waashk/dblp huggingface dataset:
architecture knowledge management: challenges, approaches, and tools. capturing the technical knowledge, contextual information, and rationale surrounding the design decisions underpinning system architectures can greatly improve the software development process. if not managed, this critical knowledge is implicitly embedded in the architecture, becoming tacit knowledge which erodes as personnel on the project change. moreover, the unavailability of architecture knowledge precludes organizations from growing their architectural capabilities. in this tutorial, we highlight the benefits and challenges in managing software architecture knowledge. we discuss various approaches to characterize architecture knowledge based on the requirements of a particular domain. we describe various concepts and approaches to manage the architecture knowledge from both management and technical perspectives. we also demonstrate the utility of captured knowledge to support software architecture activities with a case study covering the use of architecture knowledge management techniques and tools in an industrial project.
experiences with mirth: an open source health care integration engine. integration engines are a crucial piece of the health care information technology puzzle. health care organizations like hospitals and clinics are faced with vast amounts of data and a slew of interchange standards and protocols when addressing the issue of exchanging data between information systems. this paper describes our experience in developing mirth, a popular open source health care messaging integration engine. based on a unique client-server and enterprise service bus hybrid architecture, mirth supports the development of interfaces for moving data between two or more systems. we describe the mirth architecture in detail and discuss our experiences through several case studies that demonstrate its use. we also provide our insights gained in designing the mirth architecture through several lessons learned.
early prediction of software component reliability. the ability to predict the reliability of a software system early in its development, e.g., during architectural design, can help to improve the system's quality in a cost-effective manner. existing architecture-level reliability prediction approaches focus on system-level reliability and assume that the reliabilities of individual components are known. in general, this assumption is unreasonable, making component reliability prediction an important missing ingredient in the current literature. early prediction of component reliability is a challenging problem because of many uncertainties associated with components under development. in this paper we address these challenges in developing a software component reliability prediction framework. we do this by exploiting architectural models and associated analysis techniques, stochastic modeling approaches, and information sources available early in the development lifecycle. we extensively evaluate our framework to illustrate its utility as an early reliability prediction approach.
the architecture of the apex platform, salesforce.com's platform for building on-demand applications. on-demand computing has transformed enterprise software, lowering risk and cost while increasing user adoption and customer success. to be successful, an application must be designed for on-demand from the ground-up, including core architectural elements such as multitenancy, availability, performance, security, metadata-driven customization, integration via web services, etc. as with any new paradigm, initial applications must design and implement all these core attributes, but ultimately platforms emerge that encapsulate core computing services, allowing application developers to focus on innovation and value, and not on reinventing the wheel. with the apex platform, salesforce.com has delivered the first on-demand platform, allowing developers to easily develop and deliver the next generation of on-demand applications. in this talk, steve fisher discusses the technical architecture of the apex platform.
static detection of cross-site scripting vulnerabilities. web applications support many of our daily activities, but they often have security problems, and their accessibility makes them easy to exploit. in cross-site scripting (xss), an attacker exploits the trust a web client (browser) has for a trusted server and executes injected script on the browser with the server's privileges. in 2006, xss constituted the largest class of newly reported vulnerabilities making it the most prevalent class of attacks today. web applications have xss vulnerabilities because the validation they perform on untrusted input does not suffice to prevent that input from invoking a browser's javascript interpreter, and this validation is particularly difficult to get right if it must admit some html mark-up. most existing approaches to finding xss vulnerabilities are taint-based and assume input validation functions to be adequate, so they either miss real vulnerabilities or report many false positives. this paper presents a static analysis for finding xss vulnerabilities that directly addresses weak or absent input validation. our approach combines work on tainted information flow with string analysis. proper input validation is difficult largely because of the many ways to invoke the javascript interpreter; we face the same obstacle checking for vulnerabilities statically, and we address it by formalizing a policy based on the w3c recommendation, the firefox source code, and online tutorials about closed-source browsers. we provide effective checking algorithms based on our policy. we implement our approach and provide an extensive evaluation that finds both known and unknown vulnerabilities in real-world web applications.
computer professional ethics in theory and in practice. the starting place for professional ethics is with the idea that certain occupational groups have special expertise that leads to special responsibilities. the organization of the group into a profession with an organization that controls admission and promulgates a code of ethics is a mechanism for ensuring that the special expertise of members is deployed in ways that benefit the public (consumers, users, non-experts) or, at least, does not harm the public.
