Abstract

Effective security measures are crucial for modern Microservice Architecture (MSA)-based applications as many IT companies rely on microservices to deliver their business functionalities. Security smells may indicate possible security issues. However, detecting security smells and devising strategies to resolve them through refactoring is difficult and expensive, primarily due to the inherent complexity of microservice architectures. This paper proposes a Model-driven approach to resolving security smells in MSA. The proposed method uses LEMMA as a concrete approach to model microservice applications. We extend LEMMA’s functionalities to enable the modeling of microservices’ security aspects. With the proposed method, LEMMA models can be processed to automatically detect security smells and recommend the refactorings that resolve the identified security smells. To test the effectiveness of the proposed method, the paper introduces a proof-of-concept implementation of the proposed LEMMA-based, automated microservices’ security smell detection and refactoring. © The Author(s), under exclusive license to Springer Nature Switzerland AG 2024.