feat: add DBLP venues backend with local dump support (#1021)

* feat: add DBLP venues backend with local dump parsing

Integrate curated DBLP venue metadata as an additional legitimacy signal for journals and conferences, while supporting reproducible local-cache syncs and large-dump processing with bounded memory and progress logging.

* fix: use defusedxml for DBLP XML parsing

Replace stdlib ElementTree iterparse with defusedxml to satisfy security scanning and mitigate XML parser attack risk. Add explicit dependency and align tests with the new parse error type.

* fix: ignore missing defusedxml stubs in mypy

The parser security fix depends on defusedxml, but stub package availability differs across CI environments. Scope ignore_missing_imports to defusedxml modules so strict mypy checks remain unchanged elsewhere.

---------

Co-authored-by: florath-ai-assistant[bot] <Andreas.Florath@telekom.de>

Author: coding-ai-assistant[bot]

README.md

@@ -86,10 +86,11 @@ This tool acts as a **data aggregator** - it doesn't provide data itself, but co
 - **Kscien Publishers** - Known predatory publishers
 - **Kscien Hijacked Journals** - Legitimate journals that have been hijacked by predatory actors
 - **Kscien Predatory Conferences** - Database of predatory conferences
+- **DBLP Venues** - Curated computer science journals and conference series from DBLP XML
 
 The tool analyzes publication patterns, citation metrics, and metadata quality to provide comprehensive coverage beyond traditional blacklist/whitelist approaches.
 
-**Note on Conference Assessment**: Conference checking is currently limited compared to journal assessment. The primary source for conference evaluation is the Kscien Predatory Conferences database. Most other data sources focus exclusively on journals, so conference assessments may have less comprehensive coverage and fewer cross-validation opportunities.
+**Note on Conference Assessment**: Conference checking now combines curated predatory conference signals (Kscien) with curated legitimacy signals from DBLP venue series. Coverage is stronger for computer science venues than for other domains.
 
 ## Quick Start
 
@@ -120,6 +121,7 @@ These provide authoritative yes/no decisions for journals they cover:
 | **Kscien Publishers** | Predatory publishers | 1,200+ entries | Known predatory publishers |
 | **Kscien Hijacked Journals** | Hijacked journals | ~200 entries | Legitimate journals compromised by predatory actors |
 | **Kscien Predatory Conferences** | Predatory conferences | ~450 entries | Identified predatory conference venues |
+| **DBLP Venues** | Legitimate venues (CS) | dump-derived | Curated DBLP journals and conference series from local XML cache |
 | **Retraction Watch** | Quality indicator | ~27,000 journals | Retraction rates and patterns for quality assessment |
 | **Institutional Lists** | Custom whitelist/blacklist | Organization-specific | Local policy enforcement |
 

docs/CHANGELOG.md

@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- **DBLP Venues Backend**: Added `dblp_venues` cached backend with local XML dump synchronization
+  - Downloads and caches `dblp.xml.gz` locally under `.aletheia-probe/dblp/`
+  - Parses DBLP conference (`conf/*`) entries via streaming XML
+  - Adds curated DBLP conference series as legitimate conference evidence
+
 ## [0.8.0] - 2026-01-08
 
 ### Added

docs/api-reference/backends.md

@@ -120,6 +120,7 @@ YAML structure:
 | Backend | Purpose | Source |
 |---------|---------|--------|
 | **doaj** | Directory of Open Access Journals | `src/aletheia_probe/backends/doaj.py` |
+| **dblp_venues** | DBLP curated venue series (CS journals + conferences) | `src/aletheia_probe/backends/dblp_venues.py` |
 
 ### Quality Indicators
 

docs/configuration.md

@@ -307,6 +307,25 @@ backends:
 
