Search

In a complex socio-technical system, a human’s goal is delegated to many actors such as human and machines. Because the delegated goal can be decomposed into several sub-goals by each actor, goals are delegated recursively until an actor provides the means to achieve each sub-goal. We have already proposed a notation and a method called GDMA to represent and analyze the issues above. Because GDMA can be represented in a class diagram, software engineers do not have to use specific tools of GDMA models. To confirm whether a goal is properly achieved by suitable means, we have to trace such delegation and decomposition relationships. However, it is not easy to confirm it in a real-world system because of the system’s complexity. In this paper, we present a tool to check such traceability. The tool is implemented as a plugin of an existing UML modeling editor, and goal dependencies and decompositions are depicted using color. We also evaluate the tool through a comparative experiment. As a result, the tool enables an analyst to check the traceability without omission although it does not improve efficiency of the traceability checking task.

On the Controller Area Network (CAN), there are three types of messages, namely periodic messages, event based periodic messages, and non-periodic messages. On the attack detection, there are many high accuracy methods for the periodic messages. For the event based periodic messages and the non-periodic messages, detection methods utilizing the relation of plural data in some messages are effective. In such methods, the relations between plural data are investigated from some messages that were collected beforehand. And, obtained relation information is used as attributes of statistic detection. In this paper, a new attack detection method utilizing the number of occurrences of specific values and changes of values in messages is proposed. And the derivation algorithm that derives relation information efficiently is also proposed. By using the derivation algorithm, we found 582 relations for the detection method.

There is an issue when security measures are implemented and tested while using agile software development techniques such as Behavior Driven Development (BDD). We need to define the necessary levels of security and the privacy behaviors and acceptance criteria for the BDD. A method for defining the acceptance criteria (BehaveSafe) by creating a threat and countermeasure graph called the T&C graph is proposed in this paper. We have estimated the efficiency of our method with a web based system.

Because all the requirements analysts are not the experts of security, providing security knowledge automatically is one of the effective means for supporting security requirements elicitation. We propose a method for eliciting security requirements on the basis of Common Attack Patterns Enumeration and Classification (CAPEC). A requirements analyst can automatically acquire the candidates of attacks against a functional requirement with the help of our method. Because technical terms are mainly used in the descriptions in CAPEC and usual phrases are used in the requirements descriptions, there are gaps between them. To bridge the gaps, our method contains a mapping between technical terms and noun phrases called term maps.

Earlier software architecture design is essential particularly when it comes to security concerns, since security risks, requirements and architectures are all closely interrelated and interacting. We have proposed the security driven twin peaks method with a mutual refinement of the requirements, and architectures. However, there are multiple alternatives to an architecture design for initial requirements, and their choices depend on non-functional requirements (NFRs), such as security, performance, and costs which have a big impact on the quality of the software. We propose a new method called TPM-SA2 to avoid any back-track in refinement. Each architectural alternative in TPM-SA2 is refined so that it aligns with the requirements. For each refinement, the requirements can be updated vice versa. TPM-SA2 enables us to predict the impacts on the NFRs by each candidate for the architecture, and choose the most appropriate one with respect to the impact. As a result, we can define the requirements and architectures, and estimated the development costs earlier than ever.