Abstract
In recent years, many software development teams have adopted the Test Driven Development (TDD) and Behavior Driven Development (BDD) practices, which promote the creation of use case scenarios and associated test codes before creating production code. Such practices help reduce the number of bugs in production and enhance code quality. However, since many development teams lack expertise in threat modeling, they usually find it challenging to incorporate security-related test cases into the design phase. Although there are existing tools that suggest potential threats by analyzing the design of software, those tools require significant expertise and efforts from the development teams to write misuse cases that represent those threats. Fixing such flaws after code development is costly. In this thesis, we seek to discover design-level flaws by using software artifacts created during the design phase. A user study is also conducted to prove that the approach we use greatly benefits software developers. Two works will be showcased where we take in use case scenarios and automatically generate misuse case scenarios based on user-defined data and action constraints. By running those misuse case scenarios using the testing code written for functional use cases, we can discover potential flaws. We apply our approach to ownCloud and Sylius, two open-source application projects, which has high-quality feature files. OwnCloud results show that actionable misuse case scenarios can be generated automatically using the inputs from ownCloud. For Sylius project, our results show that the generated misuse case scenarios can discover, and 3 hence, potentially prevent ten flaws. Among them, several were only fixed in hindsight, with the remaining being new issues.