1. A method for generating a threat model for a software application, comprising: receiving application modeling data in a user interface, the application modeling data defines a software application that includes components and one or more calls, a call identifies a caller, first data affected by the call, an action taken by the caller with respect to the first data, and at least one of the components affected by the action of the caller; providing, in the user interface, a list of pre-defined attributes that are relevant to threats; receiving a selection of at least one of the pre-defined attributes, the selection associating the selected pre-defined attribute with a first component of the components; determining allowable actions based on the definitions of the calls in the application modeling data; automatically generating threat information based on the application modeling data, the allowed actions, the selected at least one pre-defined attribute, and an attack library, the attack library includes attacks that are associated with the pre-defined attributes, the automatically generating threat information includes identifying attacks in the attack library that are associated with the selected pre-defined attribute; and providing, in the user interface, countermeasures associated with the threat information.
7. The method of claim 1 , further comprising determining un-allowable actions based on the allowable actions, wherein the determining un-allowable actions includes: determining an illegal execution that is a variation of one of the allowed actions.