A quantitative and knowledge-based approach to choosing security architectural tactics

Abstract

This paper presents a quantitative approach to choosing security architectural tactics using architectural tactic knowledge base. An architectural tactic is an architectural design building block pertaining to a software quality. The tactic knowledge base is a tactic repository composing of architectural tactic specifications defined in role based metamodelling language (RBML) and their relationships expressed in a feature model. In this paper, a cost of an architectural tactic is estimated by using the use case points method, and a level of tactic contribution for non–functional requirements (NFRs) is predicted by the analytic hierarchy process (AHP) and sensitivity analysis. Then, the proposed approach suggests the best possible fit which is likely to satisfy NFRs. We applied the approach to choosing security architectural tactics for building software architecture of an online trading system.