xDECAF: An Extensible Data Flow Diagram Analysis Framework for Information Security

Source: arXiv:2607.05913 · Published 2026-07-07 · By Benjamin Arp, Felix Schwickerath, Alexander Vogt, Tom Hüller, Nils Niehues, Nicolas Boltz

TL;DR

xDECAF presents a novel, extensible framework and tooling environment for architecture-based data flow analysis focused on information security. It advances traditional Data Flow Diagrams (DFDs) by introducing an extended metamodel with labeled nodes and flows, a domain-specific constraint language (DSL) expressive enough to capture sophisticated security policies, and a browser-based editor powered by a scalable analysis engine. The framework enables flexible, customizable reasoning about data propagation, security annotations, and policy violations directly on architectural models. Crucially, xDECAF is designed for extensibility and reuse, supporting integration with other modeling languages and workflows while maintaining high analysis fidelity for complex systems. The authors contribute a curated dataset of over 20 diverse example DFD models with formalized constraints and known violations to foster reproducibility and benchmarking in the research community. Early adoption by multiple separate research lines illustrates xDECAF's practical utility and impact in areas such as confidentiality analysis, uncertainty-aware modeling, automated repair of security violations, and legal compliance verification.

Key findings

• xDECAF supports over 20 example DFD models ranging from 7 to 923 nodes and 4 to 72 labels for comprehensive security scenario coverage.
• Analysis runtime scales efficiently, taking less than 1 second for models with >20 nodes and under 1 minute for the largest catalog models.
• Integration with existing datasets like microSecEnD validated xDECAF's correctness, uncovering that 17 of 132 variants failed mainly due to modeling errors external to xDECAF.
• The tool's DSL supports four flow quantifiers (flows, alwaysFlows, neverFlows, notAlwaysFlows) enabling precise articulation of security constraints such as role-based access control.
• xDECAF's architecture enables coupling with Palladio Component Model (PCM) instances for confidentiality and Zero Trust Architecture evaluations.
• Prior work built on xDECAF identified and mitigated real-world vulnerabilities (e.g., encryption flaw in EV charging station) and applied machine learning to rank and repair confidentiality violations.
• The web-based editor features drag-and-drop creation, syntax-highlighted DSL editing with autocompletion, and seamless backend analysis via WebSockets.
• The extensible label propagation and assignment mechanisms handle complex data flows including cycles by applying heuristics.

Threat model

The threat model considers an analyst or security engineer analyzing system designs to detect security violations such as unauthorized data flows or access control breaches. The adversary is assumed to exploit architectural design flaws allowing unintended data propagation. The threat actor cannot directly alter the xDECAF analysis engine or the underlying architectural models but might exploit weaknesses if the architectural constraints and labels do not correctly capture security policies or if incomplete models omit critical flows.

Methodology — deep read

The threat model focuses on software architects, security analysts, and system designers seeking to identify and analyze information flow violations and security constraints within architectural data flow diagrams. Adversaries are implicitly those who exploit improper data flows or unauthorized access enabled by architectural design flaws. xDECAF assumes knowledge of system structure represented as DFD nodes and labeled flows but supports user-defined label semantics and constraints to model a broad range of security policies.

The authors provide a repository of over 20 example DFD models with documented constraints and expected violations, sourced from academic literature, industry collaborations, and recent exploits, ranging in size and complexity. The dataset additionally integrates models from the microSecEnD dataset, derived from open-source microservice codebases. Models include labels that annotate node properties and data sensitivity, enabling meaningful analysis.

The core xDECAF framework includes an extended DFD metamodel that adds Labels, Pins (input/output interfaces), and Assignments to traditional nodes and flows. Labels annotate nodes or data with discrete, user-definable properties. Assignments on output pins specify conditional logic for label propagation, allowing transformation or restriction of propagated metadata. This label propagation process explores all data paths and applies heuristics to resolve cycles.

A domain-specific constraint language (DSL) allows users to express security constraints declaratively as quantified flow relationships between labeled sources and destinations, with where-clauses permitting complex conditions and set operations on label variables. The DSL supports flow existence quantifiers such as 'flows' (∃), 'alwaysFlows' (∀), 'neverFlows' (¬∃), and their negations. For example, role-based access control policies can be formalized to ensure data flows only to authorized nodes.

