bluuebunny/crossref_metadata_2025 huggingface dataset:
Enabling control over adaptive program transformation for dynamically evolving mobile software validation
Authors: Jochen Mike , Anteneh Anteneh Addis , Pollock Lori L. , Marvel Lisa M.
Published: November 2005

Many researchers are investigating the use of adaptive program transformation as a way to efficiently improve program performance. Performance improving transformations are performed at runtime to adapt to the possibly changing runtime characteristics of the program. Leveraging this kind of program transformation on multiple hosts can achieve these same performance gains while reducing the overhead to apply the transformations on the local machine running the program. The reduction in overhead is obtained by distributing the responsibilities for the transformation process to multiple hosts throughout the network. The use of this technology could greatly benefit applications running on networked computation nodes; however, one must first establish confidence in the secure generation and distribution of the transformed versions of the original program before acceptance and execution can occur for many network environments.Since programs are being transformed dynamically, traditional program validation methods such as checksums and digital signatures will be unable to efficiently meet the security needs of this possibly itinerant, transforming software. New validation methods must be developed in order to allow future software to avail itself of the advantages that dynamic program modification may provide while mitigating potential security risks. In this paper, we present our framework to validate dynamically-transforming software in a manner that enables the system to restrict how the software can transform as it executes on a network of hosts. Our prototype system utilizes specification languages to communicate program transformations and controls for those transformations on hosts in the system. This first step towards validating evolving mobile code before transformation occurs, will make dynamically-transforming software a safe and viable future technology.
Matching attack patterns to security vulnerabilities in software-intensive system designs
Authors: Gegick Michael , Williams Laurie
Published: November 2005

Fortifying software applications from attack is often an effort that occurs late in the software development process. Applying patches to fix vulnerable applications in the field is a common approach to securing applications. Abstract representations of attacks such as attack trees and attack nets can be used for identifying potential threats before a system is released. We have constructed attack patterns that can illuminate security vulnerabilities in a software-intensive system design. Matching our attack patterns to vulnerabilities in the design phase may stimulate security efforts to start early and to become integrated with the software process. The intent is that our attack patterns can be used to effectively encode software vulnerabilities in vulnerability databases. A case study of our approach with undergraduate students in a security course indicated that our attack patterns can provide general descriptions of vulnerabilities. The students were able to accurately map the patterns to vulnerabilities in a system design.
Requirements traceability to support evolution of access control
Authors: Verhanneman Tine , Piessens Frank , De Win Bart , Joosen Wouter
Published: November 2005

One of the hurdles in the enforcement of access control remains the translation of the organization's high level policy, that drives the access control decisions, down to technology specific deployment descriptors, configuration files and code. This huge gap between the high level policy and the access logic has as a consequence that it is hard to trace implementation fragments to the actual requirement they contribute to, and to support evolution. The notion of an
access interface
is introduced as a contract between the authorization engine and the various applications using its services. A so-called
view connector
makes sure that the application behaves consistently with this contract. The implementation is based on aspect orientation, rendering the whole design more robust in the light of unanticipated changes.
Security quality requirements engineering (SQUARE) methodology
Authors: Mead Nancy R. , Stehney Ted
Published: November 2005

Requirements engineering, a vital component in successful project development, often neglects sufficient attention to security concerns. Further, industry lacks a useful model for incorporating security requirements into project development. Studies show that upfront attention to security saves the economy billions of dollars. Industry is thus in need of a model to examine security and quality requirements in the development stages of the production lifecycle.In this paper, we examine a methodology for both eliciting and prioritizing security requirements on a development project within an organization. We present a model developed by the Software Engineering Institute's Networked Systems Survivability (NSS) Program, and then examine two case studies where the model was applied to a client system. The NSS Program continues to develop this useful model, which has proven effective in helping an organization understand its security posture.
Using dynamic information flow analysis to detect attacks against applications
Authors: Masri Wes , Podgurski Andy
Published: November 2005

This paper presents a new approach to using dynamic information flow analysis to detect attacks against application software. The approach can be used to reveal and, under some conditions, to prevent attacks that violate a specified information flow policy or exhibit a known information flow signature. When used in conjunction with automatic cluster analysis, the approach can also reveal novel attacks that exhibit unusual patterns of information flows. A set of prototype tools implementing the approach have been developed for Java byte code programs. Case studies in which this approach was applied to several subject programs are described.
Improving system dependability by enforcing architectural intent
Authors: Abi-Antoun Marwan , Aldrich Jonathan , Garlan David , Schmerl Bradley , Nahas Nagi , Tseng Tony
Published: November 2005

