Earticle

초록

영어

In recent years, concentration on software design phase for evaluating security into the developing software increased where the cost of fixing errors in design level is several times less than the cost of fixing errors in the coding or implementation levels. One of the main challenges in facing current models that evaluate security into the software design phase refers to the need for existence of security experts to analyze the system from a security angle of view while this additional task makes the project more costly and lengthy. In this work we address this problem by defining a method for using known attacks’ and threats’ properties and behaviors instead of using a drawn misuse case for assessing potential risks in the developing software. The main contribution of this work refers to defining a model for analyzing security aspects into the software design phase while additional cost and time are not required for system analyzing by security experts.

목차

Abstract
 1. Introduction
 2. Related Works
  2.1. Direct Security Design
  2.2. Indirect Security Design
 3. Attack-based Security Analysis
  3.1. Pre-process
  3.2. Defining Security Rules (Threat Grammar)
  3.3. Security Evaluation
  3.4. Impact Analysis
  3.5. Risk Determination
 4. Evaluation
 5. Discussion
 6. Conclusion and Future Work
 References

키워드

저자

• Saman Hedayatpour [ Advanced Informations School, Universiti Teknologi Malaysia, International Campus, Kuala Lumpur, 54100, Malaysia ]
• Nazri Kama [ Advanced Informations School, Universiti Teknologi Malaysia, International Campus, Kuala Lumpur, 54100, Malaysia ]
• Suriayati Chuprat [ Advanced Informations School, Universiti Teknologi Malaysia, International Campus, Kuala Lumpur, 54100, Malaysia ]

참고문헌

발행기관

간행물

표지보기 관심저널 등록

• 간행물명

  International Journal of Software Engineering and Its Applications

• 간기

  월간

• pISSN

  1738-9984

• 수록기간

  2008~2016

• 등재여부

  SCOPUS

• 십진분류

  KDC 505 DDC 605