首页 > 最新文献

2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)最新文献

英文 中文
Applying Machine Learning with Chaos Engineering 机器学习与混沌工程的应用
Pub Date : 2020-10-01 DOI: 10.1109/ISSREW51248.2020.00057
Juan Hernández-Serrato, Alejandro Velasco, Yury Nifio, M. Linares-Vásquez
With the advent of internet-scale systems, and the need to assure a high functional and non-functional quality of those systems, researchers and practitioners have been working on approaches and tools for monitoring, profiling, and testing of internet-scale systems. One of those approaches is Chaos Engineering, which imposes different challenges for the software reliability engineering community. In this paper, we propose future avenues for research and development with the target of improving chaos engineering capabilities by using machine learning.
随着互联网规模系统的出现,以及确保这些系统的高功能和非功能质量的需要,研究人员和从业人员一直在研究用于监控、分析和测试互联网规模系统的方法和工具。其中一种方法是混沌工程,它对软件可靠性工程社区提出了不同的挑战。在本文中,我们提出了未来的研究和开发途径,目标是通过使用机器学习来提高混沌工程能力。
{"title":"Applying Machine Learning with Chaos Engineering","authors":"Juan Hernández-Serrato, Alejandro Velasco, Yury Nifio, M. Linares-Vásquez","doi":"10.1109/ISSREW51248.2020.00057","DOIUrl":"https://doi.org/10.1109/ISSREW51248.2020.00057","url":null,"abstract":"With the advent of internet-scale systems, and the need to assure a high functional and non-functional quality of those systems, researchers and practitioners have been working on approaches and tools for monitoring, profiling, and testing of internet-scale systems. One of those approaches is Chaos Engineering, which imposes different challenges for the software reliability engineering community. In this paper, we propose future avenues for research and development with the target of improving chaos engineering capabilities by using machine learning.","PeriodicalId":202247,"journal":{"name":"2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"37 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122336690","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 4
Engineering Resilience: Predicting The Change Impact on Performance and Availability of Reconfigurable Systems 工程弹性:预测变化对可重构系统性能和可用性的影响
Pub Date : 2020-10-01 DOI: 10.1109/ISSREW51248.2020.00054
M. A. Hakamian
Modern distributed systems are supposed to be resilience and continue to operate according to agreed-on Quality of Service (QoS) despite the failure of few services or variations in workload. Real-world incidents show that systems still undergo unacceptable QoS degradations or significant service outages. The main reasons are updates of the system or infrastructural services, and subsequently, faulty recovery logic. Frequent updates and faulty recovery logic result in a correlated set of failure modes that impact the system’s QoS. Software architects need assurance that the system satisfies agreed-on QoS despite updates in the system or infrastructural services. In this research, we propose systematic identification of the risk of a correlated set of failure modes due to updates that cause unacceptable performance degradation or service outage. According to the Architecture Tradeoff Analysis Method (ATAM), we propose to formulate collected risks into a scenario structure for a precise resilience requirement characterization. Furthermore, we propose model-based prediction methods for scenario-based resilience evaluation of the system. Therefore, the software architect has a measurement-based evaluation of system resilience and can incorporate the evaluation result for further system resilience improvement or specifying a precise service level agreement.
