Evaluation method for Web application architecture security based on AADL

Abstract

The invention discloses an evaluation method for the Web application architecture security based on AADL. The evaluation method includes the steps that (1) a Web application architecture is decomposed; (2) an AADL architecture security model is established, wherein an AADL architecture description model and an AADL architecture security threat model are established; (3) an architecture security tree model is generated, and comprises an architecture security quality tree and an architecture security threat tree; (4) an architecture security value and an architecture security threat value are calculated. According to the evaluation method for the Web application architecture security based on AADL, the security of the architecture can be actively evaluated in the design stage of the Web application architecture to assist architecture designers in discovering the security problems existing in the Web application architecture as early as possible, the security quality of the architecture is improved, and therefore the Web application security is improved.

Description

technical field [0001] The invention relates to the field of trusted computing; in particular, it relates to a method for evaluating the security of a Web application framework. Background technique [0002] At present, web applications are closely related to people's daily life. However, in recent years, security vulnerabilities of web applications have been exposed continuously, and the negative impact of security problems has become more and more serious, even threatening human life. of close attention. According to TOPTen issued by OWASP, an internationally authoritative web application security organization, it can be seen that among the effective network attacks in the world, those based on web applications account for 80%. It can be seen that it is imminent to solve the problem of web application security. [0003] In order to reduce and solve the security problems in Web applications, the consensus of secure software development is to consider security issues as ea...

AI Technical Summary

Problems solved by technology

[0005] However, the above assessment techniques mainly have two shortcomings: on the one hand, the existing assessment techniques are more suitable for assessing the reliability and usability of software architectures, and cannot fully meet the assessment requirements for security

On the other hand, the "heavyweight" evaluation technology has a high cost, the "lightweight" evaluation method has a low degree of practicality, and the "lightweight" evaluation method is not accurate in describing the software architecture, which affects the evaluation The quality of the model constructed in the method

Images