Automatic Rule Checking for Microservices: Supporting Security Analysis with Explainability

Software security analysis is often done manually, raising performance and correctness issues. Introducing automation is challenging because human verification of the outcomes is often required, especially for security assessment and certification. The distributed nature of microservice applications further increases these concerns. We present an approach for automatically checking architectural security rules on models of microservice applications. It provides explainability for verdicts of rules that are expressed as model queries in our rule specification language. This comprehensible, step-by-step evidence leverages traceability information from the input models to link to artifacts in code. Hence, the complete analysis process from source code via model to rule verdict can be traced and verified. Custom rules can be formulated in addition to a library of 25 best-practice architectural security rules. We evaluated the approach’s correctness by checking the 25 rules on 16 dataflow diagrams of microservice applications with a prototype (called MicroCertiSec ) and observed promising results (precision=0.98; recall=1). Additionally, we performed an evaluation with industry experts and academics to gain initial insights into the approach’s usefulness for real-world security analysis. The nine participants gave highly positive feedback on usefulness and usability and stated they would use such an approach in their daily work.