VeriDevOps: Automated Protection and Prevention to Meet Security Requirements in DevOps

Andrey Sadovykh; Gunnar Widforss; Dragos Truscan; Eduard Paul Enoiu; Wissam Mallouli; Rosa Iglesias; Alessandra Bagnto; Olga Hendel

doi:10.23919/DATE51398.2021.9474185

VeriDevOps: Automated Protection and Prevention to Meet Security Requirements in DevOps

Andrey Sadovykh, Gunnar Widforss, Dragos Truscan, Eduard Paul Enoiu, Wissam Mallouli, Rosa Iglesias, Alessandra Bagnto, Olga Hendel

Research output: Chapter in Book/Conference proceeding › Conference contribution › Scientific › peer-review

13 Citations (Scopus)

78 Downloads (Pure)

Abstract

Current software development practices are increasingly based on using both COTS and legacy components which make such systems prone to security vulnerabilities. The modern practice addressing ever changing conditions, DevOps, promotes frequent software deliveries, however, verification methods artifacts should be updated in a timely fashion to cope with the pace of the process. VeriDevOps, Horizon 2020 project, aims at providing a faster feedback loop for verifying the security requirements and other quality attributes of large scale cyber-physical systems. VeriDevOps focuses on optimizing the security verification activities, by automatically creating verifiable models directly from security requirements formulated in natural language, using these models to check security properties on design models and then generating artefacts such as, tests or monitors that can be used later in the DevOps process. The main drivers for these advances are: Natural Language Processing, a combined formal verification and model-based testing approach, and machine-learning-based security monitors. VeriDevOps is in its initial stage - the project started on 1.10.2020 and it will run for three years. In this paper we will present the major conceptual ideas behind the project approach as well as the organizational settings.

Original language	English
Title of host publication	Proceedings of the 2021 Design, Automation and Test in Europe, DATE 2021
Publisher	the Institute of Electrical and Electronics Engineers, Inc.
Pages	1330-1333
Number of pages	4
ISBN (Electronic)	978-3-9819263-5-4
ISBN (Print)	978-1-7281-6336-9
DOIs	https://doi.org/10.23919/DATE51398.2021.9474185
Publication status	Published - 1 Feb 2021
MoE publication type	A4 Article in a conference publication
Event	Design, Automation and Test in Europe Conference and Exhibition - Duration: 1 Feb 2021 → 5 Feb 2021

Publication series

Name	Proceedings -Design, Automation and Test in Europe, DATE
Volume	2021-February
ISSN (Print)	1530-1591

Conference

Conference	Design, Automation and Test in Europe Conference and Exhibition
Abbreviated title	DATE
Period	01/02/21 → 05/02/21

Keywords

Cybersecurity
Design checking
Machine Learning
Model-Driven Engineering
Natural Language Processing
Prevention and Reaction
Requirement
Root cause analysis
Runtime Analysis
Security-by-design
Testing and validation

Access to Document

10.23919/DATE51398.2021.9474185

DATE2020 - VeriDevops-cameraReadySubmitted manuscript, 589 KBLicence: Publisher rights policy

Cite this

Sadovykh, A., Widforss, G., Truscan, D., Enoiu, E. P., Mallouli, W., Iglesias, R., Bagnto, A., & Hendel, O. (2021). VeriDevOps: Automated Protection and Prevention to Meet Security Requirements in DevOps. In Proceedings of the 2021 Design, Automation and Test in Europe, DATE 2021 (pp. 1330-1333). Article 9474185 (Proceedings -Design, Automation and Test in Europe, DATE; Vol. 2021-February). the Institute of Electrical and Electronics Engineers, Inc.. https://doi.org/10.23919/DATE51398.2021.9474185

@inproceedings{754d5794bbc54e20b9003388dd590058,

title = "VeriDevOps: Automated Protection and Prevention to Meet Security Requirements in DevOps",

abstract = "Current software development practices are increasingly based on using both COTS and legacy components which make such systems prone to security vulnerabilities. The modern practice addressing ever changing conditions, DevOps, promotes frequent software deliveries, however, verification methods artifacts should be updated in a timely fashion to cope with the pace of the process. VeriDevOps, Horizon 2020 project, aims at providing a faster feedback loop for verifying the security requirements and other quality attributes of large scale cyber-physical systems. VeriDevOps focuses on optimizing the security verification activities, by automatically creating verifiable models directly from security requirements formulated in natural language, using these models to check security properties on design models and then generating artefacts such as, tests or monitors that can be used later in the DevOps process. The main drivers for these advances are: Natural Language Processing, a combined formal verification and model-based testing approach, and machine-learning-based security monitors. VeriDevOps is in its initial stage - the project started on 1.10.2020 and it will run for three years. In this paper we will present the major conceptual ideas behind the project approach as well as the organizational settings. ",

keywords = "Cybersecurity, Design checking, Machine Learning, Model-Driven Engineering, Natural Language Processing, Prevention and Reaction, Requirement, Root cause analysis, Runtime Analysis, Security-by-design, Testing and validation",

author = "Andrey Sadovykh and Gunnar Widforss and Dragos Truscan and Enoiu, {Eduard Paul} and Wissam Mallouli and Rosa Iglesias and Alessandra Bagnto and Olga Hendel",

note = "Funding Information: This project has received funding from the European Union{\textquoteright}s Horizon 2020 research and innovation programme under grant agreement No 957212. We acknowledge all the experts who contributed to numerous discussions and to writing the VeriDevOps proposal. Publisher Copyright: {\textcopyright} 2021 EDAA.; Design, Automation and Test in Europe Conference and Exhibition, DATE ; Conference date: 01-02-2021 Through 05-02-2021",

year = "2021",

month = feb,

day = "1",

doi = "10.23919/DATE51398.2021.9474185",

language = "English",

isbn = "978-1-7281-6336-9",

series = "Proceedings -Design, Automation and Test in Europe, DATE",

publisher = "the Institute of Electrical and Electronics Engineers, Inc.",

pages = "1330--1333",

booktitle = "Proceedings of the 2021 Design, Automation and Test in Europe, DATE 2021",

