Publications – Chair of Software Engineering

Also see Thorsten Berger’s Google Scholar profile (https://scholar.google.de/citations?user=2-YjsDsAAAAJ&hl=en)

202 entries « ‹ 2 of 5 › »

2024

Razan Ghzouli; Thorsten Berger; Einar Broch Johnsen; Andrzej Wasowski; Swaib Dragule

Behavior Trees and State Machines in Robotics Applications (Summary) Proceedings

2024.

BibTeX

Sven Peldszus; Jens Bürger; Jan Jürjens

UMLsecRT: Reactive Security Monitoring of Java Applications With Round-Trip Engineering Journal Article

In: IEEE Transactions on Software Engineering (TSE), vol. 50, no. 1, pp. 16–47, 2024.

Abstract | Links | BibTeX

@article{PBJ2024,

title = {UMLsecRT: Reactive Security Monitoring of Java Applications With Round-Trip Engineering},

author = {Sven Peldszus and Jens Bürger and Jan Jürjens},

url = {https://peldszus.com/wp-content/uploads/2024/01/2024-TSE-UMLsecRT-preprint.pdf},

doi = {10.1109/TSE.2023.3326366},

year  = {2024},

date = {2024-01-01},

journal = {IEEE Transactions on Software Engineering (TSE)},

volume = {50},

number = {1},

pages = {16–47},

abstract = {Today's software systems tend to be long-living and often process security-critical data, so keeping up with ever-changing security measures, attacks, and mitigations is critical to maintaining their security. While it has become common practice to consider security aspects during the design of a system, OWASP still identifies insecure design as one of the top 10 threats to security. Furthermore, even if the planned design is secure, verifying that the planned security assumptions hold at run-time and investigating any violations that may have occurred is cumbersome. In particular, the configuration of run-time monitors such as the Java Security Manager, which could enforce design-time security assumptions, is non-trivial and therefore used in practice rarely. To address these challenges, we present UMLsecRT for automatically supporting model-based security engineering with run-time monitoring of design-time security specifications and round-trip engineering for propagating run-time observations to the design level. Following the established security-by-design approach UMLsec, security experts annotate system models with security properties that UMLsecRT automatically synchronizes with corresponding source code annotations for the automatic configuration of UMLsecRT's run-time monitor. To this end, UMLecRT monitors these security properties at run-time without additional effort to specify monitoring policies. Developers can define mitigations for attacks detected at run-time in advance by adjusting the automatically synchronized annotations at implementation time. Triggered by a security violation, UMLsecRT can adapt the design-time models based on run-time findings to facilitate the investigation of security violations. We evaluated UMLsecRT concerning its effectiveness and applicability to security violations extracted from real-world attacks and the DaCapo benchmark, conducted user studies on the usability of the adapted models and the feasibility of UMLsecRT in practice, especially concerning countermeasures, and investigated the scalability of UMLsecRT. To study the applicability of the whole development process, we applied UMLsecRT in two case studies to the Eclipse Secure Storage and the electronic health record system iTrust.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

Today's software systems tend to be long-living and often process security-critical data, so keeping up with ever-changing security measures, attacks, and mitigations is critical to maintaining their security. While it has become common practice to consider security aspects during the design of a system, OWASP still identifies insecure design as one of the top 10 threats to security. Furthermore, even if the planned design is secure, verifying that the planned security assumptions hold at run-time and investigating any violations that may have occurred is cumbersome. In particular, the configuration of run-time monitors such as the Java Security Manager, which could enforce design-time security assumptions, is non-trivial and therefore used in practice rarely. To address these challenges, we present UMLsecRT for automatically supporting model-based security engineering with run-time monitoring of design-time security specifications and round-trip engineering for propagating run-time observations to the design level. Following the established security-by-design approach UMLsec, security experts annotate system models with security properties that UMLsecRT automatically synchronizes with corresponding source code annotations for the automatic configuration of UMLsecRT's run-time monitor. To this end, UMLecRT monitors these security properties at run-time without additional effort to specify monitoring policies. Developers can define mitigations for attacks detected at run-time in advance by adjusting the automatically synchronized annotations at implementation time. Triggered by a security violation, UMLsecRT can adapt the design-time models based on run-time findings to facilitate the investigation of security violations. We evaluated UMLsecRT concerning its effectiveness and applicability to security violations extracted from real-world attacks and the DaCapo benchmark, conducted user studies on the usability of the adapted models and the feasibility of UMLsecRT in practice, especially concerning countermeasures, and investigated the scalability of UMLsecRT. To study the applicability of the whole development process, we applied UMLsecRT in two case studies to the Eclipse Secure Storage and the electronic health record system iTrust.

