# Security Monitoring during Software Development:
## 3 Methodology
### Requirements Elicitation and Architecture Design
#### 3.2.2 Architectural Design
These diagrams provided an overview of the main entities of each feature of the VM4 SEC platform, their main inputs and outputs, and their main data processing activities that are performed. In Figure 11, the Level-1 DFD of the VM4 SEC platform is illustrated, which showcases the core features of the overall platform, namely \"Quantitative Security Assessment\", \"Vulnerability Prediction\", and \"Report Generation\". As can be seen in Figure 11, the Level-1 DFD allows the user to understand which external entities must be invoked for performing the associated functionality, what data are produced, and which data are displayed to the user. For instance, as shown in Figure 11, the quantitative security assessment entity receives the source code of the selected software application from a version control system, requests the source code to be analyzed by external static code analyzers and software metrics tools, and, based on a pre-stored security assessment model, performs a security analysis, the results of which are stored into a dedicated data store named security analysis results. Then, a report generation entity takes those assessment results and turns them into visual reports, which are displayed to the user. A similar procedure is followed for the vulnerability prediction entity that is shown in Figure 11.  
For reasons of brevity, the deeper deconstruction of the VM4 SEC platform in Level-2 DFDs is not provided in the present paper. In addition to this, detailed sequence diagrams have been derived following the common UML notation for all the main functionalities of the VM4 SEC platform. Since this information is too technical, we decided to exclude it from the present report. Figure 10: The context diagram of the VM4 SEC security monitoring platform  
The DFDs were highly useful for deriving the component diagrams of the VM4 SEC platform, which are necessary for its final development and deployment. A component is an individual functional unit that is integrated into the broader system. Each component has its own interface, which enables its interaction with other components. In contrast to the DFDs, the component diagrams focus on providing a high-level representation of the system, avoiding technical details, and giving emphasis to the interaction between the components of the system. For defining the component diagram, we utilized the common UML notation. The overall component diagram of the VM4 SEC Platform is illustrated in Figure 12.  
As can be seen in Figure 12, the VM4 SEC platform consists of four (4) main components, which have either a provided or a requested Application Programming Interface (API). The two core components of the VM4 SEC platform are the quantitative security assessment (QSA) and the vulnerability prediction (VP) components, which constitute the back-end of the platform and represent the two core security monitoring features that it provides (see Sections 3.3 for more details). The component named security monitoring interface corresponds to a graphical user interface (GUI) that will enable the user to use the security assessment and vulnerability prediction components and retrieve a visual representation of their outputs. Finally, the security monitoring database component is responsible for storing the results of the analysis that are produced by the quantitative security assessment and vulnerability prediction components. As will be discussed in Section 3.4, the core components of the VM4 SEC platform will be implemented as microservices, which will provide their functionalities through RESTfull APIs. These microservices will be deployed utilizing the Docker Engine. Figure 11: The Level-1 data flow diagram (DFD) of the VM4 SEC security monitoring platform  
Figure 12: The Component Diagram of the VM4 SEC security monitoring platform.