首页 > 最新文献

2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)最新文献

英文 中文
Multi-Level Execution Trace Based Lock Contention Analysis 基于多级执行跟踪的锁竞争分析
Pub Date : 2020-10-01 DOI: 10.1109/ISSREW51248.2020.00068
Majid Rezazadeh, Naser Ezzati-Jivan, Evan Galea, M. Dagenais
multi-threaded programming is a near-universal architecture in modern computer systems. Thread based programs usually utilize locks to coordinate access to shared resources. However, contention for locks can reduce parallel efficiency and degrade scalability.In this paper, we propose an execution-trace based method to analyze lock contention problems, without requiring an application’s source code. Our methodology uses dynamic analysis through execution tracing, running in several levels of the system to collect detailed runtime data. We combine it with an extended critical path algorithm which allows us to identify locking issues occurring in userspace. The result is a framework that is able to diagnose all contention issues while adding minimal impact on the system. We propose new views and structures to model and visualize collected data, giving programmers powerful comprehension tools to address contention issues.
多线程编程是现代计算机系统中近乎通用的体系结构。基于线程的程序通常利用锁来协调对共享资源的访问。但是,锁的争用会降低并行效率并降低可伸缩性。在本文中,我们提出了一种基于执行跟踪的方法来分析锁争用问题,而不需要应用程序的源代码。我们的方法通过执行跟踪使用动态分析,在系统的几个级别上运行,以收集详细的运行时数据。我们将其与扩展的关键路径算法相结合,该算法允许我们识别用户空间中发生的锁定问题。其结果是一个框架能够诊断所有争用问题,同时对系统的影响最小。我们提出了新的视图和结构来建模和可视化收集的数据,为程序员提供强大的理解工具来解决争用问题。
{"title":"Multi-Level Execution Trace Based Lock Contention Analysis","authors":"Majid Rezazadeh, Naser Ezzati-Jivan, Evan Galea, M. Dagenais","doi":"10.1109/ISSREW51248.2020.00068","DOIUrl":"https://doi.org/10.1109/ISSREW51248.2020.00068","url":null,"abstract":"multi-threaded programming is a near-universal architecture in modern computer systems. Thread based programs usually utilize locks to coordinate access to shared resources. However, contention for locks can reduce parallel efficiency and degrade scalability.In this paper, we propose an execution-trace based method to analyze lock contention problems, without requiring an application’s source code. Our methodology uses dynamic analysis through execution tracing, running in several levels of the system to collect detailed runtime data. We combine it with an extended critical path algorithm which allows us to identify locking issues occurring in userspace. The result is a framework that is able to diagnose all contention issues while adding minimal impact on the system. We propose new views and structures to model and visualize collected data, giving programmers powerful comprehension tools to address contention issues.","PeriodicalId":202247,"journal":{"name":"2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"4 5","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132644923","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Chapter 8: Software Aging Monitoring and Rejuvenation for the Assessment of High Availability Systems - Extended Abstract 第八章:用于高可用性系统评估的软件老化监测和恢复-扩展摘要
Pub Date : 2020-10-01 DOI: 10.1109/ISSREW51248.2020.00095
Alberto Avritzer, Michael Grottke, D. Menasché
This extended abstract summarizes the background, goals, applicability domain, method, results, and lessons learned presented in the corresponding chapter of the Handbook of Software Aging and Rejuvenation.