Developing dependable software systems. requires enforcing conformance between architecture and implementation during software development and evolution. We address this problem with a multi-pronged approach: (a) automated refinement of a component-and-connector (C&C) architectural view into an initial implementation, (b) enforcement of architectural structure at the programming language level, (c) automated abstraction of a C&C view from an implementation, and (d) semi-automated incremental synchronization between the architectural and the implementation C&C views.We use an Architecture Description Language (ADL), Acme, to describe the architecture, and ArchJava, an implementation language which embeds a C&C architecture specification within Java implementation code. Although both Acme and ArchJava specify C&C views, a number of structural differences may arise. Our approach can detect structural differences which correspond directly to implementation-level violations of the well thoughtout architectural intent. Furthermore, supplementing the C&C view extracted from the implementation with architectural types and styles can uncover additional violations.
An architectural pattern for non-functional dependability requirements
Authors: Xu Lihua , Ziv Hadar , Richardson Debra , Alspaugh Thomas A.
Published: November 2005

We address the research question of transforming dependability requirements into corresponding software architecture constructs. by proposing first that dependability needs can be classified into three types of requirements and second, an architectural pattern that allows requirements engineers and architects to map dependability requirements into three corresponding types of architectural components. The proposed pattern is general enough to work with existing requirements techniques and existing software architectural styles, including enterprise and product-line architectures.
Specifying adaptation semantics
Authors: Zhang Ji , Cheng Betty H. C.
Published: November 2005

Computer software must dynamically adapt to changing conditions. In order to fully realize the benefit of dynamic adaptation, it must be performed correctly. The correctness of adaptation cannot be properly addressed without precisely specifying the requirements for adaptation. This paper introduces an approach to formally specifying adaptation requirements in temporal logic. We introduce A-LTL, an adaptation-based extension to linear temporal logic, and use this logic to specify three commonly used adaptation semantics. Neighborhood composition and sequential composition techniques are developed and applied to A-LTL to construct the specification of an adaptive system. We introduce adaptation semantics graphs to visually present the adaptation semantics. Specifications for adaptive systems can be automatically generated from adaptation semantics graphs.
A framework for analyzing exception flow in software architectures
Authors: Filho Fernando Castor , Brito Patrick H. S. , Rubira Cecília Mary F.
Published: November 2005

We present Aereal, a framework for analyzing exception flow in architecture descriptions. Aereal works as a customizable architectural-level exception handling system that can be further constrained or have some of its rules relaxed. Since different architectural styles have different policies for exception flow, Aereal makes it possible to specify rules on how exceptions flow in a given style and to check for violations of these rules. As enabling technologies. Aereal uses Alloy, a first-order relational language, ACME, an interchange language for architecture description, and their associated tool sets.
Failure modelling in software architecture design for safety
Authors: Wu Weihang , Kelly Tim
Published: November 2005

In mission-critical industries, early feedback on the safety properties of a software system is critical and cost effective. This paper presents a compositional method for failure analysis of a system based on the proposed software architecture. This method is based upon the use of CSP as the failure modelling language and its associated tools as failure analysis. Preliminary findings from the application of this approach are also presented.
Architectural runtime configuration management in support of dependable self-adaptive software
Authors: Georgas John C. , van der Hoek André , Taylor Richard N.
Published: November 2005

The dynamic nature of some self-adaptive software systems can result in potentially unpredictable adaptations, which may be detrimental to overall system dependability by diminishing trust in the adaptation process. This paper describes our initial work with architectural runtime configuration management in order to improve dependability and overall system usefulness by maintaining a record of reconfigurations and providing support for architectural recovery operations. Our approach---fully decoupled from self-adaptive systems themselves and the adaptation management processes governing their changes---provides for better adaptation visibility and self-adaptive process dependability. We elaborate on the vision for our overall approach, present early implementation and testing results from prototyping efforts, and discuss our future plans.
A UAU test and development environment based on dynamic system reconfiguration
Authors: Rawashdeh Osamah A. , Chandler Garrett D. , Lumpp James E.
Published: November 2005

