Specifying Deception Requirements with iStar - Celestino, Ricardo Antônio Rebouças; Carvalho, Jhonatan de Sousa; Gonçalves, Enyo; Maia, Paulo Henrique Mendes (Anais do Simpósio Brasileiro de Cibersegurança (SBSeg), 2026)
Cybersecurity plays a central role in software development. Deception-based defense is a cybersecurity subfield in which actions are intentionally employed to cause misrepresentation and induce erroneous inferences on attackers. Deception can be employed at different levels of computation, from network to application-level, which demands careful planning and coordination between multiple strategies and tactics. The specification of such systems is essential to the successful development of software projects. This paper proposes a goal-oriented requirements engineering approach for representing systems with cyber deception requirements, called iStar4Deception. The development of this approach followed the PRISE process to ensure conceptual rigor, compatibility with native iStar, and the reuse of well-established extensions documented in the iStar Extension Catalog and supported by piStar-EXT. To demonstrate the applicability of iStar4Deception, we conducted a real-world case study of a Brazilian bank slip payment system in which cyber deception mechanisms and automated redirection of malicious traffic are strategically deployed not only to detect, delay, and analyze attacks but also to preserve critical assets. The results show that the proposed extension enables a systematic modeling of deception-oriented goals, dependencies, and qualities, providing analysts with a structured approach to integrating cyber deception strategies into goal-oriented requirements models.