 See backend implementations in `src/aletheia_probe/backends/kscien_*.py`
 
+### DBLP Venues Backend
+
+```yaml
+backends:
+  dblp_venues:
+    enabled: true
+    weight: 0.8
+    timeout: 10
+    config: {}
+```
+
+**Behavior**:
+- Downloads and caches the complete DBLP XML dump (`dblp.xml.gz`) locally in `.aletheia-probe/dblp/`
+- Extracts venue series from DBLP `conf/*` and `journals/*` entries
+- Sync cadence is monthly by default due dump size (~1 GB compressed)
+
+**Related URL setting**:
+- `data_source_urls.dblp_xml_dump_url`: Defaults to `https://dblp.org/xml/dblp.xml.gz`
+
 ### Scopus Backend
 
 ```yaml

pyproject.toml

@@ -40,6 +40,7 @@ dependencies = [
     "pydantic>=2.0.0",
     "aiohttp>=3.8.0",
     "aiofiles>=23.0.0",
+    "defusedxml>=0.7.1",
     "click>=8.0.0",
     "pyyaml>=6.0",
     "rarfile>=4.1",
@@ -139,6 +140,10 @@ plugins = ["pydantic.mypy"]
 module = "tests.*"
 disallow_untyped_defs = false
 
+[[tool.mypy.overrides]]
+module = ["defusedxml", "defusedxml.*"]
+ignore_missing_imports = true
+
 [tool.ruff]
 target-version = "py310"
 line-length = 88
@@ -165,4 +170,4 @@ ignore = [
 known-first-party = ["aletheia_probe"]
 section-order = ["future", "standard-library", "third-party", "first-party", "local-folder"]
 split-on-trailing-comma = true
-lines-after-imports = 2
+lines-after-imports = 2

src/aletheia_probe/backends/__init__.py

@@ -7,6 +7,7 @@
     bealls,
     crossref_analyzer,
     custom_list,
+    dblp_venues,
     doaj,
     kscien_hijacked_journals,
     kscien_predatory_conferences,
@@ -28,6 +29,7 @@
     "algerian_ministry",
     "bealls",
     "crossref_analyzer",
+    "dblp_venues",
     "custom_list",
     "doaj",
     "kscien_hijacked_journals",

src/aletheia_probe/backends/dblp_venues.py

@@ -0,0 +1,51 @@
+# SPDX-License-Identifier: MIT
+"""DBLP conference backend for legitimate conference verification."""
+
+from typing import TYPE_CHECKING
+
+from ..enums import AssessmentType, EvidenceType
+from .base import CachedBackend, get_backend_registry
+
+
+if TYPE_CHECKING:
+    from ..updater.core import DataSource
+    from ..updater.sources.dblp import DblpVenueSource
+
+
+_CACHE_TTL_HOURS = 24 * 30  # Monthly cache for large DBLP dump refreshes
+
+
+class DblpVenuesBackend(CachedBackend):
+    """Backend that checks venue legitimacy using DBLP venue series data."""
+
+    def __init__(self) -> None:
+        """Initialize DBLP venues backend."""
+        super().__init__(
+            source_name="dblp_venues",
+            list_type=AssessmentType.LEGITIMATE,
+            cache_ttl_hours=_CACHE_TTL_HOURS,
+        )
+        self._data_source: DblpVenueSource | None = None
+
+    def get_name(self) -> str:
+        """Return backend identifier."""
+        return "dblp_venues"
+
+    def get_evidence_type(self) -> EvidenceType:
+        """Return evidence type for DBLP venues backend."""
+        return EvidenceType.LEGITIMATE_LIST
+
+    def get_data_source(self) -> "DataSource | None":
+        """Get DBLP venue source for cache synchronization."""
+        if self._data_source is None:
+            from ..updater.sources.dblp import DblpVenueSource
+
+            self._data_source = DblpVenueSource()
+        return self._data_source
+
+
+get_backend_registry().register_factory(
+    "dblp_venues",
+    lambda: DblpVenuesBackend(),
+    default_config={},
+)

src/aletheia_probe/config.py

@@ -108,6 +108,10 @@ class DataSourceUrlConfig(BaseModel):
         "https://ugccare.unipune.ac.in/Apps1/User/Web/ScopusDelisted",
         description="URL for UGC-CARE Group-II delisted journals page",
     )
+    dblp_xml_dump_url: str = Field(
+        "https://dblp.org/xml/dblp.xml.gz",
+        description="URL for DBLP full XML dump",
+    )
 
 
 class DataSourceProcessingConfig(BaseModel):

src/aletheia_probe/updater/sources/__init__.py

@@ -4,6 +4,7 @@
 from .algerian import AlgerianMinistrySource
 from .bealls import BeallsListSource
 from .custom import CustomListSource
+from .dblp import DblpVenueSource
 from .kscien_generic import KscienGenericSource
 from .kscien_hijacked_journals import KscienHijackedJournalsSource
 from .kscien_publishers import KscienPublishersSource
@@ -24,6 +25,7 @@
     "AlgerianMinistrySource",
     "BeallsListSource",
     "CustomListSource",
+    "DblpVenueSource",
     "KscienGenericSource",
     "KscienHijackedJournalsSource",
     "KscienPublishersSource",