首页 > 最新文献

Electron. Commun. Eur. Assoc. Softw. Sci. Technol.最新文献

英文 中文
Facilitating Automated Compliance Checking in the Safety-critical Context 促进安全关键上下文中的自动遵从性检查
Pub Date : 2019-12-16 DOI: 10.14279/tuj.eceasst.78.1087
Julieth Patricia Castellanos Ardila
In some safety-critical domains, the applicable safety standards prescribe a safety lifecycle and process-related requirements. Process plans in accordance with the prescribed requirements are essential pieces of evidence for compliance assessment with such standards. However, providing this evidence is time-consuming and prone-to-error since safety standards are large, natural language-based documents with hundreds of requirements. Besides, a company may have many safety-critical-related processes to be checked. In this paper, we propose a novel approach that combines process modeling and compliance checking capabilities to provide the analysis required to conclude whether a process model corresponds to the model with compliant states. Hitherto, our proposed methodology has been evaluated with academic examples that show the potential benefits of its use.
在一些安全关键领域,适用的安全标准规定了安全生命周期和与过程相关的要求。符合规定要求的过程计划是对这些标准进行符合性评估的必要证据。然而,提供这种证据既耗时又容易出错,因为安全标准是大型的、基于自然语言的文档,有数百个需求。此外,公司可能有许多与安全关键相关的流程需要检查。在本文中,我们提出了一种结合流程建模和遵从性检查功能的新方法,以提供必要的分析,以得出流程模型是否与具有遵从状态的模型相对应。到目前为止,我们提出的方法已经用学术实例进行了评估,这些实例显示了使用该方法的潜在好处。
{"title":"Facilitating Automated Compliance Checking in the Safety-critical Context","authors":"Julieth Patricia Castellanos Ardila","doi":"10.14279/tuj.eceasst.78.1087","DOIUrl":"https://doi.org/10.14279/tuj.eceasst.78.1087","url":null,"abstract":"In some safety-critical domains, the applicable safety standards prescribe a safety lifecycle and process-related requirements. Process plans in accordance with the prescribed requirements are essential pieces of evidence for compliance assessment with such standards. However, providing this evidence is time-consuming and prone-to-error since safety standards are large, natural language-based documents with hundreds of requirements. Besides, a company may have many safety-critical-related processes to be checked. In this paper, we propose a novel approach that combines process modeling and compliance checking capabilities to provide the analysis required to conclude whether a process model corresponds to the model with compliant states. Hitherto, our proposed methodology has been evaluated with academic examples that show the potential benefits of its use.","PeriodicalId":115235,"journal":{"name":"Electron. Commun. Eur. Assoc. Softw. Sci. Technol.","volume":"11 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-12-16","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129907016","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Formal Verification in the Loop to Enhance Verification of Safety-Critical Cyber-physical Systems 在循环中正式验证以加强安全关键信息物理系统的验证
Pub Date : 2019-10-21 DOI: 10.14279/tuj.eceasst.77.1106
C. Bernardeschi, A. Domenici, S. Saponara
Formal verification may play a central role in the development of safe controllers, such as those found in electric drives or (semi-)autonomous vehicles, whose complexity arises from the coexistence of mechanical and electrical subsystems with sophisticated electronic controllers that must implement high-level control policies according to different driving modes, while optimizing several objectives, such as safety first and foremost, efficiency, and performance among others.  Model-driven development resorts to simulation to assess how well the various requirements and constraints are satisfied, but there is a growing awareness that more rigorous methods are needed to achieve the required levels of safety.  This paper proposes a conceptual framework for the development of complex systems based on (i) higher-order logic specification, (ii) verification by theorem proving, and (iii) tight integration of verification with model-driven development and simulation.  This framework addresses both digital and analog systems, as illustrated with some examples in different fields including implantable biomedical systems, autonomous vehicles, and electric valve actuation.
