Publisher DOI: 10.1016/j.jss.2023.111722
Title: Automatic extraction of security-rich dataflow diagrams for microservice applications written in Java
Language: English
Authors: Schneider, Simon 
Scandariato, Riccardo 
Keywords: Architecture reconstruction; Automatic extraction; Dataflow diagram; Feature detection; Microservices; Security
Issue Date: Aug-2023
Source: Journal of Systems and Software 202: 111722 (2023-08)
Abstract (english): 
Dataflow diagrams (DFDs) are a valuable asset for securing applications, as they are the starting point for many security assessment techniques. Their creation, however, is often done manually, which is time-consuming and introduces problems concerning their correctness. Furthermore, as applications are continuously extended and modified in CI/CD pipelines, the DFDs need to be kept in sync, which is also challenging. In this paper, we present a novel, tool-supported technique to automatically extract DFDs from the implementation code of microservices. The technique parses source code and configuration files in search for keywords that are used as evidence for the model extraction. Our approach uses a novel technique that iteratively detects new keywords, thereby snowballing through an application's codebase. Coupled with other detection techniques, it produces a fully-fledged DFD enriched with security-relevant annotations. The extracted DFDs further provide full traceability between model items and code snippets. We evaluate our approach and the accompanying prototype for applications written in Java on a manually curated dataset of 17 open-source applications. In our testing set of applications, we observe an overall precision of 93% and recall of 85%. The dataset created for the evaluation is openly released to the research community, as additional contribution of this work.
ISSN: 0164-1212
Journal: The journal of systems and software 
Institute: Software Security E-22 
Document Type: Article
Appears in Collections:Publications without fulltext

Show full item record

Google ScholarTM


Add Files to Item

Note about this record

Cite this record


Items in TORE are protected by copyright, with all rights reserved, unless otherwise indicated.