这个扩展的摘要总结了背景、目标、适用领域、方法、结果,以及在《软件老化与复兴手册》相应章节中呈现的经验教训。
{"title":"Chapter 8: Software Aging Monitoring and Rejuvenation for the Assessment of High Availability Systems - Extended Abstract","authors":"Alberto Avritzer, Michael Grottke, D. Menasché","doi":"10.1109/ISSREW51248.2020.00095","DOIUrl":"https://doi.org/10.1109/ISSREW51248.2020.00095","url":null,"abstract":"This extended abstract summarizes the background, goals, applicability domain, method, results, and lessons learned presented in the corresponding chapter of the Handbook of Software Aging and Rejuvenation.","PeriodicalId":202247,"journal":{"name":"2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131554917","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Improving the Security of Microservice Systems by Detecting and Tolerating Intrusions 通过检测和容忍入侵来提高微服务系统的安全性
Pub Date : 2020-10-01 DOI: 10.1109/ISSREW51248.2020.00051
José Flora
Microservice architectures adoption is growing expeditiously in market size and adoption, including in business-critical systems. This is due to agility in development and deployment further increased by containers and their characteristics. Ensuring security is still a major concern due to challenges faced such as resource separation and isolation, as improper access to one service might compromise complete systems. This doctoral work intends to advance the security of microservice systems through research and improvement of methodologies for detection, tolerance and mitigation of security intrusions, while overcoming challenges related to multi-tenancy, heterogeneity, dynamicity of systems and environments. Our preliminary research shows that host-based IDSes are applicable in container environments. This will be extended to dynamic scenarios, serving as a steppingstone to research intrusion tolerance techniques suited to these environments. These methodologies will be demonstrated in realistic microservice systems: complex, dynamic, scalable and elastic.
微服务架构的采用在市场规模和采用率方面都在迅速增长,包括在关键业务系统中。这是由于容器及其特性进一步提高了开发和部署的敏捷性。由于面临资源分离和隔离等挑战,确保安全性仍然是一个主要问题,因为对一个服务的不当访问可能会危及整个系统。本博士工作旨在通过研究和改进安全入侵的检测、容忍和缓解方法来提高微服务系统的安全性,同时克服与多租户、异构性、系统和环境的动态性相关的挑战。我们的初步研究表明,基于主机的ids适用于容器环境。这将扩展到动态场景,作为研究适合这些环境的入侵容忍技术的垫脚石。这些方法将在现实的微服务系统中展示:复杂的、动态的、可扩展的和弹性的。
{"title":"Improving the Security of Microservice Systems by Detecting and Tolerating Intrusions","authors":"José Flora","doi":"10.1109/ISSREW51248.2020.00051","DOIUrl":"https://doi.org/10.1109/ISSREW51248.2020.00051","url":null,"abstract":"Microservice architectures adoption is growing expeditiously in market size and adoption, including in business-critical systems. This is due to agility in development and deployment further increased by containers and their characteristics. Ensuring security is still a major concern due to challenges faced such as resource separation and isolation, as improper access to one service might compromise complete systems. This doctoral work intends to advance the security of microservice systems through research and improvement of methodologies for detection, tolerance and mitigation of security intrusions, while overcoming challenges related to multi-tenancy, heterogeneity, dynamicity of systems and environments. Our preliminary research shows that host-based IDSes are applicable in container environments. This will be extended to dynamic scenarios, serving as a steppingstone to research intrusion tolerance techniques suited to these environments. These methodologies will be demonstrated in realistic microservice systems: complex, dynamic, scalable and elastic.","PeriodicalId":202247,"journal":{"name":"2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"106 s415","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132227396","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 6
A Human Error Based Approach to Understanding Programmer-Induced Software Vulnerabilities 基于人为错误的方法来理解程序员引起的软件漏洞
Pub Date : 2020-10-01 DOI: 10.1109/ISSREW51248.2020.00036
Vaibhav Anu, Kazi Zakia Sultana, B. Samanthula
Many security incidents can be traced back to software vulnerabilities, which can be described as security-related defects/bugs in the code that can potentially be exploited by the attackers to perform unauthorized actions. An analysis of vulnerability data disseminated by organizations such as NIST’ s National Vulnerability (NVD) and SANS Institute shows that a majority of vulnerabilities can be traced back to a relatively small set of root causes mostly related to the repeated mistakes by the programmers. That is, programmers exhibit a pattern of erroneous coding practices or behavior which lead to vulnerable code. Cognitive Psychologists have long been studying these erroneous behavior patterns and have termed them as human cognition failures or simply, human errors. The primary goal of this paper is to propose a classification for the most frequently observed human errors committed by the programmers (the commitment of a human error can lead to injection of one or more security defects/bugs). Such a classification can be useful for software development organizations as they can train developers on the human errors so that developers can avoid committing the human errors themselves, thereby reducing the chances of vulnerability injection in their code.