正式验证可能在安全控制器的开发中发挥核心作用,例如在电力驱动或(半)自动驾驶汽车中发现的那些,其复杂性源于机械和电气子系统与复杂的电子控制器的共存,这些电子控制器必须根据不同的驾驶模式实施高级控制策略,同时优化几个目标,例如安全第一,效率和性能等。模型驱动的开发依靠模拟来评估各种需求和约束的满足程度,但是越来越多的人意识到需要更严格的方法来实现所需的安全级别。本文提出了一个基于(i)高阶逻辑规范、(ii)定理证明验证和(iii)验证与模型驱动开发和仿真紧密集成的复杂系统开发的概念框架。该框架涉及数字和模拟系统,如在不同领域的一些例子所示,包括植入式生物医学系统、自动驾驶汽车和电动阀门驱动。
{"title":"Formal Verification in the Loop to Enhance Verification of Safety-Critical Cyber-physical Systems","authors":"C. Bernardeschi, A. Domenici, S. Saponara","doi":"10.14279/tuj.eceasst.77.1106","DOIUrl":"https://doi.org/10.14279/tuj.eceasst.77.1106","url":null,"abstract":"Formal verification may play a central role in the development of safe controllers, such as those found in electric drives or (semi-)autonomous vehicles, whose complexity arises from the coexistence of mechanical and electrical subsystems with sophisticated electronic controllers that must implement high-level control policies according to different driving modes, while optimizing several objectives, such as safety first and foremost, efficiency, and performance among others.  Model-driven development resorts to simulation to assess how well the various requirements and constraints are satisfied, but there is a growing awareness that more rigorous methods are needed to achieve the required levels of safety.  This paper proposes a conceptual framework for the development of complex systems based on (i) higher-order logic specification, (ii) verification by theorem proving, and (iii) tight integration of verification with model-driven development and simulation.  This framework addresses both digital and analog systems, as illustrated with some examples in different fields including implantable biomedical systems, autonomous vehicles, and electric valve actuation.","PeriodicalId":115235,"journal":{"name":"Electron. Commun. Eur. Assoc. Softw. Sci. Technol.","volume":"12 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-10-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127621421","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
AskTheCode: Interactive Call Graph Exploration for Error Fixing and Prevention AskTheCode:用于错误修复和预防的交互式调用图探索
Pub Date : 2019-10-21 DOI: 10.14279/tuj.eceasst.77.1109
Robert Husák, J. Kofroň, F. Zavoral
In order to prevent and fix errors in program code, developers need to understand its semantics to a significant extent. For this purpose, they use various approaches, such as manual call graph exploration or dynamic analysis with a debugger. However, these techniques tend to be cumbersome in a larger codebase, because they provide either underapproximate or overapproximate results and it is often hard to combine them. Therefore, we present AskTheCode, a Microsoft Visual Studio extension enabling to interactively explore a call graph, ensuring that only feasible execution traces are taken into consideration. AskTheCode is based on control flow analysis and backward symbolic execution. We show its potential to significantly improve developers' experience on a complex code example.
