bluuebunny/crossref_metadata_2025 huggingface dataset:
Dealing with failures during failure recovery of distributed systems
Authors: Arshad Naveed , Heimbigner Dennis , Wolf Alexander L.
Published: November 2005

One of the characteristics of autonomic systems is self recovery from failures. Self recovery can be achieved through sensing failures, planning for recovery and executing the recovery plan to bring the system back to a normal state. For various reasons, however, additional failures are possible during the process of recovering from the initial failure. Handling such secondary failures is important because they can cause the original recovery plan to fail and can leave the system in a complicated state that is worse than before. In this paper techniques are identified to preserve consistency while dealing with such failures that occur during failure recovery.
Retrofitting networked applications to add autonomic reconfiguration
Authors: Merideth Michael G. , Narasimhan Priya
Published: November 2005

To reduce user maintenance is an important goal for applications that must dynamically adapt based on their environments. There are many existing popular applications that lack support for this autonomic reconfiguration, but that are beginning to be used in these dynamic environments, in which they must update themselves frequently; not all of these applications will be completely redesigned and redeveloped in order to support autonomic features. In this paper, we explore how to retrofit pre-existing networked applications to add support for autonomic reconfiguration. To illustrate our methods, we retrofit a popular open-source intrusion detection system,
Snort
, to enable it to reconfigure itself using online program updates and information about its environment.
Architectural design of a distributed application with autonomic quality requirements
Authors: Weyns Danny , Schelfthout Kurt , Holvoet Tom
Published: November 2005

An autonomic system is essentially characterized by quality requirements that specify that the system should be able to adapt itself (configure optimize, heal, etc.) under varying circumstances and situations. These quality requirements call for an architecture centric software engineering approach. In this paper, we discuss and illustrate the architectural design of a complex real-world distributed application with autonomic quality requirements. In particular, we present an architecture with autonomous entities (agents) for managing warehouse logistics. We illustrate how the subsequent architectural decisions are guided by a reference architecture for situated multi-agent systems on the one hand, and by functional and quality requirements of the application on the other hand.
Autonomic computing
Authors: Salehie Mazeiar , Tahvildari Ladan
Published: November 2005

The increasing heterogeneity, dynamism and interconnectivity in software applications, services and networks led to complex, unmanageable and insecure systems. Coping with such a complexity necessitates to investigate a new paradigm namely
Autonomic Computing.
Although academic and industry efforts are beginning to proliferate in this research area, there are still a lots of open issues that remain to be solved. This paper proposes a categorization of complexity in I/T systems and presents an overview of autonomic computing research area. The paper also discusses a summary of the major autonomic computing systems that have been already developed both in academia and industry, and finally outlines the underlying research issues and challenges from a practical as well as a theoretical point of view.
Principal agent theory and its application to analyze outsourcing of software development
Authors: Keil Patrick
Published: November 2005

Much has been written on process models, project management or tool support to increase the return on investment in software through higher quality of the development process and the resulting software or system. Yet, we lack understanding in the underlying economic principles; e.g., an external firm paid to develop software for someone else tries to maximize their own profit instead of the contractor's. These divergences of interests result in projects that consume more time and money and meet fewer requirements than expected. In this paper, we try to fill the gap by providing an insight into the theory and presenting applicable suggestions how to diminish or avoid the problems that arise when selecting the 'best' contractor and during the project. Basic advises on the formulation of contracts can be derived.
Determining how much software assurance is enough?
Authors: Huang LiGuo , Boehm Barry
Published: November 2005

A classical problem facing many software projects is to determine when to stop testing and release the product for use. Risk analyses address such "how much is enough?" questions, by balancing the risk exposure of doing too little with the risk exposure of doing too much. However, it's difficult to quantify the relative probabilities and sizes of loss in order to provide practical approaches for determining a risk-balanced "sweet spot" operating point.In this paper, we provide a quantitative approach based on the COCOMO II cost estimation model, the COQUALMO quality estimation model and the Value Estimating Relationships.
Business process-based valuation of IT-security
Authors: Neubauer Thomas , Klemen Markus , Biffl Stefan
Published: November 2005

Growing business integration raises the need for secure business processes as security problems can affect the profit and the reputation of a company. However, decisions regarding a reasonable level of security in a business environment are often made in a value-neutral way.This paper presents a framework for the valuation of cost-benefit of various security levels with business processes. The framework can be used for planning security levels in software development and allows further continuous monitoring and improvement of cost-benefit of security measures along with operative business processes.
Developing a theory of value-based software engineering
Authors: Jain Apurva , Boehm Barry
Published: November 2005

