Towards a Model-driven based Security Framework

Rouwaida Abdallah (1, 2) , Nataliya Yakymets (1, 2) , Agnes Lanusse (1, 2)

1 LIST (CEA) - Laboratoire d'Intégration des Systèmes et des Technologies
2 DILS (CEA, LIST) - Département Ingénierie Logiciels et Systèmes

In this paper, we propose a model-driven framework for security analysis. We present a security analysis process that begins from the design phase of the system architecture then allows performing several security analysis methods. Our approach presents mainly two advantages: First, it allows the traceability of the security analysis methods with the system architecture. Second, this framework can include several security analysis methods. Moreover it allows information reuse which is complicated when we use separate methods dedicated tools. Thus, we can have more consistent and accurate security analysis results for a system. We chose to implement two methods: A qualitative method named EBIOS which is simple and helps to identify areas of focus within the system. Then, to get more accurate results, we implement a quantitative method, the Attack trees. Attack trees can be automatically generated from the Ebios analysis phase and can be completed later on to get more specific results.

Mots clés: Security; Model-driven; UML Profiles; EBIOS; Attack Trees; Papyrus Tool

Domaines: Informatique [cs]

Rouwaida Abdallah, Nataliya Yakymets, Agnes Lanusse. Towards a Model-driven based Security Framework. Model-Driven Engineering and Software Development (MODELSWARD), 2015 3rd International Conference on, Jul 2015, Kaufbeuren, Germany. ⟨cea-01810074⟩