Login
Most view articles
2015, 9(2):93-93.
Abstract:
It is our great pleasure to publish a special issue regarding Prof. Dr. Bernd Krieg-Bruckner's 66th birthday, guest-edited kindly by Dr. Berthold Hoffmanm, Prof. Dr. Dieter Hutter and Dr. Hui Shi. Prof. Krieg-Bruckner has been a respectful scholar; a world's leading researcher with cross-border research interests, ranging from language design to software engineering to artificial intelligence to robot design; a warmhearted figure who is ready to help anybody at any instant; a real internationalist who gathers in his group young scholar from all continents of world; an amateur architect who drafted, designed and built his own two-stock palace-like home within a few months; a spare-time chef-cock who can prepare any type of delicious cuisines you want, in particular Chinese Hong'Shao'Rou(pork braised in brown source). For me and for many his Chinese friends, beyond those state above, Bernd has been in the first place a faithful friend of China and Chinese computer scientists. the only problem for the Chinese people is that many of them may confuse Bernd's picture with the portrait of Karl Marx. It would be difficult to count all contributions he made to the Chinese computer science community. We will show only one evidence of these contributions: Bernd's report to the Chinese University Development Project written by him in 1984 which has never been published. It is with his permission that we publish this historical document here. While giving our thanks to the three guest editors once again, we wish Bernd a very happy long life.
It is our great pleasure to publish a special issue regarding Prof. Dr. Bernd Krieg-Bruckner's 66th birthday, guest-edited kindly by Dr. Berthold Hoffmanm, Prof. Dr. Dieter Hutter and Dr. Hui Shi. Prof. Krieg-Bruckner has been a respectful scholar; a world's leading researcher with cross-border research interests, ranging from language design to software engineering to artificial intelligence to robot design; a warmhearted figure who is ready to help anybody at any instant; a real internationalist who gathers in his group young scholar from all continents of world; an amateur architect who drafted, designed and built his own two-stock palace-like home within a few months; a spare-time chef-cock who can prepare any type of delicious cuisines you want, in particular Chinese Hong'Shao'Rou(pork braised in brown source). For me and for many his Chinese friends, beyond those state above, Bernd has been in the first place a faithful friend of China and Chinese computer scientists. the only problem for the Chinese people is that many of them may confuse Bernd's picture with the portrait of Karl Marx. It would be difficult to count all contributions he made to the Chinese computer science community. We will show only one evidence of these contributions: Bernd's report to the Chinese University Development Project written by him in 1984 which has never been published. It is with his permission that we publish this historical document here. While giving our thanks to the three guest editors once again, we wish Bernd a very happy long life.
2014, 8(3-4):209-223.
Abstract:
We propose a notion of state distinguishability that does not refer to probabilities, but rather to the ability of a set of states to serve as programs for a desired set of gates. Using this notion, we reconstruct the structural features of the task of state discrimination, such as the equivalence with cloning and the impossibility to extract information from two non-distinguishable pure states without causing a disturbance. All these features express intrinsic links among operational tasks, which are valid independently of the particular theory under consideration.
We propose a notion of state distinguishability that does not refer to probabilities, but rather to the ability of a set of states to serve as programs for a desired set of gates. Using this notion, we reconstruct the structural features of the task of state discrimination, such as the equivalence with cloning and the impossibility to extract information from two non-distinguishable pure states without causing a disturbance. All these features express intrinsic links among operational tasks, which are valid independently of the particular theory under consideration.
2009, 3(2):171-196.
Abstract:
Duration Calculus (abbreviated to DC) is an interval-based, metric-time tempo-ral logic designed for reasoning about embedded real-time systems at a high level of abstrac-tion. But the complexity of model checking any decidable fragment featuring both negation and chop, DC’s only modality, is non-elementary and thus impractical. Even worse, when such decidable fragments are generalized just slightly to cover more interesting durational constraints the resulting fragments become undecidable. We here investigate a similar approximation as frequently employed in model checking situation-or point-based temporal logics, where linear-time problems are safely approximated by branching-time counterparts amenable to more e.cient model-checking algorithms. Mim-icking the role that a situation has in (A)CTL as the origin of a set of linear traces, we de.ne a branching-time counterpart to interval-based temporal logics building on situation pairs spanning sets of intervals. While this branching-time interval semantics yields the desired reduction in complexity of the model-checking problem, from undecidable to linear in the size of the formula and cubic in the size of the model, the approximation is too coarse to be practical. We therefore re.ne the semantics by an occurrence count for crucial states (e.g., cuts of loops) in the model, arriving at a 4-fold exponential model-checking problem su.ciently accurately approximating the original one. Furthermore, when chop occurs in negative polarity only in DC formulas, we have a doubly exponential model-checking algo-rithm.
