#  A model for COVID-19 and bacterial pneumonia coinfection with community-
and hospital-acquired infections

Angel G. C. Pérez${}^{\text{1}}$ David A. Oluyori${}^{\text{2}}$

###### Abstract

We propose a new mathematical model to study the coinfection dynamics of
COVID-19 and bacterial pneumonia. Our model includes two infection ways for
pneumonia, corresponding to community-acquired and hospital-acquired
infections. We show that the existence and local stability of equilibria
depend on three different parameters, which are interpreted as the basic
reproduction numbers of COVID-19, bacterial pneumonia, and bacterial
population. Numerical simulations are performed to complement our theoretical
analysis, and we show that both diseases can persist if the basic reproduction
number of COVID-19 is greater than one.

${}^{\text{1}}$ Facultad de Matemáticas, Universidad Autónoma de Yucatán,
Mérida, Yucatán, Mexico. Email address<EMAIL_ADDRESS>

${}^{\text{2}}$ Department of Mathematics, School of Physical Science, Ahmadu
Bello University, Zaria, Kaduna State, Nigeria. Email address:
<EMAIL_ADDRESS>

##  1 Introduction

The Coronavirus Disease 2019 (COVID-19) has been a major public health concern
across the nations of the world since its declaration as a global pandemic due
to its rapid infectivity and high death toll. Trend analysis reveals that one
major cause of death due to Coronavirus has been secondary causes due to
bacterial and viral infections, which lead to the eventual death. In the
current realities from COVID-19, many studies have shown that Respiratory
Tract Infections (RTIs) predispose patients to coinfections, which result in
increased disease severity and death. RTIs are infections of the parts of the
body involved in breathing, such as sinuses, throat, airways or lungs, caused
by a variety of bacteria and virues such as Influenza (flu). Typical
infections of the upper respiratory tract include tonsillitis, pharyngitis,
sinusitis and certain types of influenza (such as H1N1). Symptoms of RTIs
include cough, soar throat, running nose, nasal congestion, headache, low-
grade fever, facial pressure and sneezing.

As reported in [19], most of the fatalities in the 1918 Influenza pandemic
were due to subsequent bacterial infection, particularly with Streptococcus
pneumoniae. Data evidence from few studies has it that poor outcomes in the
Influenza (H1N1) pandemic were associated with coinfections [17]. So far,
coinfections are increasingly recognised in respiratory tract infections such
as MERS, SARS-CoV2, Influenza (H1N1) with the discovery of highly sensitive
techniques for microorganism detection and identification (MALDI-TOF,
Multiplex PCR). The study of coinfections in a pandemic situation such as
COVID-19 has become imperative due to the clinical, diagnostic and therapeutic
challenges it poses [14]. To further buttress the aforestated, Lansbury et al.
[15] highlighted some important aspects of bacterial and viral infections in
COVID-19 and antimicrobial prescription.

Despite proven epidemiological significance of coinfections in the severity of
respiratory diseases, they are largely understudied during a large outbreak of
respiratory infections like SARS-CoV-2 [5]. Zhou et al. [32] showed that 50%
of the mortalities due to COVID-19 result from secondary bacterial infections.
Chen et al. [4] in this vein reported both bacterial and fungal infection.
Clinical evidences shows that diagnosing coinfections is a complex process,
because the organism itself might have been resident in the host before the
viral infection as part of an underlying chronic infection or might have been
contacted nosocomially [5]. Hence, early diagnosis of coinfections is
required, preferably using a broad potential pathogens and antimicrobial
resistances with subsequent monitoring for infection development. Therefore,
to accurately diagnose and study coinfections in COVID-19, it is highly
recommended that patients must be recruited on admission to intensive care
units (ICU) and sampled longitudinally throughout the disease course using
culture-independent techniques capable of identifying complex mixed infections
without previous target selections such as whole-genome metagenomics to help
identify the pathogens and make informed antibiotics prescription. As rapid
extension of coinfection is necessary in the management and treatment of most
severe COVID-19 cases, which could help save lives and improve antimicrobial
stewardship. It has been reported that some patients presenting to the
hospital with SARS-CoV-2 infection have a clinical phenotype that is not
dissimilar from atypical bacterial pneumonia [23].

Recent studies have established clinical evidences of coinfections of SARS-
CoV-2 (COVID-19) with other diseases such as tuberculosis [14, 18, 27, 31, 13,
22, 27], influenza A (H1N1) [16, 12, 9, 30, 2] and Middle East Respiratory
Syndrome Coronavirus (MERS-CoV) [8], as well as bacterial coinfections [10].
Due to this, some authors have developed mathematical models to study the
dynamics of COVID-19 and its coinfection with influenza [26], malaria [28],
tuberculosis [3, 24], dengue [20] and diabetes [21]. However, no model has
been proposed to study the coinfection dynamics of COVID-19 with bacterial
pneumonia.

Bacterial pneumonia is an inflammation of the lungs caused by infection with
certain bacteria. Depending on the location where a person acquires the
infection, it can be classified as either community-acquired pneumonia or
hospital-acquired pneumonia. Community-acquired pneumonia is by far the most
common type [6]. On the other hand, hospital-acquired pneumonia is usually
more severe because the infecting organisms tend to be more aggressive; they
are also less likely to respond to antibiotics and are, therefore, harder to
treat [25]. Clinical studies have shown that critically ill COVID-19 patients
admitted to the hospital suffer more frequent bacterial or fungal nosocomial
infections, and patients with underlying risk factors such as advanced age,
mechanical ventilation or prolonged hospital stay are more prone to these
complications [1, 11, 29]. Bacterial or fungal coinfections are unlikely to be
common in patients with mild COVID-19 when compared with those with more
severe disease upon admission to the hospital [1].

The present study is motivated by the need to mathematically study the
dynamics of coinfection of COVID-19 with bacterial pneumonia, including the
cases when bacterial infection is acquired in the community or in the
hospital. This paper is structured as follows: in Section 2, we introduce
three models: a sub-model for COVID-19 infection, a sub-model for bacterial
pneumonia, and coinfection model that includes the dynamics of both diseases.
In Section 3, we determine some basic properties for the two sub-models. In
Section 4, we provide an analysis for the coinfection model. In Section 5, we
perform some numerical simulations to illustrate the dynamics of the
coinfection model. Finally, in Section 6, we provide some concluding remarks.

##  2 Description of the models

###  2.1 COVID-19 infection model

The COVID-19 infection model subdivides the human population into four
compartments: susceptible ($S$), infected but not hospitalised ($I$),
hospitalised ($H$), and recovered ($R$). This model can be described by the
following system of equations:

$\displaystyle S^{\prime}$ $\displaystyle=\Lambda+\sigma R-\mu S-\alpha SI,$
(1) $\displaystyle I^{\prime}$ $\displaystyle=\alpha SI-(\gamma+\eta+\mu)I,$
$\displaystyle H^{\prime}$ $\displaystyle=\eta I-(\theta+\delta+\mu)H,$
$\displaystyle R^{\prime}$ $\displaystyle=\gamma I+\theta H-\mu R-\sigma R.$

The interpretation of parameters is as follows:

  * •

$\Lambda$: recruitment rate of susceptible population.

  * •

$\mu$: natural death rate.

  * •

$\alpha$: transmission rate of COVID-19.

  * •

$\gamma$: recovery rate of people infected with COVID-19 but not hospitalised.

  * •

$\theta$: recovery rate of hospitalised people.

  * •

$\eta$: hospitalisation rate.

  * •

$\delta$: COVID-19-induced death rate of hospitalised people.

  * •

$\sigma$: rate of loss of immunity against COVID-19 infection.

###  2.2 Bacterial pneumonia infection model

The model for bacterial pneumonia subdivides the human population into three
compartments: susceptible ($S$), infected ($I$), and recovered ($R$). We also
consider a compartment $B$ representing the population of bacteria in the
environment. The model is given by the following system:

$\displaystyle S^{\prime}$ $\displaystyle=\Lambda-\mu S-bSI-b_{1}SB,$ (2)
$\displaystyle I^{\prime}$ $\displaystyle=bSI+b_{1}SB-\phi I-\mu I-\delta I,$
$\displaystyle R^{\prime}$ $\displaystyle=\phi I-\mu R,$ $\displaystyle
B^{\prime}$ $\displaystyle=pI+rB\left(1-\frac{B}{\kappa}\right)-mB.$

The parameters of this model can be interpreted as follows:

  * •

$\Lambda$: recruitment rate of susceptible population.

  * •

$\mu$: natural death rate.

  * •

$b$: transmission rate of community-acquired bacterial pneumonia.

  * •

$b_{1}$: transmission rate of hospital-acquired bacterial pneumonia.

  * •

$\delta$: disease-induced death rate of infected population.

  * •

$\phi$: recovery rate of people with bacterial infection.

  * •

$p$: rate of excretion of bacteria in the environment by infected people.

  * •

$r$: maximal per capita growth rate of bacteria in the environment.

  * •

$\kappa$: carrying capacity of bacterial population.

  * •

$m$: clearance rate of bacterial population.

###  2.3 Coinfection model

Based on models (1) and (2), we propose a combined COVID-19–bacterial
pneumonia coinfection model. We will consider three stages for COVID-19
infection and four for bacterial infection, which gives twelve mutually
exclusive compartments: bacterial pneumonia susceptible and COVID-19
susceptible ($X_{SS}$); bacterial pneumonia susceptible and COVID-19 mildly
infected ($X_{SI}$); bacterial pneumonia susceptible and COVID-19 hospitalised
($X_{SH}$); bacterial pneumonia susceptible and COVID-19 recovered ($X_{SR}$);
bacterial pneumonia infected and COVID-19 susceptible ($X_{IS}$); bacterial
pneumonia infected and COVID-19 mildly infected ($X_{II}$); bacterial
pneumonia infected and COVID-19 hospitalised ($X_{IH}$); bacterial pneumonia
infected and COVID-19 recovered ($X_{IR}$); bacterial pneumonia recovered and
COVID-19 susceptible ($X_{RS}$); bacterial pneumonia recovered and COVID-19
mildly infected ($X_{RI}$); bacterial pneumonia recovered and COVID-19
hospitalised ($X_{RH}$); and bacterial pneumonia recovered and COVID-19
recovered ($X_{RR}$). Additionally, we consider a compartment $B$ representing
concentration of bacteria in the hospital environment. We make the following
assumptions:

  1. 1.