This paper describes ongoing research to develop a framework for implementing dynamically reconfiguring avionics and control systems for unmanned aerial vehicles (UAVs) and a test and development environment for experimental UAVs. The framework supports
graceful degradation
, where hardware and software failures cause a reduction in the quality or capability of the control system but does not result in total system failure. The approach uses a graphical specification representing modular software interdependencies and a runtime system manager that reconfigures the system. The techniques are currently being applied to the design of UAV control systems as part of the BIG BLUE Mars airplane testbed project at the University of Kentucky.
Representing design tradeoffs in safety-critical systems
Authors: Morris Jennifer , Koopman Philip
Published: November 2005

Different fault-tolerance strategies have been shown to be effective at achieving fail-safe behavior in a number of safety-critical application domains with different dependability, service, and cost requirements. A technique for comparing the domain profiles and their fault-tolerance strategies could assist architects of new safety-critical systems in choosing an appropriate fault-tolerance strategy. We suggest an approach using Kiviat graphs to visually represent the dependability, service, and cost profile of a system, and show how such a graph can be used to analyze automotive x-by-wire applications.
An approach for categorizing end user programmers to guide software engineering research
Authors: Scaffidi Christopher , Shaw Mary , Myers Brad
Published: November 2005

Over 64 million Americans used computers at work in 1997, and we estimate this number will grow to 90 million in 2012, including over 55 million spreadsheet and database users and 13 million self-reported programmers. Existing characterizations of this end user population based on software usage provide minimal guidance on how to help end user programmers practice better software engineering. We describe an enhanced method of characterizing the end user population, based on categorizing end users according to the ways they represent abstractions. Since the use of abstraction can facilitate or impede achieving key software engineering goals (such as improving reusability and maintainability), this categorization promises an improved ability to highlight niches of end users with special software engineering capabilities or struggles. We have incorporated this approach into an in-progress survey of end user programming practices.
Naming page elements in end-user web automation
Authors: Bolin Michael , Miller Robert C.
Published: November 2005

The names of commands and objects are vital to the usability of a programming system. We are developing a web automation system in which users need to identify web page elements, such as hyperlinks and form fields, in pages written by other designers. Using a survey of 40 users asking them to provide names for page elements, we found that users' names varied widely. However, when names were restricted to using only visible words from the web page. we were able to develop name resolution techniques that automatically find the desired page element given the user's name for it, striking a balance between usability and the precision required by the programming system.
Heuristics for the automatic identification of irregularities in spreadsheets
Authors: Clermont Markus
Published: November 2005

Spreadsheet programs turned out to be the most popular end-user programming environment that has ever been released. Important decisions are based on the results of spreadsheet programs and the list of known errors with large impact is growing daily- although it surely is only the top of an iceberg.One way out of the crisis might be the introduction of software engineering techniques into spreadsheet development. Suggestions for the improvement of spreadsheet development range back as far as into the late eighties, but none has been successful yet. We argue this is either because not enough effort is put into the roll-out of the technique to the users and, mainly, because they neglect the fact that spreadsheet programmers are end-users, not willing or not able to spend any time on learning software engineering methods. We found out that most end users are willing to verify their spreadsheets, but only view have the time and skills to do really systematic testing of spreadsheets.We developed an approach to generate two orthogonal abstract representations of spreadsheet programs that are then displayed to the user by different visualisation techniques to support the auditing process. Usually, irregularities in the visualisation point out hot-spots on the spreadsheet with a high likelihood of erroneous formulas. In this paper we present new heuristics for identifying hot spots that are very efficient for large spreadsheet programs.
End-user tools for grid computing
Authors: Hernández Francisco , Bangalore Purushotham , Reilly Kevin
Published: November 2005

The present work describes an approach to simplifying the development and deployment of applications for the Grid. Our approach aims at hiding accidental complexities (e.g., low-level Grid technologies) met when developing these kinds of applications. To realize this goal, the work focuses on the development of end-user tools using concepts of domain engineering and domain-specific modeling which are modern software engineering methods for automating the development of software. This work is an attempt to contribute to the long term research goal of empowering users, to create complex applications for the Grid without depending on the expertise of support teams or on hand-crafted solutions.
Old issues, new eyes
Authors: Pickard Michael M.
Published: November 2005

This paper considers end user development (EUD) from the perspective of a veteran software professional. Many of the issues currently discussed in relation to EUD have existed almost from the dawn of computing. However, there are some modern trends that have the potential to affect both end user computing and professional software development.
Two principles of end-user software engineering research
Authors: Segal Judith
Published: November 2005

