nodes), connected by directed flows from Input- to Output-Pins, as shown in the provided screencast5 . Label values from the data dictionary can be applied to nodes via drag-and-drop. The behavior of each Output-Pin can be defined using assignments in an in-place editor. An exemplary excerpt of the frontend is shown in Figure 1. Constraints are formulated using the DSL described in section 2. Both the constraints DSL and assignment language feature syntax highlighting and autocompletion. Renaming labels or flows automatically updates all corresponding references. In addition to modeling and analysis, the editor supports saving and loading DFDs in multiple formats, exporting diagrams as images or PDFs, and automatic layouting. It also provides readability features such as hiding flow and node labels in larger models. The backend encapsulates the analysis functionality and is hosted on bwCloud, a federated Infrastructure-as-a-Service platform in Germany. Communication between the frontend and backend occurs via WebSocket6 . When an analysis is triggered, the frontend packages the diagram data, along with the constraints and label information, into a JSON format and sends it to the backend. The backend processes the model, runs the analysis, and returns a JSON response that includes the modified diagram enriched with information about constraint violations and propagated labels, which are parsed and displayed to the user.
5
Research Applications
The xdecaf framework has been used in several research approaches to achieve different goals, illustrating how it can be applied and customized to varying needs. External Validation: To enable the integration of DFDs from existing research, xdecaf has been extended to accept PlantUML files as input [17]. The integration of externally authored DFDs, such as the microSecEnD dataset [24], serves as external validation for xdecaf. The dataset is made up of DFDs derived from the source code of open-source microservice applications and manually created repair variants that fix information security concerns. Applying xdecaf to all 132 modeled DFD variants showed that only 115 variants exhibited expected results. A manual inspection of the 17 variants with diverging results revealed that none of the discrepancies stemmed from the transformation from PlantUML or the constraint formalization in xdecaf, but rather could be traced back to faults in the manually created microSecEnD variants [17]. Coupled and Downstream Analyses: Building on the support for PCM instances, Reiche et al. [22] use xdecaf as a design-time analysis in a formalized composition approach of architectural and
ASE ’26, October 12—16, 2026, Munich, Germany
source code analyses. An analysis composition, using xdecaf, was able to uncover an active encryption-related vulnerability in an open-source electric-vehicle charging-station architecture [8]. Boltz et al. [5] apply xdecaf with PCM instances to evaluate compliance to Zero Trust Architecture (ZTA) principles, in particular access control and the principle of least privilege. As ZTAs can introduce bottlenecks in policy decision and enforcement, the approach combines Palladio design-time performance simulations [23] and xdecaf analysis to enable informed trade-off decisions between performance and adherence to ZTA principles [5]. ABUNAI: Architecture-Based and Uncertainty-Aware Confidentiality Analysis (ABUNAI)7 is a line of research focusing on design-time confidentiality analysis under uncertainty. Its central idea is to represent classified uncertainty as a first-class entity and explicitly handle it during analysis. It extends xdecaf in two distinct approaches: First, an uncertainty impact analysis that extends the label propagation of xdecaf and propagates uncertainty along the data flows to predict its impact on the system’s confidentiality [10]. Second, an uncertainty-aware confidentiality analyses that identify violations of confidentiality requirements with respect to uncertainty, by adding a preprocessing step, prior to label propagation and analysis, that creates variations of data flows that contain uncertainties [9]. How variations are created depends on the type of uncertainty and on the element it is associated with. ARCoViA: Automated Repair of Confidentiality Violations in Software Architectures (ARCoViA)8 closes the loop from identification of violations through analysis to mitigation of identified violations. Its first approach [18, 19] builds on ABUNAI and, using machine learning, ranks variation points resulting from uncertainty by how often they contribute to violations, then composes alternatives into a violation-free DFD. Its second approach [16] encodes violations identified by xdecaf and a set of admissible DFD modifications as a SAT problem, which is solved to select a minimally invasive or user-preferred solution. Both approaches treat xdecaf as their oracle for confidentiality. COLJA: The Compliance-driven Joint Interdisciplinary Software Architecture Modeling and Analysis (COLJA)9 research line leverages and extends xdecaf for compliance-driven threat modeling and interdisciplinary collaboration. Addressing the inherently interdisciplinary nature of legal compliance, COLJA defines a modeldriven workflow for interdisciplinary compliance checking, based on consistency-preserving, bidirectional transformations between legal viewpoints and xdecaf DFDs [6]. Legal aspects are mapped to labels and analyzed with xdecaf to identify potential compliance violations under change and legal uncertainty. An additional approach supports legal knowledge transfer by attaching explanatory legal comments to DFD elements, using xdecaf constraints to identify their scope and extending the xdecaf online editor to show the comments as tooltips [7].
