Validating Threat Modeling Results with the Help of Vulnerable Test Applications

Technical Summary: Validating Threat Modeling Results with Vulnerable Test Applications

Problem Statement
Validating the results of threat modeling remains a significant challenge in security engineering. While threat modeling is a well-established "security-by-design" practice for identifying potential threats early, objectively assessing the quality of a generated threat model is difficult. Current validation methods typically rely on comparing the output against an expert-produced reference model or a human baseline. However, these approaches inherit the limitations of the reference itself: experts may disagree, operate at different abstraction levels, or simply miss relevant threats. Consequently, there is a lack of an external, objective "oracle" to judge the completeness of threat models without relying solely on subjective human judgment.

Methodology
To address this, the authors propose and evaluate a vulnerability-grounded validation approach. Instead of comparing against another human model, this method uses intentionally vulnerable applications with a known set of vulnerabilities as a ground-truth oracle. The core research question is: To what extent can threats produced by threat modeling tools, given architecture, Data Flow Diagrams (DFD), and general descriptions as input, cover the known vulnerabilities in the analyzed applications?

The study compares two tools:

1. ThreMoLIA: An LLM-assisted threat modeling solution developed by the authors. It utilizes Retrieval-Augmented Generation (RAG) to incorporate project documentation, high-level architecture, and DFDs. It supports traditional frameworks (STRIDE, LINDDUN, OWASP Top 10, MITRE ATT&CK) and AI-specific frameworks (MITRE ATLAS, OWASP Top 10 ML, OWASP Top 10 LLM).
2. Microsoft Threat Modeling Tool (MTMT): A widely used, STRIDE-based tool grounded in Microsoft SDL practices.

The experiment utilized two benchmark applications:

• AzureGoat: A vulnerable-by-design Azure infrastructure containing 7 known vulnerabilities (web and cloud misconfigurations).
• VulnBank: A deliberately vulnerable banking application containing 63 known vulnerabilities (web, API, and AI-integrated flaws).

Experimental Procedure

• Inputs: Both tools received the same inputs: architecture diagrams, DFDs, and descriptions. The known vulnerability lists were withheld during the modeling phase and used only for scoring.
• Configuration:
  • MTMT was executed once per application.
  • ThreMoLIA was run using the GPT-5 model via OpenAI API. It was tested in multiple configurations: 0-shot (DFD only), 1-shot (DFD + documentation), 2-shot (DFD + additional documentation), and a merged result of 1-shot and 2-shot.
  • To mitigate LLM variability, ThreMoLIA was run three times per configuration, and results were aggregated.
• Metric: The primary metric was Threat Coverage, defined as the ratio of known vulnerabilities covered by at least one modeled threat to the total number of known vulnerabilities ($V_{covered} / V_{known}$). A vulnerability was considered "covered" if an expert determined that a modeled threat semantically described the vulnerability or the condition enabling its exploitation. The study notes that false positives (hallucinations) were removed during the LLM-powered validation step, and valid threats without corresponding vulnerabilities were not penalized, as threat modeling has no theoretical upper limit on valid threats.

Key Results
The results, summarized in Table I of the paper, demonstrate that ThreMoLIA achieved higher vulnerability coverage than MTMT across both applications:

• AzureGoat: ThreMoLIA achieved 100% coverage (7/7 vulnerabilities), whereas MTMT covered 57.1% (4/7).
• VulnBank:
  • ThreMoLIA (0-shot) covered 73.0% (46/63), already outperforming MTMT.
  • ThreMoLIA (1-shot) reached 85.7% (54/63).
  • ThreMoLIA (2-shot) reached 82.5% (52/63).
  • ThreMoLIA (Merged 1+2) achieved 92.1% (58/63).
  • MTMT covered 55.6% (35/63).
• Specific Findings: MTMT performed well on conventional session management and client-side flaws but missed all 10 AI customer support vulnerabilities in VulnBank. In contrast, the best ThreMoLIA configurations covered all 10 AI vulnerabilities and all 9 authentication/authorization vulnerabilities.
• Overall: The best ThreMoLIA configuration covered 92.9% (65/70) of total vulnerabilities across both apps, compared to 55.7% (39/70) for MTMT.

Significance and Claims
The paper claims that vulnerable test applications provide a practical benchmark for assessing threat coverage, offering a measurable alternative to expert-only baselines. By shifting the evaluation from "Did the tool match a specific expert report?" to "Did the tool cover weaknesses actually present in the system?", the approach reduces reliance on subjective human consensus.

The study highlights that while MTMT remains effective for standard, STRIDE-style architectural concerns, ThreMoLIA is better suited for mixed application landscapes that combine conventional and AI-related attack surfaces. The results suggest that LLM-assisted modeling, particularly when augmented with project documentation (prompting strategies), can significantly improve the discovery of complex and AI-specific vulnerabilities.

Limitations and Future Work
The authors acknowledge several limitations:

1. Coverage is only one dimension of quality; high recall does not guarantee the absence of irrelevant threats.
2. The merged ThreMoLIA result is not strictly cost-equivalent to a single deterministic MTMT run.
3. The study was limited to only two applications.
4. There is a risk that the GPT-5 model was trained on data from these specific vulnerable applications, though the authors mitigated this by renaming the applications in the inputs.

The paper concludes that vulnerability-grounded validation is a useful complement to expert baselines. The authors plan to extend this methodology to telecommunications environments (including 5G core networks and cloud-native infrastructure) and intend to release ThreMoLIA as open source.