This paper argues the importance of two principles for end-user software engineering research. The first of these is that not all end-user developers are the same. The second is that research must be grounded in field studies of actual end-user development practice. In keeping with this second principle, our arguments are based on data from our own field studies of practice. These field studies involve a class of end user developer, whom we term 'professional end user developers' and who include scientists, mathematicians and engineers.
Evaluating the costs and benefits of end-user development
Authors: Sutcliffe Alistair
Published: November 2005

This paper describes a cost benefit modelling approach to introducing EUD technology. Costs are incurred in configuring and learning the technology then in developing and debugging applications. These are set against the perceived and actual benefits of producing better applications that fit end user requirements. The approach is illustrated with a case study of a web Content Management System.
The EUSES spreadsheet corpus
Authors: Fisher Marc , Rothermel Gregg
Published: November 2005

In recent years several tools and methodologies have been developed to improve the dependability of spreadsheets. However, there has been little evaluation of these dependability devices on spreadsheets in actual use by end users. To assist in the process of evaluating these methodologies, we have assembled a corpus of spreadsheets from a variety of sources. We have ensured that these spreadsheets are suitable for evaluating dependability devices in Microsoft Excel (the most commonly used commercial spreadsheet environment) and have measured a variety of feature of these spreadsheets to aid researchers in selecting subsets of the corpus appropriate to their needs.
How to communicate unit error messages in spreadsheets
Authors: Abraham Robin , Erwig Martin
Published: November 2005

In previous work we have designed and implemented an automatic reasoning system for spreadsheets, called UCheck, that infers unit information for cells in a spreadsheet. Based on this unit information, UCheck can identify cells in the spreadsheet that contain erroneous formulas. However, the information about an erroneous cell is reported to the user currently in a rather crude way by simply coloring the cell, which does not tell anything about the nature of error and thus offers no help to the user as to how to fix it.In this paper we describe an extension of UCheck, called UFix, which improves the error messages reported to the spreadsheet user dramatically. The approach essentially consists of three steps: First, we identify different categories of spreadsheet errors from an end-user's perspective. Second, we map units that indicate erroneous formulas to these error categories. Finally, we create customized error messages from the unit information and the identified error category. In many cases, these error messages also provide suggestions on how to fix the reported errors.
Six challenges in supporting end-user debugging
Authors: Ruthruff Joseph R. , Burnett Margaret
Published: November 2005

This paper summarizes six challenges in end-user programming that can impact the debugging efforts of end users. These challenges have been derived through our experiences and empirical investigation of interactive fault localization techniques in the spreadsheet paradigm. Our contributions reveal several insights into debugging techniques for end-user programmers, particularly fault localization techniques, that can help guide the direction of future end-user software engineering research.
Human factors affecting dependability in end-user programming
Authors: Ko Amy J. , Myers Brad A.
Published: November 2005

Human factors affecting the dependability of end user's programs are discussed in the context of controlled and observational studies of both professional and end-user programmers. These factors include the influence of the types of behaviors that end users wish to implement, end user's fundamental cognitive biases, barriers in the languages, environments, libraries, and other tools used by end users, and end users' difficulties with understanding their code's meaning and execution.
Dynamic analysis of java applications for multithreaded antipatterns
Authors: Boroday S. , Petrenko A. , Singh J. , Hallal H.
Published: November 2005

Formal verification is not always applicable to large industrial software systems due to scalability issues and difficulties in formal model and requirements specification. The scalability and model derivation problems could be alleviated by runtime trace analysis, which combines both testing and formal verification. We implement and compare an ad-hoc custom approach and a formal approach to detect common bug patterns in multithreaded Java software. We use the tracing platform of the Eclipse IDE and state-of-the-art model checker Spin.
Refactoring gcc using structure field access traces and concept analysis
Authors: Bowdidge Robert W.
Published: November 2005

Refactoring usually involves statically analyzing source code to understand which transformations safely preserve execution behavior of the program. However, static analysis may not scale well for large programs when analysis results are too general, when tools for analyzing the source code are unwieldy, or when the tools simply do not exist. In such cases, it can be simpler to analyze the program at runtime to gather answers needed for safe code changes. I show how dynamic data can guide refactoring of a single data structure into a hierarchy of classes. Specifically, I show how I refactored the gcc compiler to cut its use of heap memory. In order to partition the declaration data structure into more efficiently-sized parts, I used data structure field access traces to automatically identify how the data structure might be refactored. I also identified other potential refactorings of the data structure using concept analysis. These results then guided by-hand modifications to the compiler. I finally evaluated what size test cases would be needed to gather adequate information to correctly perform the refactoring. The case study showed the refactoring could be performed with the dynamic information, but without traces from an exhaustive set of test cases, some fields would be moved incorrectly.
Selective capture and replay of program executions
Authors: Orso Alessandro , Kennedy Bryan
Published: November 2005

