## 7 Related Work
### Dynamic Adaptation of Security  
There are a lot of approaches that try to deal with runtime adaptation of security. For instance, in [29], the authors present a policy-based approach for automating the integration of security mechanisms into Java-based business applications. They use security@runtime, a Domain-Specific Language (DSL), for the specification of security configurations based on authorization, obligation and reaction policies. The approach presented in this paper, in contrast, is suitable for using security policies specified in any model (e.g., OrBAC--Organization-Based Access Control), since the mapping between the policies and the security functionalities is made at an abstract level of the variability model. Another difference with the approach presented in this paper is that we separate the monitoring of changes in the application and the integration of the security functionality following the MAPE-K (Monitoring, Analysis, Plan, Execution--Knowledge) loop, while they integrate the security functionalities in the same monitoring events. Moreover, they implement the security rules in separate classes, but this code is application dependent, while in our approach, the security rules do not need to be hard-coded, improving the evolution of the policies.  
In [30], the authors use policy-based security profiles to make logical and knowledge-based decisions within open service environments, and it uses a layered holistic model [31] to describe security (_i.e._, security requirements are defined using security profiles that describe the interlinking of security policies to instances of services). However, in our approach, the security policies are decoupled from the specific knowledge of the application and from the implementation of the security functionality in various aspects, and this improves the reuse of both the security policies and the security functionalities.  
Model-driven security (MDS) is often used to adapt security dynamically following different approaches: UMLSec (UML for secure systems) [32], SecureUML (access control language based on UML) [33], OpenPMF (Open Policy Management Framework) [34, 35], SECTET (framework for model-driven security) [36], _etc_. For instance, in [37], models@runtime is used to keep an architectural model synchronized with a policy, but this approach only supports access control policies and not any kind of security functionality, as does our security adaptation service. This is a general limitation in many security policy-based approaches, because they are primarily focused only on access control or authorization concerns [34, 35, 38, 39] or they are focused only on a specific domain, such as mobile cloud [40] or service-oriented architecture (SOA) [34, 35, 36, 38].  
There are also some generic approaches for reconfiguration at runtime that do not only concentrate on security concerns. In [41], [PERSON] _et al._ propose a reconfiguration mechanism that switches between different architectural configurations at run-time. The configurations are based on the specialization of feature models, and the reconfiguration plans are automatically generated from the differences between them. They propagate changes in configurations at the architectural level instead of the direct aspect implementation, as we do.