Examples with ThreatStatement com.ge.research.osate.verdict.dsl.verdict.ThreatStatement used on opensource projects

Example 1 with ThreatStatement

use of com.ge.research.osate.verdict.dsl.verdict.ThreatStatement in project VERDICT by ge-high-assurance.

the class VerdictJavaValidator method checkThreatModel.

/**
 * Check that IDS are unique and non-empty and that top-level intro is a system.
 * Check that assumptions are unique.
 *
 * @param threatModel
 */
@Check(CheckType.FAST)
public void checkThreatModel(ThreatModel threatModel) {
    if (threatModel.getIntro().getType() != null && !threatModel.getIntro().getType().equals("system") && !threatModel.getIntro().getType().equals("connection")) {
        error("Top-level quantified variable must be a system or connection", VerdictPackage.Literals.THREAT_MODEL__INTRO);
    }
    if (threatModel.getId().length() == 0) {
        error("Threat model must specify an ID", VerdictPackage.Literals.THREAT_MODEL__ID);
    } else {
        // Check IDs unique
        Set<String> otherIds = new HashSet<>();
        // Find AADL package
        EObject container = threatModel;
        while (container != null && !(container instanceof PublicPackageSection)) {
            container = container.eContainer();
        }
        if (container instanceof PublicPackageSection) {
            // Find all verdict annex libraries
            for (AnnexLibrary library : ((PublicPackageSection) container).getOwnedAnnexLibraries()) {
                if ("verdict".equals(library.getName())) {
                    // Find all other threat model declarations
                    for (ThreatStatement other : ThreatModelUtil.getVerdictThreatModels(library).getStatements()) {
                        if (other instanceof ThreatModel && !threatModel.equals(other)) {
                            otherIds.add(((ThreatModel) other).getId());
                        }
                    }
                }
            }
        }
        if (otherIds.contains(threatModel.getId())) {
            error("Duplicate ID " + threatModel.getId(), VerdictPackage.Literals.THREAT_MODEL__ID);
        }
    }
    // Check for duplicate assumptions
    Map<CRVAssumption, Integer> assumptionCounts = new HashMap<>();
    for (CRVAssumption assumption : threatModel.getAssumptions()) {
        if (assumptionCounts.containsKey(assumption)) {
            assumptionCounts.put(assumption, assumptionCounts.get(assumption) + 1);
        } else {
            assumptionCounts.put(assumption, 1);
        }
    }
    int pos = 0;
    for (CRVAssumption assumption : threatModel.getAssumptions()) {
        if (assumptionCounts.get(assumption) > 1) {
            warning("Duplicate assumption: " + assumption.getLiteral(), VerdictPackage.Literals.THREAT_MODEL__ASSUMPTIONS, pos);
        }
        pos++;
    }
    if (threatModel.getReference() != null) {
        // We say that a reference string is valid if there is a valid database ID
        // that is a prefix string of that reference string
        Set<String> definedDatabases = ThreatModelUtil.getDefinedThreatDatabases(threatModel);
        if (!definedDatabases.stream().anyMatch(database -> threatModel.getReference().startsWith(database))) {
            error("Undefined threat database: " + threatModel.getReference(), VerdictPackage.Literals.THREAT_MODEL__REFERENCE);
        }
    }
}

Example 2 with ThreatStatement

use of com.ge.research.osate.verdict.dsl.verdict.ThreatStatement in project VERDICT by ge-high-assurance.

the class VerdictJavaValidator method checkThreatDatabase.

/**
 * Check that threat database IDs are non-empty and unique.
 *
 * @param database
 */
@Check(CheckType.FAST)
public void checkThreatDatabase(ThreatDatabase database) {
    List<String> otherDatabases = new ArrayList<>();
    AadlPackage top = ThreatModelUtil.getAadlPackage(database);
    if (database.getId().length() == 0) {
        error("Threat database must specify an ID", VerdictPackage.Literals.THREAT_DATABASE__ID);
    } else {
        for (AnnexLibrary library : top.getOwnedPublicSection().getOwnedAnnexLibraries()) {
            if ("verdict".equals(library.getName())) {
                VerdictThreatModels threats = ThreatModelUtil.getVerdictThreatModels(library);
                for (ThreatStatement statement : threats.getStatements()) {
                    if (statement instanceof ThreatDatabase && statement != database) {
                        otherDatabases.add(((ThreatDatabase) statement).getId());
                    }
                }
            }
        }
        if (otherDatabases.contains(database.getId())) {
            error("Duplicate ID: " + database.getId(), VerdictPackage.Literals.THREAT_DATABASE__ID);
        }
    }
}

Example 3 with ThreatStatement

use of com.ge.research.osate.verdict.dsl.verdict.ThreatStatement in project VERDICT by ge-high-assurance.

the class VerdictJavaValidator method checkThreatDefense.

/**
 * Check that threat defense names are non-empty and unique and that threat models are unique and defined.
 *
 * @param defense
 */
@Check(CheckType.FAST)
public void checkThreatDefense(ThreatDefense defense) {
    List<String> otherDefenses = new ArrayList<>();
    AadlPackage top = ThreatModelUtil.getAadlPackage(defense);
    if (defense.getName().length() == 0) {
        error("Threat defense must specify an ID", VerdictPackage.Literals.THREAT_DEFENSE__NAME);
    } else {
        for (AnnexLibrary library : top.getOwnedPublicSection().getOwnedAnnexLibraries()) {
            if ("verdict".equals(library.getName())) {
                VerdictThreatModels threats = ThreatModelUtil.getVerdictThreatModels(library);
                for (ThreatStatement statement : threats.getStatements()) {
                    if (statement instanceof ThreatDefense && statement != defense) {
                        otherDefenses.add(((ThreatDefense) statement).getName());
                    }
                }
            }
        }
        if (otherDefenses.contains(defense.getName())) {
            error("Duplicate ID: " + defense.getName(), VerdictPackage.Literals.THREAT_DEFENSE__NAME);
        }
    }
    // Check for duplicate threats
    Map<String, Integer> threatCounts = new HashMap<>();
    for (String threat : defense.getThreats()) {
        if (threatCounts.containsKey(threat)) {
            threatCounts.put(threat, threatCounts.get(threat) + 1);
        } else {
            threatCounts.put(threat, 1);
        }
    }
    int pos = 0;
    for (String threat : defense.getThreats()) {
        if (threatCounts.get(threat) > 1) {
            warning("Duplicate threat: " + threat, VerdictPackage.Literals.THREAT_DEFENSE__THREATS, pos);
        }
        pos++;
    }
    // Make sure threat models are defined
    Set<String> definedThreats = ThreatModelUtil.getDefinedThreatModels(defense);
    pos = 0;
    for (String threat : defense.getThreats()) {
        if (!definedThreats.contains(threat)) {
            error("Undefined threat: " + threat, VerdictPackage.Literals.THREAT_DEFENSE__THREATS, pos);
        }
        pos++;
    }
}