Secure Software Engineering: A Knowledge Modeling based Approach for Inferring Association between Source Code and Design Artifacts
| Autor: | Ashanthi Abeyratne, Chaman Wijesiriwardana, Buddika Dahanayake, Prasad Wimalaratne, Chamal Samarage |
|---|---|
| Rok vydání: | 2020 |
| Předmět: |
Source code
General Computer Science Computer science business.industry media_common.quotation_subject 020207 software engineering Static program analysis 02 engineering and technology Static analysis Software development process Knowledge modeling Test case Software security assurance Threat model Scalability 0202 electrical engineering electronic engineering information engineering 020201 artificial intelligence & image processing Software engineering business media_common |
| Zdroj: | International Journal of Advanced Computer Science and Applications. 11 |
| ISSN: | 2156-5570 2158-107X |
| DOI: | 10.14569/ijacsa.2020.0111282 |
| Popis: | Secure software engineering has emerged in recent decades by encouraging the idea of software security has to be an integral part of all the phases of the software development lifecycle. As a result, each phase of the lifecycle is associated with security-specific best practices such as threat modeling and static code analysis. It was observed that various artifacts (i.e., security requirements, architectural flaws, bug reports, security test cases) generated as a result of security best practices tend to be segregated. This creates a significant barrier to resolve the security issues at the implementation phase since most of them are originated in the design phase. In order to address this issue, this paper presents a knowledge-modeling based approach to semantically infer the associations between architectural level security flaws and code-level security bugs, which is manually tedious. Threat modeling and static analysis are used to identify security flaws and security bugs, respectively. The case study based experimental results revealed that the architectural level security flaws have a significant impact on originating security bugs in the code level. Besides, the evaluation results confirmed the scalability of the proposed approach to large-scale industrial software products. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|