In this paper, we present a technique for selective capture and replay of program executions. Given an application, the technique allows for (1) selecting a subsystem of interest, (2) capturing at runtime all the interactions between such subsystem and the rest of the application, and (3) replaying the recorded interactions on the subsystem in isolation. The technique can be used in several scenarios. For example, it can be used to generate test cases from users' executions, by capturing and collecting partial executions in the field. For another example. it can be used to perform expensive dynamic analyses off-line. For yet another example, it can be used to extract subsystem or unit tests from system tests. Our technique is designed to be efficient, in that we only capture information that is relevant to the considered execution. To this end, we disregard all data that, although flowing through the boundary of the subsystem of interest, do not affect the execution. In the paper, we also present a preliminary evaluation of the technique performed using SCARPE, a prototype tool that implements our approach.
Merging traces of hardware-assisted data breakpoints
Authors: Palankar Mayur , Cook Jonathan E.
Published: November 2005

Future improvements in hardware and O/S support for monitoring programs will depend on providing feedback for current support (even if it is quite limited). We look at using hardware breakpoint registers and performance counters in order to trace data accesses in a program. We first present a small experiment to understand how these features can be used to monitor a program. and then detail an algorithm for using these limited resources to trace any amount of data accesses in a program and achieve a complete and correct trace by merging partial traces.
Measuring precision for static and dynamic design pattern recognition as a function of coverage
Authors: Pettersson Niklas
Published: November 2005

We strive to detect design pattern like patterns in software. This cannot be done efficiently with sufficient precision using only static analysis; we need to combine static and dynamic analysis. In this process, the pattern candidates produced from static analysis are monitored during executions of the software: Candidates detected by static analysis violating the expected dynamic protocol of the pattern are excluded. In this article, we investigate where to put effort when trying to perform high precision pattern detection in code. We do so by investigating which parameters are most important to improve the precision of the detection process: precision of initial static analysis or coverage of the dynamic analysis. Varying the precision of the dynamic analysis is a third important parameter, but this parameter is left as a constant during our experiments. The results show that simple behavioral protocols double the precision when 30% coverage is obtained. We also have indications that simple behavioral protocols give very high precision when high coverage is obtained. In such case, the quality of the static analysis is only interesting for precision if high coverage cannot be reached.
Dynamic detection and visualization of software phases
Authors: Reiss Steven P.
Published: November 2005

Software executes in phases. JIVE is a software visualization tool that provides a high-level view of what is occurring in a Java system as it happens, offering information about both what classes are executing, what classes are being allocated, synchronizations, and what are the threads and what state each thread is in. This paper describes how we used the information available to JIVE to detect and then display the current phase of execution.
An exploration of statistical models for automated test case generation
Authors: Sant Jessica , Souter Amie , Greenwald Lloyd
Published: November 2005

In this paper, we develop methods that use logged user data to build models of a web application. Logged user data captures dynamic behavior of an application that can be useful for addressing the challenging problems of testing web applications. Our approach automatically builds statistical models of user sessions and automatically derives test cases from these models. We provide several alternative modeling approaches based on statistical machine learning methods. We investigate the effectiveness of the test suites generated from our methods by performing a preliminary study that evaluates the generated test cases. The results of this study demonstrate that our techniques are able to generate test cases that achieve high coverage and accurately model user behavior. This study provides insights into improving our methods and motivates a larger study with a more diverse set of applications and testing metrics.
Efficient static analysis with path pruning using coverage data
Authors: Vipindeep V. , Jalote Pankaj
Published: November 2005

Soundness and completeness are two primary concerns of a static analysis tool for finding defects in software. Exhaustive static analysis of the program through all paths is not always possible, especially for a large software causing incompleteness in the analysis. Also, exhaustive testing of the program to detect all bugs is not possible. In this work, we describe a technique which uses coverage data from testing to remove the tested paths and then statically analyzes the remaining code. This pruning of tested paths allows a static analyzer to perform a more thorough analysis of the reduced code, thereby improving its effectiveness. This work is a step towards integration of static analysis and testing frameworks. The proposed technique is applied with a few static analyzers publicly available. Our experience shows that the approach results in lesser false positives as well as detection of more serious errors which might have gone unnoticed otherwise.
Adaptive reuse of libre software systems for supporting on-line collaboration
Authors: Adams Paul , Boldyreff Cornelia , Nutter David , Rank Stephen
Published: November 2005

