[Back]


Publications in Scientific Journals:

C. Hochreiner, P. Frühwirt, Z. Ma, P. Kieseberg, S. Schrittwieser, E. Weippl:
"Genie in a Model? Why Model Driven Security will not secure your Web Application";
Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applications, 5 (2014), 3; 44 - 62.



English abstract:
More often a new software development methodology called Model Driven Engineering (MDE) is
used to increase productivity by supporting powerful code generation tools, which allows a less errorprone
implementation process. However the idea of modeling system aspects during the design phase
- so called Model Driven Security (MDS) - was proposed by the scientific community decades ago
and yet it is still unclear whether MDS can improve the security of a software project. In this paper
we provide a comprehensive evaluation of current MDS approaches based on a web application scenario
in regards to the most common web security attacks. We discuss their strengths and limitations
as well as the practicability of MDS for modern web application security in general.

German abstract:
More often a new software development methodology called Model Driven Engineering (MDE) is
used to increase productivity by supporting powerful code generation tools, which allows a less errorprone
implementation process. However the idea of modeling system aspects during the design phase
- so called Model Driven Security (MDS) - was proposed by the scientific community decades ago
and yet it is still unclear whether MDS can improve the security of a software project. In this paper
we provide a comprehensive evaluation of current MDS approaches based on a web application scenario
in regards to the most common web security attacks. We discuss their strengths and limitations
as well as the practicability of MDS for modern web application security in general.

Created from the Publication Database of the Vienna University of Technology.