This paper presents an initial "4+1" theory of value-based software engineering (VBSE) that builds around the stakeholder win-win Theory W, and addresses the questions of "which values are important?" and "how is success assured?" for a given software engineering enterprise. The central Theory W then draws upon four additional theories - utility theory (how important are the values?), decision theory (how do stakeholders' values determine decisions?), dependency theory (how do dependencies affect value realization?), and control theory (how to adapt to change and control value realization?).
Anticipatory configuration of resource-aware applications
Authors: Poladian Vahe , Sousa João , Padberg Frank , Shaw Mary
Published: November 2005

We propose an improved approach to dynamic configuration of resource-aware applications. The new
anticipatory model of configuration
maximizes utility based on three inputs: user preferences, application capability profiles, and resource availability. In this respect, the proposed model is similar to a model of configuration described in [2]. However, the latter addresses the dynamic nature of the problem by
reacting
to changes (such as decrease in resource availability), and maximizes the utility in a point-wise manner. The newly proposed anticipatory approach explicitly models the duration of the task and leverages possible information about the future (such as stochastic resource availability over the expected duration of the task).We expect that the anticipatory model will improve user's utility, conserve scarce resources, and reduce the amount of disruption to the user resulting from changes when compared to the reactive model. However, the optimization problem underlying the anticipatory model is computationally more difficult than the problem underlying the reactive model. We would like to investigate if the anticipatory approach is feasible and efficient in practice while delivering the above-mentioned improvements. In this paper, we carefully state the model of anticipatory configuration, highlight the sources of complexity in the problem, propose an algorithm to the anticipatory configuration problem, and provide a roadmap for research.
Coordination in software development
Authors: Amrit Chintan
Published: November 2005

To systematize software development, many process models have been proposed over the years. These models focus on the sequence of steps used by developers to create reliable software. Though these process- models have helped companies to gain certification and attain global standards, they don't take into account interpersonal interactions and various other social aspects of software development organizations. In this paper we tackle one crucial part of the Coordination problem in Software Development, namely the problem of task assignment in a team. We propose a methodology to test a hypothesis based on how social networks can be used to improve coordination in Software Industry. In a pilot case study based on 4 teams of Masters Student working in a globally distributed environment (Holland and India), the social network structures along with the task distribution in each of the teams were analyzed. In each case we observed patterns, which could be used to test many hypotheses on team coordination and task allocation between them.
Cultural patterns in software process mishaps
Authors: MacGregor Eve , Hsieh Yvonne , Kruchten Philippe
Published: November 2005

This paper describes a current and ongoing research project being conducted at the University of British Columbia, Canada. The paper begins by briefly describing past anthropological and sociological culture research. This research will inform our current exploration into the issues surrounding culture and its role in Global Software Development efforts. It then clarifies why this research is particularly important. The paper continues with a description of the current phase of this research, which is an exploratory qualitative approach rooted in Grounded Theory, and of the next phase, which will be a more quantitative approach looking at specific "problem areas" that were identified during the first phase.
Some social factors of software engineering
Authors: Sharp Helen , Robinson Hugh
Published: November 2005

While the importance of 'people factors' in software engineering has been recognised for over 25 years, few specific factors, and their impact on software engineering, have been identified. 'People factors' covers a wide and diverse set of issues. In this paper we focus on social factors, i.e. factors that arise from the various interactions that need to take place in order to develop software. We draw on three different studies we have conducted over the last 10 years to identify three specific factors and their impact on software development.
Predicting acceptance of Software Process Improvement
Authors: Umarji Medha , Seaman Carolyn
Published: November 2005

Software Process Improvement (SPI) initiatives induce organizational change, by introducing new tools, techniques and work practices. Organizations have to address acceptance issues such as resistance to change, compatibility and fear of adverse consequences. Social psychology literature includes the Technology Acceptance Model (TAM) and the Theory of Planned Behavior (TPB), which study such adoption issues and predict intention to use and actual usage of workplace technology. Some constructs of these models could be applied to software organizations to make it easier for them to counter the initial resistance and to assimilate process improvement into the work culture. To increase applicability of these models to the SPI context, some additional constructs are proposed, by taking into account organizational culture, the impact of changes caused by SPI and the unique characteristics of software developers.
Mapping concern space to software architecture
Authors: Liu Jing (Janet) , Lutz Robyn R. , Thompson Jeffrey M.
Published: November 2005