为了防止和修复程序代码中的错误,开发人员需要在很大程度上理解其语义。为此,他们使用各种方法,例如手动调用图探索或带有调试器的动态分析。然而,在较大的代码库中,这些技术往往很麻烦,因为它们提供的结果要么是过近似的,要么是过近似的,而且通常很难将它们结合起来。因此,我们提出AskTheCode,这是一个Microsoft Visual Studio扩展,可以交互式地探索调用图,确保只考虑可行的执行跟踪。AskTheCode是基于控制流分析和向后符号执行。我们展示了它在复杂代码示例上显著改善开发人员体验的潜力。
{"title":"AskTheCode: Interactive Call Graph Exploration for Error Fixing and Prevention","authors":"Robert Husák, J. Kofroň, F. Zavoral","doi":"10.14279/tuj.eceasst.77.1109","DOIUrl":"https://doi.org/10.14279/tuj.eceasst.77.1109","url":null,"abstract":"In order to prevent and fix errors in program code, developers need to understand its semantics to a significant extent. For this purpose, they use various approaches, such as manual call graph exploration or dynamic analysis with a debugger. However, these techniques tend to be cumbersome in a larger codebase, because they provide either underapproximate or overapproximate results and it is often hard to combine them. Therefore, we present AskTheCode, a Microsoft Visual Studio extension enabling to interactively explore a call graph, ensuring that only feasible execution traces are taken into consideration. AskTheCode is based on control flow analysis and backward symbolic execution. We show its potential to significantly improve developers' experience on a complex code example.","PeriodicalId":115235,"journal":{"name":"Electron. Commun. Eur. Assoc. Softw. Sci. Technol.","volume":"13 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-10-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131520338","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 4
Cross-Programming Language Taint Analysis for the IoT Ecosystem 物联网生态系统的跨编程语言污染分析
Pub Date : 2019-10-21 DOI: 10.14279/tuj.eceasst.77.1104
Pietro Ferrara, A. K. Mandal, Agostino Cortesi, F. Spoto
The Internet of Things (IoT) is a key component for the next disruptive technologies. However, IoT merges together several diverse software layers: embedded, enterprise, and cloud programs interact with each other. In addition, security and privacy vulnerabilities of IoT software might be particularly dangerous due to the pervasiveness and physical nature of these systems. During the last decades, static analysis, and in particular taint analysis, has been widely applied to detect software vulnerabilities. Unfortunately, these analyses assume that software is entirely written in a single programming language, and they are not immediately suitable to detect IoT vulnerabilities where many different software components, written in different programming languages, interact. This paper discusses how to leverage existing static taint analyses to a cross-programming language scenario.
物联网(IoT)是下一代颠覆性技术的关键组成部分。然而,物联网将几个不同的软件层融合在一起:嵌入式、企业和云程序相互交互。此外,由于这些系统的普遍性和物理性质,物联网软件的安全和隐私漏洞可能特别危险。在过去的几十年里,静态分析,特别是污点分析,已经被广泛应用于检测软件漏洞。不幸的是,这些分析假设软件完全用单一编程语言编写,并且它们不适合立即检测物联网漏洞,其中许多不同的软件组件,用不同的编程语言编写,相互作用。本文讨论了如何在跨编程语言场景中利用现有的静态污染分析。
{"title":"Cross-Programming Language Taint Analysis for the IoT Ecosystem","authors":"Pietro Ferrara, A. K. Mandal, Agostino Cortesi, F. Spoto","doi":"10.14279/tuj.eceasst.77.1104","DOIUrl":"https://doi.org/10.14279/tuj.eceasst.77.1104","url":null,"abstract":"The Internet of Things (IoT) is a key component for the next disruptive technologies. However, IoT merges together several diverse software layers: embedded, enterprise, and cloud programs interact with each other. In addition, security and privacy vulnerabilities of IoT software might be particularly dangerous due to the pervasiveness and physical nature of these systems. During the last decades, static analysis, and in particular taint analysis, has been widely applied to detect software vulnerabilities. Unfortunately, these analyses assume that software is entirely written in a single programming language, and they are not immediately suitable to detect IoT vulnerabilities where many different software components, written in different programming languages, interact. This paper discusses how to leverage existing static taint analyses to a cross-programming language scenario.","PeriodicalId":115235,"journal":{"name":"Electron. Commun. Eur. Assoc. Softw. Sci. Technol.","volume":"159 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-10-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133939907","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 5
Detecting Deadlocks in Formal System Models with Condition Synchronization 带条件同步的形式化系统模型中的死锁检测
Pub Date : 2019-05-14 DOI: 10.14279/tuj.eceasst.76.1070
Eduard Kamburjan
We present a novel notion of deadlock for synchronization on arbitrary boolean conditions and a sound, fully automatic deadlock analysis. Contrary to other approaches, our analysis aims to detect deadlocks caused by faulty system design, rather than implementation bugs. We analyze synchronization on boolean conditions on the fields of an object instead of targeting specific synchronization primitives.  As usual, a deadlock is a circular dependency between multiple tasks. A task depends on a second task if the execution of this second task has a side-effect that makes the blocking guard-condition of the first one evaluate to true. This requires an analysis of the computations in a method beyond syntactic properties and we integrate a logical validity calculus to do so.
