Formalized aspect-oriented misuse case for specifying crosscutting security threats and mitigations.

Area of Science:

• Computer Science
• Software Engineering
• Information Security

Background:

• Software applications require robust security for sensitive data management.
• Traditional object-oriented methods struggle with crosscutting security concerns in misuse case modeling.
• Scattered threats and mitigations lead to ambiguity and incomplete security analysis.

Purpose of the Study:

• To propose a novel method, Aspect-oriented Formalized Misuse Case (AFMUC), for managing crosscutting security requirements.
• To enhance the specification and analysis of security requirements in software applications.
• To address the limitations of traditional methods in handling tangled security concerns.

Main Methods:

• Developed the Aspect-oriented Formalized Misuse Case (AFMUC) method.
• Specified crosscutting security threats and mitigations as separate aspect misuse cases.
• Integrated aspect models with base use case models using aspect-oriented constructs (Pointcut, Joinpoint Advice, Introduction).
• Applied AFMUC to a case study and conducted a controlled experiment.

Main Results:

• The AFMUC approach demonstrated practicality and unambiguity in specifying and analyzing crosscutting security requirements.
• A case study and experiment validated the effectiveness of the proposed method.
• Students favored the AFMUC approach for its clarity in handling complex security concerns.

Conclusions:

• AFMUC offers a structured way to model and analyze crosscutting security threats and mitigations.
• The approach improves clarity and reduces ambiguity in software security requirement analysis.
• Further training on aspect-oriented modeling constructs may be needed for optimal application.