search menu icon-carat-right cmu-wordmark
Carnegie Mellon University

Software Engineering Institute

Software and Tools

Access and download the software, tools, and methods that the SEI creates, tests, refines, and disseminates. Organizations and individuals worldwide use these technologies and management techniques to improve the results of software projects, the quality and behavior of software systems, and the security and survivability of networked systems.

  • A Platform-Independent Model for DevSecOps

    DevSecOps

    Tim Chick and Joe Yankel present a DevSecOps Platform-Independent Model that uses model-based systems engineering (MBSE) to formalize the practices of DevSecOps pipelines and organize relevant guidance.

    Download

  • SEI Launches Mothra for Big-Data Network Flow Analysis

    Situational Awareness

    The open source Mothra libraries enable big-data analysis engine Apache Spark to process network flow information.

    Download

  • Building on Ghidra: Tools for Automating Reverse Engineering and Malware Analysis

    Reverse Engineering for Malware Analysis

    Jeffrey Gennari and Garret Wassermann talk with Suzanne Miller about Kaiju, a series of tools that they have developed that allows for malware analysis and reverse engineering. Kaiju helps analysts take better advantage of the NSA's Ghidra framework.

    Download

  • Software Assurance Guidance and Evaluation (SAGE) Tool

    The Software Assurance Guidance and Evaluation (SAGE) tool helps an organization assess the security of its systems development and operations practices.

    Download

  • Overview of Practices and Processes of the CMMC 1.0 Assessment Guides (CMMC 1.0)

    This document is intended to help anyone unfamiliar with cybersecurity standards get started with the Department of Defense (DoD) Cybersecurity Maturity Model Certification (CMMC).

    Download

  • Mission-Based Prioritization Tool (Coded)

    An alternate version of the tool to implement the mission-based prioritization of agile backlogs that includes a small amount of Visual Basic code that creates a tab containing the sorted prioritized list and a tab containing features grouped parameters.

    Download

  • Mission-Based Prioritization Tool (Code Free)

    A no-frills tool to implement the mission-based prioritization of agile backlogs that accounts for restrictions on government computers; the results must be manually sorted.

    Download

  • KalKi Platform Main Repository

    Cloud Computing

    KalKi is an IoT platform for allowing untrusted IoT devices to connect to a network in a secure way, protecting both the IoT device and the network from malicious attackers.

    Download

  • SEI-ACE

    Cloud Computing, Edge Computing

    SEI-ACE is an extension of the ACE Working Group proposal to support authentication and authorization of devices in disadvantaged environments.

    Download

  • Foundry

    Cyber Workforce Development

    Foundry is a training asset management portal that organizations can customize to meet unique training needs and that training providers can share content on. Foundry is currently in beta and will be generally available in summer 2019.

    Download

  • GHOSTS

    Cyber Workforce Development

    GHOSTS is a non-player character (NPC) orchestration generator that creates a range of realistic characters who produce network traffic that appears authentic.

    Download

  • Infrastructure as Code: Final Report

    Software Architecture

    This project explored the feasibility of infrastructure as code, developed prototype tools, populated a model of the deployment architecture, and automatically generated IaC scripts from the model.

    Download

  • TopoMojo

    Cyber Workforce Development

    TopoMojo is a topology build and management tool that provides users with the same functionality and connectivity they would experience with real, physical devices.

    Download

  • Supplementary Materials for a Case Study of Analysis Contracts with the ACTIVE tool

    This archive contains the source code of the ACTIVE tool, and models/data from a case study of analysis contracts in two domains: thread scheduling, and battery design.

    Download

  • WELLE-D

    Cyber Workforce Development

    WELLE-D is a wireless traffic transport for wired networks that you can use to create a realistic, virtual wireless network environment.

    Download

  • vTunnel

    Cyber Workforce Development

    vTunnel is a traffic proxy between guest and host networks that allows certain network activity, such as scoring mechanisms, to remain hidden from trainees.