COVID-19 is transmitted by contact with people in the $X_{SI}$, $X_{II}$ and
$X_{RI}$ compartments.

  2. 2.

The population susceptible to COVID-19 are infected by this disease at a rate
$\alpha_{1}$ if they have bacterial pneumonia, and at a rate $\alpha$
otherwise.

  3. 3.

The hospitalisation rate for people coinfected with COVID-19 and community-
acquired pneumonia increases by an amount $\eta_{1}$ with respect to people
with only COVID-19.

  4. 4.

The COVID-19 recovery rate for hospitalised people is $\theta_{1}$ if they are
coinfected, and $\theta$ otherwise.

  5. 5.

Non-hospitalised people get community-acquired pneumonia by contact with
people in the $X_{IS}$, $X_{II}$ and $X_{IR}$ compartments.

  6. 6.

Non-hospitalised people are infected with pneumonia at a rate $b_{1}$ if they
have COVID-19, and at a rate $b$ otherwise.

  7. 7.

People hospitalised due to COVID-19 get hospital-acquired pneumonia at a rate
proportional to the concentration of bacteria in the environment.

  8. 8.

The disease-induced death rate for coinfected hospitalised patients is
increased by an amount $\delta_{2}$ with respect to those with only COVID-19.

  9. 9.

The pneumonia-induced death rate for non-hospitalised people is $\delta_{0}$
if they have COVID-19, and $\delta$ otherwise.

  10. 10.

The pneumonia recovery rate is $\phi_{1}$ for people in the $X_{II}$
compartment, $\phi_{2}$ for the $X_{IH}$ compartment, and $\phi$ for the
$X_{IS}$ and $X_{IR}$ compartments.

Figure 1: Schematic diagram of the coinfection model. Solid lines represent
transition between compartments. Dashed lines represent proliferation of
bacteria. $X_{*I}$ denotes $X_{SI}+X_{II}+X_{RI}$ and $X_{I*}$ denotes
$X_{IS}+X_{II}+X_{IR}$.

The above assumptions yield a coinfection model given by the following system
of 13 differential equations:

$\displaystyle X_{SS}^{\prime}$ $\displaystyle=\Lambda+\sigma X_{SR}-\mu
X_{SS}-\alpha
X_{SS}\left(X_{SI}+X_{II}+X_{RI}\right)-bX_{SS}\left(X_{IS}+X_{II}+X_{IR}\right),$
(3) $\displaystyle X_{SI}^{\prime}$ $\displaystyle=\alpha
X_{SS}\left(X_{SI}+X_{II}+X_{RI}\right)-(\gamma+\eta+\mu)X_{SI}-b_{1}X_{SI}\left(X_{IS}+X_{II}+X_{IR}\right),$
$\displaystyle X_{SH}^{\prime}$ $\displaystyle=\eta X_{SI}-\theta
X_{SH}-(\mu+\delta_{1})X_{SH}-b_{2}X_{SH}B,$ $\displaystyle X_{SR}^{\prime}$
$\displaystyle=\gamma X_{SI}+\theta X_{SH}-\mu X_{SR}-\sigma
X_{SR}-bX_{SR}\left(X_{IS}+X_{II}+X_{IR}\right),$ $\displaystyle
X_{IS}^{\prime}$ $\displaystyle=\sigma
X_{IR}+bX_{SS}\left(X_{IS}+X_{II}+X_{IR}\right)-\alpha_{1}X_{IS}\left(X_{SI}+X_{II}+X_{RI}\right)-(\mu+\delta)X_{IS}-\phi
X_{IS},$ $\displaystyle X_{II}^{\prime}$
$\displaystyle=b_{1}X_{SI}\left(X_{IS}+X_{II}+X_{IR}\right)+\alpha_{1}X_{IS}\left(X_{SI}+X_{II}+X_{RI}\right)-\left(\gamma_{1}+\eta+\eta_{1}+\mu+\delta_{0}+\phi_{1}\right)X_{II},$
$\displaystyle X_{IH}^{\prime}$
$\displaystyle=\left(\eta+\eta_{1}\right)X_{II}+b_{2}X_{SH}B-\theta_{1}X_{IH}-(\mu+\delta_{1}+\delta_{2})X_{IH}-\phi_{2}X_{IH},$
$\displaystyle X_{IR}^{\prime}$
$\displaystyle=bX_{SR}\left(X_{IS}+X_{II}+X_{IR}\right)+\gamma_{1}X_{II}+\theta_{1}X_{IH}-(\mu+\delta)X_{IR}-\phi
X_{IR}-\sigma X_{IR},$ $\displaystyle X_{RS}^{\prime}$ $\displaystyle=\sigma
X_{RR}+\phi X_{IS}-\mu X_{RS}-\alpha X_{RS}\left(X_{SI}+X_{II}+X_{RI}\right),$
$\displaystyle X_{RI}^{\prime}$ $\displaystyle=\phi_{1}X_{II}+\alpha
X_{RS}\left(X_{SI}+X_{II}+X_{RI}\right)-(\gamma+\eta+\mu)X_{RI},$
$\displaystyle X_{RH}^{\prime}$ $\displaystyle=\eta
X_{RI}+\phi_{2}X_{IH}-\theta X_{RH}-(\mu+\delta_{1})X_{RH},$ $\displaystyle
X_{RR}^{\prime}$ $\displaystyle=\phi X_{IR}+\gamma X_{RI}+\theta X_{RH}-\mu
X_{RR}-\sigma X_{RR},$ $\displaystyle B^{\prime}$
$\displaystyle=pX_{IH}+rB\left(1-\frac{B}{\kappa}\right)-mB.$

The schematic diagram of model (3) can be seen in Figure 1. All parameters are
assumed to be positive.

##  3 Analysis of sub-models

Before studying the dynamics of the coinfection model (3), we will analyse the
two sub-models (COVID-19 only and bacterial pneumonia only).

###  3.1 Analysis of the COVID-19 infection model

The COVID-19-only model (1) has a disease-free equilibrium (DFE) given by

$\mathcal{E}_{C0}=(S,I,H,R)=\left(\frac{\Lambda}{\mu},0,0,0\right).$

The stability of $\mathcal{E}_{C0}$ depends on the basic reproduction number
of model (1). Using the notation in [7], we define the matrices $F$ and $V$
given by

$F=\begin{bmatrix}\frac{\alpha\Lambda}{\mu}&0\\\ 0&0\end{bmatrix},\qquad
V=\begin{bmatrix}\gamma+\eta+\mu&0\\\ -\eta&\theta+\delta+\mu\end{bmatrix}.$

Then, the basic reproduction number $\mathcal{R}_{C}$ of the COVID-19-only
model is given by the spectral radius of $FV^{-1}$. From this, we obtain

$\mathcal{R}_{C}=\frac{\alpha\Lambda}{\mu(\gamma+\eta+\mu)}.$ (4)

By [7, Theorem 2], we obtain the following result.

######  Theorem 1.

The disease-free equilibrium $\mathcal{E}_{C0}$ of model (1) is locally
asymptotically stable if $\mathcal{R}_{C}<1$, but unstable if
$\mathcal{R}_{C}>1$.

###  3.2 Analysis of the bacterial pneumonia infection model

The bacterial pneumonia model (2) has a DFE given by

$\mathcal{E}_{P0}=(S,I,R,B)=\left(\frac{\Lambda}{\mu},0,0,0\right).$

To apply the next-generation matrix method, we will compute the matrix of new
infections $F$ and the transition matrix $V$, which are given by

$F=\begin{bmatrix}\frac{b\Lambda}{\mu}\end{bmatrix},\qquad
V=\begin{bmatrix}\phi+\mu+\delta\end{bmatrix}.$

Using the same method as before, we obtain the basic reproduction number
$\mathcal{R}_{P}$ of the bacterial pneumonia-only model, which is

$\mathcal{R}_{P}=\frac{b\Lambda}{\mu(\phi+\mu+\delta)}.$ (5)

Using [7, Theorem 2] again, we obtain the following result.

######  Theorem 2.

The disease-free equilibrium $\mathcal{E}_{P0}$ of model (2) is locally
asymptotically stable if $\mathcal{R}_{P}<1$, but unstable if
$\mathcal{R}_{P}>1$.

##  4 Analysis of the COVID-19–bacterial pneumonia coinfection model

Next, we consider the dynamics of the coinfection model (3). The existence and
stability of equilibria for model (3) will depend on three parameters, which
are defined as follows:

$\mathcal{R}_{C}:=\frac{\alpha\Lambda}{\mu(\gamma+\eta+\mu)},\qquad\mathcal{R}_{P}:=\frac{b\Lambda}{\mu(\phi+\mu+\delta)},\qquad\mathcal{R}_{B}:=\frac{r}{m}.$

As we saw in the previous section, the parameters $\mathcal{R}_{C}$ and
$\mathcal{R}_{P}$ represent the basic reproduction numbers of COVID-19 and
bacterial pneumonia, respectively. On the other hand, $\mathcal{R}_{B}$ can be
interpreted as the reproduction number of bacterial population in the
hospital.

###  4.1 Equilibria of the model

By direct computation, we obtain the following result about the equilibria of
model (3).

######  Theorem 3.

The coinfection model (3) has the following steady states:

  1. 1.

The disease-free, bacterial population-free equilibrium:

$\mathcal{E}_{0}=\left(X_{SS}^{(0)},0,0,0,0,0,0,0,0,0,0,0,0\right),$

where

$X_{SS}^{(0)}=\frac{\Lambda}{\mu}.$

  2. 2.

The disease-free, bacterial population-present equilibrium:

$\mathcal{E}_{1}=\left(X_{SS}^{(1)},0,0,0,0,0,0,0,0,0,0,0,B^{(1)}\right),$

where

$X_{SS}^{(1)}=\frac{\Lambda}{\mu},\qquad B^{(1)}=\frac{\kappa}{r}(r-m).$

This equilibrium exists if and only if $\mathcal{R}_{B}>1$.