limits to dependability assurance - a controversy revisited. more than twenty years ago, as computers were introduced into safety-critical roles in civil aircraft, there was much debate about what claims could be made for their dependability. much of the debate focused, naturally enough, on what could be claimed for the reliability of software. a famous example was the apparent need to claim a probability of failure of less than 10**-9 per hour for some flight-critical avionics. several authors (i was one) demonstrated that such claims were several orders of magnitude beyond what could be supported with scientific rigour. in this talk i shall revisit this debate, showing some advances that have been made in "dependability cases," particularly involving formal notions of "confidence" in dependability claims. however, i shall also show that the bottom line has not changed significantly: although some systems have been shown to have extremely high dependability/ after the fact/ (i.e. in extensive operational use), it still remains impossible to show/ before using it/ that a system will be extremely dependable in operation. the reason is an unforgiving law about the extensiveness of evidence needed to make very strong dependability claims. these limits to assurance should be of interest beyond the technical community: for example, they pose difficult questions for society in estimating the risks associated with the deployment of certain novel systems.
archstudio 4: an architecture-based meta-modeling environment. we will demonstrate archstudio, an environment for software architecture modeling and meta-modeling. we will also showcase a set of innovative architecture-centric applications that use archstudio technologies as their basis.
is code still moving around? looking back at a decade of code mobility. in the mid-nineties, mobile code was on the rise and, in particular, there was a growing interest in autonomously moving code components, called mobile agents. in 1997, we published a paper that introduced the concept of mobile code paradigms, which are design patterns that involve code mobility. the paradigms highlighted the locations of code, resources, and execution as first-class abstractions. this characterization proved useful to frame mobile code designs and technologies, and also as a basis for a quantitative analysis of applications built with them. ten years later, things have changed considerably. in this paper we present our view of how mobile code evolved and discuss which paradigms succeeded or failed in supporting effectively distributed applications.
on the difficulty of replicating human subjects studies in software engineering. replications play an important role in verifying empirical results. in this paper, we discuss our experiences performing a literal replication of a human subjects experiment that examined the relationship between a simple test for consistent use of mental models, and success in an introductory programming course. we encountered many difficulties in achieving comparability with the original experiment, due to a series of apparently minor differences in context. based on this experience, we discuss the relative merits of replication, and suggest that, for some human subjects studies, literal replication may not be the the most effective strategy for validating the results of previous studies.
retrospectives on peopleware. since its publication twenty years ago, "peopleware productive projects and teams" (dorset house, 1987), by tom demarco and tim lister, has enlightened software professionals and non-professionals alike. peopleware introduced among other topics - "team gel", design patterns, the "furniture police" - to the software engineering community and suggested that "sociology matters more than technology or even money." this unique session with the pioneers of our profession is an opportunity to learn, reflect, and share experiences -- looking forward to the future. this compendium consists of brief bios and first person retrospectives on "peopleware".
executable misuse cases for modeling security concerns. misuse cases are a way of modeling negative requirements, that is, behaviors that should not occur in a system. in particular, they can be used to model attacks on a system as well as the security mechanisms needed to avoid them. however, like use cases, misuse cases describe requirements in a high-level and informal manner. this means that, whilst they are easy to understand, they do not lend themselves to testing or analysis. in this paper, we present an executable misuse case modeling language which allows modelers to specify misuse case scenarios in a formal yet intuitive way and to execute the misuse case model in tandem with a corresponding use case model. misuse scenarios are given in executable form and mitigations are captured using aspect-oriented modeling. the technique is useful for brainstorming potential attacks and their mitigations. furthermore, the use of aspects allows mitigations to be maintained separately from the core system model. the paper, supported by a uml-based modeling tool, describes an application to two case studies, providing evidence that the technique can support red-teaming of security requirements forn realistic systems.
agile contracts. in the mid 1980's toyota came to the us and showed detroit how to work with suppliers on a win-win basis. in just five years, toyota was the most trusted automaker among all automotive suppliers, had the lowest procurement costs, and the highest contribution of innovation from supplier companies. what does toyota know about working with contracts that we can learn? for starters, they know that trust lies in specific actions, not interpersonal relationships. they understand the "game' of contracting, and know how to structure relationships so both sides are motivated to contribute to the common good. there's much we can learn from toyota about how to change the contracting game in software development for the benefit of both parties.