许多安全事件可以追溯到软件漏洞,可以将其描述为代码中与安全相关的缺陷/错误,攻击者可能会利用这些缺陷/错误来执行未经授权的操作。对NIST的国家漏洞(NVD)和SANS研究所等组织发布的漏洞数据的分析表明,大多数漏洞可以追溯到相对较小的一组根本原因,这些根本原因主要与程序员的重复错误有关。也就是说,程序员表现出一种导致易受攻击的代码的错误编码实践或行为模式。认知心理学家长期以来一直在研究这些错误的行为模式,并将其称为人类认知失败或简单地称为人类错误。本文的主要目标是对程序员犯下的最常见的人为错误进行分类(人为错误的犯下可能导致注入一个或多个安全缺陷/错误)。这样的分类对于软件开发组织很有用,因为他们可以培训开发人员了解人为错误,这样开发人员就可以避免自己犯人为错误,从而减少代码中漏洞注入的机会。
{"title":"A Human Error Based Approach to Understanding Programmer-Induced Software Vulnerabilities","authors":"Vaibhav Anu, Kazi Zakia Sultana, B. Samanthula","doi":"10.1109/ISSREW51248.2020.00036","DOIUrl":"https://doi.org/10.1109/ISSREW51248.2020.00036","url":null,"abstract":"Many security incidents can be traced back to software vulnerabilities, which can be described as security-related defects/bugs in the code that can potentially be exploited by the attackers to perform unauthorized actions. An analysis of vulnerability data disseminated by organizations such as NIST’ s National Vulnerability (NVD) and SANS Institute shows that a majority of vulnerabilities can be traced back to a relatively small set of root causes mostly related to the repeated mistakes by the programmers. That is, programmers exhibit a pattern of erroneous coding practices or behavior which lead to vulnerable code. Cognitive Psychologists have long been studying these erroneous behavior patterns and have termed them as human cognition failures or simply, human errors. The primary goal of this paper is to propose a classification for the most frequently observed human errors committed by the programmers (the commitment of a human error can lead to injection of one or more security defects/bugs). Such a classification can be useful for software development organizations as they can train developers on the human errors so that developers can avoid committing the human errors themselves, thereby reducing the chances of vulnerability injection in their code.","PeriodicalId":202247,"journal":{"name":"2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"59 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132348706","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 5
Towards the synthesis of context-aware choreographies 向着上下文感知编排的综合发展
Pub Date : 2020-10-01 DOI: 10.1109/ISSREW51248.2020.00072
Gianluca Filippone, M. Autili, Massimo Tivoli
Modern technologies and emerging wireless communication solutions in the ICT world are empowering the spread of the most disparate ready-to-use software services distributed over the globe that can be easily accessed by an increasing number of connected devices. This state of affairs offers a dynamic and productive, yet distributed and complex, execution environment that encourages the development of systems based on the reuse of existing services through composition approaches, notably choreographies. However, in order to realize the distributed coordination logic that is required to enforce the correct choreography execution, automatic support is needed. Moreover, environmental changing conditions require the realization of choreographies capable of adapting their behavior to the execution context. This work presents our proposal for addressing the choreography realization problem, by describing an automated process for the synthesis of choreography-based systems capable of performing adaptation according to environmental and context conditions.