Duration Calculus (abbreviated to DC) is an interval-based, metric-time tempo-ral logic designed for reasoning about embedded real-time systems at a high level of abstrac-tion. But the complexity of model checking any decidable fragment featuring both negation and chop, DC’s only modality, is non-elementary and thus impractical. Even worse, when such decidable fragments are generalized just slightly to cover more interesting durational constraints the resulting fragments become undecidable. We here investigate a similar approximation as frequently employed in model checking situation-or point-based temporal logics, where linear-time problems are safely approximated by branching-time counterparts amenable to more e.cient model-checking algorithms. Mim-icking the role that a situation has in (A)CTL as the origin of a set of linear traces, we de.ne a branching-time counterpart to interval-based temporal logics building on situation pairs spanning sets of intervals. While this branching-time interval semantics yields the desired reduction in complexity of the model-checking problem, from undecidable to linear in the size of the formula and cubic in the size of the model, the approximation is too coarse to be practical. We therefore re.ne the semantics by an occurrence count for crucial states (e.g., cuts of loops) in the model, arriving at a 4-fold exponential model-checking problem su.ciently accurately approximating the original one. Furthermore, when chop occurs in negative polarity only in DC formulas, we have a doubly exponential model-checking algo-rithm.
2015, 9(1):23-36.
Abstract:
Ember is a smartphone web browser interface for the blind. It was designed exclusively for the blind, keeping in mind their needs and requirements. With large screen targets and easy Braille based text entry, Ember aims to make browsing an enjoyable experience for the blind user. Furthermore, Ember has a verbal command option for easier input. A simple way to find targets on the interface has been incorporated with Ember, by using a screen guard with projections at six points that correspond to the six dots used in Braille. After testing, it was found that twenty-five out of twenty-eight volunteers, on an average, could navigate faster using the Ember audio navigation method than the traditional web browser, and the learning curve for the Ember interface is less steeper than the learning curve for the traditional browser. The Ember keypad was also tested against the QWERTY keypad and the SmartBraille, a well-recognized keypad for Braille-based text entry, and was found to be more intuitive and natural to use.
Ember is a smartphone web browser interface for the blind. It was designed exclusively for the blind, keeping in mind their needs and requirements. With large screen targets and easy Braille based text entry, Ember aims to make browsing an enjoyable experience for the blind user. Furthermore, Ember has a verbal command option for easier input. A simple way to find targets on the interface has been incorporated with Ember, by using a screen guard with projections at six points that correspond to the six dots used in Braille. After testing, it was found that twenty-five out of twenty-eight volunteers, on an average, could navigate faster using the Ember audio navigation method than the traditional web browser, and the learning curve for the Ember interface is less steeper than the learning curve for the traditional browser. The Ember keypad was also tested against the QWERTY keypad and the SmartBraille, a well-recognized keypad for Braille-based text entry, and was found to be more intuitive and natural to use.
2014, 8(2):145-166.
Abstract:
Source location privacy, which means to protect source sensors' locations from being leaked out of observed network tra±c, is an emerging research topic in wireless sensor networks, because it cannot be fully addressed by traditional cryptographic mechanisms, such as encryption and authentication. Current source location privacy schemes, assuming either a local or global attack model, have limitations. For example, schemes under a global attack model are subject to a so called `01' attack, during which an attacker can potentially identify sources of real messages. Targeting on tackling this attack, we propose two perturbation schemes, one based on Uniform Distribution and the other based on Gaussian Distribution. We analyze the security properties of these two schemes. We also simulate and compare them with previous schemes, with results showing that the proposed perturbation schemes can improve sensor source location privacy significantly. Furthermore, it is realized that an attacker may employ more intelligent statistical tools, such as Univariate Distribution based Reconstruction (UDR), to analyze the traffic generation patterns and find out real sources. We propose a Risk Region (RR) based technique, to prevent the attacker from successfully doing this. Performance evaluation shows that the RR-based scheme increases the errors of the attacker, so that the attacker is not able to accurately derive real messages as well as their sources.