Concern modeling plays an important role in software design, implementation and maintenance. Hyperspace has provided a strong conceptual framework to separate concerns in multi-dimensional levels. The contribution of this work is to create an architectural element, called a concern connector, to support the implementation of hyperspace in the architectural design phase. The paper makes three basic claims for this idea. First, using concern connectors allows the scope of each hyperslice in a certain concern dimension to be defined and stored. Second, the concern interactions within each hypermodule can be specified in the concern connectors. Third, the association of concern modeling with this distinctive architectural element improves the flexibility of concern maintenance and evolution during the development process. To test these claims the paper investigates the use of concern connectors in a real-world architectural model. The results show how concern connectors implement concern modeling in the architectural design.
A model for software plans
Authors: Painter Robert R. , Coppit David
Published: November 2005

Even in well-designed software, some concerns can not be easily encapsulated due to their dependence on surrounding context. Such concerns are intermingled with each other and the context code, making it difficult for developers to reason independently about them. We have introduced
software plans
as an editor-based approach for addressing the tangling of context-dependent concerns. Software plans provide programmers with partial views of the overall software which present only that code related to concerns of current interest. The problem we address is that the traditional sequence-of-characters representation for code is poorly suited for software plans. It lacks the ability to accurately model the concerns associated with a code block, the relationships between code blocks, and the notion of multiple independent plans. In this paper, we present a formally-defined code/concern model that supports these capabilities and more. Using this model, we were able to implement a prototype editing tool that supports software plans.
Locating crosscutting concerns in the formal specification of distributed reactive systems
Authors: Pazos-Arias José J. , García-Duque Jorge , López-Nores Martín
Published: November 2005

Requirements specification is a stage of software development in which the different concerns involved with a system are especially present. Commonly, the specification is conceived as an incremental process, in which the developers progressively add requirements until reaching a description of the system that satisfies their needs and expectations. In this paper, we introduce a semi-automated approach to locate crosscutting concerns at intermediate stages of such an incremental process. The aim is to help the developers go on with the specification tasks by focusing effectively their reasoning, avoiding phenomena of tangling and scattering.
Separation of concerns in software product line engineering
Authors: Saleh Mazen , Gomaa Hassan
Published: November 2005

A software product line consists of a family of software systems that have some common functionality and some variable functionality. A better understanding of the product line can be obtained by separating the concerns of the common software, in terms of common features, components, and source code, from the variable software. This paper describes an approach and
prototype
tool support for separation of concerns and automatic customization of target applications, which are members of the software product line.
Understanding source code evolution using abstract syntax tree matching
Authors: Neamtiu Iulian , Foster Jeffrey S. , Hicks Michael
Published: November 2005

Mining software repositories at the source code level can provide a greater understanding of how software evolves. We present a tool for quickly comparing the source code of different versions of a C program. The approach is based on partial abstract syntax tree matching, and can track simple changes to global variables, types and functions. These changes can characterize aspects of software evolution useful for answering higher level questions. In particular, we consider how they could be used to inform the design of a dynamic software updating system. We report results based on measurements of various versions of popular open source programs. including BIND, OpenSSH, Apache, Vsftpd and the Linux kernel.
Mining evolution data of a product family
Authors: Fischer Michael , Oberleitner Johann , Ratzinger Jacek , Gall Harald
Published: November 2005

Diversification of software assets through changing requirements impose a constant challenge on the developers and maintainers of large software systems. Recent research has addressed the mining for data in software repositories of single products ranging from fine- to coarse grained analyses. But so far, little attention has been payed to mining data about the evolution of product families. In this work, we study the evolution and commonalities of three variants of the BSD (Berkeley Software Distribution), a large open source operating system. The research questions we tackle are concerned with how to generate high level views of the system discovering and indicating evolutionary highlights. To process the large amount of data, we extended our previously developed approach for storing release history information to support the analysis of product families. In a case study we apply our approach on data from three different code repositories representing about 8.5GB of data and 10 years of active development.
Using a clone genealogy extractor for understanding and supporting evolution of code clones
Authors: Kim Miryung , Notkin David
Published: November 2005