我们提出了一种新的死锁概念,用于任意布尔条件下的同步,并提出了一种完善的、全自动的死锁分析方法。与其他方法相反,我们的分析旨在检测由错误的系统设计引起的死锁,而不是实现错误。我们根据对象字段的布尔条件分析同步,而不是针对特定的同步原语。通常,死锁是多个任务之间的循环依赖。如果第二个任务的执行具有使第一个任务的阻塞保护条件求值为true的副作用,则该任务依赖于第二个任务。这需要在语法属性之外对方法中的计算进行分析,为此我们集成了逻辑有效性演算。
{"title":"Detecting Deadlocks in Formal System Models with Condition Synchronization","authors":"Eduard Kamburjan","doi":"10.14279/tuj.eceasst.76.1070","DOIUrl":"https://doi.org/10.14279/tuj.eceasst.76.1070","url":null,"abstract":"We present a novel notion of deadlock for synchronization on arbitrary boolean conditions and a sound, fully automatic deadlock analysis. Contrary to other approaches, our analysis aims to detect deadlocks caused by faulty system design, rather than implementation bugs. We analyze synchronization on boolean conditions on the fields of an object instead of targeting specific synchronization primitives.  As usual, a deadlock is a circular dependency between multiple tasks. A task depends on a second task if the execution of this second task has a side-effect that makes the blocking guard-condition of the first one evaluate to true. This requires an analysis of the computations in a method beyond syntactic properties and we integrate a logical validity calculus to do so.","PeriodicalId":115235,"journal":{"name":"Electron. Commun. Eur. Assoc. Softw. Sci. Technol.","volume":"7 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-05-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114819712","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 10
Analyzing Consistency of Formal Requirements 分析形式化需求的一致性
Pub Date : 2019-05-14 DOI: 10.14279/tuj.eceasst.76.1072
J. Becker
In the development of safety-critical embedded systems, requirements-driven approaches are widely used. Expressing functional requirements in formal languages enables reasoning and formal testing. This paper proposes the Simplified Universal Pattern (SUP) as an easy to use formalism and compares it to SPS, another commonly used specification pattern system. Consistency is an important property of requirements that can be checked already in early design phases. However, formal definitions of consistency are rare in literature and tent to be either too weak or computationally too complex to be applicable to industrial systems. Therefore this work proposes a new formal consistency notion, called partial consistency, for the SUP that is a trade-off between exhaustiveness and complexity. Partial consistency identifies critical cases and verifies if these cause conflicts between requirements
在安全关键型嵌入式系统的开发中,需求驱动方法被广泛使用。用形式化语言表达功能需求可以进行推理和形式化测试。本文提出了简化通用模式(Simplified Universal Pattern, SUP)作为一种易于使用的形式体系,并将其与另一种常用的规范模式体系SPS进行了比较。一致性是需求的一个重要属性,可以在早期设计阶段进行检查。然而,一致性的正式定义在文献中很少,并且可能太弱或计算太复杂而无法适用于工业系统。因此,这项工作提出了一种新的形式一致性概念,称为部分一致性,用于在耗尽性和复杂性之间进行权衡的SUP。部分一致性识别关键情况,并验证这些情况是否会导致需求之间的冲突
{"title":"Analyzing Consistency of Formal Requirements","authors":"J. Becker","doi":"10.14279/tuj.eceasst.76.1072","DOIUrl":"https://doi.org/10.14279/tuj.eceasst.76.1072","url":null,"abstract":"In the development of safety-critical embedded systems, requirements-driven approaches are widely used. Expressing functional requirements in formal languages enables reasoning and formal testing. This paper proposes the Simplified Universal Pattern (SUP) as an easy to use formalism and compares it to SPS, another commonly used specification pattern system. Consistency is an important property of requirements that can be checked already in early design phases. However, formal definitions of consistency are rare in literature and tent to be either too weak or computationally too complex to be applicable to industrial systems. Therefore this work proposes a new formal consistency notion, called partial consistency, for the SUP that is a trade-off between exhaustiveness and complexity. Partial consistency identifies critical cases and verifies if these cause conflicts between requirements","PeriodicalId":115235,"journal":{"name":"Electron. Commun. Eur. Assoc. Softw. Sci. Technol.","volume":"17 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-05-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134421515","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 7
Model-Checking-based vs. SMT-based Consistency Analysis of Industrial Embedded Systems Requirements: Application and Experience 基于模型检查与基于smt的工业嵌入式系统需求一致性分析:应用与经验
Pub Date : 2018-10-17 DOI: 10.14279/tuj.eceasst.75.1054
Predrag Filipovikj, G. Rodríguez-Navas, C. Seceleanu