In this paper, the adaptive reuse of Plone; an open source content management system is described. In one instance, Plone has been used as the backbone of a collaboration and communication support infrastructure within a large research project. In the other, Plone has been used as the main web-presence of a specialist group of the British Computer Society. This paper analyses the benefits and problems of reusing Plone to support collaboration. Based on this reuse experience, a more systematic approach to supporting Plone reuse is proposed. This approach takes into account the special case of reuse support relevant to open source software developments.
The need for effort estimation models for open source software projects
Authors: Asundi Jai
Published: November 2005

Open source software(OSS), be it products or tools, are being adopted at a fairly rapid pace in commercial organizations. In fact many firms such as IBM and Sun are even 'opening' up their once proprietary software products and making the source code available. This phenomenon may have a profound effect on the various software engineering methodologies and practices as well as project management activities. Given the difficulty in managing resources in closed source projects, planning and delivery for OSS projects will be an even bigger challenge. In this position paper, we describe the need for new effort estimation models for the development of OSS projects and how this will be required for future project management activities. We outline some of the guidelines to build these cost estimation models and some issues that arise in the verification and validation of these cost models.
Raging incrementalism
Authors: Georgas John C. , Gorlick Michael M. , Taylor Richard N.
Published: November 2005

Change is a bitter fact of life for system developers and, to a large extent, conventional practices are aimed at arresting change and minimizing its effects. We take the opposite view and are exploring system engineering practices that harness the forces of change for the ongoing, incremental improvement of systems---a view we name
raging incrementalism.
We harness three powerful forces to ride the waves of change: open-source software, commodity hardware, and web-like, representational state transfer architectures. This paper describes an early experiment in applying raging incrementalism to a complex system: large-scale digital video capture, distribution, and archival for launch range operations. We outline the methodology of raging incrementalism, describe the vital role open-source plays in system development and construction, and offer insights on the programmatic consequences of embracing open-source software.
A case study of open source tools and practices in a commercial setting
Authors: Gurbani Vijay K. , Garvert Anita , Herbsleb James D.
Published: November 2005

Commercially, many in the industry are using products based on Open Source. What have been missing are studies on if the commercial industry benefits from developing software following the open source development model. We present a case study that examines this issue by applying the concepts of the open source software development methodology to creating industrial-strength software. We conclude with lessons learned and open research questions.
Open source software maintenance process framework
Authors: Koponen Timo , Hotti Virpi
Published: November 2005

To identify the Open Source maintenance process two well known Open Source projects Apache HTTP server and Mozilla web browser were studied. The Open Source software maintenance process is formal even anyone can submit modifications or defect reports to Open Source software projects. We assume that the Open Source maintenance process is similar to the maintenance process defined by the ISO/IEC. In the case studies. four activities were found similar to the activities of the ISO/IEC Maintenance process. This paper presents the Open Source maintenance process framework. The framework is exemplified with the ISO/IEC Maintenance process framework.
The use of open source software platforms by Independent Software Vendors
Authors: Mannaert Herwig , Ven Kris
Published: November 2005

The Cast4All Content Conductor Platform is an integration and provisioning suite to manage data broadcasting networks in general and digital cinema networks in particular. The framework makes extensive use of open source components and contains several extensions and modifications to those components. It is a typical case of an Independent Software Vendor (ISV) building application software on top of open source platform software. In the spirit of the open source movement, the extensions or modifications to the open source components could be contributed back to the community. However, in this paper we discuss several issues that companies face in such a situation. They extend far beyond the obvious decision whether to keep the developed code proprietary, and should not be neglected. It is argued that a closer collaboration between open source projects and independent software vendors would be beneficial to all.
Investigating quality in large-scale Open Source Software
Authors: Raja Uzma , Barry Evelyn
Published: November 2005