现代分布式系统被认为是具有弹性的,并且可以根据商定的服务质量(QoS)继续运行,尽管很少有服务失败或工作负载变化。现实世界的事件表明,系统仍然会经历不可接受的QoS降级或严重的服务中断。主要原因是系统或基础设施服务的更新,以及随后的故障恢复逻辑。频繁的更新和错误的恢复逻辑会导致一组相关的故障模式,从而影响系统的QoS。软件架构师需要保证,无论系统或基础设施服务有更新,系统都能满足商定的QoS。在本研究中,我们建议系统地识别由于更新导致不可接受的性能下降或服务中断而导致的一组相关故障模式的风险。根据架构权衡分析方法(ATAM),我们建议将收集到的风险形成一个场景结构,以精确地描述弹性需求特征。在此基础上,提出了基于场景的系统弹性评估模型预测方法。因此,软件架构师可以对系统弹性进行基于度量的评估,并且可以合并评估结果以进一步改进系统弹性或指定精确的服务水平协议。
{"title":"Engineering Resilience: Predicting The Change Impact on Performance and Availability of Reconfigurable Systems","authors":"M. A. Hakamian","doi":"10.1109/ISSREW51248.2020.00054","DOIUrl":"https://doi.org/10.1109/ISSREW51248.2020.00054","url":null,"abstract":"Modern distributed systems are supposed to be resilience and continue to operate according to agreed-on Quality of Service (QoS) despite the failure of few services or variations in workload. Real-world incidents show that systems still undergo unacceptable QoS degradations or significant service outages. The main reasons are updates of the system or infrastructural services, and subsequently, faulty recovery logic. Frequent updates and faulty recovery logic result in a correlated set of failure modes that impact the system’s QoS. Software architects need assurance that the system satisfies agreed-on QoS despite updates in the system or infrastructural services. In this research, we propose systematic identification of the risk of a correlated set of failure modes due to updates that cause unacceptable performance degradation or service outage. According to the Architecture Tradeoff Analysis Method (ATAM), we propose to formulate collected risks into a scenario structure for a precise resilience requirement characterization. Furthermore, we propose model-based prediction methods for scenario-based resilience evaluation of the system. Therefore, the software architect has a measurement-based evaluation of system resilience and can incorporate the evaluation result for further system resilience improvement or specifying a precise service level agreement.","PeriodicalId":202247,"journal":{"name":"2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"49 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127214769","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Applying Modular Decomposition in Simulink 模块化分解在Simulink中的应用
Pub Date : 2020-10-01 DOI: 10.1109/ISSREW51248.2020.00033
Monika Jaskolka, Stephen Scott, Vera Pantelic, Alan Wassyng, M. Lawford
Modular decomposition is widely used in software engineering to support design, testing and maintenance of software intensive systems. Model-Based Development (MBD) is a paradigm for developing complex software systems using graphical approaches, with MathWorks’ Simulink being a popular choice. How to develop modular Simulink models with stable interfaces, that facilitate understanding and testing, and achieve low coupling and high cohesion, is relatively understudied. This paper applies a new modular decomposition approach to Simulink case studies from the aerospace and nuclear domains. We evaluate how well it supports information hiding, and its impact on coupling and cohesion, interface complexity, cyclomatic complexity, testability, and performance.
模块化分解在软件工程中广泛应用,以支持软件密集型系统的设计、测试和维护。基于模型的开发(MBD)是一种使用图形方法开发复杂软件系统的范例,MathWorks的Simulink是一种流行的选择。如何开发具有稳定接口的模块化Simulink模型,以方便理解和测试,并实现低耦合和高内聚,这方面的研究相对较少。本文将一种新的模块化分解方法应用于航空航天和核领域的Simulink案例研究。我们评估了它对信息隐藏的支持程度,以及它对耦合和内聚、接口复杂性、圈复杂度、可测试性和性能的影响。
{"title":"Applying Modular Decomposition in Simulink","authors":"Monika Jaskolka, Stephen Scott, Vera Pantelic, Alan Wassyng, M. Lawford","doi":"10.1109/ISSREW51248.2020.00033","DOIUrl":"https://doi.org/10.1109/ISSREW51248.2020.00033","url":null,"abstract":"Modular decomposition is widely used in software engineering to support design, testing and maintenance of software intensive systems. Model-Based Development (MBD) is a paradigm for developing complex software systems using graphical approaches, with MathWorks’ Simulink being a popular choice. How to develop modular Simulink models with stable interfaces, that facilitate understanding and testing, and achieve low coupling and high cohesion, is relatively understudied. This paper applies a new modular decomposition approach to Simulink case studies from the aerospace and nuclear domains. We evaluate how well it supports information hiding, and its impact on coupling and cohesion, interface complexity, cyclomatic complexity, testability, and performance.","PeriodicalId":202247,"journal":{"name":"2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"82 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132580839","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
Software Aging in Image Classification Systems on Cloud and Edge 基于云和边缘的图像分类系统中的软件老化问题
Pub Date : 2020-10-01 DOI: 10.1109/ISSREW51248.2020.00099
E. Andrade, F. Machida, R. Pietrantuono, Domenico Cotroneo
Image classification systems using machine learning are rapidly adopted in many software application systems. Machine learning models built for image classification tasks are usually deployed on either cloud computing or edge computers close to data sources depending on the performance and resource requirements. However, software reliability aspects during the operation of these systems have not been properly explored. In this paper, we experimentally investigate the software aging phenomena in image classification systems that are continuously running on cloud or edge computing environments. By performing statistical analysis on the measurement data, we detected a suspicious phenomenon of software aging induced by image classification workloads in the memory usages for cloud and edge computing systems. Contrary to the expectation, our experimental results show that the edge system is less impacted by software aging than the cloud system that has four times larger allocated memory resources. We also disclose our software aging data set on our project web site for further exploration of software aging and rejuvenation research.