    Download

  • SCALe Collection

    Secure Development

    The CERT Division's Source Code Analysis Laboratory (SCALe) offers conformance testing of C and Java language software systems against the CERT C Secure Coding Standard and the CERT Oracle Secure Coding Standard for Java.

    Download

  • Analysis Pipeline

    Situational Awareness

    The Analysis Pipeline supports inspection of flow records as they are created.

    Download

  • ADIA

    ADIA is a VMware-based appliance used for small-to-medium sized digital investigations.

    Download

  • TopGen

    Cyber Workforce Development

    TopGen is a virtualized application service simulator for offline exercise and training networks.

    Download

  • GreyBox

    Cyber Workforce Development

    GreyBox is a single-host Internet emulator that delivers the experience of connecting to the real Internet so you can avoid the risks of connecting to live systems in your training environment.

    Download

  • CERT quilt

    Situational Awareness

    Quilt is a JavaScript tool used to to build and manage anything from website backends to complex distributed systems.

    Download

  • SeaHorn

    Software Architecture

    SeaHorn is an automated analysis framework for LLVM-based languages.

    Download

  • CERT Linux Forensics Tools Repository

    The CERT Linux Forensics Tools Repository provides many useful packages for cyber forensics acquisition and analysis practitioners.

    Download

  • CERT YAF

    Situational Awareness

    YAF, Yet Another Flowmeter, processes packet data from pcap(3) dumpfiles and exports the flows to IPFIX Collecting Processes or an IPFIX-based file format.

    Download

  • CERT fixbuf

    Situational Awareness

    CERT fixbuf is a compliant implementation of the IPFIX Protocol.

    Download

  • CERT super_mediator

    Situational Awareness

    CERT super_mediator is an IPFIX mediator for use with the YAF and SiLK tools.

    Download

  • MADARA

    MADARA is general-purpose middleware used for distributed timing, control, knowledge and reasoning, and quality-of-service.

    Download

  • GAMS

    GAMS is a distributed operating environment that controls one or more unmanned autonomous systems (UAS).

    Download

  • Pharos

    Reverse Engineering for Malware Analysis

    Pharos is a static binary analysis framework that facilitates the automated analysis of binary programs.

    Download

  • CLANG

    Secure Development

    CERT Thread Safety Analysis in Clang is a tool that uses annotations to declare and enforce thread safety policies in C and C++ programs.

    Download

  • Clang-Tidy

    Secure Development

    Clang-Tidy is Clang-based C++ "linter" tool that provides an extensible framework for diagnosing and fixing typical programming errors.

    Download

  • The CERT Guide to Coordinated Vulnerability Disclosure

    Security Vulnerabilities

    This guide provides an introduction to the key concepts, principles, and roles necessary to establish a successful Coordinated Vulnerability Disclosure process. It also provides insights into how CVD can go awry and how to respond when it does so.

    Download

  • Big Grep

    Security Vulnerabilities

    BigGrep is a tool used to index and search a large corpus of binary files and uses a probabilistic N-gram based approach to balance index size and search speed.

    Download

  • CERT Tapioca

    Security Vulnerabilities

    CERT Tapioca is a network-layer MITM proxy utility that checks for apps that fail to validate certificates and investigates content of network traffic, including HTTP and HTTPS.

    Download

  • CERT SiLK IPset

    Situational Awareness

    CERT SiLK IPset can be used to build and manipulate IPset files.

    Download

  • CERT SiLK

    Situational Awareness

    SiLK is a collection of traffic analysis tools used to facilitate security analysis of large networks.

    Download

  • CERT pyfixbuf

    Situational Awareness

    CERT pyfixbuf is a Python API for libfixbuf that can be used to write applications that collect and export IPFIX.

    Download

  • CERT snarf

    Situational Awareness

    CERT snarf is a distributed alert reporting system that sends send network alert messages.