6
Related Work
Most existing tooling for architecture-based security analysis focuses on a single security concern within a largely closed tool
4 https://sprotty.org/ (11.05.2026)
7 https://github.com/abunai-dev/ABUNAI (11.05.2026)
5 https://youtu.be/L-PGdWoPtlw (11.05.2026)
8 https://github.com/arcovia-dev/Mitigation (11.05.2026)
6 https://datatracker.ietf.org/doc/html/rfc6455 (11.05.2026)
9 https://github.com/colja-dev (11.05.2026)
ASE ’26, October 12—16, 2026, Munich, Germany
ecosystem. These approaches typically target specific tasks, such as threat modeling or confidentiality analysis, and offer limited extensibility beyond their predefined scope. Within the domain of DFD-based approaches, the SecDFD tooling [28, 30] extends traditional DFDs by incorporating security solutions to support structured threat elicitation. Similarly, industrial tools such as Microsoft’s Threat Modeling Tool [27] and OWASP Threat Dragon [20] rely on rule-based analyses with fixed threat libraries, limiting their applicability to a predefined set of threats. Beyond DFD-based methods, other model-driven approaches such as UMLsec [13, 21] and CORAS [14] employ UML-based architectural models to reason about security properties. While these approaches provide formalized mechanisms for analyzing specific concerns, they are typically tailored to particular analysis goals and modeling paradigms. In contrast to these tools, xdecaf decouples label types and labels from the analysis logic, enabling a broader range of analyses through its constraint-driven framework.
7
Conclusion
We presented xdecaf, an open and extensible tool for architecturebased information-security analysis on DFDs. xdecaf couples an extended DFD metamodel with a constraint DSL, and a browserbased editor that makes the tool accessible for researchers as well as architects, security specialists, and developers. Beyond the tooling, we also provided a curated catalog of over 20 DFD models, each with documented constraints and expected violations, creating a baseline for future research. Current research uses Large Language Models to derive initial DFDs as well as xdecaf labels and constraints from natural language requirements, enabling xdecaf-based identification of potential threats, and extends the xdecaf editor with question-driven elicitation to guide experts in adding threat-relevant labels. Additional efforts focus on integrating context models into the analysis and closing the loop by enabling ARCoViA inside the web editor.
Acknowledgments This work was supported by funding from the topic Engineering Secure Systems of the Helmholtz Association (HGF), KASTEL Security Research Labs, Karlsruhe, and the Deutsche Forschungsgemeinschaft (DFG, German Research Foundation) – CRC 1608 – 501798263. We thank Manuel Córcoles and Elias Wörner for their contributions as research assistants.
References [1] Hanaa Alshareef, Katja Tuma, Sandro Stucki, et al. 2022. Precise analysis of purpose limitation in data flow diagrams. In International Conference on Availability, Reliability and Security (ARES). ACM, 1–11. doi:10.1145/3538969.3539010 [2] Benjamin Arp et al. 2026. Dataset. doi:10.5281/zenodo.20083877 [3] Benjamin Arp, Nils Niehues, Tom Hüller, et al. 2024. Analyzing Cyclic Data Flow Diagrams Regarding Information Security. In Softwaretechnik-Trends. Gesellschaft für Informatik eV. [4] Nicolas Boltz, Sebastian Hahner, Christopher Gerking, et al. 2023. An extensible framework for architecture-based data flow analysis for information security. In European Conference on Software Architecture (ECSA). Springer, 342–358. doi:10. 1007/978-3-031-66326-0_21 [5] Nicolas Boltz, Larissa Schmid, Bahareh Taghavi, et al. 2024. Modeling and Analyzing Zero Trust Architectures Regarding Performance and Security. In European Conference on Software Architecture (ECSA). Springer, 253–269. doi:10.1007/9783-031-70797-1_17 [6] Nicolas Boltz, Leonie Sterz, Oliver Raabe, et al. 2026. Enabling a model-driven workflow for ongoing interdisciplinary collaboration in legal threat modeling.
Arp et al.