Source location privacy, which means to protect source sensors' locations from being leaked out of observed network tra±c, is an emerging research topic in wireless sensor networks, because it cannot be fully addressed by traditional cryptographic mechanisms, such as encryption and authentication. Current source location privacy schemes, assuming either a local or global attack model, have limitations. For example, schemes under a global attack model are subject to a so called `01' attack, during which an attacker can potentially identify sources of real messages. Targeting on tackling this attack, we propose two perturbation schemes, one based on Uniform Distribution and the other based on Gaussian Distribution. We analyze the security properties of these two schemes. We also simulate and compare them with previous schemes, with results showing that the proposed perturbation schemes can improve sensor source location privacy significantly. Furthermore, it is realized that an attacker may employ more intelligent statistical tools, such as Univariate Distribution based Reconstruction (UDR), to analyze the traffic generation patterns and find out real sources. We propose a Risk Region (RR) based technique, to prevent the attacker from successfully doing this. Performance evaluation shows that the RR-based scheme increases the errors of the attacker, so that the attacker is not able to accurately derive real messages as well as their sources.
2008, 2(1):1-15.
Abstract:
Commercial organizations increasingly need software processes sensitive to business value, quick to apply, supportive of multi-stakeholder collaboration, and capable of early analysis for the cost- e ectiveness of process instances This paper presents experience in applying a lightweight synthesis of a Value-Based Software Quality Achievement process and an Object-Petri-Net-based process model to achieve a stakeholder win-win outcome for software quality achievement in an on-going ERP software project in China The application results con rmed that 1) the Object-Petri-Net-based process model provided project managers with a synchronization and stabilization framework for process activities, successcritical stakeholders and their value propositions; 2) process visualization and simulation tools signi cantly increased management visibility and controllability for the success of the software project
Commercial organizations increasingly need software processes sensitive to business value, quick to apply, supportive of multi-stakeholder collaboration, and capable of early analysis for the cost- e ectiveness of process instances This paper presents experience in applying a lightweight synthesis of a Value-Based Software Quality Achievement process and an Object-Petri-Net-based process model to achieve a stakeholder win-win outcome for software quality achievement in an on-going ERP software project in China The application results con rmed that 1) the Object-Petri-Net-based process model provided project managers with a synchronization and stabilization framework for process activities, successcritical stakeholders and their value propositions; 2) process visualization and simulation tools signi cantly increased management visibility and controllability for the success of the software project
2010, 4(2):151-163.
Abstract:
Computational methods are useful for medical diagnosis because they provide additional information that cannot be obtained by simple visual interpretation. As a result an enormous amount of computer vision research effort has been targeted at achieving automated medical image analysis. The study and development of Probabilistic Neural Network (PNN), Linear Vector Quantization (LVQ) Neural Network and Back Propagation Neural Network (BPN) for classification of fatty and cirrhosis liver from Computerized Tomography (CT) abdominal images is reported in this work. Neural networks are supported by more conventional image processing operations in order to achieve the objective set. To evaluate the classifiers, Receiver Operating Characteristic (ROC) analysis is done and the results are also evaluated by the radiologists. Experimental results show that PNN is a good classifier, giving an accuracy of 95% by holdout method and giving an accuracy of 96% by 10 fold cross validation method for classifying fatty and cirrhosis liver using wavelet based statistical texture features.
