| Title | Threat Extraction Method Based on UML Software Description |
| Publication Type | Conference Paper |
| Year of Publication | 2018 |
| Authors | Zeinali, M., Hadavi, M. A. |
| Conference Name | 2018 15th International ISC (Iranian Society of Cryptology) Conference on Information Security and Cryptology (ISCISC) |
| Date Published | aug |
| Keywords | Automated Secure Software Engineering, composability, Computational modeling, Databases, Extracting threats, human knowledge, knowledge based systems, pubcrawl, Resiliency, security, security of data, security relevant attributes, sequence diagram, software application, software behavior, Software development, software engineering, software security, software system, Software systems, threat extraction method, threat knowledge base, threat modeling, UML software description, Unified modeling language |
| Abstract | Threat modeling is one of the best practices to secure software development. A primary challenge for using this practice is how to extract threats. Existing threat extraction methods to this purpose are mainly based on penetration tests or vulnerability databases. This imposes a non-automated timeconsuming process, which fully relies on the human knowledge and expertise. In this paper, a method is presented, which can extract the threats to a software system based on the existing description of the software behavior. We elaborately describe software behavior with sequence diagrams enriched by security relevant attributes. To enrich a sequence diagram, some attributes and their associated values are added to the diagram elements and the communication between them. We have also developed a threat knowledge base from reliable sources such as CWE and CAPEC lists. Every threat in the knowledge base is described according to its occurrence conditions in the software. To extract threats of a software system, the enriched sequence diagrams describing the software behavior are matched with the threat rules in our knowledge base using a simple inference process. Results in a set of potential threats for the software system. The proposed method is applied on a software application to extract its threats. Our case study indicates the effectiveness of the proposed method compared to other existing methods. |
| DOI | 10.1109/ISCISC.2018.8546868 |
| Citation Key | zeinali_threat_2018 |
Threat Extraction Method Based on UML Software Description