Bridging Safety and Security in Complex Systems: A Model-Based Approach with SAFT-GT Toolchain

TL;DR

This paper introduces the SAFT-GT toolchain, a model-based system that enhances safety and security analysis in complex, self-adaptive systems through attack-fault tree generation and seamless integration.

Contribution

The paper presents a novel, open-source toolchain that combines safety and security analysis for self-adaptive systems, addressing evolving threats with minimal system modifications.

Findings

Demonstrated effectiveness of the toolchain in real-world applications

Validated the toolchain's usability through a user study with domain experts

Showcased integration capabilities with existing systems for enhanced analysis

Abstract

In the rapidly evolving landscape of software engineering, the demand for robust and secure systems has become increasingly critical. This is especially true for self-adaptive systems due to their complexity and the dynamic environments in which they operate. To address this issue, we designed and developed the SAFT-GT toolchain that tackles the multifaceted challenges associated with ensuring both safety and security. This paper provides a comprehensive description of the toolchain's architecture and functionalities, including the Attack-Fault Trees generation and model combination approaches. We emphasize the toolchain's ability to integrate seamlessly with existing systems, allowing for enhanced safety and security analyses without requiring extensive modifications and domain knowledge. Our proposed approach can address evolving security threats, including both known vulnerabilities and emerging attack vectors that could compromise the system. As a use case for the toolchain, we integrate it into the feedback loop of self-adaptive systems. Finally, to validate the practical applicability of the toolchain, we conducted an extensive user study involving domain experts, whose insights and feedback underscore the toolchain's relevance and usability in real-world scenarios. Our findings demonstrate the toolchain's effectiveness in real-world applications while highlighting areas for future improvements. The toolchain and associated resources are available in an open-source repository to promote reproducibility and encourage further research in this field.