a study of student strategies for the corrective maintenance of concurrent software. graduates of computer science degree programs are increasingly being asked to maintain large, multi-threaded software systems; however, the maintenance of such systems is typically not well-covered by software engineering texts or curricula. we conducted a think-aloud study with 15 students in a graduate-level computer science class to discover the strategies that students apply, and to what effect, in performing corrective maintenance on concurrent software. we collected think-aloud and action protocols, and annotated the protocols for a number of behavioral attributes and maintenance strategies. we divided the protocols into groups based on the success of the participant in both diagnosing and correcting the failure. we evaluated these groups for statistically significant differences in these attributes and strategies. in this paper, we report a number of interesting observations that came from this study. all participants performed diagnostic executions of the program to aid program comprehension; however, the participants that used this as their predominant strategy for diagnosing the fault were all unsuccessful. among the participants that successfully diagnosed the fault and displayed high confidence in their diagnosis, we found two commonalities. they all recognized that the fault involved the violation of a concurrent-programming idiom. and, they all constructed detailed behavioral models (similar to uml sequence diagrams) of execution scenarios. we present detailed analyses to explain the attributes that correlated with success or lack of success. based on these analyses, we make recommendations for improving software engineering curriculums by better training students how to apply these strategies effectively.
modeling for maintainability. software maintenance is the cinderella of software engineering. the cost of creating a longlived application is dwarfed by the cost of maintaining, updating and porting it over a lifetime sometimes measured in decades, yet few software engineers plan for maintainability. the only alternative to maintenance is to routinely re-implement working systems to a revised specification, but this is an even more expensive proposition. in fact, as the deployed software base continues to grow, we may already have reached the point where it's economically impossible to replace working applications, and there's no alternative to maintaining them. fortunately, recent studies show that model-driven development methods (such as omg's model driven architecture) not only help develop quality applications quickly and cheaply in the first place, but also yield dramatic savings in the time and effort needed to maintain them. use of model-driven techniques may literally be the only way businesses can afford to keep their software infrastructure running over the next few decades.
deryaft: a tool for generating representation invariants of structurally complex data. deryaft is a tool for generating likely representation invariants of structurally complex data. given a small set of concrete structures, deryaft analyzes their key characteristics to formulate local and global properties that the structures exhibit. for effective formulation of structural invariants, deryaft focuses on graph properties, including reachability, and views the program heap as an edge-labeled graph. deryaft outputs a java predicate that represents the invariants; the predicate takes an input structure and returns true if and only if it satisfies the invariants.
portraits in practice. portraits in practice invites companies with technically advanced software-engineering practices and intriguing research challenges to discuss them with the icse 2007 participants. the sessions in this track let researchers hear industrial practitioners describe their projects and concerns in some detail, and they let other practitioners hear what technologies these companies recommend. the track provides an open discussion and blunt assessment of future needs with experts from these leading industries. the goal is to encourage and foment improved communication between leading companies and academic researchers.
adams re-trace: traceability link recovery via latent semantic indexing. in this demonstration we present the traceability recovery tool developed in adams, a fine-grained artefact management system. the tool is based on an information retrieval technique, namely latent semantic indexing, and aims at supporting the software engineer in the identification of traceability links between artefacts of different types. the tool has also been integrated in the eclipse-based client of adams.
software engineering: the legacy of barry w. boehm. we are convening a symposium to honor barry w. boehm's lifetime contributions to the software engineering community and co-locating this event with the 29th international conference on software engineering.
defining and continuous checking of structural program dependencies. dependencies between program elements need to be modeled from different perspectives reflecting architectural, design, and implementation level decisions. to avoid erosion of the intended structure of the code, it is necessary to explicitly codify these different perspectives on the permitted dependencies and to detect violations continuously and incrementally as software evolves. we propose an approach that uses declarative queries to group source elements - across programming language module boundaries - into overlapping ensembles. the dependencies between these ensembles are also specified as logic queries. the approach has been integrated into the incremental build process of eclipse to ensure continuous checking, using an engine for tabled and incremental evaluation of logic queries. our evaluation shows that our approach is fast enough for day-to-day use along the incremental build process of modern ides.
