一句话：FlowStrider 通过可脚本化、CI/CD 集成的持续威胁建模工具降低人工成本与采用门槛。
架构级威胁建模对识别和缓解软件安全威胁十分重要，但人工投入大。现有自动化工具虽试图减轻负担，却常缺少脚本化和集成能力，难以嵌入开发流程。本文提出 FlowStrider，一种面向实践的低摩擦持续威胁建模工具：它提供新的工作流，并通过脚本化支持 CI/CD 集成，从而减少人工操作、提升分析结果质量，并便利地融入软件开发流程。作者通过工具实现降低持续威胁建模的采用门槛，并提供演示视频与开源仓库。摘要未给出对照实验或量化评估，主要贡献是工具与工作流设计。
Architectural threat modeling is a crucial technique for identifying and mitigating security threats in software systems, helping to prevent costly design flaws. While existing tools aim to reduce its resource-intensive nature through automation, they often lack key features—such as scriptability and integration capabilities—needed for practical use in development workflows.In this paper, we present FlowStrider, a tool that addresses these shortcomings by implementing a new, practice-oriented workflow and enabling CI/CD integration through scriptability. FlowStrider reduces the required manual effort, enhances the quality of analysis results, and eases integration into software development workflows, thereby lowering the adoption barrier for continuous threat modeling.Screencast: https://youtu.be/iRpeU1nubHwRepository: https://gitlab.com/dlr-dw/automated-threat-modeling/flowstrider
DOI 原文 ·
@inproceedings{paperbot9469,
title = {FlowStrider: Low-Friction Continuous Threat Modeling},
author = {Bernd Gruner and Noah Erthel and Clemens-Alexander Brust},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00360}
}