A threat-driven approach to modeling and verifying secure software

20th IEEE/ACM International Conference on Automated Software Engineering, ASE 2005

Volumn , Issue , 2005, Pages 342-346

  Xu, Dianxiang ^a   Nygard, Kendall ^a  

^a North Dakota State University   (United States)

Author keywords

Aspect oriented Petri nets; Aspect oriented software development; Petri nets; Software security; Threat modeling; Verification

Indexed keywords

ASPECT-ORIENTED; ASPECT-ORIENTED PETRI NETS; ASPECT-ORIENTED SOFTWARE DEVELOPMENT; SOFTWARE SECURITY; THREAT MODELING;

COMPUTER SOFTWARE SELECTION AND EVALUATION; COMPUTER SYSTEMS PROGRAMMING; GRAPH THEORY; PETRI NETS; VERIFICATION;

SOFTWARE DESIGN;

EID: 41549161968     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1101908.1101965     Document Type: Conference Paper

References (20)

1. Deng, Y., Wang, J., Tsai, J., and Beznosov, K. An approach for modeling and analysis of security system architectures. IEEE Trans. on Knowledge and Data Engineering. 15, 5, 2003, 1099-1119.
2. Devanbu, P. T. and Stubblebine. Software engineering for security: A roadmap. In The Future of Software Engineering, 2000, 227-239.
3. Gao, S., Deng, Y., Yu, H., He, X., Beznosov, K., and Cooper, K. Applying aspect-orientation in designing security systems: A case study. In Proc. of SEKE'04, 2004.
4. Genrich, H. J. Predicate/transition nets. Petri Nets: Central Models and Their Properties, W. Brauer, W. Resig, and G. Rozenberg (eds.), LNCS 254, 1987, 207-247.
5. Ho, Y., Frincke, D., and Tobin, D. Jr. Planning, Petri nets, and intrusion detection. In Proc. of the 21st National Information Systems Security Conference (NISSC'98), 1998.
6. Hoglund, G. and McGraw, G. Exploiting Software: How to Break Code. Addison-Wesley, 2004.
7. Howard, M. and LeBlanc, D. Writing Secure Code. Microsoft Press. 2nd edition, 2003.
8. Kiczales, G., Lamping, J., Mendhekar, A., Maeda, C., Lopes, C. V., Loingtier, J. M., and Irwin, J. Aspect oriented programming. In Proc. of ECOOP'97, 1997, 220-242.
9. Lodderstedt, T., Basin, D., and Doser, Jurgen. SecureUML: A UML-based modeling language for model-driven security. In Proc. of UML'02, 2002.
10. Lotz, V. Threat scenarios as a means to formally develop secure systems. Journal of Computer Security 5, 1997, 31-67.
11. McClure, S., Shah, S., and Shah, S. Web Hacking: Attacks and Defense. Addison-Wesley, 2003.
12. McDermott, J. Attack net penetration testing. In Proc. of the 2000 Workshop on New Security Paradigms, 2000, 15-21
13. Murata, T. Petri nets: Properties, analysis and applications, Proc. of the IEEE, 77, 4, 1989, 541-580.
14. Neumann, P. G. Principled assuredly trustworthy composable architectures, Project Report, Computer Science Laboratory. SRI International, 2004.
15. Ray, I., France, R., Li, N. and Georg, G. An aspect-based approach to modeling access control concerns. Information and Software Technology, 46, 9, 2004, 575-587.
16. Schneier, B. Attack trees. Dr. Dobb's Journal of Software Tools 24, 12, 1999, 21-29.
17. Swiderski, F. and Snyder, W. Threat Modeling. Microsoft Press, 2004.
18. Viega, J. and McGraw, G. Secure Software: How to Avoid Security Problems in the Right Way. Addison Wesley, 2002.
19. Wing, J. A symbiotic relationship between formal methods and security, In Proc. NSF Workshop on Computer Security, Fault Tolerance, and Software Assurance: From Needs to Solution, 1998.
20. Xu, D., Yin, J., Deng, Y. and Ding, J. A formal architectural model for logical agent mobility, IEEE Trans. on Software Engineering, 29, 1, 2003, 31-45.