信息通信技术领域的现代技术和新兴无线通信解决方案正在推动分布在全球各地的最不同的即用型软件服务的传播,这些服务可以通过越来越多的连接设备轻松访问。这种状态提供了一个动态的、高效的、分布式的、复杂的执行环境,它鼓励通过组合方法(特别是编排)基于现有服务的重用来开发系统。然而,为了实现强制执行正确编排所需的分布式协调逻辑,需要自动支持。此外,环境变化条件要求实现能够使其行为适应执行上下文的编排。这项工作提出了我们解决编排实现问题的建议,通过描述一个能够根据环境和上下文条件执行适应性的基于编排的系统合成的自动化过程。
{"title":"Towards the synthesis of context-aware choreographies","authors":"Gianluca Filippone, M. Autili, Massimo Tivoli","doi":"10.1109/ISSREW51248.2020.00072","DOIUrl":"https://doi.org/10.1109/ISSREW51248.2020.00072","url":null,"abstract":"Modern technologies and emerging wireless communication solutions in the ICT world are empowering the spread of the most disparate ready-to-use software services distributed over the globe that can be easily accessed by an increasing number of connected devices. This state of affairs offers a dynamic and productive, yet distributed and complex, execution environment that encourages the development of systems based on the reuse of existing services through composition approaches, notably choreographies. However, in order to realize the distributed coordination logic that is required to enforce the correct choreography execution, automatic support is needed. Moreover, environmental changing conditions require the realization of choreographies capable of adapting their behavior to the execution context. This work presents our proposal for addressing the choreography realization problem, by describing an automated process for the synthesis of choreography-based systems capable of performing adaptation according to environmental and context conditions.","PeriodicalId":202247,"journal":{"name":"2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131847077","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
Independent Verification and Validation for the Space Industry: Guide Evolution Experience 航天工业的独立验证和验证:引导进化经验
Pub Date : 2020-10-01 DOI: 10.1109/ISSREW51248.2020.00037
Nuno Silva, Xavier Ferreira, Jesper Troelsen, Tomasz Kacmajor
Independent Software Verification and Validation (ISVV) is a process targeted at safety-critical software systems. It aims to increase the quality of software products, thereby reducing risks and costs through the operational life of the software. Since 2008, the European Space Agency and its partners have been using the ESA ISVV Guide for the application of ISVV activities and methods. Over these years, the stakeholders have collected a set of lessons learned and experiences, as well as a need to adapt the application of the guide towards new environments and new technologies. For this purpose, and to harmonize the ISVV Guide into a formal ECSS handbook, an update and improvement of the ISVV guide is currently on-going. This work is considering industry feedback and covering topics such as: ISVV to system level, guidelines for agile and iterative projects, reuse, verification and validation of data, auto-generated code, model-based techniques. This paper covers the ISVV Handbook improvement topics and the process being followed to collect and confirm proposed modifications.
独立软件验证和确认(ISVV)是一个针对安全关键型软件系统的过程。它的目标是提高软件产品的质量,从而通过软件的使用寿命减少风险和成本。自2008年以来,欧洲航天局及其合作伙伴一直在使用欧空局ISVV指南来应用ISVV活动和方法。这些年来,利益攸关方已经收集了一系列的教训和经验,以及适应新环境和新技术的指南应用的需要。为此目的,并将《独立评价指南》统一为正式的经济社会保障手册,目前正在更新和改进《独立评价指南》。这项工作考虑了行业反馈,涵盖的主题包括:ISVV到系统级、敏捷和迭代项目的指导方针、重用、数据的验证和确认、自动生成代码、基于模型的技术。本文涵盖了ISVV手册的改进主题以及收集和确认建议的修改所遵循的过程。
{"title":"Independent Verification and Validation for the Space Industry: Guide Evolution Experience","authors":"Nuno Silva, Xavier Ferreira, Jesper Troelsen, Tomasz Kacmajor","doi":"10.1109/ISSREW51248.2020.00037","DOIUrl":"https://doi.org/10.1109/ISSREW51248.2020.00037","url":null,"abstract":"Independent Software Verification and Validation (ISVV) is a process targeted at safety-critical software systems. It aims to increase the quality of software products, thereby reducing risks and costs through the operational life of the software. Since 2008, the European Space Agency and its partners have been using the ESA ISVV Guide for the application of ISVV activities and methods. Over these years, the stakeholders have collected a set of lessons learned and experiences, as well as a need to adapt the application of the guide towards new environments and new technologies. For this purpose, and to harmonize the ISVV Guide into a formal ECSS handbook, an update and improvement of the ISVV guide is currently on-going. This work is considering industry feedback and covering topics such as: ISVV to system level, guidelines for agile and iterative projects, reuse, verification and validation of data, auto-generated code, model-based techniques. This paper covers the ISVV Handbook improvement topics and the process being followed to collect and confirm proposed modifications.","PeriodicalId":202247,"journal":{"name":"2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"69 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133428371","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Instrumenting Compiler Pipeline to Synthesise Traceable Runtime Memory Layouts in Mixed-critical Applications 在混合关键应用中使用编译器管道来合成可跟踪的运行时内存布局
Pub Date : 2020-10-01 DOI: 10.1109/ISSREW51248.2020.00040
N. Kajtazovic, Peter Hödl, Georg Macher
Ensuring traceability between software code and its runtime memory is a required design measure in a number of application fields to achieve functional safety targets. For mixed-critical systems, where a code with different levels of criticality may coexist, this aspect is of particular importance. In the course of safety audits for example, this information may serve to build an evidence that safety-critical code/data is sufficiently isolated from non-critical parts. Unfortunately, addressing the evidence for every byte in memory is not supported by modern compilers. In this paper, we introduce a method where the compiler pipeline is instrumented to recover traceability links between the code and runtime memory. We qualify our proposal on a real-world industrial use case in which the C/C++ code is synthesised for ARM Cortex-M3 controllers. Our experimental results suggest that such an accurate traceability support may serve as a solid basis when analysing memories for mixed-critical applications.