The browser-based online editor implements a frontend using Eclipse Sprotty to render SVG DFDs with drag-and-drop editing of nodes, pins, labels, and assignments, with syntax highlighting and autocomplete for the DSL. The backend runs analyses on a cloud platform, communicating over WebSocket to accept JSON-encoded models and constraints and return enriched data including propagated labels and violation reports.

Evaluation includes runtime performance measurements on the curated dataset (sub-second to under a minute), external validation by ingesting PlantUML DFDs and cross-checking results against microSecEnD manual corrections (revealing initial modeling errors outside xDECAF), and application in real research to detect vulnerabilities and assess Zero Trust Architecture compliance. Multiple extensions have reused xDECAF as an oracle or foundation to build uncertainty-aware analyses, repair tools, and legal compliance workflows. The tool library, datasets, and hosted editor are open-source and publicly available, enabling reproducibility and wider adoption.

One concrete example end-to-end: A role-based access control constraint is specified in the DSL prohibiting data with grantedRoles label from flowing to nodes whose assignedRoles label sets intersect empty. The propagation engine uses assignments on output pins to conditionally propagate these labels along flows, computing all data paths. The analysis identifies violations where labeled data flows reach unauthorized nodes, reported in the UI and visualized on the DFD, facilitating early detection and correction.

Technical innovations

• Extended DFD metamodel supporting labeled nodes, flows, pins, and assignments for fine-grained, programmable label propagation and data flow annotation.
• A powerful, domain-specific constraint language enabling precise, quantified security policies expressed declaratively with flexible predicates and set operations over propagated labels.
• Web-based interactive modeling and analysis environment with real-time label propagation and constraint evaluation integrated into a scalable backend service architecture.
• General architecture enabling extensibility by decoupling label semantics from core analysis logic to support diverse security and compliance use cases beyond single concerns.

Datasets

• xDECAF curated example model catalog — 26 models sized 7 to 923 nodes, 4 to 72 labels — public on GitHub and Zenodo
• microSecEnD Dataset — 132 security-enriched DFD variants from open-source microservice applications — public

Baselines vs proposed

• MicroSecEnD variants: 115/132 exhibited expected results using xDECAF vs 17 with divergences traced to modeling errors outside xDECAF
• Runtime: small models ~1s analysis time vs large models up to <1 minute using xDECAF analysis engine

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.05913.

Fig 1: Extended DFD Example in xDECAF online editor.

Limitations

• No explicit adversarial robustness evaluations against adaptive attackers manipulating models or labels.
• Current dataset and validation focus primarily on confidentiality violations, less on other security properties like integrity or availability.
• Complex cyclic data flows rely on heuristics without formal guarantees for all pathological cases.
• Unclear how large-scale industrial systems with millions of nodes would scale beyond tested largest models (~900 nodes).
• Constraint language expressive power may require expertise; usability improvements could be needed for broader adoption.
• Integration beyond Palladio and PlantUML limited so far; extensibility to other architecture languages requires effort.

Open questions / follow-ons

• How to formally guarantee soundness and completeness of label propagation in presence of complex cycles and heuristics?
• Can the DSL be extended or augmented with probabilistic or quantitative properties to better model uncertainty?
• What are best practices for deriving initial labels and constraints automatically from natural language requirements or code?
• How well does xDECAF scale and integrate into continuous deployment pipelines for real-time threat modeling in large, evolving architectures?

Why it matters for bot defense

For bot-defense and CAPTCHA practitioners, xDECAF provides a structured approach to model data flows and security constraints at the architecture level. While not directly a bot-detection or CAPTCHA tool, its framework could inform threat modeling of automated attacker pathways exploiting system components or APIs. The extensible label propagation and constraint language might be adapted to formalize and detect information leakage or bypass flows relevant to automated attacks. Furthermore, the web-based, user-friendly editor and open datasets may serve as foundation assets to develop or integrate architectural analysis into a layered bot-defense strategy. Practitioners can leverage xDECAF’s composability to combine data flow reasoning with other behavioral or network-level analyses specific to automated adversaries.

Cite

@article{arxiv2607_05913,
  title={ xDECAF: An Extensible Data Flow Diagram Analysis Framework for Information Security },
  author={ Benjamin Arp and Felix Schwickerath and Alexander Vogt and Tom Hüller and Nils Niehues and Nicolas Boltz },
  journal={arXiv preprint arXiv:2607.05913},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.05913}
}

Read the full paper

• arXiv:2607.05913 (abstract)
• arXiv:2607.05913 (PDF)