Industry relies predominantly on manual peer-review techniques for assessing the correctness of system specifications. However, with the ever increasing size, complexity and intricacy of the specifications, it becomes difficult to assure their correctness with respect to certain criteria such as consistency. To cope with this challenge, a set of techniques based on formal methods, called textit{sanity checks} have been proposed to automatically assess the quality of system specifications in a systematic and rigorous manner. The predominant way of assessing the sanity of system specifications is by model checking, which in literature is reported to be expensive for analysis as it takes a long time for the procedure to terminate. Recently, another approach for checking the consistency of a system's specification using Satisfiability Modulo Theories has been proposed in order to reduce the analysis time. In this paper, we compare the two approaches for consistency analysis, by applying them on a relevant industrial use case, using the same definition for consistency and the same set of requirements. The comparison is carried out with respect to: i) time for generating the model and the latter's complexity, and ii) consistency analysis time. Contrary to the currently available data, our preliminary results show no significant difference in analysis time when applied on the same system specification under the same definition of consistency, but show significant difference in the time of creating the model for analysis.
工业界主要依靠人工同行评审技术来评估系统规格说明的正确性。然而,随着规范的规模、复杂性和复杂性的不断增加,保证它们在某些标准(如一致性)方面的正确性变得越来越困难。为了应对这一挑战,已经提出了一组基于形式化方法的技术,称为textit{完整性检查},以系统和严格的方式自动评估系统规格说明的质量。评估系统规范是否健全的主要方法是通过模型检查,据文献报道,模型检查对于分析来说是昂贵的,因为过程需要很长时间才能终止。最近,为了减少分析时间,提出了另一种利用可满足模理论检验系统规范一致性的方法。在本文中,我们比较了一致性分析的两种方法,通过将它们应用于相关的工业用例,使用相同的一致性定义和相同的需求集。从模型生成时间和复杂度、一致性分析时间两方面进行比较。与现有数据相反,我们的初步结果表明,在相同的一致性定义下,应用于相同的系统规范时,分析时间没有显着差异,但在创建用于分析的模型的时间上存在显着差异。
{"title":"Model-Checking-based vs. SMT-based Consistency Analysis of Industrial Embedded Systems Requirements: Application and Experience","authors":"Predrag Filipovikj, G. Rodríguez-Navas, C. Seceleanu","doi":"10.14279/tuj.eceasst.75.1054","DOIUrl":"https://doi.org/10.14279/tuj.eceasst.75.1054","url":null,"abstract":"Industry relies predominantly on manual peer-review techniques for assessing the correctness of system specifications. However, with the ever increasing size, complexity and intricacy of the specifications, it becomes difficult to assure their correctness with respect to certain criteria such as consistency. To cope with this challenge, a set of techniques based on formal methods, called textit{sanity checks} have been proposed to automatically assess the quality of system specifications in a systematic and rigorous manner. The predominant way of assessing the sanity of system specifications is by model checking, which in literature is reported to be expensive for analysis as it takes a long time for the procedure to terminate. Recently, another approach for checking the consistency of a system's specification using Satisfiability Modulo Theories has been proposed in order to reduce the analysis time. In this paper, we compare the two approaches for consistency analysis, by applying them on a relevant industrial use case, using the same definition for consistency and the same set of requirements. The comparison is carried out with respect to: i) time for generating the model and the latter's complexity, and ii) consistency analysis time. Contrary to the currently available data, our preliminary results show no significant difference in analysis time when applied on the same system specification under the same definition of consistency, but show significant difference in the time of creating the model for analysis.","PeriodicalId":115235,"journal":{"name":"Electron. Commun. Eur. Assoc. Softw. Sci. Technol.","volume":"87 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-10-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132098077","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Model-to-Model Transformation in Meta-Modeled CINCO Domains 元建模CINCO领域中的模型到模型转换
Pub Date : 2018-10-17 DOI: 10.14279/tuj.eceasst.75.1050
D. Kuehn
In this paper we present an approach to transform models of concrete domains specified with CINCO, a meta-modeling suite, into other CINCO domains. This procedure is demonstrated by transforming Webstory models to DIME applications. The model-to-model transformation increases benefits gained from domain-specific solutions, as shown with the DIME to web application generator, ultimately allowing for Webstories to be deployed and run as web applications.