基于机器学习的图像分类系统在许多软件应用系统中得到了迅速的应用。为图像分类任务构建的机器学习模型通常部署在云计算或靠近数据源的边缘计算机上,具体取决于性能和资源需求。然而,这些系统在运行过程中的软件可靠性方面还没有得到很好的探讨。在本文中,我们实验研究了在云或边缘计算环境下连续运行的图像分类系统中的软件老化现象。通过对测量数据进行统计分析,我们发现在云和边缘计算系统的内存使用中存在由图像分类工作负载引起的可疑的软件老化现象。与预期相反,我们的实验结果表明,边缘系统受软件老化的影响比具有四倍大的分配内存资源的云系统小。我们还在我们的项目网站上公开了我们的软件老化数据集,以进一步探索软件老化与返老还童的研究。
{"title":"Software Aging in Image Classification Systems on Cloud and Edge","authors":"E. Andrade, F. Machida, R. Pietrantuono, Domenico Cotroneo","doi":"10.1109/ISSREW51248.2020.00099","DOIUrl":"https://doi.org/10.1109/ISSREW51248.2020.00099","url":null,"abstract":"Image classification systems using machine learning are rapidly adopted in many software application systems. Machine learning models built for image classification tasks are usually deployed on either cloud computing or edge computers close to data sources depending on the performance and resource requirements. However, software reliability aspects during the operation of these systems have not been properly explored. In this paper, we experimentally investigate the software aging phenomena in image classification systems that are continuously running on cloud or edge computing environments. By performing statistical analysis on the measurement data, we detected a suspicious phenomenon of software aging induced by image classification workloads in the memory usages for cloud and edge computing systems. Contrary to the expectation, our experimental results show that the edge system is less impacted by software aging than the cloud system that has four times larger allocated memory resources. We also disclose our software aging data set on our project web site for further exploration of software aging and rejuvenation research.","PeriodicalId":202247,"journal":{"name":"2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"110-111 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132827829","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 8
Modelling CI/CD Pipeline Through Agent-Based Simulation 基于agent的CI/CD管道建模
Pub Date : 2020-10-01 DOI: 10.1109/ISSREW51248.2020.00059
Qianying Liao
The need for rapid and efficient software development pushes the demand for automation in the phases of build, test, and release. Thereby, the methodology of Continuous Integration and Continuous Deployment (CI/CD) emerges, which then gives birth to a set of CI/CD enabling services, such as Travis CI and Jenkins. Those services facilitate the automatic compilation, connection tracking, and packaging of new features. They not only incorporate playgrounds for testing and functionality verification but also enable the final delivery.Poor understanding and execution in CI/CD operations can result in slowing and even halting the pace of a software project. Many bottlenecks of CI/CD pipeline might occur due to its incorrect configurations, i.e. the inadequate level of automation, the unsuitable load capacity and the suboptimal queueing strategy. However, understanding the actual CI/CD pipeline is hard since its performance varies significantly with different hosting machines, technologies and plugins. On the other hand, finding a way to analyse and improve the settings of CI/CD pipeline brings great managerial and economic benefits since an optimal configuration implies the eventual high efficiency. To that end, this study attempts to design a model that can not only capture the abstraction of the pipeline but also provides a testing environment for the impersonal influencers of CI/CD performance. The current study, therefore, aims to contribute (1) a pipeline model based on the logic of the queueing system and enabled by agent-based simulation, and (2) an experimental environment which allows the testing of different settings and operation scenarios.
