¹Department of Computer Science, North Carolina A&T State University, 1601 East Market St., Greensboro, North Carolina, USA.
²Department of Computer Science, University of South Alabama, 3150 Jaguar Drive, Mobile, Alabama, USA.

---

Abstract—To develop secure software, software engineers need to have the mindset of attackers. Developing abuse cases can help software engineers to think more like attackers. This paper describes a method for developing abuse cases based on threat modeling, attack patterns, and Common Weakness Enumeration. The method also includes ranking the abuse cases according to their risks. This method intends to help non-experts create abuse cases following a specific process, and leveraging the knowledge bases of threat modeling, attack patterns, and Common Weakness Enumeration. The proposed method was evaluated through two evaluation studies conducted in two secure software engineering courses at two different universities. Evaluation studies show that the proposed method was easier to follow by non-experts in generating abuse cases than brainstorming, and could reduce the time needed for creating abuse cases. Other findings from the evaluation studies are also discussed in the paper.

Index Terms—Abuse cases, threat modeling, attack patterns, common weakness enumeration, secure software development.

[PDF]

Cite: Imano Williams, Xiaohong Yuan, Jeffrey Todd McDonald, Mohd Anwar, "A Method for Developing Abuse Cases and Its Evaluation," Journal of Software vol. 11, no. 5, pp. 520-527, 2016.