A resource-based approach to extend UML diagrams for web applications

Web applications will perform unexpected behaviors against their original UML diagrams and specifications if they are attacked. These attacks always exploit vulnerabilities of those web applications which lack of sufficient protection on their web resources. The paper proposes a resource-based approach to extend UML diagrams for web applications. The goal of the research is, by integrating web resources into UML diagrams, to seek a systematic framework on requirement analysis from the perspective of web resources. First, we formalize use case specification and conduct lexical analysis on event flows. Then, we identify and organize different types of web resources according to the results of lexical analysis. After that, attributes of web resources are integrated into static UML diagram, i.e., class diagram. Finally, dynamic UML diagram, i.e., sequence diagram, is extended by tagging related web resources on each action and object. These extended UML diagrams enable security analysts to further investigate vulnerabilities of web applications in terms of web resources, and help to generate security requirements.