确保软件代码及其运行时内存之间的可追溯性是许多应用领域实现功能安全目标所需的设计措施。对于混合临界系统,具有不同临界级别的代码可能共存,这方面是特别重要的。例如,在安全审核的过程中,这些信息可以用来建立一个证据,证明安全关键代码/数据与非关键部分是充分隔离的。不幸的是,现代编译器不支持对内存中每个字节的证据进行寻址。在本文中,我们介绍了一种方法,其中编译器管道被用来恢复代码和运行时内存之间的可追溯性链接。我们在一个真实的工业用例中验证了我们的建议,其中C/ c++代码是为ARM Cortex-M3控制器合成的。我们的实验结果表明,这种精确的可追溯性支持可以作为分析混合关键应用程序内存的坚实基础。
{"title":"Instrumenting Compiler Pipeline to Synthesise Traceable Runtime Memory Layouts in Mixed-critical Applications","authors":"N. Kajtazovic, Peter Hödl, Georg Macher","doi":"10.1109/ISSREW51248.2020.00040","DOIUrl":"https://doi.org/10.1109/ISSREW51248.2020.00040","url":null,"abstract":"Ensuring traceability between software code and its runtime memory is a required design measure in a number of application fields to achieve functional safety targets. For mixed-critical systems, where a code with different levels of criticality may coexist, this aspect is of particular importance. In the course of safety audits for example, this information may serve to build an evidence that safety-critical code/data is sufficiently isolated from non-critical parts. Unfortunately, addressing the evidence for every byte in memory is not supported by modern compilers. In this paper, we introduce a method where the compiler pipeline is instrumented to recover traceability links between the code and runtime memory. We qualify our proposal on a real-world industrial use case in which the C/C++ code is synthesised for ARM Cortex-M3 controllers. Our experimental results suggest that such an accurate traceability support may serve as a solid basis when analysing memories for mixed-critical applications.","PeriodicalId":202247,"journal":{"name":"2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131133038","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Generating test cases to evaluate and improve processes of safety-critical systems development 生成测试用例来评估和改进安全关键系统的开发过程
Pub Date : 2020-10-01 DOI: 10.1109/ISSREW51248.2020.00090
Lilian Barros, C. Hirata, Johnny Cardoso Marques, A. Ambrosio
DO-178C establishes considerations for developers, installers, and users to design software of embedded equipment in the aviation sector. Organizations must define processes and verify that they help to demonstrate that the DO-178C objectives are satisfied. We propose a test case generation method for process evaluation and improvement. The proposed method consists of an adaptation of the CoFI (Conformance and Fault Injection) approach to generate test cases to processes. Test cases verify if the deployed processes comply with their requirements. We applied the innovative approach to a corrective action process for safety-critical software reviews. The results show that the method is helpful to elicit and analyze unexpected behaviors.