strada: a tool for scenario-based feature-to-code trace detection and analysis. software engineers frequently struggle with understanding the relationships between the source code of a system and its requirements or high-level features. these relationships are commonly referred to as trace links. the creation and maintenance of trace links is a largely manual, time-consuming, and error-prone process. this paper presents strada (scenario-based trace detection and analysis) -- a tool that helps software engineers explore traces links to source code through testing. while testing is predominantly done to ensure the correctness of a software system, strada demonstrates a vital secondary benefit: by executing source code during testing it can be linked to requirements and features, thus establishing traceability automatically.
incremental state-space exploration for programs with dynamically allocated data. we present a novel technique that speeds up state-space exploration (sse) for evolving programs with dynamically allocated data. sse is the essence of explicit-state model checking and an increasingly popular method for automating test generation. traditional, non-incremental sse takes one version of a program and systematically explores the states reachable during the program's executions to find property violations. incremental sse considers several versions that arise during program evolution: reusing the results of sse for one version can speed up sse for the next version, since state spaces of consecutive program versions can have significant similarities. we have implemented our technique in two model checkers: java pathfinder and the j-sim state-space explorer. the experimental results on 24 program evolutions and exploration changes show that for non-initial runs our technique speeds up sse in 22 cases from 6.43% to 68.62% (with median of 42.29%) and slows down sse in only two cases for -4.71% and -4.81%.
ucsim: a tool for simulating use case scenarios. this paper describes the use case simulator (ucsim), an eclipse plug-in for visualization and simulation of use cases. simulation of use cases allows stakeholders to play with what-if scenarios as a way to test completeness and correctness. textual use cases, however, are not semantically precise enough to be simulated. ucsim, therefore, uses minimal extensions to uml models to describe use cases, transforms the use cases automatically into an executable form (hierarchical uml state machines), and provides a configurable simulator for executing the state machine representation of the use cases.
mining library specifications using inductive logic programming. software libraries organize useful functionalities in order to promote modularity and code reuse. a typical library is used by client programs through an application programming interface (api) that hides its internals from the client. typically, the rules governing the correct usage of the api are documented informally. in many cases, libraries may have complex api usage rules and unclear documentation. as a result, the behaviour of the library under some corner cases may not be well understood by the programmer. formal specifications provide a precise understanding of the api behaviour. we propose a methodology for learning interface specifications using inductive logic programming (ilp). our technique runs several unit tests on the library in order to generate relations describing the operation of the library. the data collected from these tests are used by an inductive learner to obtain rich datalog/prolog specifications. such specifications capture essential properties of interest to the user. they may be used for applications such as reverse engineering the library internals or constructing checks on the application code to enforce proper api usage along with other properties of interest.
building scalable libraries with cj. creating highly reusable software libraries is one of the primary software engineering goals. the ability of a library to be reused, however, depends crucially on the ease of customizing the reusable components. if customization is hard, the well-known library scalability problem [1] ensues: a domain contains n features, but these can produce an exponential (or super-exponential if order matters or features can be replicated) number of combinations. hard-coding all combinations results in an unmaintainably large library. offering features as components that are composed without any customization results in undesirable "bad-fit" solutions, either for reasons of performance or correctness.
mismar: a new approach to developer documentation. successful open source projects foster collaboration and innovation while benefiting from a faster pace of development, but are often plagued by poor developer's documentation. in this paper, we present the rationale and the architecture of mismar, a toolset tightly integrated in the eclipse environment and implementing a concern-oriented approach to documentation. as opposed to traditional documentation artifacts, guides produced by mismar are almost wordless and automatically maintain implementation examples. moreover, since mismar was built from the ground up to be extensible, it is easy to support artifacts written in multiple languages or modeling approaches.
marama: an eclipse meta-toolset for generating multi-view environments. we describe the marama suite of meta-tools. this eclipse-based toolset permits rapid specification of notational elements, meta-models, view editors and view-model mappings. it has a novel set of behavioural specification tools for both visual and model level behaviours. an integrated mapping tool provides model transformation and code generation support. the toolset has been applied to several significant application development tasks and has undergone a variety of evaluations.