Computational methods are useful for medical diagnosis because they provide additional information that cannot be obtained by simple visual interpretation. As a result an enormous amount of computer vision research effort has been targeted at achieving automated medical image analysis. The study and development of Probabilistic Neural Network (PNN), Linear Vector Quantization (LVQ) Neural Network and Back Propagation Neural Network (BPN) for classification of fatty and cirrhosis liver from Computerized Tomography (CT) abdominal images is reported in this work. Neural networks are supported by more conventional image processing operations in order to achieve the objective set. To evaluate the classifiers, Receiver Operating Characteristic (ROC) analysis is done and the results are also evaluated by the radiologists. Experimental results show that PNN is a good classifier, giving an accuracy of 95% by holdout method and giving an accuracy of 96% by 10 fold cross validation method for classifying fatty and cirrhosis liver using wavelet based statistical texture features.
2010, 4(2):183-196.
Abstract:
Mobile ad hoc networks (MANET) are characterized by multi-hop wireless links and resource constrained nodes. To improve network lifetime, energy balance is an important concern in such networks. Geographic routing has been widely regarded as efficient and scalable. However, it cannot guarantee packet delivery in some cases, such as faulty location services. Moreover, greedy forwarding always takes the shortest local path so that it has a tendency of depleting the energy of nodes on the shortest path. The matter gets even worse when the nodes on the boundaries of routing holes suffer from excessive energy consumption, since geographic routing tends to deliver data packets along the boundaries by perimeter routing. In this paper, we present an Energy-Aware Geographic Routing (EGR) protocol for MANET that combines local position information and residual energy levels to make routing decisions. In addition, we use the prediction of the range of a destination's movement to improve the delivery ratio. The simulation shows that EGR exhibits a noticeably longer network lifetime and a higher delivery rate than some non-energy-aware geographic routing algorithms, such as GPSR, while not compromising too much on end-to-end delivery delay.
Mobile ad hoc networks (MANET) are characterized by multi-hop wireless links and resource constrained nodes. To improve network lifetime, energy balance is an important concern in such networks. Geographic routing has been widely regarded as efficient and scalable. However, it cannot guarantee packet delivery in some cases, such as faulty location services. Moreover, greedy forwarding always takes the shortest local path so that it has a tendency of depleting the energy of nodes on the shortest path. The matter gets even worse when the nodes on the boundaries of routing holes suffer from excessive energy consumption, since geographic routing tends to deliver data packets along the boundaries by perimeter routing. In this paper, we present an Energy-Aware Geographic Routing (EGR) protocol for MANET that combines local position information and residual energy levels to make routing decisions. In addition, we use the prediction of the range of a destination's movement to improve the delivery ratio. The simulation shows that EGR exhibits a noticeably longer network lifetime and a higher delivery rate than some non-energy-aware geographic routing algorithms, such as GPSR, while not compromising too much on end-to-end delivery delay.
2012, 6(1):3-27.
Abstract:
The paper proposes a method for generating a sequence of images with smooth change of illumination from two input images with different lighting conditions. The idea of the proposed method is based on image morphing. While conventional image morphing changes object shapes between two input images, here we focus on changing the illumination between two images. The proposed method uses isoluminance curves as a feature primitive. Isoluminance curves acquired from images are warped based on the correspondence of the curves between two images, and transformed luminance distributions are generated from the warped isoluminance curves. The proposed method called "illumination morphing" is able to generate smooth transition of luminance between two color images. The method does not need even the information about the light sources and 3D object models. The proposed method is a promising technique for many applications requiring a scene with variety of lighting effects, such as movies, TV games, and so on.
The paper proposes a method for generating a sequence of images with smooth change of illumination from two input images with different lighting conditions. The idea of the proposed method is based on image morphing. While conventional image morphing changes object shapes between two input images, here we focus on changing the illumination between two images. The proposed method uses isoluminance curves as a feature primitive. Isoluminance curves acquired from images are warped based on the correspondence of the curves between two images, and transformed luminance distributions are generated from the warped isoluminance curves. The proposed method called "illumination morphing" is able to generate smooth transition of luminance between two color images. The method does not need even the information about the light sources and 3D object models. The proposed method is a promising technique for many applications requiring a scene with variety of lighting effects, such as movies, TV games, and so on.
2010, 4(4):419-436.