  3. 3.

The COVID-19-free, pneumonia-present, bacterial population-free equilibrium:

$\mathcal{E}_{2}=\left(X_{SS}^{(2)},0,0,0,X_{IS}^{(2)},0,0,0,X_{RS}^{(2)},0,0,0,0\right),$

where

$X_{SS}^{(2)}=\frac{\mu+\delta+\phi}{b},\qquad
X_{IS}^{(2)}=\frac{\Lambda}{\mu+\delta+\phi}-\frac{\mu}{b},\qquad
X_{RS}^{(2)}=\frac{\phi}{\mu}X_{IS}^{(2)}.$

This equilibrium exists if and only if $\mathcal{R}_{P}>1$.

  4. 4.

The COVID-19-free, pneumonia-present, bacterial population-present
equilibrium:

$\mathcal{E}_{3}=\left(X_{SS}^{(3)},0,0,0,X_{IS}^{(3)},0,0,0,X_{RS}^{(3)},0,0,0,B^{(3)}\right),$

where

$\displaystyle X_{SS}^{(3)}=\frac{\mu+\delta+\phi}{b},\qquad
X_{IS}^{(3)}=\frac{\Lambda}{\mu+\delta+\phi}-\frac{\mu}{b},\qquad
X_{RS}^{(3)}=\frac{\phi}{\mu}X_{IS}^{(3)},$ $\displaystyle
B^{(3)}=\frac{\kappa}{r}(r-m).$

This equilibrium exists if and only if

$\mathcal{R}_{B}>1\quad\text{and}\quad\mathcal{R}_{P}>1.$

  5. 5.

The COVID-19-present, pneumonia-free, bacterial population-free equilibrium:

$\mathcal{E}_{4}=\left(X_{SS}^{(4)},X_{SI}^{(4)},X_{SH}^{(4)},X_{SR}^{(4)},0,0,0,0,0,0,0,0,0\right),$

where

$\displaystyle X_{SS}^{(4)}=\frac{\gamma+\eta+\mu}{\alpha},\quad
X_{SI}^{(4)}=\frac{(\mu+\sigma)(\theta+\mu+\delta_{1})\big{[}\alpha\Lambda-\mu(\gamma+\eta+\mu)\big{]}}{\alpha\big{[}\mu(\theta+\mu+\delta_{1})(\gamma+\eta+\mu+\sigma)+\eta\sigma(\mu+\delta_{1})\big{]}},$
$\displaystyle
X_{SH}^{(4)}=\frac{\eta}{\theta+\mu+\delta_{1}}X_{SI}^{(4)},\quad
X_{SR}^{(4)}=\left(\frac{\gamma}{\mu+\sigma}+\frac{\eta\theta}{(\mu+\sigma)(\theta+\mu+\delta_{1})}\right)X_{SI}^{(4)}.$

This equilibrium exists if and only if

$\mathcal{R}_{C}>1.$

###### Proof.

Equilibria $\mathcal{E}_{0}$, $\mathcal{E}_{1}$, $\mathcal{E}_{2}$ and
$\mathcal{E}_{3}$ are obtained by assuming that $X_{SI}=0$ in the system at
equilibrium and solving the resulting algebraic equations. This yields four
different cases: one for each equilibrium.

On the other hand, assuming $X_{SI}>0$ and $X_{IS}=0$ results in only one
case, corresponding to the equilibrium $\mathcal{E}_{4}$.

The case when $X_{SI}>0$ and $X_{IS}>0$ will be discussed below. ∎

Theorem 3 shows that, under certain conditions, the coinfection model has five
different steady states. Moreover, we conjecture that a sixth equilibrium,
with positive values for all variables, may exist. We will denote this
interior equilibrium by $\mathcal{E}_{5}$. Since the theoretical analysis
becomes too cumbersome in this case, we will resort to numerical simulations
to investigate the dynamics of equilibrium $\mathcal{E}_{5}$ (see Section 5).

###  4.2 Stability analysis

We will now analyse the local stability for the equilibria of system (3). Our
results focus only on the disease-free equilibria $\mathcal{E}_{0}$ and
$\mathcal{E}_{1}$.

######  Theorem 4.

  1. (i)

The disease-free, bacterial population-free equilibrium $\mathcal{E}_{0}$ is
locally asymptotically stable if and only if

$\mathcal{R}_{C}<1,\quad\mathcal{R}_{P}<1\quad\text{and}\quad\mathcal{R}_{B}<1.$
(6)

  2. (ii)

The disease-free, bacterial population-present equilibrium $\mathcal{E}_{1}$
is locally asymptotically stable if and only if

$\mathcal{R}_{C}<1,\quad\mathcal{R}_{P}<1\quad\text{and}\quad\mathcal{R}_{B}>1.$
(7)

###### Proof.

The Jacobian of system (3) evaluated at $\mathcal{E}_{0}$ is given by

$J_{0}=\setcounter{MaxMatrixCols}{13}\begin{bmatrix}-\mu&-\tfrac{\alpha\Lambda}{\mu}&0&\sigma&-\tfrac{b\Lambda}{\mu}&-\tfrac{(\alpha+b)\Lambda}{\mu}&0&-\tfrac{b\Lambda}{\mu}&0&-\tfrac{\alpha\Lambda}{\mu}&0&0&0\\\
0&\tfrac{\alpha\Lambda}{\mu}-k_{1}&0&0&0&\tfrac{\alpha\Lambda}{\mu}&0&0&0&\tfrac{\alpha\Lambda}{\mu}&0&0&0\\\
0&\eta&-k_{2}&0&0&0&0&0&0&0&0&0&0\\\
0&\gamma&\theta&-k_{3}&0&0&0&0&0&0&0&0&0\\\
0&0&0&0&\tfrac{b\Lambda}{\mu}-k_{4}&\tfrac{b\Lambda}{\mu}&0&\tfrac{b\Lambda}{\mu}+\sigma&0&0&0&0&0\\\
0&0&0&0&0&-k_{5}&0&0&0&0&0&0&0\\\
0&0&0&0&0&\eta+\eta_{1}&-\theta_{1}-k_{6}&0&0&0&0&0&0\\\
0&0&0&0&0&\gamma_{1}&\theta_{1}&-k_{7}&0&0&0&0&0\\\
0&0&0&0&\phi&0&0&0&-\mu&0&0&\sigma&0\\\
0&0&0&0&0&\phi_{1}&0&0&0&-k_{1}&0&0&0\\\
0&0&0&0&0&0&\phi_{2}&0&0&\eta&-k_{2}&0&0\\\
0&0&0&0&0&0&0&\phi&0&\gamma&\theta&-k_{3}&0\\\
0&0&0&0&0&0&p&0&0&0&0&0&r-m\end{bmatrix}$

where

$\displaystyle k_{1}=\gamma+\eta+\mu,\qquad k_{2}=\theta+\mu+\delta_{1},\qquad
k_{3}=\mu+\sigma,\qquad k_{4}=\mu+\delta+\phi,$ $\displaystyle
k_{5}=\gamma_{1}+\eta+\eta_{1}+\mu+\delta_{0}+\phi_{1},\qquad
k_{6}=\mu+\delta_{1}+\delta_{2}+\phi_{2},\qquad k_{7}=\mu+\delta+\phi+\sigma.$

From this, we obtain the characteristic polynomial

$\displaystyle\left(\lambda+\mu\right)^{2}\left(\lambda+k_{1}\right)\left(\lambda+k_{2}\right)^{2}\left(\lambda+k_{3}\right)^{2}\left(\lambda+k_{5}\right)\left(\lambda+\theta_{1}+k_{6}\right)\left(\lambda+k_{7}\right)$
$\displaystyle\quad\times\left(\lambda+k_{1}-\frac{\alpha\Lambda}{\mu}\right)\left(\lambda+k_{4}-\frac{b\Lambda}{\mu}\right)\left(\lambda+m-r\right)=0.$

Due to positivity of parameters, it is clear that all eigenvalues have
negative real part if and only if

$\gamma+\eta+\mu-\frac{\alpha\Lambda}{\mu}>0,\qquad\mu+\delta+\phi-\frac{b\Lambda}{\mu}>0\quad\text{and}\qquad
m-r>0,$

which is equivalent to the condition (6). This proves part (i) of the theorem.

Next, we compute the Jacobian at $\mathcal{E}_{1}$, which is given by

$J_{1}=\setcounter{MaxMatrixCols}{13}\begin{bmatrix}-\mu&-\tfrac{\alpha\Lambda}{\mu}&0&\sigma&-\tfrac{b\Lambda}{\mu}&-\tfrac{(\alpha+b)\Lambda}{\mu}&0&-\tfrac{b\Lambda}{\mu}&0&-\tfrac{\alpha\Lambda}{\mu}&0&0&0\\\
0&\tfrac{\alpha\Lambda}{\mu}-k_{1}&0&0&0&\tfrac{\alpha\Lambda}{\mu}&0&0&0&\tfrac{\alpha\Lambda}{\mu}&0&0&0\\\
0&\eta&-k_{0}-k_{2}&0&0&0&0&0&0&0&0&0&0\\\
0&\gamma&\theta&-k_{3}&0&0&0&0&0&0&0&0&0\\\
0&0&0&0&\tfrac{b\Lambda}{\mu}-k_{4}&\tfrac{b\Lambda}{\mu}&0&\tfrac{b\Lambda}{\mu}+\sigma&0&0&0&0&0\\\
0&0&0&0&0&-k_{5}&0&0&0&0&0&0&0\\\
0&0&k_{0}&0&0&\eta+\eta_{1}&-\theta_{1}-k_{6}&0&0&0&0&0&0\\\
0&0&0&0&0&\gamma_{1}&\theta_{1}&-k_{7}&0&0&0&0&0\\\
0&0&0&0&\phi&0&0&0&-\mu&0&0&\sigma&0\\\
0&0&0&0&0&\phi_{1}&0&0&0&-k_{1}&0&0&0\\\
0&0&0&0&0&0&\phi_{2}&0&0&\eta&-k_{2}&0&0\\\
0&0&0&0&0&0&0&\phi&0&\gamma&\theta&-k_{3}&0\\\
0&0&0&0&0&0&p&0&0&0&0&0&m-r\end{bmatrix},$

where $k_{0}=b_{2}\kappa\left(1-\frac{m}{r}\right)$, and $k_{1},\ldots,k_{7}$
are as defined above. Notice that $k_{0}>0$ if and only if
$\mathcal{R}_{B}>1$.