DO-178C为航空领域嵌入式设备的开发人员、安装人员和用户设计软件建立了考虑因素。组织必须定义过程,并确认它们有助于证明DO-178C目标得到满足。我们提出了一种用于过程评估和改进的测试用例生成方法。提出的方法包括对CoFI(一致性和故障注入)方法的适应,以生成流程的测试用例。测试用例验证部署的流程是否符合它们的需求。我们将创新的方法应用到安全关键软件审查的纠正行动过程中。结果表明,该方法有助于引发和分析意外行为。
{"title":"Generating test cases to evaluate and improve processes of safety-critical systems development","authors":"Lilian Barros, C. Hirata, Johnny Cardoso Marques, A. Ambrosio","doi":"10.1109/ISSREW51248.2020.00090","DOIUrl":"https://doi.org/10.1109/ISSREW51248.2020.00090","url":null,"abstract":"DO-178C establishes considerations for developers, installers, and users to design software of embedded equipment in the aviation sector. Organizations must define processes and verify that they help to demonstrate that the DO-178C objectives are satisfied. We propose a test case generation method for process evaluation and improvement. The proposed method consists of an adaptation of the CoFI (Conformance and Fault Injection) approach to generate test cases to processes. Test cases verify if the deployed processes comply with their requirements. We applied the innovative approach to a corrective action process for safety-critical software reviews. The results show that the method is helpful to elicit and analyze unexpected behaviors.","PeriodicalId":202247,"journal":{"name":"2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"5 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131255168","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
Detecting Struct Member-Related Memory Leaks Using Error Code Analysis in Linux Kernel 在Linux内核中使用错误码分析检测结构成员相关的内存泄漏
Pub Date : 2020-10-01 DOI: 10.1109/ISSREW51248.2020.00097
Keita Suzuki, Takafumi Kubota, K. Kono
Struct member-related memory leak can become a serious problem. Linux kernel is not an exception. According to our study of Linux Kernel patches, 54.6% of all memory leak-related patches within the last two years were related to the leak of struct members. This occurs when a struct is freed before freeing its dynamically allocated struct members. Detecting these bugs in large-scale software requires to reduce analysis cost for scalability and effectively collect the state of a struct and its members.In this paper, we present a simple static-analysis approach to detect struct member-related memory leak in the Linux Kernel. Our analysis first collects alloc/free information by conducting a path-insensitive analysis. To efficiently conduct inter-procedural analysis, we introduce error-code analysis, which is an optimization to efficiently pass back the alloc/free information by focusing on the return value of callee and its use in the caller. When detecting a struct free, we scan through the collected information to detect any member that remains unfreed, and generate warnings to them. We evaluated our method by analyzing the Linux Kernel 5.3-rc4, and found two new bugs. Both of the bugs were reviewed and confirmed by Linux Kernel developers.
与结构成员相关的内存泄漏可能成为一个严重的问题。Linux内核也不例外。根据我们对Linux内核补丁的研究,在近两年的所有内存泄漏相关补丁中,有54.6%与struct成员泄漏有关。当在释放动态分配的结构体成员之前释放结构体时,就会发生这种情况。在大型软件中检测这些错误需要降低可伸缩性的分析成本,并有效地收集结构体及其成员的状态。在本文中,我们提出了一种简单的静态分析方法来检测Linux内核中与结构成员相关的内存泄漏。我们的分析首先通过进行路径不敏感分析来收集alloc/free信息。为了有效地进行过程间分析,我们引入了错误代码分析,这是一种优化,通过关注被调用方的返回值及其在调用方中的使用,有效地传递回alloc/free信息。当检测到一个struct free时,我们扫描收集到的信息以检测任何仍然未释放的成员,并向它们生成警告。我们通过分析Linux Kernel 5.3-rc4来评估我们的方法,发现了两个新的错误。Linux内核开发人员审查并确认了这两个错误。
{"title":"Detecting Struct Member-Related Memory Leaks Using Error Code Analysis in Linux Kernel","authors":"Keita Suzuki, Takafumi Kubota, K. Kono","doi":"10.1109/ISSREW51248.2020.00097","DOIUrl":"https://doi.org/10.1109/ISSREW51248.2020.00097","url":null,"abstract":"Struct member-related memory leak can become a serious problem. Linux kernel is not an exception. According to our study of Linux Kernel patches, 54.6% of all memory leak-related patches within the last two years were related to the leak of struct members. This occurs when a struct is freed before freeing its dynamically allocated struct members. Detecting these bugs in large-scale software requires to reduce analysis cost