Programmers often create similar code snippets or reuse existing code snippets by copying and pasting. Code clones---syntactically and semantically similar code snippets---can cause problems during software maintenance because programmers may need to locate code clones and change them consistently. In this work, we investigate (1) how code clones evolve, (2) how many code clones impose maintenance challenges, and (3) what kind of tool or engineering process would be useful for maintaining code clones.Based on a formal definition of clone evolution, we built a
clone genealogy tool
that automatically extracts the history of code clones from a source code repository (CVS). Our clone genealogy tool enables several analyses that reveal evolutionary characteristics of code clones. Our initial results suggest that aggressive refactoring may not be the best solution for all code clones; thus, we propose alternative tool solutions that assist in maintaining code clones using clone genealogy information.
When do changes induce fixes?
Authors: Śliwerski Jacek , Zimmermann Thomas , Zeller Andreas
Published: November 2005

As a software system evolves, programmers make changes that sometimes cause problems. We analyze CVS archives for
fix-inducing changes
---changes that lead to problems, indicated by fixes. We show how to automatically locate fix-inducing changes by linking a version archive (such as CVS) to a bug database (such as BUGZILLA). In a first investigation of the MOZILLA and ECLIPSE history, it turns out that fix-inducing changes show distinct patterns with respect to their size and the day of week they were applied.
Text mining for software engineering
Authors: Hayes Jane Huffman , Dekhtyar Alex , Sundaram Senthil
Published: November 2005

The mining of textual artifacts is requisite for many important activities in software engineering: tracing of requirements; retrieval of components from a repository; location of manpage text for an area of question, etc. Many such activities leave the "final word" to the analyst --- have the relevant items been retrieved? are there other items that should have been retrieved? When analysts become a part of the text mining process, their decisions on the relevance of retrieved elements impact the final outcome of the activity. In this paper, we undertook a pilot study to examine the impact of analyst decisions on the final outcome of a task.
Analysis of signature change patterns
Authors: Kim Sunghun , Whitehead E. James , Bevan Jennifer
Published: November 2005

Software continually changes due to performance improvements, new requirements, bug fixes, and adaptation to a changing operational environment. Common changes include modifications to data definitions, control flow, method/function signatures, and class/file relationships. Signature changes are notable because they require changes at all sites calling the modified function, and hence as a class they have more impact than other change kinds.We performed signature change analysis over software project histories to reveal multiple properties of signature changes, including their kind, frequency, and evolution patterns. These signature properties can be used to alleviate the impact of signature changes. In this paper we introduce a taxonomy of signature change kinds to categorize observed changes. We report multiple properties of signature changes based on an analysis of eight prominent open source projects including the Apache HTTP server, GCC, and Linux 2.5 kernel.
Repository mining and Six Sigma for process improvement
Authors: VanHilst Michael , Garg Pankaj K. , Lo Christopher
Published: November 2005

In this paper, we propose to apply artifact mining in a global development environment to support measurement based process management and improvement, such as SEI/CMMI's GQ(I)M and Six Sigma's DMAIC. CMM has its origins in managing large software projects for the government and emphasizes achieving expected outcomes. In GQM, organizational goals are identified. The appropriate questions with corresponding measurements are defined and collected. Six Sigma has its origins in manufacturing and emphasizes reducing cost and defects. In DMAIC, a major component of a Six Sigma approach, sources of waste are identified. Then changes are made in the process to reduce effort and increase the quality of the product produced. GQM and Six Sigma are complementary. Both approaches rely heavily on the measurement of input and output metrics. Mining development artifacts can provide usable metrics for the application of DMAIC and GQM in the software domain.
Accelerating cross-project knowledge collaboration using collaborative filtering and social networks
Authors: Ohira Masao , Ohsugi Naoki , Ohoka Tetsuya , Matsumoto Ken-ichi
Published: November 2005

Vast numbers of free/open source software (F/OSS) development projects use hosting sites such as Java.net and Source-Forge.net. These sites provide each project with a variety of software repositories (e.g. repositories for source code sharing, bug tracking, discussions, etc.) as a media for communication and collaboration. They tend to focus on supporting rich collaboration among members in each project. However, a majority of hosted projects are relatively small projects consisting of few developers and often need more resources for solving problems. In order to support cross-project knowledge collaboration in F/OSS development, we have been developing tools to collect data of projects and developers at SourceForge, and to visualize the relationship among them using the techniques of collaborative filtering and social networks. The tools help a developer identify "who should I ask?" and "what can I ask?" and so on. In this paper, we report a case study of applying the tools to F/OSS projects data collected from SourceForge and how effective the tools can be used for helping cross-project knowledge collaboration.
On establishing the essential components of a technology-dependent framework
Authors: Williams Laurie , Layman Lucas , Abrahamsson Pekka
Published: November 2005