在本文中,我们提出了一种将CINCO(一个元建模套件)指定的具体领域的模型转换到其他CINCO领域的方法。通过将Webstory模型转换为DIME应用程序来演示这个过程。模型到模型的转换增加了从特定于领域的解决方案中获得的好处,如DIME到web应用程序生成器所示,最终允许将webstory作为web应用程序部署和运行。
{"title":"Model-to-Model Transformation in Meta-Modeled CINCO Domains","authors":"D. Kuehn","doi":"10.14279/tuj.eceasst.75.1050","DOIUrl":"https://doi.org/10.14279/tuj.eceasst.75.1050","url":null,"abstract":"In this paper we present an approach to transform models of concrete domains specified with CINCO, a meta-modeling suite, into other CINCO domains. This procedure is demonstrated by transforming Webstory models to DIME applications. The model-to-model transformation increases benefits gained from domain-specific solutions, as shown with the DIME to web application generator, ultimately allowing for Webstories to be deployed and run as web applications.","PeriodicalId":115235,"journal":{"name":"Electron. Commun. Eur. Assoc. Softw. Sci. Technol.","volume":"36 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-10-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114803174","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
On Privacy and Utility while Improving Software Quality 论提高软件质量的私密性与实用性
Pub Date : 2018-10-17 DOI: 10.14279/tuj.eceasst.75.1053
Fayola Peters
Software development produces large amounts of data both from the process, as well as the usage of the software product. Software engineering data science turns this data into actionable insights for improving software quality. However, the processing of this data can raise privacy concerns for organizations, which are obligated by law, regulations and polices, to protect personal and business sensitive data. Early data privacy studies in sub-disciplines of software engineering found that applying privacy algorithms often degraded the usefulness of data. Hence, there is a recognized need for finding a balance between privacy and utility. A survey of data privacy solutions for software engineering data was conducted. Overall, researchers found that a combination of data minimization and obfuscation of data, produced results with high levels of privacy while allowing data to remain useful.
