Towards Secure Architecture-Based Adaptations

• Published in: 2019 IEEE ACM 14th International Symposium on Software Engineering for Adaptive and Self Managing Systems (SEAMS) pp. 114 - 125
• Main Authors: Khakpour, Narges, Skandylas, Charilaos, Nariman, Goran Saman, Weyns, Danny
• Format: Conference Proceeding
• Language: English
• Published: IEEE 01.05.2019
• Series: Software Engineering for Adaptive and Self-Managing Systems, ICSE Workshops, SEAMS, International Workshop on
• Subjects: Adaptation models; Analytical models; Computer architecture; Computer Science; Datavetenskap; Graph-based Threat Models; Measurement; Risk management; Runtime; Security; Security Metrics; Self-Adaptation; Vulnerability Analysis
• ISBN: 1728133696; 9781728133683; 9781728133690; 1728133688
• ISSN: 2157-2321
• DOI: 10.1109/SEAMS.2019.00023

As any software system, a self-adaptive system is subject to security threats. However, applying self-adaptation may introduce additional threats. So far, little research has been devoted to this important problem. In this paper, we propose an approach for vulnerability analysis of architecture-based adaptations in self-adaptive systems using threat modeling and analysis techniques. To this end, we specify components' vulnerabilities and the system architecture formally and generate an attack model that describes the attacker's strategies to attack the system by exploiting different vulnerabilities. We use a set of security metrics to quantitatively assess the security risks of adaptations based on the produced attack model which enables the system to consider security aspects while choosing an adaptation to apply to the system. We automate and incorporate our approach into the Rainbow framework, allowing for secure architectural adaptations at runtime. To evaluate the effectiveness of our approach, we apply it on a simple document storage system and on the ZNN system.