A goal of evidence-based software engineering is to provide a means by which industry practitioners can make rational decisions about technology adoption. When a technology is mature enough for potential widespread use, practitioners find empirical evidence most compelling when the study has taken place in a live, industrial situation in an environment comparable to their own. However, empirical software engineering is in need of guidelines and standards to direct industrial case studies so that the results of this research are valuable and can be combined into an evidentiary base. In this paper, we present a high-level view of a measurement framework that has been used with multiple agile software development industrial case studies. We propose that this technology-dependent framework can be used as a strawman for a guideline of data collection, analysis, and reporting of industrial case studies. Our goal in offering the framework as a strawman is to solicit input from the community on a guideline for the essential components of a technology-dependent framework for industrial case study research.
A design for evidence - based soft research
Authors: Liu WenQian , Chen Charles L. , Lakshminarayanan Vidya , Perry Dewayne E.
Published: November 2005

Active research is being done in how to go from requirements to architecture. However, no studies have been attempted in this area despite a long history of empirical research in software engineering (SE). Our goal is to establish a framework for the transformation from requirements to architecture on the basis of a series of empirical studies. The first step is to collect evidence about practice in industry before designing relevant techniques, methods and tools. As part of this step, we use an interview-based multiple-case study with a carefully designed process of conducting the interviews and of preparing the data collected for analysis while preserving its integrity. In this paper, we describe the design of this multiple-case study, delineate the evidence trail, discuss validity issues, outline the data analysis focus, discuss meta issues on evidence-based SE particularly on combining and using evidence, describe triangulation approaches, and present two methods for accumulating evidence.
Harmonizing intra- and inter-object specification and verification
Authors: Ehrich Hans-Dieter
Published: November 2005

Object-oriented approaches to designing information systems suggest to distinguish between intra- and inter-object aspects. While intra-object design and verification tools are being used on a large scale, inter-object techniques are not yet well established. There are a variety of approaches addressing the concurrency and communication aspects of multi-object systems, but fundamental problems remain.The TROLL object specification language project aims at providing logic-based formal semantics to intra- and inter-object aspects, among others. For the former, a conventional temporal logic was employed. For the latter, an extension called multi-object logic was developed. It has proven useful for semantics descriptions, recently also for a mobile-agent extension where the innovative contribution was to distinguish between the ever-mobile units and those which provide fixed subsystems as contexts for the mobile entities.While being developed for giving semantics, multi-object logics showed surprising potential for verification. Conventionally, intra-object verification techniques are applied to inter-object verification by building a global state space. This state space, however, grows exponentially with the number of objects in the system. In spite of sophisticated techniques which have been developed to overcome this 'state-space explosion' problem, there is a notorious complexity barrier. It is not feasible to verify large systems this way.In the multi-object logic approach, the construction of the global state space - or any fraction or abstraction thereof - is avoided. So it has the potential to handle large systems. The method is applicable in cases where the objects and interaction patterns in a system are known beforehand, when writing the global conditions to be checked. Although these conditions are bound to objects, they are 'global' in the sense that they may refer to the states of other objects at interaction points.This way, conditions concerning interacting objects may be written in a still basically sequential logic, although multiple objects are assumed to behave concurrently. Global checking conditions may then be automatically and equivalently split into local conditions for the objects involved, plus interaction requirements for these objects. All these conditions and requirements can be checked locally, one after the other, where only the objects involved in the condition have to be taken into account.While we are working on the potential of the approach for software engineering, it may have potential beyond: we are also working on a project to simulate and analyze biological processes using object-oriented techniques. For instance, model checking can be used to find possible scenarios leading to biological cell states of interest. Applying the multi-object approach here is a challenging problem.
From scenarios to aspects
Authors: Krüger Ingolf H. , Mathew Reena , Meisinger Michael
Published: November 2005

Software product lines are gaining importance because they allow improvements in time to market, cost, productivity and quality of software products. Architecture evaluation is one important aspect in the development of product lines for large-scale distributed systems. It is desirable to evaluate and compare architectures for functionality and quality attributes before implementing or changing the whole system. Often, the effort required for the thorough evaluation of alternatives using prototypes is prohibitive. In this paper, we present an approach for cost-efficient software architecture evaluation, based on scenario-oriented software specifications, modeling the system services. We show how to map the same set of services to several possible target architectures and give a procedure to generate evaluation prototypes using aspect-oriented programming techniques. This significantly reduces the effort required to explore architectural alternatives. We explain our approach using the Center TRACON Automation System as an example.
Overview of existing safeguarding techniques for automatically generated code
Authors: Stürmer Ingo , Weinberg Daniela , Conrad Mirko
Published: November 2005