The characteristic polynomial at $\mathcal{E}_{1}$ is

$\displaystyle\left(\lambda+\mu\right)^{2}\left(\lambda+k_{1}\right)\left(\lambda+k_{2}\right)\left(\lambda+k_{3}\right)^{2}\left(\lambda+k_{5}\right)\left(\lambda+\theta_{1}+k_{6}\right)\left(\lambda+k_{7}\right)$
$\displaystyle\quad\times\left(\lambda+k_{0}+k_{2}\right)\left(\lambda+k_{1}-\frac{\alpha\Lambda}{\mu}\right)\left(\lambda+k_{4}-\frac{b\Lambda}{\mu}\right)\left(\lambda+r-m\right)=0.$

Then, all eigenvalues have negative real part if and only if

$k_{0}+k_{2}>0,\quad\gamma+\eta+\mu-\frac{\alpha\Lambda}{\mu}>0,\quad\mu+\delta+\phi-\frac{b\Lambda}{\mu}>0\quad\text{and}\quad
r-m>0.$

The first of these inequalities holds automatically when $\mathcal{R}_{B}>1$.
Hence, we can conclude that $\mathcal{E}_{1}$ is locally asymptotically stable
if and only if the last three inequalities hold, which is equivalent to
condition (7). Thus, the proof of (ii) is complete. ∎

##  5 Numerical analysis

In this section, we perform some simulations for system (3) to illustrate the
dynamics of the coinfection model in some cases that are not covered by the
analysis in Section 4. We will consider the initial conditions

$\displaystyle X_{SS}(0)=8.33\times 10^{7},\quad X_{SI}(0)=10^{5},\quad
X_{SH}(0)=10^{3},\quad X_{SR}(0)=10^{5},\quad X_{IS}(0)=10^{3},$
$\displaystyle B(0)=0.8,\quad
X_{II}(0)=X_{IH}(0)=X_{IR}(0)=X_{RS}(0)=X_{RI}(0)=X_{RH}(0)=X_{RR}(0)=0.$

Throughout this section, we will use the parameter values shown in Table 1.
These are based on the values used in other models for COVID-19, although they
do not necessarily correspond to the dynamics in any specific country. Thus,
we obtain a fixed value for $\mathcal{R}_{C}$, which is greater than one
($\mathcal{R}_{C}=1.2294$), while $\mathcal{R}_{P}$ and $\mathcal{R}_{B}$ will
vary as the parameters $b$ and $r$ take different values.

Table 1: Parameter values used for the coinfection model. Parameter | Value | Unit
---|---|---
$\Lambda$ | 2000 | people/day
$\mu$ | $2.4\times 10^{-5}$ | $(\text{people}\cdot\text{day})^{-1}$
$\sigma$ | 1/100 | $\text{day}^{-1}$
$\gamma$ | 1/12 | $\text{day}^{-1}$
$\gamma_{1}$ | 1/20 | $\text{day}^{-1}$
$\theta$ | 1/14 | $\text{day}^{-1}$
$\theta_{1}$ | 1/24 | $\text{day}^{-1}$
$b_{1}$ | $2\times 10^{-9}$ | $(\text{people}\cdot\text{day})^{-1}$
$b_{2}$ | 0.1 | $\text{day}^{-1}$
$\delta$ | 0.001 | $\text{day}^{-1}$
$\delta_{0}$ | 0.005 | $\text{day}^{-1}$
$\delta_{1}$ | 0.01 | $\text{day}^{-1}$
$\delta_{2}$ | 0.2 | $\text{day}^{-1}$
$\eta$ | 0.12 | $\text{day}^{-1}$
$\eta_{1}$ | 0.1 | $\text{day}^{-1}$
$\phi$ | 1/14 | $\text{day}^{-1}$
$\phi_{1}$ | 1/30 | $\text{day}^{-1}$
$\phi_{2}$ | 1/40 | $\text{day}^{-1}$
$p$ | $10^{-5}$ | $(\text{people}\cdot\text{day})^{-1}$
$\kappa$ | 1 |
$m$ | 0.01 | $\text{day}^{-1}$
$\alpha$ | $3\times 10^{-9}$ | $(\text{people}\cdot\text{day})^{-1}$
$\alpha_{1}$ | $10^{-8}$ | $(\text{people}\cdot\text{day})^{-1}$
$b$ | variable | $(\text{people}\cdot\text{day})^{-1}$
$r$ | variable | $\text{day}^{-1}$

Case 1. When $b=10^{-10}$ and $r=0.004$, we have $\mathcal{R}_{P}=0.1150<1$
and $\mathcal{R}_{B}=0.4<1$. The time plots of the solutions for this case are
shown in Figure 2. The solutions converge to a positive equilibrium

$\displaystyle\mathcal{E}_{5}$ $\displaystyle\approx\big{(}6.3418\times
10^{7},\ 5684,\ 3153,\ 69716,\ 191.8,\ 0.0735,\ 1537,\ 776.8,$
$\displaystyle\qquad 4.368\times 10^{6},\ 391.5,\ 1048,\ 16263,\
1.3487\big{)}.$

Figure 2: Dynamics of the coinfection model when $\mathcal{R}_{C}>1$,
$\mathcal{R}_{P}<1$ and $\mathcal{R}_{B}<1$.

Case 2. When $b=9\times 10^{-10}$ and $r=0.004$, we have
$\mathcal{R}_{P}=1.0352>1$ and $\mathcal{R}_{B}=0.4<1$. The time plots of the
solutions are depicted in Figure 3; we can see that they converge to a
positive equilibrium

$\displaystyle\mathcal{E}_{5}$ $\displaystyle\approx\big{(}5.711\times
10^{7},\ 5602,\ 3130,\ 6.89\times 10^{4},\ 2229,\ 0.59,\ 1509,\ 765,$
$\displaystyle\qquad 1.066\times 10^{7},\ 1046,\ 2005,\ 2.85\times 10^{4},\
1.33\big{)}.$

Figure 3: Dynamics of the coinfection model when $\mathcal{R}_{C}>1$,
$\mathcal{R}_{P}>1$ and $\mathcal{R}_{B}<1$.

Case 3. When $b=10^{-10}$ and $r=0.08$, we have $\mathcal{R}_{P}=0.1150<1$ and
$\mathcal{R}_{B}=8>1$. The time plots of the solutions are depicted in Figure
4. We can see that they converge to the positive equilibrium

$\displaystyle\mathcal{E}_{5}$ $\displaystyle\approx\big{(}6.353\times
10^{7},\ 6206,\ 3984,\ 8.0\times 10^{4},\ 189.8,\ 0.0793,\ 1519,\ 768,$
$\displaystyle\qquad 4.251\times 10^{6},\ 415.3,\ 1078,\ 16605,\
1.055\big{)}.$

Figure 4: Dynamics of the coinfection model when $\mathcal{R}_{C}>1$,
$\mathcal{R}_{P}<1$ and $\mathcal{R}_{B}>1$.

Case 4. When $b=9\times 10^{-10}$ and $r=0.08$, we have
$\mathcal{R}_{P}=1.0352>1$ and $\mathcal{R}_{B}=8>1$. The time plots of the
solutions are shown in Figure 5. We can see that the solutions converge to the
positive equilibrium

$\displaystyle\mathcal{E}_{5}$ $\displaystyle\approx\big{(}5.728\times
10^{7},\ 6007,\ 3867,\ 7.747\times 10^{4},\ 2186,\ 0.618,\ 1467,\ 744.4,$
$\displaystyle\qquad 1.050\times 10^{7},\ 1102,\ 2074,\ 2.92\times 10^{4},\
1.0497\big{)}.$

Figure 5: Dynamics of the coinfection model when $\mathcal{R}_{C}>1$,
$\mathcal{R}_{P}>1$ and $\mathcal{R}_{B}>1$.

##  6 Conclusions

We proposed a novel mathematical model to study the coinfection dynamics of
COVID-19 and bacterial pneumonia. We established some basic properties of the
sub-models (COVID-19 only and bacterial pneumonia only) and computed their
basic reproduction numbers.

We obtained some analytical results for the coinfection model and showed that
its dynamics depends on three parameters: $\mathcal{R}_{C}$, $\mathcal{R}_{P}$
and $\mathcal{R}_{B}$. We determined conditions for the existence of five
equilibrium points. Furthermore, by means of numerical simulations, we showed
that a sixth equilibrium may exist. Based on the simulations on Section 5, we
conjecture that the COVID-19-present, pneumonia-present, bacterial population-
present equilibrium $\mathcal{E}_{5}$ exists and locally stable whenever
$\mathcal{R}_{C}>1$. This implies that both diseases can coexist in the
population even if reproduction numbers of bacterial pneumonia
($\mathcal{R}_{P}$) and bacterial population ($\mathcal{R}_{B}$) are reduced
below unity. Hence, epidemic policies should focus on reducing the basic
reproduction number of COVID-19 in order to control the pandemic.

The stability conditions for the equilibria $\mathcal{E}_{0}$ and
$\mathcal{E}_{1}$ were determined in terms of the reproduction numbers. Due to
the complexity of our model, we did not include a stability analysis for all
equilibria. On the other hand, the coinfection model could be expanded to
include vaccination or multiple COVID-19 variants. We expect to carry out a
more thorough analysis in future works.

## Code availability

The code used in this paper was written in Python and can be downloaded from
https://github.com/agcp26/COVID19-pneumonia.

