A supporting system for predicting vulnerabilities and their countermeasures of an information system during requirements analysis

需求分析过程中预测信息系统漏洞及其对策的支撑系统

• 批准号: 23500042
• 负责人: KAIYA Haruhiko
• 金额: $ 3.33万
• 依托单位: Shinshu University
• 依托单位国家: 日本
• 项目类别: Grant-in-Aid for Scientific Research (C)
• 财政年份: 2011
• 资助国家: 日本
• 起止时间: 2011 至 2013
• 项目状态: 已结题
• 来源: https://kaken.nii.ac.jp/grant/KAKENHI-PROJECT-23500042/
• 关键词: 要求工学; モデリング; セキュリティ分析; アッセトフロー; モデル検査; システムアーキテクチャ; オントロジ; アセットフロー; アーキテクチャ; データフロー図; モデルチェック; インパクト分析; ソフトウェアパターン

We have developed a method for security requirements analysis. In the method, vulnerabilities and their countermeasures are systematically predicted on the basis of the dependencies among assets and a system architecture in a system to be developed. We can re-examine vulnerabilities and their countermeasures when the architecture is changed but system functionalities are not changed. We have also developed a supporting tool for enacting the method. The tool consists of three components: a modeling editor, a model checker and a visualizer. With the help of the tool, stakeholders including security experts can validate the predicted results of the method because the tool can automatically derive the candidates of vulnerabilities on the basis of our original model checking engine and visualize the derived results.

我们开发了一种安全需求分析方法。在该方法中，基于待开发系统中的资产和系统架构之间的依赖性，系统地预测脆弱性及其对策。当架构改变但系统功能不变时，我们可以重新检查漏洞及其对策。我们还开发了一个辅助工具，用于制定该方法。该工具由三个组件组成：建模编辑器，模型检查器和可视化工具。在该工具的帮助下，包括安全专家在内的利益相关者可以验证该方法的预测结果，因为该工具可以在我们原有的模型检查引擎的基础上自动推导出漏洞的候选者，并可视化推导出的结果。

项目成果

Security Driven Requirements Refinement and Exploration of Architecture with Multiple NFR Points of View

• DOI: 10.1109/hase.2014.35
• 发表时间: 2014-01
• 期刊: 2014 IEEE 15th International Symposium on High-Assurance Systems Engineering
• 作者: T. Okubo;Nobukazu Yoshioka;H. Kaiya

Effective Security Impact Analysis with Patterns for Software Enhancement

有效的安全影响分析与软件增强模式

• 发表时间: 2011
• 作者: Takao Okubo;Haruhiko Kaiya;and Nobukazu Yoshioka
• 通讯作者: and Nobukazu Yoshioka

Validating Quality Requirements Considerations in a Design Document using Spectrum Analysis

使用频谱分析验证设计文档中的质量要求注意事项

• 发表时间: 2012
• 作者: Masahiro Umemura;Haruhiko Kaiya;Shinpei Ogata and Kenji Kaijiri
• 通讯作者: Shinpei Ogata and Kenji Kaijiri

how to support software revision in software non-intensive projects using existing techniques

如何使用现有技术支持软件非密集型项目中的软件修订

• 发表时间: 2011
• 作者: Haruhiko Kaiya;Kenichiro Hara;Kyotaro Kobayashi;Akira Osada;and Kenji Kaijiri.
• 通讯作者: and Kenji Kaijiri.

Model Transformation Patterns for Introducing Suitable Information Systems

引入合适信息系统的模型转换模式

• DOI: 10.1109/apsec.2012.52
• 发表时间: 2012
• 期刊: Proceedings of the 19th Asia-Pacific Software Engineering Conference (APSEC 2012)
• 作者: Haruhiko Kaiya;Shunsuke Morita;Shinpei Ogata;Kenji Kaijiri;Shinpei Hayashi;Motoshi Saeki
• 通讯作者: Motoshi Saeki