Visible to the public Threat Extraction Method Based on UML Software Description

TitleThreat Extraction Method Based on UML Software Description
Publication TypeConference Paper
Year of Publication2018
AuthorsZeinali, M., Hadavi, M. A.
Conference Name2018 15th International ISC (Iranian Society of Cryptology) Conference on Information Security and Cryptology (ISCISC)
Date Publishedaug
KeywordsAutomated Secure Software Engineering, composability, Computational modeling, Databases, Extracting threats, human knowledge, knowledge based systems, pubcrawl, Resiliency, security, security of data, security relevant attributes, sequence diagram, software application, software behavior, Software development, software engineering, software security, software system, Software systems, threat extraction method, threat knowledge base, threat modeling, UML software description, Unified modeling language
AbstractThreat modeling is one of the best practices to secure software development. A primary challenge for using this practice is how to extract threats. Existing threat extraction methods to this purpose are mainly based on penetration tests or vulnerability databases. This imposes a non-automated timeconsuming process, which fully relies on the human knowledge and expertise. In this paper, a method is presented, which can extract the threats to a software system based on the existing description of the software behavior. We elaborately describe software behavior with sequence diagrams enriched by security relevant attributes. To enrich a sequence diagram, some attributes and their associated values are added to the diagram elements and the communication between them. We have also developed a threat knowledge base from reliable sources such as CWE and CAPEC lists. Every threat in the knowledge base is described according to its occurrence conditions in the software. To extract threats of a software system, the enriched sequence diagrams describing the software behavior are matched with the threat rules in our knowledge base using a simple inference process. Results in a set of potential threats for the software system. The proposed method is applied on a software application to extract its threats. Our case study indicates the effectiveness of the proposed method compared to other existing methods.
Citation Keyzeinali_threat_2018