    Download

  • Nabu

    Reverse Engineering for Malware Analysis

    Nabu is a tool based on the work of NetSimile used for parsing, constructing, and comparing the structural graphs of a large collection of PDF documents.

    Download

  • PDFrankenstein

    Reverse Engineering for Malware Analysis

    PDFrankenstein is a Python tool for bulk malicious PDF feature extraction.

    Download

  • Insider Threat Test Dataset

    Insider Threat

    The Insider Threat Test Dataset is a collection of synthetic insider threat test datasets that provide both background and malicious actor synthetic data.

    Download

  • DMPLC

    DMPLC is the compiler for the DART Modeling and Programming Language (DMPL).

    Download

  • DART

    DART combines model-driven development with evidence-generating analysis for engineering high-assurance software.

    Download

  • CERT BFF

    Security Vulnerabilities

    CERT BFF is a software-testing tool that finds defects in applications that run on Microsoft Windows, Linux, Mac OS X, and other unix-like platforms.

    Download

  • SEI CERT C Coding Standard: Rules for Developing Safe, Reliable, and Secure Systems (2016 Edition)

    Secure Development

    In this online download, the CERT Secure Coding Team describes the root causes of common software vulnerabilities, how they can be exploited, the potential consequences, and secure alternatives.

    Download

  • Report Writer and Security Requirements Finder: User and Admin Manuals

    Reverse Engineering for Malware Analysis

    This report presents instructions for using the Malware-driven Overlooked Requirements (MORE) website applications.

    Download

  • gbtl

    gbtl is a library that provides GraphBLAS API in C++ and common graph algorithms built on top of it.

    Download

  • CERT Resilience Management Model (CERT-RMM) Version 1.2

    CERT-RMM, the foundation for a process improvement approach to operational resilience management, defines the practices needed to manage operational resilience.

    Download

  • CERT netsa-python

    Situational Awareness

    The netsa-python library is a collection of Python routines and frameworks to use when developing analyses using the SiLK toolkit.

    Download

  • CERT iSiLK

    Situational Awareness

    iSiLK is a graphical front-end for the SiLK tools, designed to work with an existing installation of the SiLK analysis suite.

    Download

  • bgpuma

    Security Vulnerabilities

    bgpuma is a tool that looks through BGP update files quickly to find direct matches for CIDR blocks and CIDR blocks that contain the initial set and are contained by the initial set.

    Download

  • QuaBaseBD

    Software Architecture

    QuABaseBD is a linked collection of computer science and software engineering knowledge used specifically for designing big data systems with NoSQL databases.

    Download

  • CERT Orcus

    Situational Awareness

    Orcus is a system for analyzing passively-collected DNS information. It includes a capability for analyzing all DNS information that has been seen (the “resource record database”), as well as a faster name-to-address mapping with daily resolution (the “na

    Download

  • Spacer

    Reverse Engineering for Malware Analysis

    Spacer is an algorithmic framework for SMT-based software model checking using proofs and counterexamples.

    Download

  • MZSRM

    MZSRM is a zero-slack rate monotonic scheduler that has been simplified for verification.

    Download

  • ERACES

    Software Architecture

    ERACES is a collection of methods and tools for reducing complexity in software models.

    Download

  • KD-Cloudlet

    Edge Computing

    Cloudlets are discoverable, generic, stateless servers located in single-hop proximity of mobile devices that can operate in disconnected mode and are virtual-machine based.

    Download

  • Rosecheckers

    Secure Development

    Rosecheckers is a tool that performs static analysis on C/C++ source files to enforce the rules in the CERT C Coding Standard.

    Download

  • Architecture Analysis and Design Language (AADL) Tool

    Software Architecture

    AADL provides a framework for analyzing system designs and supports architecture-centric, model-based development through the system lifecycle.

    Download

  • CERT Dranzer

    Security Vulnerabilities

    Dranzer is a tool that enables users to examine effective techniques for fuzz testing ActiveX controls.

