期刊名称：International Journal of Security and Its Applications
印刷版ISSN：1738-9976
出版年度：2014
卷号：8
期号：2
页码：271-282
DOI：10.14257/ijsia.2014.8.2.28
出版社：SERSC
摘要：This paper refers important issues regarding how to evaluate the security threats of the online banking effectively, a system threat analysis method combining STRIDE threat model and threat tree analysis is proposed, which improves the efficiency of the threat analysis greatly and also has good practicability. By applying this method to the online banking system threat analysis, we construct STRIDE threat model on the analysis of the key business data, and then we construct threat tree on the security threat by layer-by-layer decomposition. Thus it gives a detailed threat analysis of the online banking system . This security threat analysis has important significance for the online banking system security analysis and for revealing the threats that the online banking facing.
关键词：Threat modeling; Data flow diagrams; online banking; STRIDE threat model; ; data stream; threat tree
