A UML Extension for the Model-Driven Specification of Audit Rules

Abstract

Abstract. In recent years, a number of laws and regulations (such as the Basel II accord or SOX) demand that organizations record certain activities or decisions to fulfill legally enforced reporting duties. Most of these regulations have a direct impact on the information systems that support an organization's business processes. Therefore, the definition of audit requirements at the modeling-level is an important prerequisite for the thorough implementation and enforcement of corresponding policies in a software system. In this paper, we present a UML extension for the specification of audit properties. The extension is generic and can be applied to a wide variety of UML elements. In a model-driven development (MDD) approach, our extension can be used to generate corresponding audit rules via model transformations.

Extensibility Interaction Flow Modeling Language Metamodels to Develop New Web Application Concerns

“…The definitions are provided for a variety of purposes. The UML extension provided in [13] enables modeling system audits by supporting an event-based modeling approach. This extension makes it possible to integrate different audit properties for a wide range of UML models.…”

Towards a Systematic Integration of MOF/UML-based Domain-Specific Modeling Languages

“…In this section, we apply the process model presented in the former Section 3 for integrating two securityrelated DSMLs (see [11,29]). The first DSML [29] models system audits (referred to as DSML A, hereafter).…”

“…The first DSML [29] models system audits (referred to as DSML A, hereafter). Therein, a domain-specific UML extension is defined for the specification of audit events, audit rules, and notifications that are triggered via audit events.…”

“…The composition is done via a dedicated integration profile named SOF::Services+SecurityAudit which merges the corresponding profiles from both DSMLs (packaging, see Figure 2). In addition to the integration of the DSML language models, the profile merge also implies the application of corresponding language model constraint specifications (as defined in [11,29]). Moreover, the integration profile provides the following OCL constraint as a composition refinement (constraint adaptation): Every «secure» stereotyped ObjectNode must also be tagged as an «AuditEventSource».…”

“…For each individual DSML, OCL constraints formally specify their semantics (see [11,29]). The integration profile SOF::Services+SecurityAudit merges these constraints as well as the language models (see Section 4.1).…”