    Download

  • DidFail

    Secure Development

    DidFail uses static analysis to detect potential leaks of sensitive information within a set of Android apps.

    Download

  • MCDA

    MCDA formally verifies the correctness, safety or other critical properties of distributed algorithm implementations before they are deployed.

    Download

  • CERT Prism

    Situational Awareness

    Prism is a tool for visualizing flow data as a time series, broken down into several configurable bins by SiLK's rwfilter tool.

    Download

  • Compiler-Enforced Buffer Overflow Elimination

    Secure Development

    This tool prevents buffer overflows from succeeding in multithreaded code using static and dynamic analysis.

    Download

  • OSATE

    Software Architecture

    OSATE is an open-source tool platform to support AADL.

    Download

  • CERT Stix2Cif

    Situational Awareness

    CERT Stix2Cif parses STIX/Cybox documents into JSON CIF feed files with corresponding configuration files and feeds them to CIF.

    Download

  • CERT Triage Tools

    Security Vulnerabilities

    CERT Triage Tools consist of a triage script and a GNU Debugger (GDB) extension named 'exploitable' that classify Linux application defects by severity.

    Download

  • CERT Cif2Stix

    Situational Awareness

    CERT Cif2Stix is a plug-in for CIF that takes JSON object or file inputs and outputs STIX/CyBox documents.

    Download

  • CERT Rayon

    Situational Awareness

    CERT Rayon is a Python library and set of tools that generates basic two-dimensional statistical visualizations.

    Download

  • Controls Systems Code Samples Download

    Insider Threat

    The Controls Systems Code Samples help an organization protect text-based intellectual property, including source code repositories.

    Download

  • Mobile SCALe: Rules and Analysis for Secure Java and Android Coding

    Secure Development

    In this report, the authors describe Android secure coding rules, guidelines, and static analysis developed as part of the Mobile SCALe project.

    Download

  • SQUARE Instructional Materials

    Cybersecurity Engineering

    SQUARE instructional materials are designed for teaching the SQUARE method.

    Download

  • Introduction to the Mission Thread Workshop

    Software Architecture

    This report introduces the Mission Thread Workshop, a method for understanding architectural and engineering considerations for developing and sustaining systems of systems. It describes the three phases of the workshop and explains the steps of each.

    Download

  • CERT FOE

    Security Vulnerabilities

    Failure Observation Engine (FOE) is a mutational file-based fuzz testing tool for finding defects in applications that run on the Windows platform.

    Download

  • CERT JIRA Plugins

    CERT JIRA Plugins consist of Automated Task Creator, Email Attachment Handler, and Common Code.

    Download

  • SMART Materials

    Software Architecture

    SMART materials help organizations make better decisions on their paths to adopting a service-oriented architecture.

    Download

  • A Framework for Software Product Line Practice, Version 5.0

    Software Architecture

    This document describes the activities and practices in which an organization must be competent before it can benefit from fielding a product line of software systems.

    Download

  • Secure Coding Validation Suite

    Secure Development

    The Secure Coding Validation Suite is a tool that performs a set of tests to validate the rules defined in ISO Technical Specification 17961.

    Download

  • Source Code Analysis Laboratory (SCALe)

    Secure Development

    In this report, the authors describe the CERT Program's Source Code Analysis Laboratory (SCALe), a conformance test against secure coding standards.

    Download

  • Mission Risk Diagnostic (MRD) Method Description

    Cybersecurity Engineering

    In this report, the authors describe the Mission Risk Diagnostic (MRD) method, which is used to assess risk in systems across the lifecycle and supply chain.

    Download

  • Smart Grid Maturity Model Assets Collection, Version 1.2

    These are the assets related to version 1.2 of the Smart Grid Maturity Model.

    Download

  • CERT SQUARE for Privacy (P-SQUARE)

    Cybersecurity Engineering

    P-SQUARE was designed for stakeholders, requirements engineers, and administrators and supports the security and privacy aspects of SQUARE.