Abstract:
Recent pervasive systems are designed to be context-aware so that they are able to adapt to continual changes of their environments. Rule-based adaptation, which is commonly adopted by these applications, introduces new challenges in software design and verification. Recent research results have identified some faulty or unwanted adaptations caused by factors such as asynchronous context updating, and missing or faulty context reading. In addition, adaptation rules based on simple event models and propositional logic are not expressive enough to address these factors and to satisfy users' expectation in the design. We tackle these challenges at the design stage by introducing sequential event patterns in adaptation rules to eliminate faulty and unwanted adaptations with features provided in the event pattern query language. We illustrate our approach using the recent published examples of adaptive applications, and show that it is promising in designing more reliable context-aware adaptive applications. We also introduce adaptive rule specification patterns to guide the design of adaptation rules.
Recent pervasive systems are designed to be context-aware so that they are able to adapt to continual changes of their environments. Rule-based adaptation, which is commonly adopted by these applications, introduces new challenges in software design and verification. Recent research results have identified some faulty or unwanted adaptations caused by factors such as asynchronous context updating, and missing or faulty context reading. In addition, adaptation rules based on simple event models and propositional logic are not expressive enough to address these factors and to satisfy users' expectation in the design. We tackle these challenges at the design stage by introducing sequential event patterns in adaptation rules to eliminate faulty and unwanted adaptations with features provided in the event pattern query language. We illustrate our approach using the recent published examples of adaptive applications, and show that it is promising in designing more reliable context-aware adaptive applications. We also introduce adaptive rule specification patterns to guide the design of adaptation rules.
2008, 2(1):33-60.
Abstract:
In this paper, we demonstrate the use of qualitative spatial modelling as the foundation for the conceptual representation of route instructions, to enable robust humanrobot interaction on navigation tasks. Our conceptual model is motivated by empirical studies on route navigation, and combines Qualitative Orientation Calculi for spatial reasoning using directional orientation information and topological maps for structuring route segments and routes. Moreover, we present a formal de nition of the conceptual model using the algebraic speci cation language CASL for syntactic and semantic checking, consistency checking and veri cation. Finally, we introduce a generic route graph concept and its formalization. The instantiation of the generic route graph at di erent abstraction levels provides a formal foundation for linking the conceptual model to a global environment map used by an intelligent robot, e.g., a semi-autonomous wheelchair, to carry out human navigation tasks.
In this paper, we demonstrate the use of qualitative spatial modelling as the foundation for the conceptual representation of route instructions, to enable robust humanrobot interaction on navigation tasks. Our conceptual model is motivated by empirical studies on route navigation, and combines Qualitative Orientation Calculi for spatial reasoning using directional orientation information and topological maps for structuring route segments and routes. Moreover, we present a formal de nition of the conceptual model using the algebraic speci cation language CASL for syntactic and semantic checking, consistency checking and veri cation. Finally, we introduce a generic route graph concept and its formalization. The instantiation of the generic route graph at di erent abstraction levels provides a formal foundation for linking the conceptual model to a global environment map used by an intelligent robot, e.g., a semi-autonomous wheelchair, to carry out human navigation tasks.
2010, 4(4):351-365.
Abstract:
Current cloud computing systems pose serious limitation to protecting users' data confidentiality. Since users' sensitive data is presented in unencrypted forms to remote machines owned and operated by third party service providers, the risks of unauthorized disclosure of the users' sensitive data by service providers may be high. Many techniques for protecting users' data from outside attackers are available, but currently there exists no effective way for protecting users' sensitive data from service providers in cloud computing. In this paper, an approach is presented to protecting the confidentiality of users' data from service providers, and ensures that service providers cannot access or disclose users' confidential data being processed and stored in cloud computing systems. Our approach has three major aspects: 1) separating software service providers and infrastructure service providers in cloud computing, 2) hiding information of the owners of data, and 3) data obfuscation. An example to show how our approach can protect the confidentiality of users' data from service providers in cloud computing is given. Experimental results are presented to show that our approach has reasonable performance.
