Using Malware Analysis in Security Requirements Elicitation
This collection contains information about using malware analysis to identify security requirements.
Software Engineering Institute
SEI researchers and CMU students extended this work by creating an open-source tool, MORE, which allows developers to add information and search misuse cases, use cases, and overlooked requirements. Having this information enables developers to build more robust requirements that prevent security weaknesses in their products.
June 7, 2016 • Special Report
By Nancy R. Mead, Anand Sankalp (Carnegie Mellon University), Gupta Anurag (Carnegie Mellon), Priyam Swati (Carnegie Mellon University), Yaobin Wen (Carnegie Mellon University), Walid El Baroni (Carnegie Mellon University)
This report presents instructions for using the Malware-driven Overlooked Requirements (MORE) website applications.read
January 3, 2017 • Presentation
In this presentation, Nancy Mead explains how malware analysis can be used effectively to identify otherwise overlooked security requirements.read
August 25, 2015 • Conference Paper
In this paper, the authors propose to improve how security requirements are identified.read
January 9, 2015 • Article
In this article, the authors propose to enhance software development lifecycle models by implementing a process for including use cases based on previous cyberattacks.read
November 18, 2014 • Technical Note
This technical note explores the development of security requirements for the K-9 Mail application, an open source email client for the Android operating system.read