# Security Monitoring during Software Development:
## 3 Methodology
### Requirements Elicitation and Architecture Design
#### 3.2.2 Architectural Design  
After devising the requirements and the use cases of the VM4 SEC platform, we proceeded with the design of its overall architecture. For the architectural design of the VM4 SEC platform, we followed the guidelines of the IEEE 1471 international standard. According to this standard, starting from the functional requirements and the use cases of a system, three main viewpoints of its architectures can be defined, which are the logical, the functional, and the deployment viewpoints. As our main architectural design technique, we have selected the _Data Flow Diagram_ (_DFD_) technique, which provides a convenient graphical means for analyzing the structure of the system at different levels of abstraction, focusing on the flow of data among internal and external entities [46]. According to [PERSON] et al. [47], the DFD technique is one of the most effective techniques for visualizing the flows and the processing of data within a software system. The DFD technique is based on the hierarchical decomposition of the system following a top-down approach [46], providing in that way several levels of abstractions for the given system. In the highest level of abstraction, which is known as the context diagram or the Level-0 DFD, the system is represented as a black box, showcasing its interconnection with external entities (e.g., users and third-party systems). In fact, the context diagram showcases the boundaries of the system, separating it from external entities and highlighting its input and output flows. The context diagram of the envisaged VM4 SEC platform, as specified based on the collected information (see Section 3.1.1) and the guidelines of the IEEE 1471 standard is illustrated in Figure 10.  
As can be seen in Figure 10, the context diagram is useful to (i) visualize the scope of the system, (ii) highlight the external entities that interact with the system, and (iii) summarize the input and output flows of the system. More specifically, as can be seen in Figure 10, the VM4 SEC platform has five external entities, one of them being the actual user of the system, and the other four being external tools that are required for retrieving the source code of the selected software application (i.e., Version Control System) and analyzing it in an attempt to detect security issues and vulnerability patterns (i.e., Static Code Analyzers, Text mining tools, and Software Metrics Tools). \begin{table}
\begin{tabular}{p{142.3 pt} p{284.5 pt}} \hline \hline
**ID** & Use Case 3 \\ \hline
**Brief Description** & Executing the software vulnerability prediction model \\ \hline
**Frequency** & Several times a day upon user request. \\ \hline
**Main User** & User \\ \hline
**Scope** & System Functionality \\ \hline
**Priority** & 1 \\ \hline
**Detailed Description** & This use case describes how a user can identify potentially vulnerable software components of a selected application. \\ \hline
**Related Functional Requirements** & FR 1, FR 2, FR 4, FR 5 \\ \hline
**Basic Flow** \\ \hline
**Step 1 (Actor: User)** & The user declares that he/she wishes to be informed about the components of the selected software application that may be vulnerable. \\ \hline
**Step 2 (Actor: System)** & The system analyzes the source code of the selected software product and runs the implemented vulnerability prediction model to categorize the software components as vulnerable or not. \\ \hline
**Step 3 (Actor: System)** & Finally, the system displays to the user a report of the software components that have been predicted to be vulnerable, together with a score reflecting the likelihood that they are vulnerable. \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Use case about executing the software vulnerability prediction model. As already stated, the DFD technique is based on the hierarchical decomposition of the system. Hence, the context diagram was further elaborated and decomposed into Level-1 and Level-2 diagrams, which were useful for the VM4 SEC component identification and specification.