Current cloud computing systems pose serious limitation to protecting users' data confidentiality. Since users' sensitive data is presented in unencrypted forms to remote machines owned and operated by third party service providers, the risks of unauthorized disclosure of the users' sensitive data by service providers may be high. Many techniques for protecting users' data from outside attackers are available, but currently there exists no effective way for protecting users' sensitive data from service providers in cloud computing. In this paper, an approach is presented to protecting the confidentiality of users' data from service providers, and ensures that service providers cannot access or disclose users' confidential data being processed and stored in cloud computing systems. Our approach has three major aspects: 1) separating software service providers and infrastructure service providers in cloud computing, 2) hiding information of the owners of data, and 3) data obfuscation. An example to show how our approach can protect the confidentiality of users' data from service providers in cloud computing is given. Experimental results are presented to show that our approach has reasonable performance.
2007, 1(1):67-84.
Abstract:
In this paper, the well-known competitive clustering algorithm (CA) is revisited and reformulated from a point of view of entropy minimization. That is, the second term of the objective function in CA can be seen as quadratic or second-order entropy. Along this novel explanation, two generalized competitive clustering algorithms inspired by Renyi entropy and Shannon entropy, i.e. RECA and SECA, are respectively proposed in this paper.Simulation results show that CA requires a large number of initial clusters to obtain the right number of clusters, while RECA and SECA require small and moderate number of initial clusters respectively. Also the iteration steps in RECA and SECA are less than that of CA.Further CA and RECA are generalized to CA-p and RECA-p by using the p-order entropy and Renyi's p-order entropy in CA and RECA respectively. Simulation results show that the value of phas a great impact on the performance of CA-p, whereas it has little in uence on that of RECA-p.
In this paper, the well-known competitive clustering algorithm (CA) is revisited and reformulated from a point of view of entropy minimization. That is, the second term of the objective function in CA can be seen as quadratic or second-order entropy. Along this novel explanation, two generalized competitive clustering algorithms inspired by Renyi entropy and Shannon entropy, i.e. RECA and SECA, are respectively proposed in this paper.Simulation results show that CA requires a large number of initial clusters to obtain the right number of clusters, while RECA and SECA require small and moderate number of initial clusters respectively. Also the iteration steps in RECA and SECA are less than that of CA.Further CA and RECA are generalized to CA-p and RECA-p by using the p-order entropy and Renyi's p-order entropy in CA and RECA respectively. Simulation results show that the value of phas a great impact on the performance of CA-p, whereas it has little in uence on that of RECA-p.
2008, 2(2):125-139.
Abstract:
There are many correlated attributes in a database. Conventional attribute selection methods are not able to handle such correlations and tend to eliminate important rules that exist in correlated attributes. In this paper, we propose an attribute selection method that preserves important rules on correlated attributes. We rst compute a ranking of attributes by using conventional attribute selection methods. In addition, we compute two-dimensional rules for each pair of attributes and evaluate their importance for predicting a target attribute. Then, we evaluate the shapes of important two-dimensional rules to pick up hidden important attributes that are under-estimated by conventional attribute selection methods. After the shape evaluation, we re-calculate the ranking so that we can preserve the important correlations. Intensive experiments show that the proposed method can select important correlated attributes that are eliminated by conventional methods.
There are many correlated attributes in a database. Conventional attribute selection methods are not able to handle such correlations and tend to eliminate important rules that exist in correlated attributes. In this paper, we propose an attribute selection method that preserves important rules on correlated attributes. We rst compute a ranking of attributes by using conventional attribute selection methods. In addition, we compute two-dimensional rules for each pair of attributes and evaluate their importance for predicting a target attribute. Then, we evaluate the shapes of important two-dimensional rules to pick up hidden important attributes that are under-estimated by conventional attribute selection methods. After the shape evaluation, we re-calculate the ranking so that we can preserve the important correlations. Intensive experiments show that the proposed method can select important correlated attributes that are eliminated by conventional methods.
2010, 4(4):437-471.
Abstract:
Software-as-as-Service (SaaS) is a new approach for developing software, and it is characterized by its multi-tenancy architecture and its ability to provide flexible customization to individual tenant. However, the multi-tenancy architecture and customization requirements introduce many new issues in software, such as database design, database partition, scalability, recovery, and continuous testing. This paper proposes a hybrid test database design to support SaaS customization with two-layer database partitioning. The database is further extended with a new built-in redundancy with ontology so that the SaaS can recover from ontology, data or metadata failures. Furthermore, constraints in metadata can be used either as test cases or policies to support SaaS continuous testing and policy enforcement.
