Software Assets Research Articles

A meta-model for software protections and reverse engineering attacks

Software protection techniques are used to protect valuable software assets against man-at-the-end attacks. Those attacks include reverse engineering to steal confidential assets, and tampering to break the software’s integrity in unauthorized ways. While their ultimate aims are the original assets, attackers also target the protections along their attack path. To allow both humans and tools to reason about the strength of available protections (and combinations thereof) against potential attacks on concrete applications and their assets, i.e., to assess the true strength of layered protections, all relevant and available knowledge on the relations between the relevant aspects of protections, attacks, applications, and assets need to be collected, structured, and formalized. This paper presents a software protection meta-model that can be instantiated to construct a formal knowledge base that holds precisely that information. The presented meta-model is validated against existing models and taxonomies in the domain of software protection, and by means of prototype tools that we developed to help non-modelling-expert software defenders with populating a knowledge base and with extracting and inferring practically useful information from it. All discussed tools are available as open source, and we evaluate their use as part of a software protection work flow on an open source application and industrial use cases.

Revisiting the relationship between safety and security

Free to read on publisher website Safety and Security (S&S) have the same goal, that is to maintain the integrity of human, infrastructure, hardware, software, capital and intangible assets of a system. However, literature and practice indicate that the relationship between S&S has not yet been clearly defined and their boundaries remain blurry. The current paper presents a short review of academic and professional literature about the relationship between S&S. This relationship is examined by looking at the S&S dependencies, their similarities and differences, and the role of the human element in achieving and maintaining the desired S&S levels. The review of literature showed that (1) there is a tendency to emphasize on the effects of security on safety and underestimate the opposite, (2) human factors are not part of security training to the extent are addressed in safety training, (3) security and safety problems can be the result of both internal and external disturbances and agents, (4) the intentionality or not of outcomes, and not of the action, can stand as a valid criterion to classify an event as a security or a safety one correspondingly, (5) S&S issues can result in negative implications internally and externally to the system, and (6) the synergy between S&S is of paramount importance for achieving the optimum levels of system protection. The positions of this paper might comprise a basis for enriching educational programmes around S&S and igniting relevant research.

Process simulation platform for virtual manufacturing systems evaluation

The paper presents the design of a cloud simulation platform and the associated services that will provide the computing resources and services for hybrid simulation of Virtual Manufacturing Systems. At the core of the research is the design of a framework defined as Virtual Development Environment (VDE). Associated to VDE is a set of block functions and algorithms defined as software assets, stored in a large repository implemented within an on-line cloud supported library. The platform offers flexibility concerning the continuous testing and updates regarding the algorithms in order to improve the existing ones.

Enhancing Similarity Distances Using Mandatory and Optional for Early Fault Detection

Software Product Line (SPL) describes procedures, techniques, and tools in software engineering by using a common method of production for producing a group of software systems that identical from a shared set of software assets. In SPL, the similarity-based prioritization can resemble combinatorial interaction testing in scalable and efficient way by choosing and prioritize configurations that most dissimilar. However, the similarity distances in SPL still not so much cover the basic detail of feature models which are the notations. Plus, the configurations always have been prioritized based on domain knowledge but not much attention has been paid to feature model notations. In this paper, we proposed the usage of mandatory and optional notations for similarity distances. The objective is to improve the average percentage of faults detected (APFD). We investigate four different distances and make modifications on the distances to increase APFD value. These modifications are the inclusion of mandatory and optional notations with the similarity distances. The results are the APFD values for all the similarity distances including the original and modified similarity distances. Overall, the results shown that by subtracting the optional notation value can increase the APFD by 3.71% from the original similarity distance.

On the use of model transformation for the automation of product derivation process in SPL

Abstract Product Derivation represents one of the main challenges that Software Product Line (SPL) faces. Deriving individual products from shared software assets is a time-consuming and an expensive activity. In this paper, we (1) present an MDE approach for engineering SPL and (2) propose to leverage model-to-model transformations (MMT) and model-to-text (MTT) transformations for supporting both domain engineering and application engineering processes. In this work, we use ATL as a model-to-model transformation language and Acceleo as a model-to-text transformation language.The proposed approach is discussed with e-Health product line applications.

