Hier finden Sie wissenschaftliche Publikationen aus den Fraunhofer-Instituten.

A framework for semi-automated co-evolution of security knowledge and system models

: Bürger, Jens; Strüber, Daniel; Gärtner, Stefan; Ruhroth, Thomas; Jürjens, Jan; Schneider, Kurt


The Journal of systems and software 139 (2018), S.142-160
ISSN: 0164-1212
Fraunhofer ISST ()

Security is an important and challenging quality aspect of software-intensive systems, becoming even more demanding regarding long-living systems. Novel attacks and changing laws lead to security issues that did not necessarily rise from a flawed initial design, but also when the system fails to keep up with a changing environment. Thus, security requires maintenance throughout the operation phase. Ongoing adaptations in response to changed security knowledge are inevitable. A necessary prerequisite for such adaptations is a good understanding of the security-relevant parts of the system and the security knowledge.
We present a model-based framework for supporting the maintenance of security during the long-term evolution of a software system. It uses ontologies to manage the system-specific and the security knowledge. With model queries, graph transformation and differencing techniques, knowledge changes are analyzed and the system model is adapted. We introduce the novel concept of Security Maintenance Rules to couple the evolution of security knowledge with co-evolutions of the system model.
As evaluation, community knowledge about vulnerabilities is used (Common Weakness Enumeration database). We show the applicability of the framework to the iTrust system from the medical care domain and hence show the benefits of supporting co-evolution for maintaining secure systems.