    Download

  • CERT IPA

    Security Vulnerabilities

    CERT IPA is an IP address annotation system that provides a repository of IP address information and related tools for accessing the data.

    Download

  • CERT SQUARE for Acquisition (A-SQUARE)

    Cybersecurity Engineering

    SQUARE-A is designed for stakeholders, requirements engineers, and contractors/vendors to use in acquisitions and provides documentation support for a variety of use cases.

    Download

  • Measurement and Analysis Infrastructure Diagnostic, Version 1.0: Method Definition Document

    This 2010 report is a guidebook for conducting a Measurement and Analysis Infrastructure Diagnostic (MAID) evaluation.

    Download

  • As-If Infinitely Ranged Integer Model, Second Edition

    Secure Development

    In this report, the authors present the as-if infinitely ranged (AIR) integer model, a mechanism for eliminating integral exceptional conditions.

    Download

  • Measurement and Analysis Infrastructure Diagnostic (MAID) Evaluation Criteria, Version 1.0

    This 2009 report presents the criteria used during a MAID evaluation that serve as a checklist to rate the quality of an organization's measurement and analysis practices and the quality of the measurement information that results from the implementation of those practices.

    Download

  • As-if Infinitely Ranged Integer Model

    Secure Development

    In this report, the authors present the as-if infinitely ranged (AIR) integer model, which eliminates integer overflow and integer truncation in C and C++ code.

    Download

  • SMART: Analyzing the Reuse Potential of Legacy Components in a Service-Oriented Architecture Environment

    Is legacy system migration feasible for your organization as a means of SOA adoption? The Service Migration and Reuse Technique (SMART) assists an organization in determining what to migrate, the steps needed, and the costs involved.

    Download

  • Copper

    Copper is a software model checker that can be used to verify whether a concurrent C program satisfies its safety, reliability, or security requirements.

    Download

  • Introducing OCTAVE Allegro: Improving the Information Security Risk Assessment Process

    In this 2007 report, the authors highlight the design considerations and requirements for OCTAVE Allegro based on field experience.

    Download

  • Attribute-Driven Design (ADD), Version 2.0

    Software Architecture

    This report revises the steps of the Attribute-Driven Design (ADD) method and offers practical guidelines for carrying out each step.

    Download

  • Acquisition Strategy Development Tool

    The Acquisition Strategy Development Tool is a customized Excel workbook that helps acquisition planners work through their method and techniques.

    Download

  • QUASAR: A Method for the Quality Assessment of Software-Intensive System Architectures

    This 2006 handbook documents the QUASAR (QUality Assessment of System ARchitectures) method for assessing the quality of the architecture of a software-intensive system.

    Download

  • Views and Beyond Documentation Template

    Software Architecture

    A Microsoft Word template for a software architecture document is available for free download.

    Download

  • Quality Attribute Workshops (QAWs), Third Edition

    Software Architecture

    This report describes the newly revised QAW (Quality Attribute Workshop) and describes potential uses of the refined scenarios generated during it.

    Download

  • Identifying Commercial Off-the-Shelf (COTS) Product Risks: The COTS Usage Risk Evaluation

    This 2003 report describes the development of an approach to reduce the number of program failures attributable to COTS software: the COTS Usage Risk Evaluation (CURE).

    Download

  • Active Reviews for Intermediate Designs

    Software Architecture

    This 2000 technical note describes Active Review for Intermediate Designs (ARID), a piloted software design review technique.

    Download

  • ATAM: Method for Architecture Evaluation

    Software Architecture

    This report presents technical and organizational foundations for performing architectural analysis, and presents the SEI's ATAM, a technique for analyzing software architectures.

    Download

  • Goal-Driven Software Measurement: A Guidebook

    The materials in this 1996 guidebook are designed to help you identify, select, define, and implement software measures to support your business goals.

    Download