Security patterns: A systematic mapping study

Abstract

Security patterns are a means to encapsulate and communicate proven security solutions. They are wellestablished approaches for introducing security into the software development process. Our objective is to explore the research efforts on security patterns and discuss the current state of the art. This study will serve as a guideline for researchers, practitioners, and teachers interested in this field. We have conducted a systematic mapping study of relevant literature from 1997 until the end of 2017 and identified 403 relevant papers, 274 of which were selected for analysis based on quality criteria. This study derives a customized research strategy from established systematic approaches in the literature. We have utilized an exhaustive 3-tier search strategy to ensure a high degree of completeness during the study collection and used a test set to evaluate our search. The first 3 research questions address the demographics of security pattern research such as topic classification, trends, and distribution between academia and industry, along with prominent researchers and venues. The next 9 research questions focus on more indepth analyses such as pattern presentation notations and classification criteria, pattern evaluation techniques, and pattern usage environments. The results and discussions of this study have significant implications for researchers, practitioners, and teachers in software engineering and information security. to the end of 2017 Security pattern related research (Development, Evaluation, Usage)TABLE 1 COMPARISON BETWEEN OUR WORK AND OTHER REVIEWSpattern research and instead, attempted to cover the entire research spectrum in this field. We initially planned to utilize only two search strategies (manual search and backward snowballing), but we found that these two approaches were lacking in a few specific instances. The issue with backward snowballing and manual search is that they rely on the cross-reference relationship between research papers. Papers referenced from multiple other papers, or published in commonly occurring venues are easily discovered, whereas isolated papers in unexpected venues have a chance of never being found. Another issue with backward snowballing stems from its backward nature. The search period for our study was up to the end of 2017, but to find 2017 papers through backward snowballing, we had to analyze papers published after that period (2018 and up) which was out of our scope. Similarly, newer papers with fewer citations are hard to discover through backward snowballing. Adding a database search proved beneficial as we discovered 97 new papers, 64 of which were included.The time period for the study of Uzunov et al. (Uzunov et al., 2012) and Yoshioka et al. (Yoshioka et al., 2008) in Table 1 are not explicitly stated, but are extracted based on the references list. In the work of Bunke et al. (Bunke et al., 2012), the mentioned number of studies consists of other non-primary studies (e.g. tech reports, books, surveys). This work utilizes three search strat...

From Vulnerability Anti-Patterns to Secure Design Patterns (S)

“…The research on security pattern is an active and growing field across the globe [14]. Much research has been done on the secure design pattern classification, but little research has considered selecting appropriate secure design patterns for a given problem.…”

Electric Vehicles and the Use of Demand Projection Models: A Systematic Mapping of Studies

“…In a similar context, the research by Behmanesh et al (2020) reports on the identification and classification of tele-orthopedic applications and services, together with a general description of trends in this field. Strictly in the field of technology and information, the following studies use systematic mapping: Khan et al (2021), who try to identify, categorize, and present a complete general description of the approaches, techniques, and tools used in election predictions on Twitter; Rachad and Idri (2020), who aim to provide an overview of the use of machine learning (ML) techniques in the design and development of mobile applications; Jafari and Rasoolzadegan (2020), who explore security patterns as a means of encapsulating and communicating tested security solutions and introduce security into the development process. Moreover, Belmonte et al (2019) present an overview of automatic tasks based on the concept of unmanned aerial vehicles (UAV); Zakari et al (2019) present a study of software fault localization (SFL) in order to determine the general productivity of investigation, demography, and trends, as well as to classify existing techniques; Cravero et al (2018) offer an overview of how IoT (Internet of Things) technologies and BigData can help oenologists to manage and optimize wine production, and how the components of the computer architectures used can be determined; Haghighatkhah et al (2017) propose a classification and analysis of the literature related with software engineering in the motor car industry; and Gabriel et al (2016) analyze the existing digital tools to support creativity in organizations.…”

Evaluation of design pattern alternatives in Java

“…We restrict our research to the original "Gang-of-four" patterns, exclusing other developments in patterns such as nano patterns in programming ccode, 12 patterns for different computing models, 13 or security patterns. 14 Our main contribution is that we reason, in a systematic way, about how to compare possible implementations of design patterns. As far as we know, this has not been done before.…”

“…We restrict our research to the original “Gang‐of‐four” patterns, exclusing other developments in patterns such as nano patterns in programming ccode, 12 patterns for different computing models, 13 or security patterns 14 …”