Towards Automated Security Design Flaw Detection Efficiency of securitybydesign has become an important goal for organizations implementing software engineering practices such as Agile, DevOps, and Continuous Integration. Software architectures are (often manually) analyzed at design time for potential security design flaws, based on natural language descriptions of security weaknesses (e.g., CWE, CAPEC). The use of natural language hinders the application of such knowledge bases in an automated fashion. In this paper, we analyze an existing catalog of 19 security design flaws in order to identify conceptual, technologyindependent requirements on architectural models that enable automatically detecting these flaws. This constitutes the first step towards automated assessment of designlevel security. Our findings are illustrated on an IoTbased smart home system.

Can AI Close the DesignCode Abstraction Gap? Aligning the design of a system with its implementation improves product quality and simplifies product evolution. While developers are empowered with AIML augmented tools and techniques that increasingly assist them in implementation tasks, the abstraction gap between code and design limits automation for design tasks. In this position paper, we argue that the software engineering community can take advantage of the experiences built with AIML techniques to advance automation in design analysis. We summarize research challenges and describe two efforts that apply machine learning to codebases to extract design constructs and detect deviation from intended designs and to use searchbased refactoring to make design improvements for extracting functionality.