## References

  * [1] Shamshul Ansari et al.  “The potential impact of the COVID-19 pandemic on global antimicrobial and biocide resistance: an AMR Insights global perspective”  In _JAC-Antimicrobial Resistance_ 3.2 Oxford University Press, 2021, pp. dlab038
  * [2] Fateen Ata et al.  “A 28-year-old man from India with SARS-Cov-2 and pulmonary tuberculosis co-infection with central nervous system involvement”  In _American Journal of Case Reports_ 21 International Scientific Information, Inc., 2020, pp. e926034
  * [3] Shraddha Ramdas Bandekar and Mini Ghosh  “A co-infection model on TB-COVID-19 with optimal control and sensitivity analysis”  In _Mathematics and Computers in Simulation_ 200 Elsevier, 2022, pp. 1–31
  * [4] Nanshan Chen et al.  “Epidemiological and clinical characteristics of 99 cases of 2019 novel coronavirus pneumonia in Wuhan, China: a descriptive study”  In _The Lancet_ 395.10223 Elsevier, 2020, pp. 507–513
  * [5] Michael J Cox, Nicholas Loman, Debby Bogaert and Justin O’Grady  “Co-infections: potentially lethal and unexplored in COVID-19”  In _The Lancet Microbe_ 1.1 Elsevier, 2020, pp. e11
  * [6] MaryAnn De Pietro  “What to know about bacterial pneumonia”, 2019  URL: https://www.medicalnewstoday.com/articles/312565
  * [7] Pauline Driessche and James Watmough  “Reproduction numbers and sub-threshold endemic equilibria for compartmental models of disease transmission”  In _Mathematical Biosciences_ 180.1-2 Elsevier, 2002, pp. 29–48
  * [8] Alyaa Elhazmi et al.  “Severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2) and Middle East Respiratory Syndrome Coronavirus (MERS-CoV) coinfection: A unique case series”  In _Travel Medicine and Infectious Disease_ 41 Elsevier, 2021, pp. 102026
  * [9] Manal Fahim et al.  “Coinfection with SARS-CoV-2 and influenza A(H1N1) in a patient seen at an influenza-like illness surveillance site in Egypt: case report”  In _JMIR Public Health and Surveillance_ 7.4 JMIR Publications Inc., Toronto, Canada, 2021, pp. e27433
  * [10] Maddalena Giannella et al.  “Predictive model for bacterial co-infection in patients hospitalized for COVID-19: A multicenter observational cohort study”  In _Infection_ Springer, 2022
  * [11] Chaolin Huang et al.  “Clinical features of patients infected with 2019 novel coronavirus in Wuhan, China”  In _The lancet_ 395.10223 Elsevier, 2020, pp. 497–506
  * [12] Ran Jing et al.  “Co-infection of COVID-19 and influenza A in a hemodialysis patient: a case report”  In _BMC Infectious Diseases_ 21 BioMed Central, 2021, pp. 68
  * [13] Alkesh Kumar Khurana and Deepak Aggarwal  “The (in)significance of TB and COVID-19 co-infection”  In _European Respiratory Journal_ 56.2 European Respiratory Society, 2020, pp. 2002105
  * [14] Rohit Kumar et al.  “COVID-19 and TB co-infection - ‘Finishing touch’ in perfect recipe to ‘severity’ or ‘death”’  In _Journal of Infection_ 81.3 Elsevier, 2020, pp. e39–e40
  * [15] Louise Lansbury, Benjamin Lim, Vadsala Baskaran and Wei Shen Lim  “Co-infections in people with COVID-19: a systematic review and meta-analysis”  In _Journal of Infection_ 81.2 Elsevier, 2020, pp. 266–275
  * [16] Sungyub Lew, Prabhjot Manes and Brittany Smith  “Coinfection with SARS-CoV-2 and Influenza A virus in a 32-year-old man”  In _American Journal of Case Reports_ 21 International Scientific Information, Inc., 2020, pp. e926092
  * [17] Chandini Raina MacIntyre et al.  “The role of pneumonia and secondary bacterial infection in fatal and serious outcomes of pandemic influenza a(H1N1)pdm09”  In _BMC Infectious Diseases_ 18 Springer, 2018, pp. 637
  * [18] José Arturo Martínez Orozco et al.  “COVID-19 and tuberculosis coinfection in a 51-year-old taxi driver in Mexico City”  In _American Journal of Case Reports_ 21 International Scientific Information, Inc., 2020, pp. e927628
  * [19] David M Morens, Jeffery K Taubenberger and Anthony S Fauci  “Predominant role of bacterial pneumonia as a cause of death in pandemic influenza: implications for pandemic influenza preparedness”  In _The Journal of Infectious Diseases_ 198.7 Oxford University Press, 2008, pp. 962–970
  * [20] A. Omame et al.  “COVID-19 and dengue co-infection in Brazil: optimal control and cost-effectiveness analysis”  In _The European Physical Journal Plus_ 136.10 Springer, 2021, pp. 1090
  * [21] Andrew Omame, Ugochukwu K Nwajeri, M Abbas and Chibueze P Onyenegecha  “A fractional order control model for Diabetes and COVID-19 co-dynamics with Mittag-Leffler function”  In _Alexandria Engineering Journal_ Elsevier, 2022
  * [22] Linda Petrone et al.  “Coinfection of tuberculosis and COVID-19 limits the ability to in vitro respond to SARS-CoV-2”  In _International Journal of Infectious Diseases_ 113 Elsevier, 2021, pp. S82–S87
  * [23] Timothy M Rawson et al.  “Bacterial and fungal coinfection in individuals with coronavirus: a rapid review to support COVID-19 antimicrobial prescribing”  In _Clinical Infectious Diseases_ 71.9 Oxford University Press US, 2020, pp. 2459–2468
  * [24] H. Rwezaura et al.  “Mathematical modeling and optimal control of SARS-CoV-2 and tuberculosis co-infection: a case study of Indonesia”  In _Modeling Earth Systems and Environment_ Springer, 2022, pp. 1–28
  * [25] Sanjay Sethi  “Hospital-Acquired Pneumonia”, 2020  URL: https://www.msdmanuals.com/home/lung-and-airway-disorders/pneumonia/hospital-acquired-pneumonia
  * [26] Bhavnita Soni and Shailza Singh  “COVID-19 co-infection mathematical model as guided through signaling structural framework”  In _Computational and Structural Biotechnology Journal_ 19 Elsevier, 2021, pp. 1672–1683
  * [27] Marina Tadolini et al.  “Active tuberculosis, sequelae and COVID-19 co-infection: first cohort of 49 cases”  In _European Respiratory Journal_ 56.1 European Respiratory Society, 2020, pp. 2001398
  * [28] S. Y. Tchoumi, M. L. Diagne, H. Rwezaura and J. M. Tchuenche  “Malaria and COVID-19 co-dynamics: A mathematical model and optimal control”  In _Applied Mathematical Modelling_ 99 Elsevier, 2021, pp. 294–327
  * [29] Dawei Wang et al.  “Clinical characteristics of 138 hospitalized patients with 2019 novel coronavirus–infected pneumonia in Wuhan, China”  In _JAMA_ 323.11 American Medical Association, 2020, pp. 1061–1069
  * [30] Xuan Xiang et al.  “Co-infection of SARS-COV-2 and influenza A virus: a case series and fast review”  In _Current Medical Science_ 41.1 Springer, 2021, pp. 51–57
  * [31] Sankalp Yadav and Gautam Rawal  “The case of pulmonary tuberculosis with COVID-19 in an Indian male - a first of its type case ever reported from South Asia”  In _The Pan African Medical Journal_ 36 African Field Epidemiology Network, 2020, pp. 374
  * [32] Fei Zhou et al.  “Clinical course and risk factors for mortality of adult inpatients with COVID-19 in Wuhan, China: a retrospective cohort study”  In _The Lancet_ 395.10229 Elsevier, 2020, pp. 1054–1062


N. Boltz, S. Hahner, et al., "An Extensible Framework for Architecture-Based Data Flow Analysis for

Information Security," in European Conference on Software Architecture (ECSA), Springer, 2024.

An Extensible Framework for Architecture-Based Data Flow Analysis for Information Security

An Extensible Framework for Architecture-Based Data Flow Analysis

Nicolas BoltzBoth main authors contributed equally. Sebastian Hahner

Christopher Gerking Robert Heinrich

N. Boltz, S. Hahner, et al.

Karlsruhe Institute for Technology (KIT)

The growing interconnection between software systems increases the need for security already at design time.
Security-related properties like confidentiality are often analyzed based on data flow diagrams (DFDs).
However, manually analyzing DFDs of large software systems is bothersome and error-prone, and adjusting an already deployed software is costly.
Additionally, closed analysis ecosystems limit the reuse of modeled information and impede comprehensive statements about a system's security.

In this paper, we present an open and extensible framework for data flow analysis.
The central element of our framework is our new implementation of a well-validated data-flow-based analysis approach.

The framework is compatible with DFDs and can also extract data flows from the Palladio architectural description language.
We showcase the extensibility with multiple model and analysis extensions.
Our evaluation indicates that we can analyze similar scenarios while achieving higher scalability compared to previous implementations.

§ INTRODUCTION

As our modern world becomes increasingly digitized, the integration of various digital services into our daily lives has become more prevalent.
To enhance the quality of service, a growing amount of data is stored and processed, e.g., online shops utilizing purchase history data for recommendations.
The seamless exchange of such collected data between different services or systems is a common practice.
In scenarios like online shopping, sensitive information like payment details and customer addresses are involved.
Consequently, security becomes a central concern in designing and building such software-intensive systems.

Information security has several definitions, e.g., as the CIA triad of confidentiality, integrity, and availability, or in ISO 27000 <cit.>.
More recent legal regulations, like the General Data Protection Regulation (GDPR) <cit.>, define information security more broadly.
For modern systems, changes and reconfiguration in the context, environment, or internal structure might occur frequently <cit.>.
Since the protection goals are highly dependent on the system under consideration, the protection goals that must be addressed may also change.
In addition to the CIA goals, other protection goals might be considered, like privacy, authenticity, non-repudiation, accountability, and auditability.
A system violating confidentiality or privacy can cause costly fines, as seen in the case of H&M <cit.> or British Airways <cit.>.
However, identifying such violations can be difficult, because the interconnected software systems represent complex networks of data flows.
Hence, a holistic and scalable approach to analyzing them is required.