对快速和有效的软件开发的需求推动了对构建、测试和发布阶段自动化的需求。因此,持续集成和持续部署(CI/CD)的方法出现了,然后产生了一组支持CI/CD的服务,例如Travis CI和Jenkins。这些服务促进了新特性的自动编译、连接跟踪和打包。它们不仅包含测试和功能验证的场所,而且还支持最终交付。在CI/CD操作中,缺乏理解和执行可能会导致软件项目的进度减慢,甚至停止。由于CI/CD管道的配置不正确,例如自动化程度不高、负载能力不合适、排队策略不理想等,可能会导致CI/CD管道出现许多瓶颈。然而,理解实际的CI/CD管道是很困难的,因为它的性能因托管机器、技术和插件的不同而有很大差异。另一方面,找到一种方法来分析和改进CI/CD管道的设置,可以带来巨大的管理效益和经济效益,因为最优的配置意味着最终的高效率。为此,本研究试图设计一个模型,该模型不仅可以捕获管道的抽象,还可以为CI/CD性能的非个人影响因素提供测试环境。因此,本研究旨在提供(1)基于排队系统逻辑的管道模型,并通过基于agent的仿真实现;(2)允许测试不同设置和操作场景的实验环境。
{"title":"Modelling CI/CD Pipeline Through Agent-Based Simulation","authors":"Qianying Liao","doi":"10.1109/ISSREW51248.2020.00059","DOIUrl":"https://doi.org/10.1109/ISSREW51248.2020.00059","url":null,"abstract":"The need for rapid and efficient software development pushes the demand for automation in the phases of build, test, and release. Thereby, the methodology of Continuous Integration and Continuous Deployment (CI/CD) emerges, which then gives birth to a set of CI/CD enabling services, such as Travis CI and Jenkins. Those services facilitate the automatic compilation, connection tracking, and packaging of new features. They not only incorporate playgrounds for testing and functionality verification but also enable the final delivery.Poor understanding and execution in CI/CD operations can result in slowing and even halting the pace of a software project. Many bottlenecks of CI/CD pipeline might occur due to its incorrect configurations, i.e. the inadequate level of automation, the unsuitable load capacity and the suboptimal queueing strategy. However, understanding the actual CI/CD pipeline is hard since its performance varies significantly with different hosting machines, technologies and plugins. On the other hand, finding a way to analyse and improve the settings of CI/CD pipeline brings great managerial and economic benefits since an optimal configuration implies the eventual high efficiency. To that end, this study attempts to design a model that can not only capture the abstraction of the pipeline but also provides a testing environment for the impersonal influencers of CI/CD performance. The current study, therefore, aims to contribute (1) a pipeline model based on the logic of the queueing system and enabled by agent-based simulation, and (2) an experimental environment which allows the testing of different settings and operation scenarios.","PeriodicalId":202247,"journal":{"name":"2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"9 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128119751","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 4
Multi-Language Web Vulnerability Detection 多语言Web漏洞检测
Pub Date : 2020-10-01 DOI: 10.1109/ISSREW51248.2020.00058
Alexandra Figueiredo, Tatjana Lide, M. Correia
Most web applications are compromised due to vulnerable source code [1]. Static code analysis tools that are often used to find security vulnerabilities in code have two main problems: they are language-specific, and they have to be programmed, or at least configured manually, to deal with new types of vulnerabilities.
大多数web应用程序由于易受攻击的源代码而受到损害[1]。通常用于查找代码中的安全漏洞的静态代码分析工具有两个主要问题:它们是特定于语言的,并且必须对它们进行编程,或者至少手动配置,以处理新类型的漏洞。
{"title":"Multi-Language Web Vulnerability Detection","authors":"Alexandra Figueiredo, Tatjana Lide, M. Correia","doi":"10.1109/ISSREW51248.2020.00058","DOIUrl":"https://doi.org/10.1109/ISSREW51248.2020.00058","url":null,"abstract":"Most web applications are compromised due to vulnerable source code [1]. Static code analysis tools that are often used to find security vulnerabilities in code have two main problems: they are language-specific, and they have to be programmed, or at least configured manually, to deal with new types of vulnerabilities.","PeriodicalId":202247,"journal":{"name":"2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134381823","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Evaluating the Accuracy of Password Strength Meters using Off-The-Shelf Guessing Attacks 使用现成的猜测攻击评估密码强度计的准确性
Pub Date : 2020-10-01 DOI: 10.1109/ISSREW51248.2020.00079
David Pereira, J. Ferreira, A. Mendes
In this paper we measure the accuracy of password strength meters (PSMs) using password guessing resistance against off-the-shelf guessing attacks. We consider 13 PSMs, 5 different attack tools, and a random selection of 60,000 passwords extracted from three different datasets of real-world password leaks. Our results show that a significant percentage of passwords classified as strong were cracked, thus suggesting that current password strength estimation methods can be improved.