Code generators are increasingly used in an industrial context to translate graphical models into executable code. Since the code is often deployed in safety-related environments, the quality of the code generators is of paramount importance. In this paper, we will present and discuss state-of-the-art techniques for safeguarding automatic code generation applied in model-based development.
Automotive use case standard for embedded systems
Authors: Pettersson Fredrik , Ivarsson Martin , Öhman Peter
Published: November 2005

Today the lack of deliveries from suppliers to automotive OEMs in early phases of software development cause a number of problems such as misinterpreted requirements and difficulties in keeping deadlines. We have identified use cases as a means to communicate and visualize requirements. A well defined standard is needed to enable communication between different organizations.In this paper we propose a two level use case standard for embedded systems. The standard consists of a template and guidelines specifying how to write consistent and unambiguous use cases while capturing the necessary requirements.
Experience of introducing reference architectures in the development of automotive electronic systems
Authors: Eklund Ulrik , Askerdal Örjan , Granholm Johan , Alminger Anders , Axelsson Jakob
Published: November 2005

The requirements on increasing functionality, quality, and, customisation, while reducing cost has lead to the introduction of an architecture centred development process for electronic systems at Volvo Cars. This process enables better control of system integration and achieving non-functional requirements, such as reusability, understandability, etc. The result of the process is a reference architecture that includes strategies for implementing the balanced requirements, architectural views that provide means for reasoning about all the concerns of all stakeholders, and a top-level design of the architecturally significant parts. The reference architecture guides the design of several projects, and thus, cost is optimised accordingly. The main contribution of this paper is that we present experiences from introducing the architecture centred process. The main conclusions are that disseminating and maintaining the reference architecture actually require more resources than developing it. Furthermore, experience shows it is difficult to create an architecture that enables a lot of different variants that is also strategically useable in the long term.
Towards an architectural treatment of software security
Authors: Ren Jie , Taylor Richard , Dourish Paul , Redmiles David
Published: November 2005

Security is a very important concern for software architecture and software components. Previous modeling approaches provide insufficient support for an in-depth treatment of security. This paper argues for a more comprehensive treatment based on software connectors. Connectors provide a suitable vehicle to model, capture, and enforce security. Our approach models security principal, privilege, trust, and context of architectural constituents. Extending our existing architecture description language and support tools, our approach can facilitate describing the security characteristics of an architecture generating enabling infrastructure, and monitoring run-time conformance. Initial results of applying this approach are illustrated through a case study. The contribution of this research is a deeper and more comprehensive treatment of architectural security through software connectors.
Establishing trustworthiness in services of the critical infrastructure through certification and accreditation
Authors: Lee Seok Won , Gandhi Robin A. , Ahn Gail-Joon
Published: November 2005

Trustworthiness in services provided by the Critical Infrastructure (CI) is essentially dependent on the quality of underlying software, systems, practice and environment, as which the software information infrastructures are becoming increasingly a major component of business, industry, government and defense. The level of trustworthiness required from services that are operational in such critical software information infrastructures is often established based on standardized infrastructure-wide evaluation criteria - Certification and Accreditation (C&A) - through the identification of operational risks and the determination of conformance with established security standards and best practices. In order to effectively establish such levels of trustworthiness for services in the CI, we identify the need for a structured and comprehensive C&A framework with appropriate tool support that combines its theoretical and practical aspects. In this paper, we present our efforts in developing such a framework that leverages novel techniques from software requirements engineering and knowledge engineering to support the automation of the Department of Defense Information Technology Security Certification and Accreditation Process (DITSCAP), which is a standard for certifying and accrediting the information networks that support the Defense Information Infrastructure (DII). Through the examples derived from our case study, we further motivate the applicability and appropriateness of our framework.
Leveraging architectural models to inject trust into software systems
Authors: Banerjee Somo , Mattmann Chris A. , Medvidovic Nenad , Golubchik Leana
Published: November 2005

