Institutsseminar/2026-10-16 Zusatztermin
| Datum | Freitag, 16. Oktober 2026 | |
|---|---|---|
| Uhrzeit | 12:00 – 12:45 Uhr (Dauer: 45 min) | |
| Ort | Raum 348 (Gebäude 50.34) | |
| Prüfer/in | Ralf Reussner | |
| Webkonferenz | ||
| Vorheriger Termin | Fr 16. Oktober 2026 | |
| Nächster Termin | Fr 30. Oktober 2026 |
Termin in Kalender importieren: iCal (Download)
Vorträge
| Vortragende(r) | Thomas Riekert |
|---|---|
| Vortragstyp | Masterarbeit |
| Betreuer(in) | Mahdi Jafari |
| Vortragssprache | Englisch |
| Vortragsmodus | in Präsenz |
| Kurzfassung | Authorization weaknesses are usually found only during or after implementation, even though many of them come from design decisions. This thesis moves part of identifying weaknesses into the design phase and derives Abstract Penetration Test Cases (APTCs) from Palladio Component Model (PCM) architectures. A security annotation adds three things to the model: which actors each operation is intended for, how far each actor is trusted, and how sensitive each component's data is. Deterministic rules then trace every path from an entry point to the data it reaches. Each path that breaks a rule against missing authentication (CWE-306) or missing authorization (CWE-862) becomes an APTC. Writing the annotation takes the most effort, so an LLM drafts it from the model and a fixed vocabulary, and an architect reviews the draft. The evaluation covers four case studies (MoPla, crAPI, CoronaWarnApp and EVerest) and an expert study. It looks at whether the annotation can be applied in practice, if the APTCs stay consistent when the model changes and if experts find them useful. |
Neuen Vortrag erstellen
Bitte melde Dich mit Deinen KIT-Zugangsdaten an. Falls Du trotz Anmeldung diese Meldung siehst, bitte eine/-n Wissensmanager/-in darum, Dich zur richtigen Gruppe hinzuzufügen.