TY - GEN
T1 - Towards an architecture-centric approach to security analysis
AU - Feng, Qiong
AU - Kazman, Rick
AU - Cai, Yuanfang
AU - Mo, Ran
AU - Xiao, Lu
N1 - Publisher Copyright:
© 2016 IEEE.
PY - 2016/7/19
Y1 - 2016/7/19
N2 - Recently there has been increased attention to the consequences of architecture design decisions and their impact on security. Architectural design decisions have been identified as being critical for achieving high levels of software system security. However the majority of this research has been anecdotal and there are few tools or methods for understanding the architectural relations among files, and their impact on security. In this paper we employ a DRSpace-based analysis approach to identify architectural design flaws and we show, via an empirical study of 10 open source projects, that areas of a software architecture that suffer from greater numbers of design flaws are highly correlated with security bugs, and high levels of churn associated with those security bugs. Finally, we show that a specific type of design flaw - unstable interface - is correlated with the greatest increase in software security bugs.
AB - Recently there has been increased attention to the consequences of architecture design decisions and their impact on security. Architectural design decisions have been identified as being critical for achieving high levels of software system security. However the majority of this research has been anecdotal and there are few tools or methods for understanding the architectural relations among files, and their impact on security. In this paper we employ a DRSpace-based analysis approach to identify architectural design flaws and we show, via an empirical study of 10 open source projects, that areas of a software architecture that suffer from greater numbers of design flaws are highly correlated with security bugs, and high levels of churn associated with those security bugs. Finally, we show that a specific type of design flaw - unstable interface - is correlated with the greatest increase in software security bugs.
KW - design flaw
KW - software architecture
KW - software security
UR - http://www.scopus.com/inward/record.url?scp=84983238335&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=84983238335&partnerID=8YFLogxK
U2 - 10.1109/WICSA.2016.41
DO - 10.1109/WICSA.2016.41
M3 - Conference contribution
AN - SCOPUS:84983238335
T3 - Proceedings - 2016 13th Working IEEE/IFIP Conference on Software Architecture, WICSA 2016
SP - 221
EP - 230
BT - Proceedings - 2016 13th Working IEEE/IFIP Conference on Software Architecture, WICSA 2016
T2 - 13th Working IEEE/IFIP Conference on Software Architecture, WICSA 2016
Y2 - 5 April 2016 through 8 April 2016
ER -