在本文中,我们使用密码猜测抵抗现成的猜测攻击来衡量密码强度计(psm)的准确性。我们考虑了13个psm, 5种不同的攻击工具,以及从三个不同的真实世界密码泄露数据集中随机抽取的60,000个密码。我们的研究结果表明,被分类为强的密码中有很大比例被破解,这表明目前的密码强度估计方法可以得到改进。
{"title":"Evaluating the Accuracy of Password Strength Meters using Off-The-Shelf Guessing Attacks","authors":"David Pereira, J. Ferreira, A. Mendes","doi":"10.1109/ISSREW51248.2020.00079","DOIUrl":"https://doi.org/10.1109/ISSREW51248.2020.00079","url":null,"abstract":"In this paper we measure the accuracy of password strength meters (PSMs) using password guessing resistance against off-the-shelf guessing attacks. We consider 13 PSMs, 5 different attack tools, and a random selection of 60,000 passwords extracted from three different datasets of real-world password leaks. Our results show that a significant percentage of passwords classified as strong were cracked, thus suggesting that current password strength estimation methods can be improved.","PeriodicalId":202247,"journal":{"name":"2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"196 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121183900","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 6
Should we “safely” handle the uncertainties at runtime? - A rather seldom asked question 我们应该“安全地”处理运行时的不确定性吗?——一个很少有人问的问题
Pub Date : 2020-10-01 DOI: 10.1109/ISSREW51248.2020.00065
Nishanth Laxman, P. Liggesmeyer
Ipso facto “Uncertainty is certain” makes design and development of Cyber Physical Systems (CPS), specifically for safety critical scenarios, a challenging process. CPS are expected to function safely in unforeseen contexts, which are often characterized by the pervasive presence of uncertainty. There is a multitude of research and numerous approaches available for efficiently handling such uncertainties at runtime, but how many of them handle it from the viewpoint of safety assurance? Are the approaches which handle various possible uncertainties at runtime from safety assurance perspective need of the hour? This paper attempts to explore these issues and offers a rarely chosen but important perspective on handling uncertainties at runtime during the development of CPS. This paper is based on initial outcomes of an ongoing Systematic Literature Review (SLR) and consequent research on ”safe” handling of uncertainties at runtime.
事实上,“不确定性是确定的”使得网络物理系统(CPS)的设计和开发,特别是针对安全关键场景,成为一个具有挑战性的过程。期望CPS在不可预见的环境中安全运行,这些环境通常以普遍存在的不确定性为特征。有大量的研究和方法可以有效地处理运行时的不确定性,但是有多少是从安全保证的角度来处理的呢?从安全保证的角度来看,处理运行时各种可能的不确定性的方法是否需要时间?本文试图探讨这些问题,并提供了一个很少选择但重要的视角来处理在CPS开发过程中运行时的不确定性。本文基于一项正在进行的系统文献综述(SLR)的初步结果,以及随后对运行时不确定性的“安全”处理的研究。
{"title":"Should we “safely” handle the uncertainties at runtime? - A rather seldom asked question","authors":"Nishanth Laxman, P. Liggesmeyer","doi":"10.1109/ISSREW51248.2020.00065","DOIUrl":"https://doi.org/10.1109/ISSREW51248.2020.00065","url":null,"abstract":"Ipso facto “Uncertainty is certain” makes design and development of Cyber Physical Systems (CPS), specifically for safety critical scenarios, a challenging process. CPS are expected to function safely in unforeseen contexts, which are often characterized by the pervasive presence of uncertainty. There is a multitude of research and numerous approaches available for efficiently handling such uncertainties at runtime, but how many of them handle it from the viewpoint of safety assurance? Are the approaches which handle various possible uncertainties at runtime from safety assurance perspective need of the hour? This paper attempts to explore these issues and offers a rarely chosen but important perspective on handling uncertainties at runtime during the development of CPS. This paper is based on initial outcomes of an ongoing Systematic Literature Review (SLR) and consequent research on ”safe” handling of uncertainties at runtime.","PeriodicalId":202247,"journal":{"name":"2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"574 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128769681","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
AHPCap: A Framework for Automated Hardware Profiling and Capture of Mobile Application States AHPCap:用于自动硬件分析和捕获移动应用程序状态的框架
Pub Date : 2020-10-01 DOI: 10.1109/ISSREW51248.2020.00069
Rodger William Byrd, Taniza Sultana, Kristen R. Walcott
The prevalence of push notifications for communication between devices is increasing and is vital to Internet of Things (IoT) components. It has been observed that delays of notification receipt vary even for devices that are on the same network and using the same hardware. A closer analysis is needed to understand what is occurring in the hardware when a notification occurs from a cloud service or other application.In this paper, we describe and develop a framework, AHPCap, to better understand application behavior at the hardware level at the time of a notification. We explain the framework and its deployment and capabilities. We then show an example of a hardware profile that can be generated on mobile devices and analyze the time required to capture and record the profile data. Lastly, we discuss some of AHPCap’s potential applications.