Existing software systems have become increasingly durable and their lifetimes have significantly lengthened. They are increasingly distributed and decentralized. Our dependence on them has grown tremendously. As such, the issues of
trustworthiness
and
security
have become prime concerns in designing, constructing, and evolving software systems. However, the exact meanings of these concepts are not universally agreed upon, nor is their role in the different phases of the software development lifecycle. In this paper, we argue that trustworthiness is a more broadly encompassing term than security, and that the two are often interdependent. We then identify a set of dimensions of trustworthiness. Finally, we analyze how the key elements of a software system's architecture can be leveraged in support of those trustworthiness dimensions. Our ultimate goal is to apply these ideas in the context of a concrete software architecture project. The goal of this paper is more modest: to understand the problem area and its relation to software architecture.
Articulating and enforcing authorisation policies with UML and OCL
Authors: Sohr Karsten , Ahn Gail-Joon , Migge Lars
Published: November 2005

Nowadays, more and more security-relevant data are stored on computer systems; security-critical business processes are mapped to their digital pendants. This situation applies to various critical infrastructures requiring that different security requirements must be fulfilled. It demands a way to design and express higher-level security policies for such critical organizations. In this paper we focus on authorisation policies to demonstrate how software engineering techniques can help validate authorisation constraints and enforce access control policies. Our approach leverages features and functionalities of the UML/OCL modeling methods as well as model driven approach to represent and specify authorisation model and constraints. Using our authorisation constraints editor, we articulate role-based authorisation policies. Also, we attempt to validate and enforce such constraints with the USE (UML Specification Environment) tool.
Towards software architecture-based regression testing
Authors: Muccini Henry , Dias Marcio S. , Richardson Debra J.
Published: November 2005

When architecting dependable systems, in addition to improving system dependability by means of construction (fault-tolerant and redundant mechanisms, for instance), it is also important to evaluate, and thereby confirm, system dependability. There are many different approaches for evaluating system dependability, and testing always has been an important one.Previous work on software architecture testing has shown it is possible to apply conformance-testing techniques to yield confidence that the behavior of an implemented system conforms to the expected behavior of the software architecture, specified with Architecture Description Languages.In this work, we explore how regression testing can be systematically applied at the software architecture level in order to reduce the cost of retesting modified systems, and also to assess the regression testability of the evolved system. We consider assessing both "top-down" and "bottom-up" evolution, i.e., whether a slightly modified implementation conforms to the initial architecture, and whether the (modified) implementation conforms an evolved architecture. A better understanding on how regression testing can be applied at the software architecture level will help us to assess and identify architecture with higher dependability.
Computing optimal self-repair actions
Authors: Tichy Matthias , Giese Holger , Schilling Daniela , Pauls Wladimir
Published: November 2005

The dependability of a software system can be improved by online redeployment of failed software components using appropriate system self-repair actions. The effect of different self-repair actions can vary to a great extent w.r.t. the resulting temporary service unavailability and reduced redundancy of services. We therefore developed an approach to efficiently compute self-repair actions which realize requested repair steps in a nearly optimal manner. We show that our approach achieves a suitable compromise between the usually infeasible optimal deployment modification w.r.t. damage minimization and repair time minimization by presenting a number of simulation results.
Architectural support for mode-driven fault tolerance in distributed applications
Authors: Srivastava Deepti , Narasimhan Priya
Published: November 2005

Many distributed applications exhibit different types of system behaviors, or
modes
, during the course of their operation. Each such mode may have different functional and non-functional requirements (such as fault tolerance, availability, and security). A static software fault-tolerance solution can not cater to the needs of every mode, and also does not utilize system resources intelligently. A flexible architecture is required to provide dependability that can be tailored for such applications. We propose a novel mode-driven fault-tolerance approach that includes:
(i)
a generic framework to extend the
specification
of modes with fault-tolerance requirements, and
(ii) a software architecture
that uses this description to provide the
appropriate
fault tolerance for each mode at
runtime.
We also present a case study using a distributed multi-modal CORBA application to demonstrate the effectiveness of our approach.
Sensitivity analysis for a scenario-based reliability prediction model
Authors: Rodrigues Genaína N. , Rosenblum David S. , Uchitel Sebastian
Published: November 2005

As a popular means for capturing behavioural requirements, scenarios show how components interact to provide system-level functionality. If component reliability information is available, scenarios can be used to perform early system reliability assessment. In previous work we presented an automated approach for predicting software system reliability that extends a scenario specification to model (1)
the probability of component failure
, and (2)
scenario transition probabilities.
Probabilistic behaviour models of the system are then synthesized from the extended scenario specification. From the system behaviour model, reliability prediction can be computed. This paper complements our previous work and presents a sensitivity analysis that supports reasoning about how component reliability and usage profiles impact on the overall system reliability. For this purpose, we present how the system reliability varies as a function of the
components reliabilities
and the
scenario transition probabilities.
Taking into account the concurrent nature of component-based software systems, we also analyse the effect of implied scenarios prevention into the sensitivity analysis of our reliability prediction technique.
Availability simulation of peer-to-peer architectural styles
Authors: Giesecke Simon , Warns Timo , Hasselbring Wilhelm
Published: November 2005

