Petr Matousek Jaroslav Ráb Ondrej Rysavy Miroslav Svéda A Formal Model for Network-Wide Security Analysis. 171-181 2008 ECBS http://doi.ieeecomputersociety.org/10.1109/ECBS.2008.13 conf/ecbs/2008 db/conf/ecbs/ecbs2008.html#MatousekRRS08