Validating Threat Modeling Results with the Help of Vulnerable Test Applications
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2026
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866916039622656000 |
|---|---|
| author | Adamov, Oleksandr Fucci, Davide Jedrzejewski, Felix Viktor Britto, Ricardo Saini, Nishrith |
| author_facet | Adamov, Oleksandr Fucci, Davide Jedrzejewski, Felix Viktor Britto, Ricardo Saini, Nishrith |
| contents | Validating threat modeling results remains difficult because completeness is hard to judge without an external oracle. Existing studies often rely on expert-produced reference models and other human baselines, but these can contain omissions or disagreements. This paper evaluates a complementary, vulnerability-grounded validation approach. We apply threat modeling to intentionally vulnerable applications with a known vulnerability set to measure the number of related vulnerabilities that can be discovered. We compare ThreMoLIA, an LLM-assisted threat modeling solution developed by our team, with the Microsoft Threat Modeling Tool (MTMT) across two vulnerable applications: AzureGoat and the Vulnerable Bank Application (VulnBank). The inputs to both tools are limited to architecture, data flow diagrams, and their descriptions. The results show that ThreMoLIA achieved higher vulnerability coverage on both systems. We show that vulnerable test applications provide a practical benchmark for assessing threat coverage and complement expert-based validation. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2605_23695 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | Validating Threat Modeling Results with the Help of Vulnerable Test Applications Adamov, Oleksandr Fucci, Davide Jedrzejewski, Felix Viktor Britto, Ricardo Saini, Nishrith Cryptography and Security Validating threat modeling results remains difficult because completeness is hard to judge without an external oracle. Existing studies often rely on expert-produced reference models and other human baselines, but these can contain omissions or disagreements. This paper evaluates a complementary, vulnerability-grounded validation approach. We apply threat modeling to intentionally vulnerable applications with a known vulnerability set to measure the number of related vulnerabilities that can be discovered. We compare ThreMoLIA, an LLM-assisted threat modeling solution developed by our team, with the Microsoft Threat Modeling Tool (MTMT) across two vulnerable applications: AzureGoat and the Vulnerable Bank Application (VulnBank). The inputs to both tools are limited to architecture, data flow diagrams, and their descriptions. The results show that ThreMoLIA achieved higher vulnerability coverage on both systems. We show that vulnerable test applications provide a practical benchmark for assessing threat coverage and complement expert-based validation. |
| title | Validating Threat Modeling Results with the Help of Vulnerable Test Applications |
| topic | Cryptography and Security |
| url | https://arxiv.org/abs/2605.23695 |