Software-as-as-Service (SaaS) is a new approach for developing software, and it is characterized by its multi-tenancy architecture and its ability to provide flexible customization to individual tenant. However, the multi-tenancy architecture and customization requirements introduce many new issues in software, such as database design, database partition, scalability, recovery, and continuous testing. This paper proposes a hybrid test database design to support SaaS customization with two-layer database partitioning. The database is further extended with a new built-in redundancy with ontology so that the SaaS can recover from ontology, data or metadata failures. Furthermore, constraints in metadata can be used either as test cases or policies to support SaaS continuous testing and policy enforcement.
2009, 3(1):89-120.
Abstract:
Engineering secure software systems requires a thorough understanding of the social setting within which the system-to-be will eventually operate. To obtain such an understanding, one needs to identify the players involved in the system's operation, and to recognize their personal preferences, agendas and powers in relation to other players. The analysis also needs to identify assets that need to be protected, as well as vulnerabilities leads to system failures when attacked. Equally important, the analyst needs to take rational steps to predict most likely attackers, knowing their possible motivations, and capabilities enabled by latest technologies and available resources. Only an integrated social analysis of both sides (attackers/protectors) can reveal the full space of tradeoffs among which the analyst must choose. Unfortunately, current system development practices treat design decisions on security in an ad-hoc way, often as an afterthought. This paper introduces a methodological framework based on i*, for dealing with security and privacy requirements, namely, Secure-i*. The framework supports a set of analysis techniques. In particular, attacker analysis helps identify potential system abusers and their malicious intents. Dependency vulnerability analysis helps detect vulnerabilities in terms of organizational relationships among stakeholders. Countermeasure analysis supports the dynamic decision-making process of defensive system players in addressing vulnerabilities and threats. Finally, access control analysis bridges the gap between security requirement models and security implementation models. The framework is illustrated with an example involving security and privacy concerns in the design of electronic health information systems.In addition, we discuss model evaluation techniques, including qualitative goal model analysis and property verification techniques based on model checking.
Engineering secure software systems requires a thorough understanding of the social setting within which the system-to-be will eventually operate. To obtain such an understanding, one needs to identify the players involved in the system's operation, and to recognize their personal preferences, agendas and powers in relation to other players. The analysis also needs to identify assets that need to be protected, as well as vulnerabilities leads to system failures when attacked. Equally important, the analyst needs to take rational steps to predict most likely attackers, knowing their possible motivations, and capabilities enabled by latest technologies and available resources. Only an integrated social analysis of both sides (attackers/protectors) can reveal the full space of tradeoffs among which the analyst must choose. Unfortunately, current system development practices treat design decisions on security in an ad-hoc way, often as an afterthought. This paper introduces a methodological framework based on i*, for dealing with security and privacy requirements, namely, Secure-i*. The framework supports a set of analysis techniques. In particular, attacker analysis helps identify potential system abusers and their malicious intents. Dependency vulnerability analysis helps detect vulnerabilities in terms of organizational relationships among stakeholders. Countermeasure analysis supports the dynamic decision-making process of defensive system players in addressing vulnerabilities and threats. Finally, access control analysis bridges the gap between security requirement models and security implementation models. The framework is illustrated with an example involving security and privacy concerns in the design of electronic health information systems.In addition, we discuss model evaluation techniques, including qualitative goal model analysis and property verification techniques based on model checking.
2015, 9(2):95-111.
Abstract:
This report is a historical document from 1985, with some footnotes highlighting the change towards the present. From a quite personal perspective, Computer Science education at the university level in the USA and West Germany are compared, endeavoring to take the best of both educational systems to derive recommendations for the emerging development in China.
This report is a historical document from 1985, with some footnotes highlighting the change towards the present. From a quite personal perspective, Computer Science education at the university level in the USA and West Germany are compared, endeavoring to take the best of both educational systems to derive recommendations for the emerging development in China.
2012, 6(2):125-162.
