[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-84032-en":3,"doc-seo-84032-105":29,"detail-sidebar-cat-0-en-105":90},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":20,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},84032,13056703019404,"Miles","https://ap-avatar.wpscdn.com/davatar_29158cc5080c5b710cf443261637dec0",8,"Research & Report","xDECAF An Extensible Data Flow Diagram Analysis Framework for Information Security","xDECAF is an extensible tool for architecture-based data flow analysis focused on information security. It combines an extended data flow diagram metamodel using labeled flows and nodes, a domain-specific constraint language supporting flow operations, and a browser-based editor backed by an analysis engine. The paper introduces the xDECAF tool library and a curated catalog of 20+ example models with documented constraints and expected violations as a reusable community dataset. Tool, dataset, and a hosted online editor are publicly available.","xDECAF: An Extensible Data Flow Diagram Analysis Framework  \nfor Information Security  \nBenjamin Arp  \n[benjamin.arp@kit.edu](benjamin.arp@kit.edu)[ ](benjamin.arp@kit.edu)Karlsruhe Institute of Technology Germany  \nFelix Schwickerath  \n[felix.schwickerath@student.kit.edu](felix.schwickerath@student.kit.edu)[ ](felix.schwickerath@student.kit.edu)Karlsruhe Institute of Technology Germany  \nAlexander Vogt  \n[alexander.vogt@student.kit.edu](alexander.vogt@student.kit.edu)[ ](alexander.vogt@student.kit.edu)Karlsruhe Institute of Technology Germany  \nTom Hüller  \n[tom.hueller@student.kit.edu](tom.hueller@student.kit.edu)[ ](tom.hueller@student.kit.edu)Karlsruhe Institute of Technology Germany  \nNils Niehues  \n[nils.niehues@kit.edu](nils.niehues@kit.edu)[ ](nils.niehues@kit.edu)Karlsruhe Institute of Technology Germany  \nNicolas Boltz  \n[nicolas.boltz@kit.edu](nicolas.boltz@kit.edu)[ ](nicolas.boltz@kit.edu)Karlsruhe Institute of Technology Germany  \narXiv :2607 .059 13v 1 [ cs . SE] 7 Jul 2026  \nAbstract  \nxdecaf is an extensible tool for architecture-based data flow analysis with a focus on information security. It combines an extended data flow diagram metamodel of labeled flows and nodes, a domainspecific constraint language with different flow operations, and a browser-based editor backed by an analysis engine. In this paper, we present the xdecaf tool library and a curated catalog of over 20 example models with documented constraints and expected violations, intended as a reusable dataset for the community. The tool has already been adopted by several research lines, providing concrete evidence of its utility. The tool, dataset, and a hosted online editor are publicly available.  \nScreencast: [https://youtu.be/L-PGdWoPtlw](https://youtu.be/L-PGdWoPtlw)  \nCode & Dataset: [https://github.com/DataFlowAnalysis](https://github.com/DataFlowAnalysis) • [https://doi.org/10.5281/zenodo.20083877](https://doi.org/10.5281/zenodo.20083877)  \nKeywords  \nData Flow Diagram, Data Flow Analysis, Propagation, Constraint Language, Example Catalogue, Tooling, Web Editor  \nACM Reference Format:  \nBenjamin Arp, Felix Schwickerath, Alexander Vogt, Tom Hüller, Nils Niehues, and Nicolas Boltz. 2026. xDECAF: An Extensible Data Flow Diagram Analysis Framework for Information Security. In Proceedings of 41st IEEE/ACM International Conference on Automated Software Engineering (ASE ’26). ACM, New York, NY, USA, 4 pages. [https://doi.org/XXXXXXX.XXXXXXX](https://doi.org/XXXXXXX.XXXXXXX)  \n1 Introduction  \nModern software systems increasingly shape critical parts of everyday life and are rarely confined to a single technical or organizational setting. They commonly span organizational boundaries, heterogeneous technologies, and multiple regulatory contexts, which makes it necessary to assess them systematically against security and compliance requirements. To reason about such properties at  \nPermission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission [and/or a fee. Request permissions from permissions@acm.org](and/or a fee. Request permissions from permissions@acm.org).  \nASE’26, Munich, Germany  \n© 2026 Copyright held by the owner/author(s) . Publication rights licensed to ACM. ACM ISBN 978-1-4503-XXXX-X/2018/06  \n[https://doi.org/XXXXXXX.XXXXXXX](https://doi.org/XXXXXXX.XXXXXXX)  \ndesign time, Data Flow Diagrams (DFDs) are a common notation for representing the structure of relevant parts of a system [20, 27] .  \nIn this tool paper, we present xdecaf, a DFD-based extensible framework for security mo","cbCaiaQw6jd8OOUI","https://ap.wps.com/l/cbCaiaQw6jd8OOUI","pdf",641726,4,1,"English","en",105,"# Introduction\n## Data Flow Diagrams for Security Modeling\n## xDECAF Framework Capabilities\n## Artifacts and Dataset Overview","[{\"question\":\"What is xDECAF designed to do?\",\"answer\":\"xDECAF provides an extensible, DFD-based framework for security modeling and automated information security analysis.\"},{\"question\":\"Which main components does xDECAF include?\",\"answer\":\"It includes an extended DFD metamodel with labeled flows and nodes, a domain-specific constraint language for flow operations, and a browser-based editor supported by an analysis engine.\"},{\"question\":\"What does the paper contribute to the research community?\",\"answer\":\"It provides a reusable tool library and a curated dataset of 20+ example models with documented constraints and expected violations, along with a hosted online editor.\"}]",1784192145,10,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":85,"head_meta":87,"extra_data":89,"updated_unix":27},"xdecaf-an-extensible-data-flow-diagram-analysis-framework-for-information-security","",{"@graph":35,"@context":84},[36,52,67],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":20},"https://docshare.wps.com/document/xdecaf-an-extensible-data-flow-diagram-analysis-framework-for-information-security/84032/",{"url":51,"name":13,"@type":53,"author":54,"headline":13,"publisher":56,"fileFormat":59,"inLanguage":23,"description":14,"dateModified":60,"datePublished":61,"encodingFormat":59,"isAccessibleForFree":62,"interactionStatistic":63},"DigitalDocument",{"name":9,"@type":55},"Person",{"url":40,"name":57,"@type":58},"DocShare","Organization","application/pdf","2026-07-27","2026-07-16",true,{"@type":64,"interactionType":65,"userInteractionCount":20},"InteractionCounter",{"@type":66},"ViewAction",{"@type":68,"mainEntity":69},"FAQPage",[70,76,80],{"name":71,"@type":72,"acceptedAnswer":73},"What is xDECAF designed to do?","Question",{"text":74,"@type":75},"xDECAF provides an extensible, DFD-based framework for security modeling and automated information security analysis.","Answer",{"name":77,"@type":72,"acceptedAnswer":78},"Which main components does xDECAF include?",{"text":79,"@type":75},"It includes an extended DFD metamodel with labeled flows and nodes, a domain-specific constraint language for flow operations, and a browser-based editor supported by an analysis engine.",{"name":81,"@type":72,"acceptedAnswer":82},"What does the paper contribute to the research community?",{"text":83,"@type":75},"It provides a reusable tool library and a curated dataset of 20+ example models with documented constraints and expected violations, along with a hosted online editor.","https://schema.org",{"og:url":51,"og:type":86,"og:title":13,"og:site_name":57,"og:description":14},"article",{"robots":88,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":91},[92,96,100,104,109,114,119,122,127,130,133],{"id":21,"doc_module":4,"doc_module_name":45,"category_name":93,"show_sort_weight":94,"slug":95},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":97,"show_sort_weight":98,"slug":99},"Literature",80,"literature",{"id":20,"doc_module":4,"doc_module_name":45,"category_name":101,"show_sort_weight":102,"slug":103},"Exam",70,"exam",{"id":105,"doc_module":4,"doc_module_name":45,"category_name":106,"show_sort_weight":107,"slug":108},5,"Comic",60,"comic",{"id":110,"doc_module":4,"doc_module_name":45,"category_name":111,"show_sort_weight":112,"slug":113},6,"Technology",50,"technology",{"id":115,"doc_module":4,"doc_module_name":45,"category_name":116,"show_sort_weight":117,"slug":118},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":120,"slug":121},30,"research-report",{"id":123,"doc_module":4,"doc_module_name":45,"category_name":124,"show_sort_weight":125,"slug":126},9,"Religion & Spirituality",20,"religion-spirituality",{"id":125,"doc_module":4,"doc_module_name":45,"category_name":128,"show_sort_weight":125,"slug":129},"World Cup","world-cup",{"id":28,"doc_module":4,"doc_module_name":45,"category_name":131,"show_sort_weight":28,"slug":132},"Lifestyle","lifestyle",{"id":134,"doc_module":4,"doc_module_name":45,"category_name":135,"show_sort_weight":105,"slug":136},19,"General","general"]