Open Source Software (OSS) development and use has increased significantly over recent years. Therefore, there is a need to analyze and understand these projects. Software quality is an important characteristic effecting overall system lifecycle cost, performance and useful life. The existing models for software quality are based on empirical analysis of propriety source software (PSS), and need to be verified in OSS. Research on PSS has revealed that software quality declines, as it ages. Part of this decline is associated with the lifecycle maintenance activities that introduce change in the size and complexity of the system, while introducing software errors into modified system. Lifecycle maintenance activities in OSS systems are processed under a very different paradigm. We are interested in investigating the effects of maintenance activities on OSS project outcomes. Linux is one of the most popular and complex OSS project available. In our research, we investigate the characteristics of Linux source code. In this position paper we present some preliminary results of the effects of various types of maintenance activities on quality of Linux software.
Why profit-oriented companies enter the OS field?
Authors: Rossi Cristina , Bonaccorsi Andrea
Published: November 2005

This paper contributes to the literature on Open Source (OS) by providing empirical evidence on the incentives of firms that engage in the field. Data collected by a survey on 146 Italian companies supplying OS solutions (Open Source firms) show that (surprisingly) intrinsic, community-based incentives do play a role but are not, in general, put into practise. We investigate this discrepancy between attitudes and behaviours and single out groups of firms adopting a more consistent behaviour. Our results are in line with the literature on individual motivations in the OS movement.
OpenEC/B
Authors: Scacchi Walt
Published: November 2005

This report investigates Open Source E-Commerce or E-Business capabilities. This entails a case study within one firm that has undertaken an organizational initiative to develop, deploy, use, and support free/open source software systems for Enterprise Resource Planning (ERP), E-Commerce (EC) or E-Business (EB) services. The objective is to identify and characterize the resource-based software product development capabilities that lie at the center of the initiative.
Learning/organizing in Linux
Authors: Shaikh Maha , Cornford Tony
Published: November 2005

We assume that open source communities or collectives are somewhat organized. we also assume that such collectives are capable of learning, and indeed do learn. However, it is far more difficult to say exactly where, when and how such learning occurs, or resulting (re-)organizing happens. Drawing on Clegg et al's [1] concept of learning and becoming this paper seeks to show, through a case study of the Linux discussion around version control software, how learning and organizing occur. The paper discusses the Linux community's engagement with BitKeeper and explains aspects of its adoption. In this we address version control software as not merely a collaborative, organizing vehicle but as a part of a generative duality.
Observations on patterns of development in open source software projects
Authors: Stewart Katherine J. , Darcy David P. , Daniel Sherae L.
Published: November 2005

This paper discusses a project aimed at understanding how open source software evolves by examining patterns of development and changes in releases over time. The methodological approach of the research and initial observations are described. These include descriptions of release cycles and categorization of projects based on the overall changes in size and complexity exhibited across releases. Implications of these observations are discussed in light of prior and future work on understanding OSS evolution.
Open source software reliability model
Authors: Zhou Ying , Davis Joseph
Published: November 2005

We collected bug tracking data from a few popular open source projects and investigated the time related bug reporting patterns from them. The results indicate that along its development cycle, open source projects exhibit similar reliability growth pattern with that of closed source project. Bug arrivals of most open source project will stabilize at a very low level, even though in comparison, no formal testing activities are involved. This stabilizing point would be viewed as the mature point for adoption consideration. The results also show that general Weibull distribution offers possible way to establish the reliability model; Also, popular measures such as page views and download are not highly correlated with the bug arrival rate and may not be suitable measures for a project's quality.
Test prioritization for pairwise interaction coverage
Authors: Bryce Renée C. , Colbourn Charles J.
Published: November 2005

Interaction testing is widely used in screening for faults. In software testing, it provides a natural mechanism for testing systems to be deployed on a variety of hardware and software configurations. Several algorithms published in the literature are used as tools to automatically generate these test suites; AETG is a well known example of a family of greedy algorithms that generate one test at a time. In many applications where interaction testing is needed, the entire test suite is not run as a result of time or cost constraints. In these situations, it is essential to
prioritize
the tests. Here we adapt a "one-test-at-a-time" greedy method to take importance of pairs into account. The method can be used to generate a set of tests in order, so that when run to completion all pairwise interactions are tested, but when terminated after any intermediate number of tests, those deemed most important are tested. Computational results on the method are reported.
Using information about functions in selecting test cases
Authors: Clermont Markus , Parnas David
Published: November 2005