The scenario of software asset management (SAM) in large and midsize companies

The implementation of processes and tools of Software Asset Management (SAM) has become an action agenda for Information Technology (IT) managers. Then this study aims to investigate the scenario for the implementation of SAM in large and midsize companies of Rio de Janeiro, Brazil. As methodology, a literature review was performed which founded the creation of an online questionnaire applied to 53 Chief Information Officers (CIOs). Based on the result of this research, it was possible to identify the knowledge of managers pertinent to the concept of SAM, and the fact that the majority of the investigated companies are in stages 1 and 2 of the development of the tiers of SAM proposed by the ISO / IEC 19770 standard. As contribution, it is expected to elucidate the recognition of SAM as a relevant factor to be used in the IT area, aiming at the search for solutions that increase productivity and optimize the costs and investments in companies.

Information and Communications Technology and Inventory Management amongst Breweries in Nigeria

This study examined the effect of ICT on inventory management amongst breweries in Nigeria. Secondary data were sourced for this study. The population for the study comprises all brewery companies quoted on the Nigerian Stock Exchange. Purposive sampling technique was used in selecting the three leading brewery companies in Nigeria, namely the Nigerian Breweries Plc; Guinness Nigeria Plc; and International Breweries Plc that represent 75% of the breweries quoted in the Nigerian Stock Exchange factsbook. Secondary data on ICT/ software costs, inventories, sales turnover/revenue, and assets were sourced from years 2006 to 2015 Annual Reports and Statements of Accounts of the three selected breweries and the Nigeria Stock Exchange facts book. The data collected were analyzed using descriptive statistics ( tables, mean and standard deviation) and inferential statistics (Ordinary Least Square (OLS) method). The results also showed that ICT usage had no significant positive relationship on inventory management (t = 0.021, P > 0.01). The study concluded that ICT had no significant positive effect on inventory management in the Nigerian Brewery industry. It is recommended that brewery firms in Nigeria should deploy the right software for inventory management. The limitation of this research is what were used to measure the inventory management and Information and Communications Technology (ICT) as contrary results could be obtained if these variables are measured using other yardsticks. The improvement of the respondent required to see the other problem and another kind of business.

A decision-making process-line for selection of software asset origins and components

Selecting sourcing options for software assets and components is an important process that helps companies to gain and keep their competitive advantage. The sourcing options include: in-house, COTS ...

The RAGE Game Software Components Repository for Supporting Applied Game Development

This paper presents the architecture of the RAGE repository, which is a unique and dedicated infrastructure that provides access to a wide variety of advanced technology components for applied game development. The RAGE project, which is the principal Horizon2020 research and innovation project on applied gaming, develops up to three dozens of software components (RAGE software assets) that are reusable across a wide diversity of game engines, game platforms and programming languages. The RAGE repository provides storage space for assets and their artefacts and is designed as an asset life-cycle management system for defining, publishing, updating, searching and packaging for distribution of these assets. It will be embedded in a social platform for asset developers and other users. A dedicated Asset Repository Manager provides the main functionality of the repository and its integration with other systems. Tools supporting the Asset Manager are presented and discussed. When the RAGE repository is in full operation, applied game developers will be able to easily enhance the quality of their games by including selected advanced game software assets. Making available the RAGE repository system and its variety of software assets aims to enhance the coherence and decisiveness of the applied game industry.

Construcción de un repositorio de activos de software para el desarrollo ágil de aplicaciones aplicando un método para el reuso

En este artículo de investigación se expone el estudio y la construcción de un repositorio de activos de software para el desarrollo ágil de aplicaciones aplicando un método para el reúso que permite manejar, manipular, crear, almacenar, recuperar y reutilizar diversas fuentes de códigos y activos de software para la agilización de procesos sistemáticos con el fin de crear cimientos en procesos industriales que requieran la intervención directa de un software. Este software ha sido desarrollado luego de una amplia investigación y recopilación de antecedentes, una amplia arquitectura de reglas de manejo, enfoque en minería de datos y propósitos de promover el reúso de activos de software como una importante metodología dentro de la ingeniería, así con dicha implementación de esta herramienta se busca explorar, ayudar, fundamentar y respaldar en etapas tempranas de formación de un software, donde el campo de interés radica en pequeñas y medianas empresas de software que necesitan una metodología y una herramienta elástica para la mejora de procesos en sus instalaciones sin escatimar la calidad que del producto final que definitiva es el intangible “software”.