for scalability and effectively collect the state of a struct and its members.In this paper, we present a simple static-analysis approach to detect struct member-related memory leak in the Linux Kernel. Our analysis first collects alloc/free information by conducting a path-insensitive analysis. To efficiently conduct inter-procedural analysis, we introduce error-code analysis, which is an optimization to efficiently pass back the alloc/free information by focusing on the return value of callee and its use in the caller. When detecting a struct free, we scan through the collected information to detect any member that remains unfreed, and generate warnings to them. We evaluated our method by analyzing the Linux Kernel 5.3-rc4, and found two new bugs. Both of the bugs were reviewed and confirmed by Linux Kernel developers.","PeriodicalId":202247,"journal":{"name":"2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"19 2 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121279101","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
ADF2T: an Active Disk Failure Forecasting and Tolerance Software ADF2T:一个主动磁盘故障预测和容错软件
Pub Date : 2020-10-01 DOI: 10.1109/ISSREW51248.2020.00030
Hongzhang Yang, Yahui Yang, Zhengguang Chen, Zongzhao Li, Yaofeng Tu
The reliability of distributed file system is inevitably affected by hard disk failure. This paper proposes an active disk failure forecasting and tolerance software. Firstly, multiple SMART records in the time window are merged into one sample, and after sliding, tens of times of positive samples are created. Secondly, the features are selected by two-stage sorting method, so that the most conducive features are used in machine learning modeling, and the time for model training can be shortened obviously. Thirdly, through two-stage verification, parameters can be adjusted in time for unreasonable proactive reconstruction strategies. Experiments show that modeling and forecast of ZTE data set and Backblaze data set respectively, the recall rate is 95.66% and 84.28%, and the error rate is 0.23% and 2.45%. The work in this paper has been commercially used for more than one year in ZTE data center. The reliability of distributed file system software is significantly improved.
硬盘故障不可避免地会影响分布式文件系统的可靠性。提出了一种主动磁盘故障预测与容错软件。首先,将时间窗内的多条SMART记录合并为一个样本,滑动后生成数十次正样本。其次,采用两阶段排序的方法选择特征,使最有利于机器学习建模的特征被使用,可以明显缩短模型训练的时间。第三,通过两阶段验证,可以对不合理的主动重构策略及时调整参数。实验表明,分别对ZTE数据集和Backblaze数据集进行建模和预测,召回率为95.66%和84.28%,错误率为0.23%和2.45%。本文的工作已经在中兴通讯数据中心进行了一年多的商业应用。大大提高了分布式文件系统软件的可靠性。
{"title":"ADF2T: an Active Disk Failure Forecasting and Tolerance Software","authors":"Hongzhang Yang, Yahui Yang, Zhengguang Chen, Zongzhao Li, Yaofeng Tu","doi":"10.1109/ISSREW51248.2020.00030","DOIUrl":"https://doi.org/10.1109/ISSREW51248.2020.00030","url":null,"abstract":"The reliability of distributed file system is inevitably affected by hard disk failure. This paper proposes an active disk failure forecasting and tolerance software. Firstly, multiple SMART records in the time window are merged into one sample, and after sliding, tens of times of positive samples are created. Secondly, the features are selected by two-stage sorting method, so that the most conducive features are used in machine learning modeling, and the time for model training can be shortened obviously. Thirdly, through two-stage verification, parameters can be adjusted in time for unreasonable proactive reconstruction strategies. Experiments show that modeling and forecast of ZTE data set and Backblaze data set respectively, the recall rate is 95.66% and 84.28%, and the error rate is 0.23% and 2.45%. The work in this paper has been commercially used for more than one year in ZTE data center. The reliability of distributed file system software is significantly improved.","PeriodicalId":202247,"journal":{"name":"2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"242 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122920109","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
期刊
2020 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1