软件开发过程和软件产品的使用都会产生大量的数据。软件工程数据科学将这些数据转化为可操作的见解,以提高软件质量。然而,这些数据的处理可能会引起组织的隐私问题,因为法律、法规和政策有义务保护个人和商业敏感数据。早期软件工程分支学科的数据隐私研究发现,应用隐私算法往往会降低数据的有用性。因此,有必要在隐私和实用之间找到平衡。对软件工程数据的数据隐私解决方案进行了调查。总的来说,研究人员发现,数据最小化和数据混淆的结合,在允许数据保持有用的同时,产生了高度隐私的结果。
{"title":"On Privacy and Utility while Improving Software Quality","authors":"Fayola Peters","doi":"10.14279/tuj.eceasst.75.1053","DOIUrl":"https://doi.org/10.14279/tuj.eceasst.75.1053","url":null,"abstract":"Software development produces large amounts of data both from the process, as well as the usage of the software product. Software engineering data science turns this data into actionable insights for improving software quality. However, the processing of this data can raise privacy concerns for organizations, which are obligated by law, regulations and polices, to protect personal and business sensitive data. Early data privacy studies in sub-disciplines of software engineering found that applying privacy algorithms often degraded the usefulness of data. Hence, there is a recognized need for finding a balance between privacy and utility. A survey of data privacy solutions for software engineering data was conducted. Overall, researchers found that a combination of data minimization and obfuscation of data, produced results with high levels of privacy while allowing data to remain useful.","PeriodicalId":115235,"journal":{"name":"Electron. Commun. Eur. Assoc. Softw. Sci. Technol.","volume":"70 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-10-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123109939","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Rule-Based Synthesis of Chains of Security Functions for Software-Defined Networks 基于规则的软件定义网络安全功能链综合
Pub Date : 2018-07-18 DOI: 10.14279/TUJ.ECEASST.76.1075.1042
Nicolas Schnepf, Rémi Badonnel, Abdelkader Lahmadi, Stephan Merz
Software-defined networks (SDN) offer a high degree of programmabil-ity for handling and forwarding packets. In particular, they allow network administrators to combine different security functions, such as firewalls, intrusion detection systems, and external services, into security chains designed to prevent or mitigate attacks against end user applications. These chains can benefit from formal techniques for their automated construction and verification. We propose in this paper a rule-based system for automating the composition and configuration of such chains for Android applications. Given the network characterization of an application and the set of permissions it requires, our rules construct an abstract representation of a custom security chain. This representation is then translated into a concrete implementation of the chain in Pyretic, a domain-specific language for programming SDN controllers. We prove that the chains produced by our rules satisfy a number of correctness properties such as the absence of black holes or loops, and shadowing freedom, and that they are coherent with the underlying security policy.
软件定义网络(SDN)为处理和转发数据包提供了高度的可编程性。特别是,它们允许网络管理员将不同的安全功能(如防火墙、入侵检测系统和外部服务)组合到旨在防止或减轻对最终用户应用程序的攻击的安全链中。这些链可以从它们的自动化构造和验证的正式技术中获益。在本文中,我们提出了一个基于规则的系统,用于为Android应用程序自动化这些链的组合和配置。给定应用程序的网络特征及其所需的权限集,我们的规则构建了自定义安全链的抽象表示。然后用Pyretic(一种用于编程SDN控制器的领域特定语言)将这种表示转换为链的具体实现。我们证明了由我们的规则产生的链满足许多正确性属性,例如不存在黑洞或环,以及阴影自由,并且它们与底层安全策略一致。
{"title":"Rule-Based Synthesis of Chains of Security Functions for Software-Defined Networks","authors":"Nicolas Schnepf, Rémi Badonnel, Abdelkader Lahmadi, Stephan Merz","doi":"10.14279/TUJ.ECEASST.76.1075.1042","DOIUrl":"https://doi.org/10.14279/TUJ.ECEASST.76.1075.1042","url":null,"abstract":"Software-defined networks (SDN) offer a high degree of programmabil-ity for handling and forwarding packets. In particular, they allow network administrators to combine different security functions, such as firewalls, intrusion detection systems, and external services, into security chains designed to prevent or mitigate attacks against end user applications. These chains can benefit from formal techniques for their automated construction and verification. We propose in this paper a rule-based system for automating the composition and configuration of such chains for Android applications. Given the network characterization of an application and the set of permissions it requires, our rules construct an abstract representation of a custom security chain. This representation is then translated into a concrete implementation of the chain in Pyretic, a domain-specific language for programming SDN controllers. We prove that the chains produced by our rules satisfy a number of correctness properties such as the absence of black holes or loops, and shadowing freedom, and that they are coherent with the underlying security policy.","PeriodicalId":115235,"journal":{"name":"Electron. Commun. Eur. Assoc. Softw. Sci. Technol.","volume":"24 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-07-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125799702","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 11
期刊
Electron. Commun. Eur. Assoc. Softw. Sci. Technol.
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1