Quantitative security analysis for service-oriented software architectures

摘要: Due to the dramatic increase in intrusion activities, definition and evaluation of software security requirements have become important aspects development services. It is now a well-accepted fact engineering that concerns, like any other quality should be dealt with early stages process. Current practices for architecture risk analysis, however, still heavily rely on human expertise. This involves significant amount subjective efforts creating greater potential inaccuracies. In this dissertation, we propose framework quantitative analysis service-oriented systems. regard two contributions are made dissertation. First, identify define some internal attributes related properties based generic model, setting up formal corresponding metrics. Second, measurement abstraction paradigm named User System Interaction Effect (USIE) model can used systematically derive analyze concerns from architectures. Many derivation automated, which limit user involvement and, thereby, reduce subjectivity underlying typical The as foundation services different perspectives respect introduced. Based sample metrics derived framework, illustrate empirically viability our by conducting case studies existing open source software.