Sven Peldszus

Security Compliance in Model-Driven Software Development Book Chapter

In: Bodden, Eric; Felderer, Michael; Hasselbring, Wilhelm; Herber, Paula; Koziolek, Heiko; Lilienthal, Carola; Matthes, Florian; Prechelt, Lutz; Rumpe, Bernhard; Schaefer, Ina (Ed.): Ernst Denert Award for Software Engineering 2022: Practice Meets Foundations, pp. 73–104, Springer Nature Switzerland, Cham, 2024, ISBN: 978-3-031-44412-8.

Abstract | Links | BibTeX

@inbook{Peldszus2024,

title = {Security Compliance in Model-Driven Software Development},

author = {Sven Peldszus},

editor = {Eric Bodden and Michael Felderer and Wilhelm Hasselbring and Paula Herber and Heiko Koziolek and Carola Lilienthal and Florian Matthes and Lutz Prechelt and Bernhard Rumpe and Ina Schaefer},

url = {https://doi.org/10.1007/978-3-031-44412-8_4},

doi = {10.1007/978-3-031-44412-8_4},

isbn = {978-3-031-44412-8},

year  = {2024},

date = {2024-01-01},

booktitle = {Ernst Denert Award for Software Engineering 2022: Practice Meets Foundations},

pages = {73–104},

publisher = {Springer Nature Switzerland},

address = {Cham},

abstract = {To ensure the security of a software system, it is vital to keep up with changing security precautions, attacks, and mitigations. Although model-based development enables addressing security already at design-time, design models are often inconsistent with the implementation or among themselves. Such inconsistencies hinder the effective realization and verification of secure software systems. In addition, variants of software systems are another burden to developing secure systems. Vulnerabilities must be identified and fixed on all variants or else attackers could be well-guided in attacking unfixed variants. To ensure security in this context, in the thesis (Peldszus, Security Compliance in Model-driven Development of Software Systems in Presence of Long-Term Evolution and Variants. Springer, Berlin; 2022), we present GRaViTY, an approach that allows security experts to specify security requirements on the most suitable system representation. To preserve security, based on continuous automated change propagation, GRaViTY automatically checks all system representations against these security requirements. To systematically improve the object-oriented design of a software-intensive system, GRaViTY provides security-preserving refactorings. For both continuous security compliance checks and refactorings, we show the application to variant-rich software systems. To support legacy systems, GRaViTY allows to automatically reverse-engineer variability-aware UML models and semi-automatically map existing design models to the implementation. Besides evaluations of the individual contributions, we demonstrate applicability of the approach in two real-world case studies, the iTrust electronics health records system and the Eclipse Secure Storage. This book chapter provides a summary of the thesis, focusing on the addressed problems, identified and answered research questions, the general solution, and its application of it to two case studies. For details on the individual solutions, please refer to the thesis and the corresponding publications referenced in this book chapter.},

keywords = {},

pubstate = {published},

tppubtype = {inbook}

}

To ensure the security of a software system, it is vital to keep up with changing security precautions, attacks, and mitigations. Although model-based development enables addressing security already at design-time, design models are often inconsistent with the implementation or among themselves. Such inconsistencies hinder the effective realization and verification of secure software systems. In addition, variants of software systems are another burden to developing secure systems. Vulnerabilities must be identified and fixed on all variants or else attackers could be well-guided in attacking unfixed variants. To ensure security in this context, in the thesis (Peldszus, Security Compliance in Model-driven Development of Software Systems in Presence of Long-Term Evolution and Variants. Springer, Berlin; 2022), we present GRaViTY, an approach that allows security experts to specify security requirements on the most suitable system representation. To preserve security, based on continuous automated change propagation, GRaViTY automatically checks all system representations against these security requirements. To systematically improve the object-oriented design of a software-intensive system, GRaViTY provides security-preserving refactorings. For both continuous security compliance checks and refactorings, we show the application to variant-rich software systems. To support legacy systems, GRaViTY allows to automatically reverse-engineer variability-aware UML models and semi-automatically map existing design models to the implementation. Besides evaluations of the individual contributions, we demonstrate applicability of the approach in two real-world case studies, the iTrust electronics health records system and the Eclipse Secure Storage. This book chapter provides a summary of the thesis, focusing on the addressed problems, identified and answered research questions, the general solution, and its application of it to two case studies. For details on the individual solutions, please refer to the thesis and the corresponding publications referenced in this book chapter.

2023

Léuson Da Silva; Paulo Borba; Toni Maciel; Wardah Mahmood; Thorsten Berger; João Moisakis; Aldiberg Gomes; Vinícius Leite

Detecting Semantic Conflicts with Unit Tests Journal Article

In: 2023.

2024

2023

2022

2021

2020