We consider the problem of generating a set of test cases from a black box specification. We focus on
stress testing
, i.e. picking test cases that seem most likely to reveal program bugs. Our approach assumes that so-called interesting points, i.e. points in a function's domain where properties change, e.g. maxima, are likely to reveal any problems and examine how we can determine the interesting points for a function defined by a complex expression if we know the interesting points for the functions named in that expression.
Usage model-based automated testing of C++ templates
Authors: Sayre Kirk
Published: November 2005

The object-oriented design of software in C++ using class templates presents many advantages over non-object-oriented or non-template based software design. However, the testing of template based C++ software involves some unique issues not usually faced during the testing of non-template based software. This paper will describe these testing issues and describe a proposed solution to these issues using a usage model-based automated testing framework.
A simulation model of a multi-server EJB system
Authors: Guinness David Mc , Murphy Liam
Published: November 2005

Despite the fact that EJB (Enterprise Java Beans) is a widely used technology, research in the area of performance modelling of EJB application servers is quite sparse. This paper will describe how Workbench™, an advanced simulation modelling tool, can be used to build a scalable model of a multi-server EJB system that allows users to input variables that describe interactions and their constituent methods, as well as system parameters. The model will output the average time for each given user interaction and allow users to seek system improvements by changing the system parameters and workloads.
Model-based testing for applications derived from software product lines
Authors: Olimpiew Erika Mir , Gomaa Hassan
Published: November 2005

This paper describes an approach for mapping the models of an SPL (Software Product Line) to tests so that functional tests can be automatically generated and selected when an application is derived from an SPL. Information relevant for testing is added to and then extracted from the SPL models. A Hotel Product line example is used to illustrate the approach.
An integrated method for designing user interfaces based on tests
Authors: Schilling Albert , Madeira Kelma , Donegan Paula , Sousa Kênia , Furtado Elizabeth , Furtado Vasco
Published: November 2005

We present artifacts and techniques used for User Interface (UI) evaluation, performed by professionals from the Human-Computer Interaction (HCI) area of study, covering Usability and Semiotic Engineering, which can assist Software Engineering (SE) to perform usability tests earlier. The study of various interaction alternatives, made possible by these artifacts, verifies if they are in accordance with users' preferences and constraints, and usability patterns, and can enhance the probability of achieving a more usable and reliable product.
Modeling requirements for combinatorial software testing
Authors: Lott C. , Jain A. , Dalal S.
Published: November 2005

The combinatorial approach to software testing uses models to generate a minimal number of test inputs so that selected combinations of input values are covered. The most common coverage criteria is two-way, or pairwise coverage of value combinations, though for higher confidence three-way or higher coverage may be required. This paper presents example system requirements and corresponding models for applying the combinatorial approach to those requirements. These examples are intended to serve as a tutorial for applying the combinatorial approach to software testing. Although this paper focuses on pairwise coverage, the discussion is equally valid when higher coverage criteria such as three-way (triples) are used. We use terminology and modeling notation from the AETG
1
system to provide concrete examples.
Requirements traceability in automated test generation
Authors: Bouquet F. , Jaffuel E. , Legeard B. , Peureux F. , Utting M.
Published: November 2005

Automated test case and test driver generation from a formal model is becoming a more widely used practice in the smart card area. This innovative approach for validation testing makes it possible to ensure the functional coverage of the test suite and to automate the production of executable test scripts. This paper presents an approach to automatically produce the Traceability Matrix from requirements to test cases, as part of the test generation process. This approach is embedded in the LEIRIOS Test Generator (LTG) tool, and has been used for several real-life applications in the smart card industry. This paper introduces the approach to annotating the formal model and using it to generate the Traceability Matrix. It also discusses some lessons learnt from our experience using Model-Based Testing for smart card software validation.
Generating optimal distinguishing sequences with a model checker
Authors: Robinson-Mallett Christopher , Liggesmeyer Peter , Mücke Tilo , Goltz Ursula
Published: November 2005

This paper presents an approach for the automatic generation of shortest Distinguishing Sequences (DS) with the Uppaal model checker. The presented method is applicable to a large number of extended finite state machines and it will find an optimal result, if a DS sequence exists for the considered automaton. Our approach is situated in an integrated testing environment that is used to generate checking sequences. The generation method is based on a DS model, which is derived from the same test model that is used for generating test cover sets. The problem of generating DS is reduced to the definition of a DS model and for this reason the complexity of our approach depends mainly on the used model checking algorithm. This means, that the presented method is automatically improved, when the model checking algorithm is improved. This includes the generation of optimal DS depending on the ability of the model checker to produce optimal results.