Abstract:
Several model-driven development (MDD) techniques for web applications exist; these techniques use meta-models for defining transformations and designing models. In this paper, we propose a meta-model for abstract web applications that can be mapped to multiple platforms. We extend a UML-based model to support specific features of the Web and Web 2.0 as well as to establish a bridge to functional and usability requirements through use cases and user interface (UI) prototypes. The meta-model also helps avoid a common MDD-related problem caused by name-based dependencies. Finally, mappings to a number of specific web platforms are presented in order to validate the appropriateness of the meta-model as an abstract web model.
Several model-driven development (MDD) techniques for web applications exist; these techniques use meta-models for defining transformations and designing models. In this paper, we propose a meta-model for abstract web applications that can be mapped to multiple platforms. We extend a UML-based model to support specific features of the Web and Web 2.0 as well as to establish a bridge to functional and usability requirements through use cases and user interface (UI) prototypes. The meta-model also helps avoid a common MDD-related problem caused by name-based dependencies. Finally, mappings to a number of specific web platforms are presented in order to validate the appropriateness of the meta-model as an abstract web model.
2011, 5(1-2Part1):1-6.
Abstract:
This Festschrift contains papers written by friends, students and colleagues to honor Manfred Broy in celebration of his 60th birthday. It presents results in the area of systems and software engineering - Manfred's research area - comprising both theoretical and practical aspects. The Festschrift is divided into two volumes. The first volume contains ten scientific contributions and presents results for the more foundational issues of Manfred's research area ranging from formal verification and specification to concurrency and formal transformation. The second volume comprises seven papers and is devoted to more practical aspects of systems and software engineering. It presents interesting approaches to model-driven, automated, and change-driven software development and discusses issues in feature-oriented modeling, abstraction patterns and framework construction. The papers of both volumes have a clear relation with Manfred's research; some of them even compare or extend Manfred's work, and all papers contain personal notes of the authors where they explain there relationship with Manfred ...
This Festschrift contains papers written by friends, students and colleagues to honor Manfred Broy in celebration of his 60th birthday. It presents results in the area of systems and software engineering - Manfred's research area - comprising both theoretical and practical aspects. The Festschrift is divided into two volumes. The first volume contains ten scientific contributions and presents results for the more foundational issues of Manfred's research area ranging from formal verification and specification to concurrency and formal transformation. The second volume comprises seven papers and is devoted to more practical aspects of systems and software engineering. It presents interesting approaches to model-driven, automated, and change-driven software development and discusses issues in feature-oriented modeling, abstraction patterns and framework construction. The papers of both volumes have a clear relation with Manfred's research; some of them even compare or extend Manfred's work, and all papers contain personal notes of the authors where they explain there relationship with Manfred ...
2011, 5(1-2Part1):139-157.
Abstract:
In this paper we present a method based on UML sequence diagrams for integrating policy requirements with requirements to system design and functionality in the development process. The approach allows policy requirements to be taken into account throughout the system development instead of in a post hoc manner. The method supports the formalization of system specifications and policy specifications at various levels of abstraction, where the abstraction levels are related by refinement. The notion of policy adherence formally captures what it means that a system specification satisfies a policy specification. For analysis with respect to adherence at abstract levels to be meaningful, the results must be preserved under refinement. This paper gives a characterization of conditions under which adherence is preserved under refinement, and identifies development rules that guarantee adherence preservation. By results of transitivity and modularity, the development process, as well as analysis tasks, may be conducted in a stepwise manner addressing individual parts of the specifications separately.
In this paper we present a method based on UML sequence diagrams for integrating policy requirements with requirements to system design and functionality in the development process. The approach allows policy requirements to be taken into account throughout the system development instead of in a post hoc manner. The method supports the formalization of system specifications and policy specifications at various levels of abstraction, where the abstraction levels are related by refinement. The notion of policy adherence formally captures what it means that a system specification satisfies a policy specification. For analysis with respect to adherence at abstract levels to be meaningful, the results must be preserved under refinement. This paper gives a characterization of conditions under which adherence is preserved under refinement, and identifies development rules that guarantee adherence preservation. By results of transitivity and modularity, the development process, as well as analysis tasks, may be conducted in a stepwise manner addressing individual parts of the specifications separately.