CONICET | Buscador de Institutos y Recursos Humanos

We propose a model-driven approach based on formal data- driven choreographies to model the threat intelligence exchange (TIE) services that McAfee provides through the OpenDXL industrial platform. We advocate a methodology consisting of a chain of model transforma- tions that (i) devises a visual presentation of communication protocols, (ii) derives a global specification from the visual presentation that rig- orously describes the interactions required by the services, (iii) enables the automatic derivation of specifications for the single components, and (iv) enables the analysis of software implementations.Global specifications (steps (i) and (ii) of the chain) are described through global graphs and data-driven choreographies. The former were key to identify the main aspects of the protocol as well as to ease the collabo- ration between practitioners and academics. However, global graphs can hardly capture the execution model of OpenDXL; therefore we formalise TIE with klaimographies, a data-driven model of choreographies. Klaimo- graphies allow us to automatically derive local specifications (step (iii)) and use them as precise blue-prints of components as well as to auto- matically derive monitors (step (iv))