# Facilitating the Integrative Use of Security Knowledge Bases within a Modelling Environment
## 2 Materials and Methods  
We relied on model-to-model transformations to import information from knowledge bases into the modelling environment. Also, we introduced new _TRADES Tool_ extensions to support user/modeller interaction with the imported information.  
The model-to-model transformations are underpinned by the previously designed TRADES metamodel and, specifically, the \"threat\" and \"control\" concepts embedded within the metamodel. These concepts were previously established as concepts that are essential for security analysis [7]. The existence of such concepts and the relations between them allows for accommodating external information as specific/specialised instances of these concepts, while still maintaining correct-by-construction security analysis models. For this work, we extended the metamodel--which is a core element of the _TRADES Tool_ security modelling tool--with additional concepts that allow for tracking the source of external information to provide users with proper references and access to additional information, as discussed in Section 3.1. Additionally, pertinent user interface mechanisms--such as dedicated representational enhancements and import dialogues--were developed, extending the _TRADES Tool_.  
For importing attack patterns from CAPEC, we developed a model-to-model transformation from the official MITRE CAPEC XML (Extensible Markup Language) file--downloadable from the online CAPEC website--to a TRADES catalogue, which is a model that is fully compliant with the extended TRADES metamodel (by-design). Every attack pattern appears in the TRADES catalogue as an external threat element. For ATT&CK information, an XML file was not available; instead, we developed tools to download relevant web pages from the online ATT&CK repository and parse them into a TRADES catalogue which contains both ATT&CK techniques (as external threat elements) and mitigations (as external control elements). The CAPEC and ATT&CK transformations were implemented as Python programs. We allow users to trace each external element to its CAPEC/ATT&CK catalogue by specifying--for each element--a link to the original knowledge base's entry.  
For importing NIST SP800-53 security controls, we rely on translation from their OSCAL representation into TRADES model elements. First, OSCAL files can be imported into our workspace, instantiating designated OSCAL security control concept elements and resulting in a complete OSCAL catalogue, including detailed attributes and parameter names for each security control. Security controls from the catalogue can then be used within a specific threat and risk assessment, by creating uniquely identified external control elements for each desired security control. This includes setting parameters' values for the control's description. The resulting elements are traceable to their security control concept as it appears in the imported OSCAL catalogue, providing users with access to pertinent information within the modelling environment itself.  
All of the mechanisms described in this paper--including our model-to-model transformations and the extended _TRADES Tool_--are available as open-source solutions in a public, online repository [23].