Open Source UML Tools

SeaMonster is a security modeling tool for threat models. It supports notations that security experts and analyzers are already familiar with, namely attack trees and misuse cases, and can connect to a repository for model sharing and reuse.

XACML-Studio is an authorization policy editor implemented as a web application that allows importing, creating, editing, exporting policies defined in XACML 2.0 specification. Intuitive UI and DB-based repository improves policy creator's experience.

ASOPEC is a framework for dealing with security in a diverse range of environments. It abstracts security from your application with a AOP approach. It is written in Java and works in Spring and EJB3 containers.

A 100% pure Java Swing ASN.1 analysis utility for inspecting arbitrary BER-encoded data files. It allows inspection of data with unknown structure, can drill down to any nesting level and allows to interpret embedded OCTET STRING data recursively.

The goal of Keen Manager is to design a simple and highly expandable control panel system for use by end-users and developers. It is also meant for having a multi-user authentication system in which each control panel can have it's own privilege system.

The Network Security Response Framework (NSRF) allows for testing different computer security response engines and methodologies. It supports simulated and real: Intrusion Detection Systems (sensors), Attacks, and Responses.

SEPIA provides implementations for various types of Petri nets. Along Place/Transition-nets, it supports Petri nets with distinguishable token colors and defines coloured workflow nets, where coloured tokens are interpreted as data elements used during process execution. To support information flow analysis of processes, SEPIA defines so-called IF-Nets, tailored for security-oriented workflow modeling which enable users to assign security-levels (HIGH, LOW) to transitions, data elements and persons/agents participating in the process execution. SEPIA builds upon TOVAL (http://sourceforge.net/p/toval), JAGAL (http://sourceforge.net/p/jagal) and SEWOL (https://sourceforge.net/projects/jawl/). To use SEPIA, make sure these libraries are on the build path. SEPIA encloses the Multi Schema Validator (https://msv.java.net/) and isorelax (http://iso-relax.sourceforge.net/) The documentation can be found under http://doku.telematik.uni-freiburg.de/sepia.

Safet is a library writing for C/C++ that use an xml file to model any workflow describe in a relational database, It includes drawing, statistics, document, resource and control workflow perspective.

Trike is a platform-independent tool for systematic, computer-assisted threat modeling, from requirements through deployment. We are developing Trike v2 on GitHub (https://github.com/octotrike/trike). Our mailing lists are still here on SourceForge, and we're leaving the old code repository & releases up for archival purposes. Plus you probably want to use something while you're waiting for v2.