Proposed Secure Activity Diagram for Software Development

Unified Modeling Language (UML) activity diagrams are derived from use case diagrams. It becomes essential to incorporate security features and maintain consistency in the diagrams during analysis phase of Software Development Life Cycle (SDLC). As part of current software development practices, software security must be a constant effort. The activity diagrams are used to model business process. The detailed analysis of activity diagram is done. The challenge lies in viewing the main activity diagram from attacker's perspective and providing defense mechanism to mitigate the attacks. This paper presents an extension of the activity diagram named SecUML3Activity to provide security with Object Constraint Language (OCL) constraints using Five Primary Security Input Validation Attributes (FPSIVA) parameters for input validation. It also proposed three security color code notations and stereotypes in activity diagrams. White color is used to represent activity diagram in normal state. Red color in dotted line is used to represent attack activity components. Blue color with double line is used to represent the defensive activity components. The defense mechanism algorithm against SQL Injection (SQLI) attack, Cross Site Scripting (XSS) attack, DoS/ DDoS attack, access validation attack is provided. The mapping of Secure 3-Use Case diagram with SecUML3Activity diagram is done through mathematical modeling.

@article{Gedam2023,
  title     = {Proposed Secure Activity Diagram for Software Development},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {14},
  number    = {6},
  year      = {2023},
  publisher = {The Science and Information Organization},
  author    = {Madhuri N. Gedam and Bandu B. Meshram},
  doi       = {10.14569/IJACSA.2023.0140671},
  url       = {https://doi.org/10.14569/IJACSA.2023.0140671}
}