Information and Software Technology (IST) 195 (2026), 108121. doi:10.1016/j.infsof. 2026.108121 [7] Nicolas Boltz, Leonie Sterz, Oliver Raabe, et al. 2026. Towards Legal Knowledge Transfer Based on Software Architecture. In European Conference on Software Architecture (ECSA). Springer, 332–340. doi:10.1007/978-3-032-02138-0_22 [8] Sophie Corallo, Debora Grupp, Dominik Fuchß, et al. 2026. The EVerest Dataset for Secure Software Engineering. In International Conference on Automated Software Engineering (ASE). IEEE/ACM. doi:10.48550/arXiv.2606.23197 (to appear). [9] Sebastian Hahner, Tizian Bitschi, et al. 2023. Model-based confidentiality analysis under uncertainty. In International Conference on Software Architecture Companion (ICSA-C). IEEE, 256–263. doi:10.1109/ICSA-C57050.2023.00062 [10] Sebastian Hahner, Robert Heinrich, and Ralf Reussner. 2023. Architecture-Based Uncertainty Impact Analysis to Ensure Confidentiality. In Symposium on Software Engineering for Adaptive and Self-Managing Systems (SEAMS). IEEE, 126–132. doi:10.1109/SEAMS59076.2023.00026 [11] Marc Heinrich, Maximilian Zipfl, Marc Uecker, et al. 2024. CoCar NextGen: A Multi-Purpose Platform for Connected Autonomous Driving Research. In International Conference on Intelligent Transportation Systems (ITSC). IEEE, 482– 489. doi:10.1109/ITSC58415.2024.10920249 [12] Tom Hüller, Felix Schwickerath, Benjamin Arp, et al. 2024. Towards a Data Flow Diagram-Centric Confidentiality Analysis in Palladio. In Softwaretechnik-Trends. Gesellschaft für Informatik eV. [13] Jan Jürjens. 2002. UMLsec: Extending UML for secure systems development. In International Conference on The Unified Modeling Language. Springer, 412–425. doi:10.1007/3-540-45800-X_32 [14] Mass Soldal Lund, Bjørnar Solhaug, and Ketil Stølen. 2010. Model-driven risk analysis: the CORAS approach. Springer Science & Business Media. [15] Linus Neumann. 2024. Wir wissen, wo dein Auto steht. https://www.ccc.de/de/ updates/2024/wir-wissen-wo-dein-auto-steht [16] Nils Niehues, Benjamin Arp, and Robert Heinrich. 2026. Efficient Repair of Confidentiality Violations in Software Architectures. In International Conference on Software Architecture (ICSA). IEEE. (to appear). [17] Nils Niehues, Benjamin Arp, Tom Hüller, et al. 2024. Integrating SecurityEnriched Data Flow Diagrams Into Architecture-Based Confidentiality Analysis. In Softwaretechnik-Trends. Gesellschaft für Informatik eV. [18] Nils Niehues, Sebastian Hahner, et al. 2025. Mitigation Strategies for Confidentiality Violations in Software Architecture Using Ranked Feature Importance. Journal of Systems and Software (JSS) (2025), 112761. doi:10.1016/j.jss.2025.112761 [19] Nils Niehues, Sebastian Hahner, and Robert Heinrich. 2025. An ArchitectureBased Approach to Mitigate Confidentiality Violations Using Machine Learning. In International Conference on Software Architecture (ICSA). IEEE, 107–118. doi:10. 1109/ICSA65012.2025.00020 [20] OWASP Foundation. 2024. OWASP Threat Dragon. https://owasp.org/wwwproject-threat-dragon/. accessed: 2026-04-27. [21] Sven Peldszus, Katja Tuma, Daniel Strüber, et al. 2019. Secure Data-Flow Compliance Checks between Models and Code Based on Automated Mappings. In International Conference on Model Driven Engineering Languages and Systems (MODELS). IEEE, 23–33. doi:10.1109/MODELS.2019.00-18 [22] Frederik Reiche, Ralf Reussner, and Robert Heinrich. 2025. Detecting Information Flow Security Vulnerabilities by Analysis Coupling. IEEE Transactions on Software Engineering (TSE) 51, 10 (2025), 2710–2743. doi:10.1109/TSE.2025.3589647 [23] Ralf H Reussner, Steffen Becker, Jens Happe, et al. 2016. Modeling and Simulating Software Architectures – The Palladio Approach. MIT Press. 377 pages. [24] Simon Schneider, Tufan Özen, Michael Chen, et al. 2023. microSecEnD: A Dataset of Security-Enriched Dataflow Diagrams for Microservice Applications. In International Conference on Mining Software Repositories (MSR). IEEE, 125–129. doi:10.1109/MSR59073.2023.00030 [25] Stephan Seifermann, Robert Heinrich, et al. 2022. Detecting violations of access control and information flow policies in data flow diagrams. Journal of Systems and Software (JSS) 184 (2022), 111138. doi:10.1016/j.jss.2021.111138 [26] Stephan Seifermann, Robert Heinrich, and Ralf Reussner. 2019. Data-Driven Software Architecture for Analyzing Confidentiality. In International Conference on Software Architecture (ICSA). IEEE, 1–10. doi:10.1109/ICSA.2019.00009 [27] Adam Shostack. 2008. Experiences Threat Modeling at Microsoft. In Modeling Security Workshop. https://shostack.org/files/papers/modsec08/ShostackModSec08-Experiences-Threat-Modeling-At-Microsoft.pdf [28] Laurens Sion, Koen Yskout, Dimitri Van Landuyt, et al. 2018. Solution-aware data flow diagrams for security threat modeling. In Symposium on Applied Computing (SAC). ACM, 1425–1432. doi:10.1145/3167132.3167285 [29] Katja Tuma, Christian Sandberg, Urban Thorsson, et al. 2021. Finding security threats that matter: Two industrial case studies. Journal of Systems and Software (JSS) 179 (2021), 111003. doi:10.1016/j.jss.2021.111003 [30] Katja Tuma, Riccardo Scandariato, and Musard Balliu. 2019. Flaws in Flows: Unveiling Design Flaws via Information Flow Analysis. In International Conference on Software Architecture (ICSA). IEEE, 191–200. doi:10.1109/ICSA.2019.00028 [31] Dimitri Van Landuyt. 2025. Privacy Impact Tree Analysis (PITA): A Tree-Based Privacy Threat Modeling Approach. IEEE Transactions on Software Engineering (TSE) 51, 7 (2025), 2102–2124. doi:10.1109/TSE.2025.3573380