Automated analysis of security requirements through risk-based argumentation

摘要: Included definition of premises.Adjusted the metamodel according to Toulmin-style arguments.Revised examples changed metamodel.Added descriptions Figs. 7 and 8.Fixed typos improved language. Computer-based systems are increasingly being exposed evolving security threats, which often reveal new vulnerabilities. A formal analysis threats is difficult due a number practical considerations such as incomplete knowledge about design, limited information attacks, constraints on organisational resources. In our earlier work RISA (RIsk assessment in Security Argumentation), we showed that informal risk can complement requirements. this paper, integrate by proposing unified meta-model an automated tool for supporting argumentation called OpenRISA. Using uniform representation risks arguments, checking arguments identify relevant rebuttals those mitigations from publicly available catalogues when possible. As result, engineers able make informed traceable decisions their computer-based systems. The application OpenRISA illustrated with PIN Entry Device case study.