xDECAF: An Extensible Data Flow Diagram Analysis Framework for Information Security

2026-04-27 · Source: cs.SE updates on arXiv.org · Field: Technology & Digital — Software Development & Engineering, Cybersecurity & Data Privacy · Depth: Advanced, long

Summary

xDECAF is an extensible framework designed for architecture-based data flow analysis, specifically targeting information security. It integrates an extended Data Flow Diagram (DFD) metamodel featuring labeled flows and nodes, a domain-specific constraint language with various flow operations, and a browser-based editor powered by an analysis engine. The framework includes a tool library and a curated catalog of 26 example models, ranging from 7 to 923 nodes and 4 to 72 individual labels, complete with documented constraints and expected violations. This catalog serves as a reusable dataset for the community. xDECAF has been adopted across multiple research lines, demonstrating its utility in addressing security properties, integrating architectural modeling languages, supporting analysis composition, uncertainty modeling, automated mitigation of violations, and legal compliance scenarios. The tool, dataset, and a hosted online editor are all publicly available.

Key takeaway

For AI Security Engineers or Software Architects evaluating system designs for information security, xDECAF offers a robust, extensible framework. You can use its extended DFDs and constraint language to systematically assess security and compliance requirements at design time. This enables early identification of data flow violations and supports informed trade-off decisions, especially for complex systems or Zero Trust Architectures. Consider integrating xDECAF to enhance your threat modeling workflows and automate mitigation strategies.

Key insights

xDECAF provides an extensible DFD analysis framework for information security, enabling custom label propagation and constraint evaluation.

Principles

• DFDs can be extended with labels, pins, and assignments.
• User-defined semantics allow broad analysis beyond security.
• Decoupling label types from analysis logic enhances flexibility.

Method

xDECAF's core involves modeling DFDs with labels, pins, and assignments, propagating labels through flows, and then evaluating user-defined constraints using a domain-specific language to identify violations.

In practice

• Analyze Zero Trust Architecture compliance.
• Identify encryption-related vulnerabilities.
• Automate mitigation of DFD confidentiality violations.

Topics

• Data Flow Diagram Analysis
• Information Security
• Software Architecture Modeling
• Constraint Language
• Threat Modeling
• Automated Security Analysis

Code references

• abunai-dev/ABUNAI
• arcovia-dev/Mitigation

Best for: AI Architect, AI Scientist, Research Scientist, AI Security Engineer, Software Engineer

Related on AIssential

• Explainable AI-Driven Cyber Risk Analytics and Model Reliability Assessment for Intelligent Governance of U.S. Critical Infrastructure: An XGBoost and SHAP-Based Intrusion Detection Framework — An XAI-driven framework enhances cyber risk analytics and intrusion detection for critical infrastructure by improving model transparency and reliability.
• AttackPathGNN: Cross-function vulnerability detection in smart contracts using state interference graphs and conjunction pooling — Cross-function smart contract vulnerabilities require reasoning over inter-function relationships, not just single-function patterns.
• Toward a Generalized Defense Across Sparse, Continuous, and Structured Parameter Attacks — ParDef provides a generalized, retraining-free defense against diverse DNN parameter attacks with minimal overhead.
• A Security Analysis of Long-Horizon Agentic AI Systems: Threats, Evaluation, and Framework Development — The paper analyzes security threats and proposes a taxonomy and attack propagation framework for long-horizon agentic AI systems.
• Execution-bound advisory automation for agentic AI: a reproducible AIBOM-driven CSAF-VEX framework — A framework automates agentic AI vulnerability advisories by combining static and runtime evidence with deterministic replay.
• Announcing The Forrester Wave™ On Extended Detection And Response Platforms: Platformization, AI, And … AI — The XDR market is maturing, consolidating vendors, expanding detection surfaces, and integrating advanced AI and SIEM replacement capabilities.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.SE updates on arXiv.org.