Modeling Security-Sensitive Architecture of Systems-of-Systems

An increasing number of software systems are considered Software Intensive Systems of Systems (SiSoS), which consist of dozens of constituent systems. Systems are interconnected using private or public networks, which can be prime target for security attacks. Hence, securing SiSoS is a huge challenge and an emerging areas of research and development. SoS can have several applications domains that can range from smart cities, to defence systems, and industrial control systems. Modeling of and reasoning of security-sensitive architecture of software intensive systems is a challenging piece of work but several modelling approaches and tooling support have been developed. However, there has been no signifiant effort to develop appropriate modelling approach and associated infrastructure for modeling security-senstive architecture of SoS. Led by our collaboratives in France, we have recently developed an approach and tool support for supporting seccutiry-senstive architecture design and analysis .
Our work has been accepted in the Asia-Pacific Software Engineering (APSEC 2016) has been accepted with an acceptance rate of around 19%. We are working on extending this approach to provide Model Driven Engineering (MDE) support. This work addresses the cascading attack problem, which has become one of the current main security challenges in the context of SoS . In the paper, we describe the problem, how we have addressed and evaluated it have been described in these words, “The challenge is to predict the concatenation/sequence of CS’s vulnerabilities that could be triggered resulting in destructive cascading failures and take corrective actions to reduce the cost, development time and effect of later changes. In this paper, we propose a domain specific modeling language (DSML) to represent SoS security ar- chitecture. Having SoS security models will enable the discovery, analysis and resolution of cascading attacks, in the architecture phase, preventing development time and cost wastage. Following a Model Driven Engineering (MDE) approach, we generate a graphical editor for our DSML and use it to model a Smart Campus case study.”