设备间通信的推送通知越来越普遍,对物联网(IoT)组件至关重要。已经观察到,即使在同一网络上使用相同硬件的设备,通知接收的延迟也会有所不同。当从云服务或其他应用程序发出通知时,需要进行更深入的分析,以了解硬件中发生了什么。在本文中,我们描述并开发了一个框架AHPCap,以便在发出通知时更好地理解硬件级别的应用程序行为。我们将解释框架及其部署和功能。然后,我们将展示一个可以在移动设备上生成的硬件配置文件示例,并分析捕获和记录配置文件数据所需的时间。最后,我们讨论了AHPCap的一些潜在应用。
{"title":"AHPCap: A Framework for Automated Hardware Profiling and Capture of Mobile Application States","authors":"Rodger William Byrd, Taniza Sultana, Kristen R. Walcott","doi":"10.1109/ISSREW51248.2020.00069","DOIUrl":"https://doi.org/10.1109/ISSREW51248.2020.00069","url":null,"abstract":"The prevalence of push notifications for communication between devices is increasing and is vital to Internet of Things (IoT) components. It has been observed that delays of notification receipt vary even for devices that are on the same network and using the same hardware. A closer analysis is needed to understand what is occurring in the hardware when a notification occurs from a cloud service or other application.In this paper, we describe and develop a framework, AHPCap, to better understand application behavior at the hardware level at the time of a notification. We explain the framework and its deployment and capabilities. We then show an example of a hardware profile that can be generated on mobile devices and analyze the time required to capture and record the profile data. Lastly, we discuss some of AHPCap’s potential applications.","PeriodicalId":202247,"journal":{"name":"2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"21 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115409486","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Techniques and Tools for Advanced Software Vulnerability Detection 高级软件漏洞检测技术和工具
Pub Date : 2020-10-01 DOI: 10.1109/ISSREW51248.2020.00049
José D’Abruzzo Pereira
Software is frequently deployed with vulnerabilities that may allow hackers to gain access to the system or information, leading to money or reputation losses. Although there are many techniques to detect software vulnerabilities, their effectiveness is far from acceptable, especially in large software projects, as shown by several research works. This Ph.D. aims to study the combination of different techniques to improve the effectiveness of vulnerability detection (increasing the detection rate and decreasing the number of false-positives). Static Code Analysis (SCA) has a good detection rate and is the central technique of this work. However, as SCA reports many false-positives, we will study the combination of various SCA tools and the integration with other detection approaches (e.g., software metrics) to improve vulnerability detection capabilities. We will also study the use of such combination to prioritize the reported vulnerabilities and thus guide the development efforts and fixes in resource-constrained projects.
软件经常部署有漏洞,这些漏洞可能允许黑客访问系统或信息,导致金钱或声誉损失。尽管有许多检测软件漏洞的技术,但正如一些研究工作所表明的那样,它们的有效性远远不能被接受,特别是在大型软件项目中。本博士旨在研究不同技术的结合,以提高漏洞检测的有效性(提高检测率,减少误报次数)。静态代码分析(SCA)具有很高的检测率,是这项工作的核心技术。然而,由于SCA报告了许多误报,我们将研究各种SCA工具的组合以及与其他检测方法(例如,软件度量)的集成,以提高漏洞检测能力。我们还将研究使用这种组合来确定报告的漏洞的优先级,从而指导资源受限项目中的开发工作和修复。
{"title":"Techniques and Tools for Advanced Software Vulnerability Detection","authors":"José D’Abruzzo Pereira","doi":"10.1109/ISSREW51248.2020.00049","DOIUrl":"https://doi.org/10.1109/ISSREW51248.2020.00049","url":null,"abstract":"Software is frequently deployed with vulnerabilities that may allow hackers to gain access to the system or information, leading to money or reputation losses. Although there are many techniques to detect software vulnerabilities, their effectiveness is far from acceptable, especially in large software projects, as shown by several research works. This Ph.D. aims to study the combination of different techniques to improve the effectiveness of vulnerability detection (increasing the detection rate and decreasing the number of false-positives). Static Code Analysis (SCA) has a good detection rate and is the central technique of this work. However, as SCA reports many false-positives, we will study the combination of various SCA tools and the integration with other detection approaches (e.g., software metrics) to improve vulnerability detection capabilities. We will also study the use of such combination to prioritize the reported vulnerabilities and thus guide the development efforts and fixes in resource-constrained projects.","PeriodicalId":202247,"journal":{"name":"2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"22 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114537463","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 5
期刊
2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1