基于通用知识的软件设计安全性评估

Knowledge-Based Security Evaluation in Software Design

安全性作为软件系统的重要属性,越来越受到人们的重视.在软件开发的早期对安全性进行评估,对软件的质量控制和成本控制有着重要意义.当前的软件安全性评估主要依靠专家评审,结果的客观性及准确性常常受到专家主观意见的影响.通过使用通用知识作为评估依据,提出一种可以对UML顺序图形式的软件设计文档进行自动化分析的方法,可以发现软件设计中潜在的安全性漏洞.该方法可以减少结果中的主观性,同时,通过基于该方法的辅助工具的使用,可以大大提高评估效率.

As an important property of the software system, software security has drawn more and more attention. Security evaluation in the early phase of the software development is important to software quality and cost control. Current expert-based review and inspection methods can be error-prone and subjective. In this paper, we have proposed a knowledge-based security evaluation approach which can detect vulnerabilities in the UML sequence diagrams. With common knowledge as the evaluation reference, we can reduce the subjectivity in the result. We also have developed a support tool which can automatically perform most of the work in the method and improve the efficiency.