Mark van der Brand

Ozan Özkan, Önder Babur, Mark van den Brand

Context: Domain-Driven Design (DDD) is a leading paradigm for managing software complexity, yet research remains largely theoretical; our prior work found nearly 39% of DDD studies lack rigorous empirical evaluation, leaving practical adoption largely unexamined at scale. Objective: We provide the first large-scale characterisation of the DDD landscape on GitHub, a data-driven baseline for how the paradigm is implemented and sustained in practice. Method: Using a Mining Software Repositories (MSR) approach with a hybrid strategy (topics and README keywords), we identified 11,742 candidate repositories. To address label noise, we built a novel semantic validation pipeline using GPT-4o with a triplicate majority-vote strategy, yielding 2,502 verified repositories. Validation against a manually labelled sample showed substantial agreement with human experts (kappa = 0.77). Results: DDD adoption accelerated sharply after a 2017 inflection point, and the resulting projects are notably long-lived: their median lifespan exceeds the typical GitHub project by over an order of magnitude, indicating sustained, professional-grade engineering rather than short-lived experiments. Layered and Clean Architecture dominate, while CQRS and Event Sourcing recur in distributed, data-intensive systems. Notably, the data challenge the Java-centric assumption of much academic work: C# and TypeScript, not Java, lead practical adoption. Conclusions: DDD has matured into a stable, professional-grade practice adopted across diverse languages and domains. However, a quarter of projects (25.3%) record no explicit business context, revealing a persistent gap between how domain intent is designed and how it is preserved in version control. We call for lightweight architectural traceability standards and offer guidance for teams reusing these repositories as reference implementations.

Leonard Tudorache, Ivan Kurtev, Mark van den Brand

Security is critical for everything relying on modern digital systems. Because almost all digital interactions are governed by the Internet and cryptographic protocols, these protocols must serve as reliable mechanisms that guarantee core security properties, such as confidentiality and integrity. Formal verification of these protocols is a critical step in securing interconnected systems. Tools such as ProVerif and Tamarin are widely employed to perform automated verification. However, their effective use demands specialized domain knowledge, creating a significant learning curve for security protocol designers who often have a security, rather than a formal verification background. We therefore need structured, accessible resources to help protocol designers to express their design and requirements in the language of the formal verification tools. To address this, we introduce a systematic and evidence-based taxonomy of security properties. This taxonomy is derived from a literature review of 53 recent studies (2022-2025) that used ProVerif and Tamarin, providing an up-to-date view of verified properties. We systematically categorize and define these properties, providing both informal definitions for intuitive comprehension and rigorous formal definitions expressed in first-order logic for clarity and consistency. We further detail modeling patterns and implement executable examples in both ProVerif and Tamarin, collected in an open repository. This work advances the state of the art by bridging the gap between theoretical security property definitions and their practical, executable verification models.