}

Sadovykh, A, Widforss, G, Truscan, D, Enoiu, EP, Mallouli, W, Iglesias, R, Bagnto, A & Hendel, O 2021, VeriDevOps: Automated Protection and Prevention to Meet Security Requirements in DevOps. in Proceedings of the 2021 Design, Automation and Test in Europe, DATE 2021., 9474185, Proceedings -Design, Automation and Test in Europe, DATE, vol. 2021-February, the Institute of Electrical and Electronics Engineers, Inc., pp. 1330-1333, Design, Automation and Test in Europe Conference and Exhibition, 01/02/21. https://doi.org/10.23919/DATE51398.2021.9474185

VeriDevOps: Automated Protection and Prevention to Meet Security Requirements in DevOps. / Sadovykh, Andrey; Widforss, Gunnar; Truscan, Dragos et al.
Proceedings of the 2021 Design, Automation and Test in Europe, DATE 2021. the Institute of Electrical and Electronics Engineers, Inc., 2021. p. 1330-1333 9474185 (Proceedings -Design, Automation and Test in Europe, DATE; Vol. 2021-February).

Research output: Chapter in Book/Conference proceeding › Conference contribution › Scientific › peer-review

TY - GEN

T1 - VeriDevOps

T2 - Design, Automation and Test in Europe Conference and Exhibition

AU - Sadovykh, Andrey

AU - Widforss, Gunnar

AU - Truscan, Dragos

AU - Enoiu, Eduard Paul

AU - Mallouli, Wissam

AU - Iglesias, Rosa

AU - Bagnto, Alessandra

AU - Hendel, Olga

N1 - Funding Information: This project has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement No 957212. We acknowledge all the experts who contributed to numerous discussions and to writing the VeriDevOps proposal. Publisher Copyright: © 2021 EDAA.

PY - 2021/2/1

Y1 - 2021/2/1

N2 - Current software development practices are increasingly based on using both COTS and legacy components which make such systems prone to security vulnerabilities. The modern practice addressing ever changing conditions, DevOps, promotes frequent software deliveries, however, verification methods artifacts should be updated in a timely fashion to cope with the pace of the process. VeriDevOps, Horizon 2020 project, aims at providing a faster feedback loop for verifying the security requirements and other quality attributes of large scale cyber-physical systems. VeriDevOps focuses on optimizing the security verification activities, by automatically creating verifiable models directly from security requirements formulated in natural language, using these models to check security properties on design models and then generating artefacts such as, tests or monitors that can be used later in the DevOps process. The main drivers for these advances are: Natural Language Processing, a combined formal verification and model-based testing approach, and machine-learning-based security monitors. VeriDevOps is in its initial stage - the project started on 1.10.2020 and it will run for three years. In this paper we will present the major conceptual ideas behind the project approach as well as the organizational settings.

AB - Current software development practices are increasingly based on using both COTS and legacy components which make such systems prone to security vulnerabilities. The modern practice addressing ever changing conditions, DevOps, promotes frequent software deliveries, however, verification methods artifacts should be updated in a timely fashion to cope with the pace of the process. VeriDevOps, Horizon 2020 project, aims at providing a faster feedback loop for verifying the security requirements and other quality attributes of large scale cyber-physical systems. VeriDevOps focuses on optimizing the security verification activities, by automatically creating verifiable models directly from security requirements formulated in natural language, using these models to check security properties on design models and then generating artefacts such as, tests or monitors that can be used later in the DevOps process. The main drivers for these advances are: Natural Language Processing, a combined formal verification and model-based testing approach, and machine-learning-based security monitors. VeriDevOps is in its initial stage - the project started on 1.10.2020 and it will run for three years. In this paper we will present the major conceptual ideas behind the project approach as well as the organizational settings.

KW - Cybersecurity

KW - Design checking

KW - Machine Learning

KW - Model-Driven Engineering

KW - Natural Language Processing

KW - Prevention and Reaction

KW - Requirement

KW - Root cause analysis

KW - Runtime Analysis

KW - Security-by-design

KW - Testing and validation

UR - http://www.scopus.com/inward/record.url?scp=85108370840&partnerID=8YFLogxK

U2 - 10.23919/DATE51398.2021.9474185

DO - 10.23919/DATE51398.2021.9474185

M3 - Conference contribution

AN - SCOPUS:85108370840

SN - 978-1-7281-6336-9

T3 - Proceedings -Design, Automation and Test in Europe, DATE

SP - 1330

EP - 1333

BT - Proceedings of the 2021 Design, Automation and Test in Europe, DATE 2021

PB - the Institute of Electrical and Electronics Engineers, Inc.

Y2 - 1 February 2021 through 5 February 2021

ER -

Sadovykh A, Widforss G, Truscan D, Enoiu EP, Mallouli W, Iglesias R et al. VeriDevOps: Automated Protection and Prevention to Meet Security Requirements in DevOps. In Proceedings of the 2021 Design, Automation and Test in Europe, DATE 2021. the Institute of Electrical and Electronics Engineers, Inc. 2021. p. 1330-1333. 9474185. (Proceedings -Design, Automation and Test in Europe, DATE). doi: 10.23919/DATE51398.2021.9474185

VeriDevOps: Automated Protection and Prevention to Meet Security Requirements in DevOps

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint