作为风险分析过程的终端人员软件保护
Man-at-the-End Software Protection as a Risk Analysis Process
摘要：
近年来，针对软件应用程序的终端人员（MATE）攻击在数量和严重程度上都有所增加。然而，MATE软件保护是由模糊的概念和技术，通过模糊的安全无处不在的领域。本文提出了一个基本原理，采用和标准化的软件保护作为风险管理过程，根据NIST SP 800 -39的方法。我们研究的相关方面的正式化和自动化的活动在这个过程中的背景下，MATE软件保护。我们强调研究界仍然需要解决的开放问题。我们讨论了这种方法可以为所有利益相关者带来的好处。此外，我们提出了一个概念证明（OHCHR）的决策支持系统，自动化的风险分析方法对软件应用程序的保护许多活动。尽管仍然是一个原型，但与行业专家的共同验证表明，拟议的风险管理过程的几个方面已经可以通过我们现有的工具箱正式化和自动化，并且它实际上可以帮助工业相关环境中的决策制定
英文摘要：
The last years have seen an increase of Man-at-the-End (MATE) attacks against software applications, both in number and severity. However, MATE software protections are dominated by fuzzy concepts and techniques, with security-through-obscurity omnipresent in the field. This paper presents a rationale for adopting and standardizing the protection of software as a risk management process according to the NIST SP800-39 approach. We examine the relevant aspects of formalizing and automating the activities in this process in the context of MATE software protection. We highlight the open issues that the research community still has to address. We discuss the benefits that such an approach can bring to all stakeholders. In addition, we present a Proof of Concept (PoC) of a decision support system that automates many activities in the risk analysis methodology towards the protection of software applications. Despite still being a prototype, the PoC validation with industry experts indicated that several aspects of the proposed risk management process can already be formalized and automated with our existing toolbox, and that it can actually assist decision making in industrially relevant settings
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
