<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: building-abuse-case-models
description: >-
  Develop abuse case and misuse case models that capture adversary perspectives alongside legitimate use cases, identifying security requirements from threat actor motivations and attack scenarios.
domain: cybersecurity
subdomain: threat-modeling
tags:
  - abuse-cases
  - misuse-cases
  - security-requirements
  - uml
  - threat-scenarios
  - attacker-personas
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190", "T1078", "T1059", "T1098"]
---

# Building Abuse Case Models

## Overview

Abuse case modeling extends traditional use case analysis by adding adversary perspectives —
documenting how threat actors can misuse system functionality. This technique covers abuse
case construction, attacker persona development, and security requirement derivation.

Mode: `[MODE: RED]` — Adversary-perspective misuse scenario modeling.

## Prerequisites

- System use case documentation or user stories
- Understanding of threat actor profiles and motivations
- UML diagramming tool (PlantUML, draw.io) for visualization
- Python 3.10+

## Key Concepts

### Abuse Case Components

| Component | Description | Example |
|-----------|-------------|---------|
| Actor | Legitimate user or threat actor | Customer, Script Kiddie, Insider |
| Use Case | Normal system functionality | "Place Order", "View Account" |
| Abuse Case | Adversary misuse of functionality | "Inject SQL via search", "Scrape PII" |
| Security Use Case | Defensive control | "Validate input", "Rate limit API" |
| Threat Scenario | End-to-end attack narrative | "Attacker exploits IDOR to access other accounts" |

### Attacker Personas

| Persona | Motivation | Capability | Persistence |
|---------|-----------|------------|-------------|
| Script Kiddie | Notoriety | Low (public tools) | Low |
| Cybercriminal | Financial gain | Medium (custom tools) | Medium |
| Insider | Revenge/profit | High (system access) | High |
| Nation State | Intelligence | Very High (0-days) | Very High |
| Hacktivist | Ideology | Medium | Medium |

### Relationship Types

- **<<threatens>>**: abuse case threatens a use case
- **<<mitigates>>**: security use case mitigates an abuse case
- **<<includes>>**: abuse case includes sub-steps
- **<<extends>>**: variation of an abuse case

## Workflow

### Step 1: Enumerate Use Cases

```bash
node scripts/agent.js --action use-cases --input features.json --output use-cases.json
```

### Step 2: Derive Abuse Cases

```bash
# Generate abuse cases from use cases and attacker personas
node scripts/agent.js --action abuse-cases --input use-cases.json --output abuse-cases.json
```

### Step 3: Map Security Requirements

```bash
# Derive security use cases that mitigate abuse cases
node scripts/agent.js --action mitigations --input abuse-cases.json --output security-reqs.json
```

### Step 4: Generate Report

```bash
node scripts/agent.js --action report --input abuse-cases.json --output abuse-report.json
```

## Verification

- [ ] Every use case has at least one corresponding abuse case
- [ ] Attacker personas cover relevant threat actor profiles
- [ ] Abuse cases include threat scenario narratives
- [ ] Security use cases defined for each high-risk abuse case
- [ ] Security requirements traced from abuse case mitigations
- [ ] Abuse case model reviewed by security and development teams

## References

- [OWASP Abuse Case Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Abuse_Case_Cheat_Sheet.html)
- [Misuse Cases — Sindre & Opdahl](https://www.sciencedirect.com/science/article/pii/S0164121204002103)
- [Security Use Cases and Abuse Cases](https://www.microsoft.com/en-us/security/blog/)
