ThreatGet的分析方法
The analysis approach of ThreatGet
摘要：
如今，几乎所有的电子设备都包括通信接口，允许与它们交互，交换数据或远程操作它们的服务。互联性增强的趋势同时也增加了这些系统的脆弱性。由于与全面安全分析相关的高成本，许多制造商为了避免成本而忽视产品的安全性。然而，安全IT系统的重要性正在增长，因为系统的安全性也会影响安全关键方面。标准的安全分析方法现在仍然主要基于时间密集且容易出错的手动活动。在本文中，我们提出了正式的概念，自动威胁和漏洞分析工具ThreatGet。因此，我们引入了扩展的数据流图的概念，用于表示在调查中的系统的抽象形式，我们突出的工具的形式化分析语言。这种特定于领域的语言用于制定所谓的反模式。这些反模式可以由工具解释，用于系统的自动安全分析。除了语言声明之外，我们还在分析过程中给出了语言的整个语义评估。图模型和分析语言的部分定义和阐述是在Korbinian Christl的硕士论文的背景下与维也纳大学合作开发的。
英文摘要：
Nowadays, almost all electronic devices include a communication interface that allows to interact with them, exchange data, or operate their services remotely. The trend toward increased interconnectivity simultaneously increases the vulnerability of these systems. Due to the high costs associated with comprehensive security analysis, many manufacturers neglect the safety aspect of a product in order to avoid costs. However, the importance of secure IT systems is growing, as the security of a system can also influence safety-critical aspects. Standard security analysis approaches are nowadays still mainly based on time-intensive and error-prone manual activities. In this paper, we present the formal concepts of the automatic threat and vulnerability analysis tool ThreatGet. Therefore, we introduce the concept of the Extended Data-Flow Diagram that is used to represent the system under investigation in an abstracted form, and we highlight the formal analysis language of the tool. This domain-specific language is used to formulate so-called anti-patterns. These anti-patterns that can be interpreted by the tool for an automatic security analysis of the system. Besides the language declaration, we present the entire semantic evaluation of the language during the analysis. Parts of the definitions and elaborations of the diagram model and the analysis language were developed in the context of the master thesis of Korbinian Christl, in cooperation with the University of Vienna.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
