Software Security Modeling based on Petri nets