Data flow analyses based on source code, e.g., JOANA <cit.>, KeY <cit.>, or CodeQL <cit.>, cannot consider context information, such as deployment.
However, such information can be essential for information security, e.g., whether the application is deployed to an external cloud provider or not.
In addition, source code analyses cannot be used in early design phases because of their need for existing source code.
Analyzing the system during design time is beneficial because fixing issues in later phases is usually more costly <cit.>.
Seifermann et al. <cit.> proposed an architecture-based data flow analysis to analyze software systems for confidentiality violations.
Their approach considers additional context information, such as the deployment, enabling software architects to analyze confidentiality during early design phases.
However, the original Prolog-based implementation of seifermann2022detecting is hard to maintain and has a high resource demand, which severely limits the applicability for large software systems.
Although they already used a model of a data flow diagram (DFD) <cit.> as an intermediate representation during their analysis, they did not continue to follow the idea of using DFDs as the primary model artifact.
With appropriate tool support, DFDs represent a powerful and commonly used mechanism for threat analysis <cit.> that helps in correctly identifying security-related issues <cit.>.

In this paper, we present an extensible analysis framework centered around our previously presented new implementation of the aforementioned approach to data flow analysis <cit.>. Our framework addresses shortcomings regarding the limited input capabilities, the limited intermediate use of DFDs, and problems with maintainability, scalability, and extensibility:

* We propose a novel DFD metamodel.
In contrast to the previous DFD model <cit.> we do not consider DFDs as intermediate system representations but as primary software architecture modeling artifacts.
As part of our framework, we provide means to manually define DFDs as well as automatically derive them from the architecture description language Palladio Component Model (PCM) <cit.> and other third-party diagram representations <cit.>.

* We present a new Java-based implementation of the analysis approach of seifermann2022detecting, which is based on a newly developed internal data structure and alleviates the need to mix Java with other technologies like Prolog.
In addition, we provide new forms of input, e.g., DFDs defined with our metamodel (C1), and a domain-specific language (DSL) that enables software architects to define constraints or queries for the analysis.
We demonstrate how our analysis framework can be applied and extended for other security concerns, e.g., regarding the GDPR <cit.>, or uncertainty <cit.>.

This paper is structured as follows:
<ref> introduces our data flow analysis framework.

<ref> describes our new DFD metamodel (C1).
In <ref>, we describe the analysis (C2), and in <ref>, we showcase existing extensions.
<ref> presents our evaluation and <ref> concludes the paper.

§ OVERVIEW OF THE DATA FLOW ANALYSIS FRAMEWORK

In this section, we summarize our framework which is explained in more detail hereafter.
<ref> gives an informal overview of the structure and the dependencies between the different parts of our data flow analysis framework.
We highlight analyses and editors with a bold border; all other rectangles represent models.

Informal overview of the structure of the data flow analysis framework.

Unified data flow diagrams (DFDs) <cit.> play a central role in our framework (C1).
These diagrams can be manually defined using a web-based editor or transformed from third-party diagram representations.
Additionally, we enable the extraction of data flows from software architecture models described using PCM <cit.>.
To unify the analysis process (C2), we transform DFD or PCM models into a set of Directed Acyclic Graphs (DAGs), called transpose flow graphs (TFGs).
Each vertex represents one individual data processing operation from either a DFD or PCM model, which simplifies the analysis.
Using label propagation on TFGs, the analysis finds violations of predefined constraints that reflect information security objectives, e.g., confidentiality requirements.
Constraints and queries can be specified using a domain-specific language (DSL), referencing PCM and DFD models.
Framework extensions are possible by transforming into our DFDs or TFGs or by inheriting from the data flow analysis.
GDPR models <cit.> are an example of the former while uncertainty impact analysis <cit.> and uncertainty-aware confidentiality analyses <cit.> showcase the latter.
The framework is tool-supported and available as open source[See <https://dataflowanalysis.org> or <https://github.com/DataFlowAnalysis>].
This includes modeling support, automated model transformations, and a DSL-supported analysis[Video demonstration available <cit.>: <https://youtube.com/watch?v=q3WJsMyqJcA>]. We also provide a dataset <cit.> including all tooling, code artifacts, and evaluation data.

§ MODELING AND DERIVING DATA FLOW DIAGRAMS

While PalladioIntegrationConfidentiality created a unified DFD notation, they only used it as an intermediary representation for their data flow analysis <cit.>.
However, as DFDs are an established software architecture representation <cit.> and are widely used to analyze various types of data security <cit.>, we present an explicit DFD metamodel that can also be used as input for our analysis.
The study of bernsmed2022adopting concludes, that, while DFDs are good for evaluating security, there exist challenges in preparing DFDs.

Especially tooling that improves the effort of creating and maintaining DFDs is missing.
In this section, we present our DFD metamodel (C1).
We also provide tooling centered around our metamodel, which aims to aid in the creation of new DFDs, the import of already existing DFD notations <cit.>, and the automated derivation and visualization of DFDs from system architecture models like the PCM <cit.>.

§.§ Unified Data Flow Diagram Metamodel

DFDs, as proposed by demarco1979structure, can be represented as DAGs showing the data flow and processing in software systems.
Nodes in these graphs represent External entities like users, Processes that can alter data, or Stores like databases, connected by Flows of data.
seifermann2022detecting extend the notation by integrating several strands of work from different research groups into one unified metamodel.
<ref> shows our metamodel that aligns with the unified DFD notation.
It is split into the so-called Data Dictionary <cit.> and the DFD.
The Data Dictionary does not directly depend on a modeled system and can thus be reused while DFD elements are specific to a certain system.

The central part of the unified notation is the representation of behavior and characteristics as first-class entities.
Labels represent characteristics in the DFD, e.g., specifying the sensitivity of data, or the role of a user.
They can either be defined as a characteristic of a Node or as a characteristic of data flowing between Nodes.
Labels are grouped in LabelTypes.
The Behavior of Nodes defines which Labels flow from one Node to the next via the connecting Flow.
It is made up of Pins and Assignments.
Input Pins represent required interfaces and output Pins represent provided interfaces of nodes.
If a node has a certain Behavior, it also has the corresponding input and output Pins.
A Flow connects two Nodes by connecting an output Pin of the source Node to an input Pin of the destination Node.
Assignments define which labels flow out of a node.
They reference input and output Pins of their corresponding Behavior and aggregate all Labels of the data flowing in through the input Pin.
By evaluating a logical statement defined in the assignment, it is determined how the incoming Labels are changed and passed on via the referenced output Pins, e.g., the encryption of data can be represented by an Assignment that adds an encrypted label to the flowing data.

For assignments, we define two subclasses: Assignment which contains a freely definable logical Term that is evaluated to decide if a set of Labels is applied to the output Pin. The ForwardingAssginment does not define a logical term but specifies that all Labels that flow into the input pins are combined and directly forwarded to the output pin.
The logical terms can be nested with binary operators AND and OR and negated with NOT to express different statements. LabelReferences are evaluated by checking if the referenced Label flows into the node through one of the input pins of the Assignment.
In this case, the LabelReference evaluates to true, otherwise to false.
The Assignments of a Behavior are ordered. If a Behavior contains multiple Assignments, first all ForwardingAssignments are evaluated and the Labels for each output Pin are saved. Other Assignments add or remove labels for their specific output Pin, depending on if their Term evaluates to true or false.
Once all Assignments are evaluated, the Labels flow to the next Node.

Metamodel of data flow diagrams and data dictionaries.

§.§ Manually Defining Data Flow Diagrams

Manual ways to define DFDs that go beyond drawing on either paper or in software are limited.
With our approach, we therefore offer a ready-to-use web editor to manually define DFDs and means to import DFDs from other notations.

Our web-based editor uses a notation that is compatible with the unified DFD notation from <ref>.
We also incorporated the concept of the data dictionaries.
The graphical syntax follows earlier definitions of DFDs <cit.>.
<ref> shows the editor with an exemplary DFD.
The toolbar on the right allows the creation of the three node types, data flow edges, and input and output pins via drag and drop.
The Label Types field allows the creation of label types and corresponding labels.
Created labels can be annotated to a node by drag and drop.
Double-clicking on an output pin opens an editor for specifying assignments for the corresponding output pin.
Assignments can be defined in textual form using a DSL.
The forward keyword is used to forward all labels of the corresponding input.
The set keyword is used to define an output label and a logical term, similar to the DFD metamodel.
Incoming data can be referenced via the name of the incoming edge.
Labels are referenced by label type and label name.
Assignments are automatically syntax-checked, and issues are reported to the user.

Additionally, our web editor supports highlighting in different colors and providing tooltips for nodes. This can be used to, e.g., visualize analysis results and provide additional information regarding identified security violations.

Screenshot of the web-based editor showing the DFD of a simplified online shop.

The manually created DFDs can be exported as JSON files.
To integrate the editor into our framework, we offer tooling that converts the JSON files of the web editor into an instance of our DFD metamodel.
The editor is implemented in TypeScript and uses the open-source diagramming framework Eclipse Sprotty.

To ease the adoption of our approach, we additionally created extensible tooling for generating instances of our DFD metamodel from various inputs.
At the time of writing, we support DFD notations in PlantUML and two different types of JSON notations.

To showcase this functionality, we have processed all security-enriched DFDs of the microSecEnD dataset of schneider2023microsecend.
The resulting instances of our DFD metamodel can be found in our dataset <cit.>.

§.§ Automatically Deriving Data Flows from Architectural Models

Besides the manual modeling of DFDs, our framework also supports the automated extraction of data flows from the architecture description language PCM <cit.>.
We choose PCM as it has already been used by previous data flow analysis approaches <cit.>.
However, the described concept of data flow extraction is also applicable to other modeling languages like UML.

Simplified PCM model of the online shop example and the corresponding data flow with annotated node labels, data labels, and numbered transformation traces.

<ref> shows a simplified PCM model of an online shop.
It comprises information about components (e.g., Online Shop), resources (e.g., Local Server), deployment, usage, and system behavior as Service Effect Specification (SEFF) <cit.>.
The model is annotated with confidentiality-related labels that represent characteristics of data storage like On Premise and data processing like the encryption of userData in the SetVariableAction.
In the lower half, we show the extracted data flow.
We annotate numbers to represent the transformation traces from PCM to DFD.
Note, that this is only a simplified example; realistic software systems contain more than one data flow and several hundred nodes <cit.>.