This paper addresses the issue of quantitatively investigating availability within peer-to-peer systems. We devise a conceptual framework integrating architectural styles, architectures, and concrete systems. We identify basic characteristics of architectural styles for peer-to-peer systems and give a formal model to describe derived architectures. Architectural descriptions are used as input for simulations to predict the availability of services within real-world systems.
Fault patterns in Matlab
Authors: Nkwocha Fidel , Elbaum Sebastian
Published: November 2005

Fault patterns are code idioms that may constitute faults. Software engineers have various program analysis techniques and tools to assist them in the detection of such patterns, resulting in increased software quality. End user programmers, however, often lack such support. In this paper we take a first step to address this limitation in the context of Matlab. First, we adapt fault patterns commonly used in other programming languages to Matlab. Second, we present a tool to detect such patterns in fifteen popular Matlab programs. Our results reveal that these simple and quickly identifiable patterns are commonly found in Matlab programs developed by end users and shared across the large Matlab community of end user programmers.
An effective testing method for end-user programmers
Authors: Chen T. Y. , Kuo F.-C. , Zhou Zhi Quan
Published: November 2005

End-user programmers do not have extensive knowledge of various software testing methodologies used by professional testers. While they are creating the vast majority of software today, errors are pervasive in the programs due to the lack of testing techniques readily adoptable by end-user programmers. In this article we argue that the technique of metamorphic testing is both practical and effective for end-user programmers.
Market forces and end-user programming for mission-critical systems
Authors: Prechelt Lutz , Hutzel Daniel J.
Published: November 2005

The abaXX Workflow Engine (WFE) is a J2EE COTS software component, part of a larger suite for building web-based systems. Although these systems are usually mission-critical (the customers often being financial institutions), a visual tool that could be used for end-user programming, called the Process Modeler, proved important for marketing the WFE and the component suite in general. The promise of end-user programming (EUP), however, never materialized. This article sketches the evolution of the WFE. It de-scribes why the EUP capabilities were required, why they were never really used in practice, and how to reconcile these two facts.
Combining static analysis and runtime monitoring to counter SQL-injection attacks
Authors: Halfond William G. J. , Orso Alessandro
Published: November 2005

Our dependence on web applications has steadily increased, and we continue to integrate them into our everyday routine activities. When we are making reservations, paying bills, and shopping on-line, we expect these web applications to be secure and reliable. However, as the availability of these services has increased, there has been a corresponding increase in the number and sophistication of attacks that target them. One of the most serious types of attack against web applications is SQL injection. SQL injection is a class of code-injection attacks in which user input is included in a SQL query in such a way that part of the input is treated as code. Using SQL injection. attackers can leak confidential information, such as credit card numbers, from web applications' databases and even corrupt the database. In this paper, we propose a novel technique to counter SQL-injection. The technique combines conservative static analysis and runtime monitoring to detect and stop illegal queries before they are executed on the database. In its static part, the technique builds a conservative model of the legitimate queries that could be generated by the application. In its dynamic part, the technique inspects the dynamically generated queries for compliance with the statically-built model. We also present a preliminary evaluation of the technique performed on two small web applications. The results of the evaluation are promising---our technique was able to prevent all of the attacks that we performed on the two applications.
Analyzing clusters of web application user sessions
Authors: Sampath Sreedevi , Sprenkle Sara , Gibson Emily , Pollock Lori , Souter Amie
Published: November 2005

User sessions provide valuable insight into the dynamic behavior of web applications. They also play a key role in user-session-based testing, which gathers user sessions in the field and replays selected sessions to test an evolving application. To decrease the testing and analysis effort, testers reduce the set of collected user sessions by either clustering user sessions by their shared URL attributes or by program coverage requirements-based reduction techniques. Clustering URL attributes can be considerably less expensive; however, the tradeoff may be that clustering is not representative of dynamic behavior similarities. This paper describes our analysis of user session data to reveal correlations between sessions clustered on the sessions' attributes and the relative dynamic behavior of the program for those sessions. The results of our analysis also motivate other clustering and test suite reduction techniques. Our results can also be used to learn more about how clusters of web application use cases are related in terms of the underlying user session attributes, program coverage, and fault detection.