Towards Architectural Pen Test Case Generation and Attack Surface Analysis to Support Secure Design

In today’s interconnected world, software systems
have become indispensable components of complex frameworks,
such as cyber-physical systems, e-commerce platforms, and
healthcare information systems. This widespread integration
highlights the importance of security more than ever, as these
systems often function in critical environments where vulnerabilities
can lead to significant destructive consequences. Penetration
testing is a key method for identifying vulnerabilities
but is often conducted after deployment, making remediation
costly and time-consuming. On the other hand, back to the
early phases of the Software Development Life Cycle (SDLC),
software architects often lack the security expertise and feedback
mechanisms needed to make informed design decisions, leading
to vulnerabilities that remain undetected until later stages. In this
paper, to address these challenges, we propose a research plan
to integrate security considerations into the design phase. Our
approach involves generating architecture-based penetration test
cases, evaluating the attack surface of alternative architectures
by using the generated test cases, and supporting software
... mehr
architects in making secure design decisions afterward. We plan
to leverage threat modeling and Large Language Models (LLMs)
to fulfill our target ambitions. To validate the applicability and
effectiveness of our approach, we aim to conduct case studies
in areas such as autonomous vehicles (AVs), which present
significant security challenges.