Every action in the usage and system behavior is transformed into one DFD node.
This includes calls from the user, external calls between components, start and end nodes, and internal data processing nodes.
The nodes' pins correspond to the in and outgoing data types, e.g., userData.
For every node, we perform a lookup of node labels, which can be annotated, e.g., to resources, or usage scenarios.
An exemplary lookup in the PCM model goes from the encrypt node to the Online Shop component via the deployment to the Local Server resource which is annotated with On Premise.
Additionally, we convert the modeled system behavior to assignments of our DFD metamodel like the encryption of userData can be expressed.
The default case is the forwarding of labels.

The transformation considers all information that is relevant for security analysis, e.g., data processing and characteristics.
Other information is not transformed, e.g., components and servers do not cause additional elements in the DFD.
This enables a system view from the perspective of the data which is especially suitable for properties like confidentiality <cit.>.
However, we store all traces to the originating PCM elements during the transformation.
This enables the evaluation of advanced queries and constraints in the data flow analysis.

§ DATA FLOW ANALYSIS

The original Prolog-based analysis of seifermann2022detecting realized the extraction of data flows and propagation of labels by first transforming the PCM models to an explicit DFD metamodel notation, then transforming the DFD elements to Prolog. Data flow constraints were checked by defining Prolog queries that are unique to the modeled system. As one DFD element with characteristic labels is transformed into multiple Prolog statements, the Prolog code grows exponentially with the model size. The exponential growth results in high demand for memory, as the whole Prolog program needs to be fully loaded by the Prolog interpreter.

As the analysis is made up of multiple chained transformations and intermediate model representations, the maintenance of the analysis was made even harder.

Additionally, the approach of modeling data flows via logical statements in Prolog can lead to increased runtimes: Due to the lazy evaluation of Prolog, the Prolog-based analysis needs to reevaluate the characteristic labels of nodes for each different constraint.
For cases where very few nodes need to be evaluated, this might be an advantage. However, in using the analysis, the use case rarely occurs. For most constraints, like Role-based Access Control (RBAC), the node and data characteristic labels need to be evaluated at each node.

Due to the aforementioned reasons, we chose to implement the data flow analysis in Java and made the analysis more extensible as a central part of our framework. In this section, we first provide a general overview of the architecture of the analysis and provide a more detailed technical description of the extraction of data flows into flow graphs, label propagation, and constraint definition.

§.§ Architecture Overview

Our data flow analysis follows the general architecture of the Prolog-based data flow analysis of seifermann2022detecting. <ref> shows the analysis steps and their sequential order as an activity diagram.
Initially, the input models are loaded and references between model elements are resolved.
This is done automatically by the Eclipse Modeling Framework (EMF).
Using the information from the models and annotations, we extract a set of transpose flow graphs (TFGs) that each represents one unambiguous flow of data to a data sink in the modeled software architecture, i.e., the transpose rooted directed graph, where the root is a single data sink.
The extraction starts at each identified data sink and follows the modeled flow of data in the opposite direction.
Afterward, we transpose the graph to represent data flows between the vertices of the graph, so each TFG connects one or multiple data sources with a single data sink.
Each vertex represents one individual data processing step.

If the analysis encounters an ambiguity in the data flow of the current element, it is resolved by creating copies of the current TFG, for each of the possible flows.
After all TFGs are extracted, we first evaluate the node characteristic labels of the vertices. Afterward, we propagate the data characteristic labels along the edges of the TFGs.
Starting with the sink vertices, we calculate the data characteristics flowing into the current vertex by recursively evaluating the behaviors of the previous vertices in the TFG and tracing back the results.
How sinks are identified, how characteristic labels and vertex behavior are specified, and how they are evaluated, is specific to the input model type, e.g., DFD or PCM.

Using a set of fully propagated TFGs, data flow constraints can be checked. For example, by comparing propagated data characteristics with specified node characteristics, as described in <ref>.

Analysis architecture as performed key activities.

§.§ Flow Graph Extraction

We specify extraction logic for creating TFGs and specific subclasses of vertex for each element that represents a data flow node in DFDs and PCM models.

For the DFDs described in <ref>, sinks are nodes that either have no outgoing flows or nodes whose assignments for an output pin are independent of all its input pins.
Starting with these, the analysis performs a depth-first search over the DFD and creates vertices for each node. Ambiguities in the data flow exist if two or more flows point to the same input pin. To resolve the ambiguity, the analysis creates a copy of the current TFG for each path to the pin.

In the PCM, sinks are represented by the last element in usage scenarios. As the information regarding data flows is distributed across all PCM models, the analysis has to iterate over them and resolve relationships between elements. The analysis creates a vertex for all elements that can be annotated with a node characteristic label, that specifies data flow behavior, or that joins the control flow after a branch. The latter also creates a new TFG.
Calls to Service Effect Specifications (SEFFs) that are defined in interfaces are also handled separately: For each call of these SEFFs, a calling and returning vertex is created, which enclose the data flows, i.e., the vertices, which make up the SEFF internally.

§.§ Label Propagation

We individually propagate the characteristic labels for each TFG.

Each vertex references the input model element it represents and contains all logic regarding the calculation of node and data characteristic labels. First, we calculate the node characteristic labels and store them in the corresponding vertex.
Starting from the sink of the TFG, we calculate the data characteristic labels that represent the output of the vertex and also store them in the corresponding vertex.
This is achieved by recursively calling the calculation logic of all previous vertices and using the hereby calculated output labels as input.

Note, that we do not consider cycles in the propagation logic because TFGs represent DAGs.

For our DFD metamodel, the calculation of node characteristic labels is trivial, as DFD nodes already contain these labels, and vertices directly represent nodes. During the calculation of data characteristic labels, each vertex first recursively evaluates its input, as described above, iterating the DFD nodes that are connected by input pins. After the input has been evaluated the labels are aggregated and saved as output of the corresponding output pin.

In PCM, node characteristic labels are directly annotated to PCM elements like resource containers or usage scenarios. For the calculation of node characteristic labels, the vertex iterates over the relationships of the PCM element it represents and stores the annotated characteristic labels relevant to the vertex. For the calculation of data characteristic labels, the PCM-specific vertices use the output of the previous vertex in the TFG. In contrast to our DFDs, the PCM does not support the definition of multiple individual data flows between two nodes that each represents a separate flowing data variable. Rather, one flow between two vertices in the TFG encapsulates all data flowing between two nodes. To evaluate the input, the vertices filter the variables with their data characteristics to only include variables that are in the scope of the element represented by the vertex. To calculate the output data characteristic labels, the vertex evaluates stochastical expressions that are used in the PCM to define propagation behavior.

§.§ DSL-based Constraint Checking

To help in the specification and checking of constraints and queries, we define a simple domain-specific language (DSL).
We follow the general structure of the DSL by Hahner2021b, which was defined for the original analysis of seifermann2022detecting but simplify the approach by implementing it in Java and fitting it to our new implementation of the analysis.

Metamodel showing the abstract syntax of the DSL for the data flow analysis.

<ref> shows the abstract syntax of our DSL.
A Constraint is made up of primary and secondary selectors, as well as an optional condition.
Selectors are either specific for data or vertices.
VertexSelectors match the properties of the vertices themselves, while DataSelectors match the propagated data characteristic labels of each vertex.
They contain a set of Selections that each represent a property.
A Selection can for example define a characteristic label or the name of a vertex or data.
The VariableLabelSelection does not reference a specific label but defines a variable that contains all labels of a given label type that are present at either the vertex or data.
These variables can be compared in the Condition of the constraint using set theory.
Executing the constraint searches all TFGs in the modeled software architecture using the flow graph extraction, propagates all labels, and tests each vertex.
The selectors return all vertices in a TFG that match the properties defined by its selections.

Constraints define a never flows relationship between the primary DataSelector and secondary selectors.
The results of the primary and secondary selectors represent violations.
If a condition is defined, it is evaluated in addition.
In this case, the violations are the results of primary and secondary selectors, for which the condition evaluates to true.

caption=Code snippet showing a DSL constraint for a simplified online shop.,
var analysis = new DataFlowAnalysisBuilder().build(); // simplified

var constraint =  new Constraint()
.withLabel("Sensitivity", "Personal")
.withoutLabel("Encryption", "Encrypted")
.withLabel("Location", "offPremise")

var violations = constraint.execute(analysis);

<ref> demonstrates the concrete syntax of our DSL for the online shop example from <ref>.
We provide a builder to set up the analysis with required inputs, which is simplified in line 1.
We define a constraint using our DSL, starting in line 3.
For our example, we specify that personal data (line 5) that is not encrypted (line 6) should never flow to vertices that are off-premise of the online shop (line 9).
We execute the constraint in line 12. After the execution, the variable violations contains a list of all constraint-violating vertices within the modeled software architecture.
If no violation has been found, the list is empty.

§ ANALYSIS FRAMEWORK EXTENSIONS

We demonstrate the extensibility of our framework with several related work <cit.> that is either compatible to or already using our approach.

boltz2023designing, boltz2022model showcase the extension of both modeling and analysis for data protection and privacy.

As shown in <ref>, they provide a GDPR metamodel and transformations from PCM and to and from our DFD metamodel.
Regarding the consideration of uncertainty within the software architectural design and system environment, multiple black-box and white-box extensions exist.
walter2021architectural use the data flow analysis as black-box together with PerOpteryx <cit.> for design space exploration regarding confidentiality under structural uncertainty.
Other white-box extensions analyze access control under uncertainty <cit.> or trace confidentiality violations to related uncertainty sources <cit.>.
Our framework is also used in an uncertainty impact analysis <cit.> that predicts the impact of uncertainty on confidentiality based on the extracted data flows and a classification of uncertainty regarding confidentiality <cit.>.

§ EVALUATION

In our evaluation, we compare our new Java-based analysis to the Prolog-based analysis of seifermann2022detecting. The primary goals of this evaluation were to assess the accuracy and scalability of both analyses and to show that our Java-based analysis not only maintains the core functionalities of the Prolog-based analysis but also improves execution times and resource efficiency. Due to the lack of support for our new DFD metamodel in the Prolog-based analysis, our evaluation only focuses on PCM model instances. The evaluation of our analysis with a focus on the DFD metamodel or the extensions from <ref> are considered potential future work.

§.§ Evaluation Design

To compare accuracy, we check whether both analyses correctly identify violations across various case study-based PCM models.
To ensure a good base for comparison, we utilize the same case study-based models employed by seifermann2022detecting for evaluating the accuracy of the Prolog-based approach.
The selected case studies use the default call return semantics of the current stable PCM version.
We executed both analyses with semantically equivalent constraint queries, using the count of accurately identified violations as the evaluation metric.

To examine and compare scalability, we measured the full execution time of both analyses while analyzing models of increasing size. To isolate the impact of distinct model features on scalability, we generated individual minimal models incrementally increasing the number of node characteristic labels, characteristic label propagations, variable actions, or SEFF parameters. We chose these elements, as they have the highest impact on either the length of Prolog code or Java loop iterations, depending on the analysis.
Each analysis was executed with a constraint designed to detect a violation at each node, thus ensuring a worst-case execution time scenario for both analyses.
For each run, we increase the model feature under consideration by the power of ten, starting at $10^0$ and ending with $10^5$.
We conducted each test 10 times and calculated the median execution time to mitigate outliers or measurement anomalies.
The analyses were performed on a dedicated VM equipped with 4 AMD Opteron 8435 cores, 97 GB RAM, running Debian 11 with OpenJDK 11/17.

§.§ Evaluation Results

In terms of accuracy, both analyses successfully identified the 42 violations present in the case study-based models without returning any false positives. <ref> shows the results of the accuracy evaluation and size of analyzed models. As both analyses performed the same, we assume, that our Java-based analysis is functionally equivalent to the Prolog-based analysis, when analyzing models using the call return semantics of the PCM.

Case Study     Prolog-based     Java-based     Components     Labels

ContactSMS <cit.>     10 violations     10 violations     3     4

FlightControl <cit.>     0 violations     0 violations     6     6

FriendMap <cit.>     0 violations     0 violations     5     12

Hospital <cit.>     0 violations     0 violations     4     12

ImageSharing <cit.>     0 violations     0 violations     1     9

PrivateTaxi <cit.>      0 violations     0 violations     13     20

TravelPlanner <cit.>     32 violations     32 violations     7     8

WebRTC <cit.>     0 violations     0 violations     20     12

Accuracy results of both analyses compared and size of the models.

Regarding scalability, we plotted the results of both analyses as line graphs for each examined model feature, shown in <ref>. Each graph contains data points from both analyses—the Prolog-based analysis (in red) and the Java-based analysis (in blue). Both axes are scaled logarithmically, with the x-axis showing the increasing number of model elements and the y-axis the median execution times in milliseconds.
Our evaluation showed that the Prolog-based analysis fails to complete a run for more than 1000 node characteristic labels or 100 for variable actions and SEFF parameters, due to high memory demand (see <ref>).
In our tests, the analysis ran in out of memory errors or crashed, despite the substantial 97 GB of available memory.
Regarding execution time behavior, while the Prolog-based analysis displayed an exponential increase in execution times or incomplete analysis runs for larger models, our Java-based analysis maintained nearly constant execution times up to $10^3$ elements for most evaluated cases. When increasing the number of label propagations, the execution time behavior of both analyses is similar.
The exponential increase in execution time of the Java-based analysis for larger models can be explained due to inefficiencies in TFG finding, and overhead during label propagation.

Overall, despite the noted increase in execution times for larger models in the Java-based analysis, we consider the time required in all scenarios feasible for design-time analyses.
Our Java-based analysis, compared to the Prolog-based analysis, offers more manageable execution times and the capability to analyze large models, rendering it more suitable for real-world systems.

As parts of our evaluation are based around artificial scenarios and case studies, we discuss the external, internal, and construct validity, as well as reliability of our evaluation, as characterized by runeson2012case. Our main threat to external validity is the limited generalizability due to the case study-based evaluation. We try to mitigate this threat by using well-known case studies from literature to evaluate and compare accuracy. For the evaluation of scalability, the models were programmatically generated to only scale and focus on individual aspects of the models and analysis.

A threat to the internal validity of our evaluation of scalability is that, due to the use of different technologies in both analyses, it was not possible to use the exact same constraints. We mitigate this threat by defining semantically equivalent constraints that find a violation at each node.
Our main threat to construct validity of our scalability evaluation is that it does not comprehensively cover all aspects that influence the execution time. We cannot fully mitigate this threat but have chosen the examined aspects based on the execution logic of both analyses and a previous scalability evaluation of seifermann2022detecting.
To mitigate threats regarding the reliability of our evaluation and to address the lack of replication packages in software architecture research <cit.>, we have published a data set <cit.>. The dataset contains all raw and compiled code artifacts, as well as an Eclipse-based product that already includes the plugins that make up the framework. The product can be used to model DFD or PCM instances and analyze them using our data flow analysis. We also include the raw results of our scalability evaluation and the used case study models.

§ CONCLUSION AND FUTURE WORK

In this paper, we have presented our open and extensible framework for data flow analysis. We have introduced a unified DFD metamodel as a primary software architecture modeling artifact and input for our data flow analysis framework. We have described means that we provide to manually define DFDs as well as automatically derive them from the architecture description language PCM and other third-party representations.

Based on the approach of seifermann2022detecting, we have implemented a Java-based data flow analysis. We described the general architecture of the analysis and provided detailed technical descriptions of the core features. For the analysis, we have defined an extensible intermediate representation of data flows, called transpose flow graphs. We have described how data flows are extracted from input models and how characteristic labels are propagated using our new intermediate representation. To enable the definition of data flow constraints for the analysis, we have defined a new domain-specific language.

We highlight the problems of the Prolog-based analysis of seifermann2022detecting and show in our evaluation, that our Java-based analysis is functionally equivalent to the Prolog-based analysis and can analyze larger system models.

In future work, we aim to further enhance the tooling that makes up our framework.

We also aim to further work on the various framework extensions, like the data protection <cit.> and uncertainty analyses <cit.>
and include more cooperation points of our framework, e.g., with continuous security analysis <cit.>. Lastly, we aim to comprehensively evaluate the overall approach of our framework.

§.§ Acknowledgements

This publication is partially based on the research project SofDCar (19S21002), which is funded by the German Federal Ministry for Economic Affairs and Climate Action. This work was also supported by funding from the topic Engineering Secure Systems of the Helmholtz Association (HGF) and by KASTEL Security Research Labs, the BMBF (German Federal Ministry of Education and Research) grant number 16KISA086 (ANYMOS), and the NextGenerationEU project by the European Union (EU).
We like to thank Felix Schwickerath, Tom Hüller, Daniel Huber, Tizian Bitschi, Anne-Kathrin Hermann, and Nils Niehues for their support in the development of the presented work.

Missing 'biblatex' package
The bibliography requires the 'biblatex' package.

titleDeductive software verification–the key book

titlePrecise Analysis of Purpose Limitation in Data Flow Diagrams

journaltitleJournal of Systems and Software
titleAdopting threat modelling in agile software development projects

titleBritish Airways Faces Significantly Reduced £20M Fine for GDPR Breach
titleaddonThe National Law Review

Gesellschaft für Informatik eV

titleDesigning Automotive Case Studies for Architectural Security Analyses

Gesellschaft für Informatik, Bonn

journaltitleINFORMATIK 2022
titleA Model-Based Framework for Simplified Collaboration of Legal and Software Experts in Data Protection Assessments

titleDataset: An Extensible Framework for Architecture-Based Data Flow Analysis for Information Security

titleHandling environmental uncertainty in design time access control analysis

booktitleInternational Summer School on Generative and Transformational Techniques in Software Engineering
title.QL: Object-Oriented Queries Made Easy

booktitlePioneers and Their Contributions to Software Engineering
titleStructure analysis and system specification
titleGeneral Data Protection Regulation (GDPR)

titleArchitecture-Based Uncertainty Impact Analysis to Ensure Confidentiality

titleA Classification of Software-Architectural Uncertainty regarding Confidentiality

titleModel-based Confidentiality Analysis under Uncertainty

titleModeling Data Flow Constraints for Design-Time Confidentiality Analyses

title35.3 Million Euro Fine for Data Protection Violations in H&M's Service Center
family=International Organization for Standardization,

numberISO/IEC 27000:2018
shorttitleISO/IEC 27000:2018
titleInformation technology — Security techniques — Information security management systems — Overview and vocabulary

Universität Augsburg

titleEin modellgetriebener Ansatz zur Entwicklung informationsflusssicherer Systeme

titleEvaluation Methods and Replicability of Software Architecture Research Objects

titlePerOpteryx: automated application of tactics in multi-objective software architecture optimization

Cambridge, MA

MIT Press

titleModeling and Simulating Software Architectures – The Palladio Approach

John Wiley & Sons

booktitleCase Study Research in Software Engineering: Guidelines and Examples
titleCase Study Research in Software Engineering: Guidelines and Examples

journaltitleJournal of Systems and Software
titleAutomatic extraction of security-rich dataflow diagrams for microservice applications written in Java

titleHow Dataflow Diagrams Impact Software Security Analysis: an Empirical Experiment

titlemicroSecEnD: A Dataset of Security-Enriched Dataflow Diagrams for Microservice Applications

titleContinuous Secure Software Development and Analysis

booktitlearXiv preprint
titleTool-Supported Architecture-Based Data Flow Analysis for Confidentiality

titleA unified model to detect information flow and access control violations in software architectures

titleData-Driven Software Architecture for Analyzing Confidentiality

journaltitleJournal of Systems and Software
titleDetecting violations of access control and information flow policies in data flow diagrams

titleWhat we have learned about fighting defects

titleSolution-aware data flow diagrams for security threat modeling

journaltitleit - Information Technology
titleChecking probabilistic noninterference using JOANA

titleFlaws in Flows: Unveiling Design Flaws via Information Flow Analysis

titleArchitectural optimization for confidentiality under structural uncertainty

journaltitleSIGSOFT Software Engineering Notes
titleTowards a Research Agenda for Understanding and Managing Uncertainty in Self-Adaptive Systems