The long‐term growth rate of evolving software: Empirical results and implications

AbstractThe amount of code in evolving software‐intensive systems appears to be growing relentlessly, affecting products and entire businesses. Objective figures quantifying the software code growth rate bounds in systems over a large time scale can be used as a reliable predictive basis for the size of software assets. We analyze a reference base of over 404 million lines of open source and closed software systems to provide accurate bounds on source code growth rates. We find that software source code in systems doubles about every 42 months on average, corresponding to a median compound annual growth rate of 1.21 ± 0.01. Software product and development managers can use our findings to bound estimates, to assess the trustworthiness of road maps, to recognise unsustainable growth, to judge the health of a software development project, and to predict a system's hardware footprint.

Extracting and Conserving Production Data as Test Cases in Executable Business Process Architectures

Because executable business processes are an important and critical software asset of organizations because they control and integrate critical information systems. Thus, testing them thoroughly is a very important task within the software development process. However, failures due to implementation defects still occur in production, which in turn means that the development team needs to analyze, fix and repair the failing processes. In order to support the activities of reproducing the problem outside of the production system and to create better test cases for verifying the fixed implementation, we propose to use process mining techniques on the production process event logs to aid the support & development teams. With our approach it is possible to automatically extract a working unit test case with all partner services being mocked that can run in a development environment. Within in this paper we present the extraction algorithm, our implementation, and possible ways to integrate the tool into the support & development process.

Highly Protected Arbitrary Biometric Key Based Electronic Accessing System

A great number of the systems available today, allowing the path just to those individuals who know a particular code, have a card or have chosen physic marks. Although it is more expensive for the security reason, every organization is showing their interest. The secret key strategy is the least costly and most straightforward advancements which require software assets. Of course, this structure is easily attackable, since it is anything but straightforward to get the password data from a man. The Smart Cards based systems are remarkably valuable, yet utilized like the primary ID system, are not too much reliable since cards can be effortlessly stolen, lost or actually overlooked at home. The proposed system is the biometric based locker with short message service (SMS) which guarantees the security of individual and secret effects of a man. The system couldscan the finger, coordinate it with the saved pattern and open thelocker.

Reusing Components from Cultural Heritage Games – the RAGE Project Approach

Video games proved to be an attractive media for presenting cultural heritage issues. They can use virtual worlds to present cultural and historic information in amazing and highly appealing way. Each video game is implemented using set of valuable artifacts (components) reflecting technological, socioeconomic and historical issues. These software components are known as software assets, which are key output of the RAGE project. They can be used by game developers to enhance the pedagogical and educational value of their games. These software assets cover a broad spectrum of functionalities, including emotion detection, intelligent adaptation and social gamification. In order to facilitate integration and interoperability, all of these assets adhere to a common model, which describes their properties through a set of metadata. In this paper, we present the RAGE asset model and asset metadata model, highlighting key issues and challenges in constructing RAGE assets and using asset metadata model with flexible metadata editor, facilitating both adaptation and improvement of the asset metadata model.

Construction and utilization of problem-solving knowledge in open source software environments

Abstract Open Source Software (OSS) has become an important environment where developers can share reusable software assets in a collaborative manner. Although developers can find useful software assets to reuse in the OSS environment, they may face difficulties in finding solutions to problems that occur while integrating the assets with their own software. In OSS, sharing the experiences of solving similar problems among developers usually plays an important role in reducing problem-solving efforts. We analyzed how developers interact with each other to solve problems in OSS, and found that there is a common pattern of exchanging information about symptoms and causes of a problem. In particular, we found that many problems involve multiple symptoms and causes and it is critical to identify those symptoms and causes early to solve the problems more efficiently. We developed a Bayesian network based approach to semi-automatically construct a knowledge base for dealing with problems, and to recommend potential causes of a problem based on multiple symptoms reported in OSS. Our experiments showed that the approach is effective to recommend the core causes of a problem, and contributes to solving the problem in an efficient manner.

WHAT EVERY CEO NEEDS TO KNOW ABOUT THE VAPORIZED ECONOMY

Tercek shows how organizations that once produced solid, tangible products have consistently been “vaporized,” turned into digital bits. Familiar examples include physical books, newspapers, and music. The “widespread take‐up of smartphone apps means that consumers can now use a downloadable app to replace physical things like cameras, GPS units, DVD players, game consoles, even keys and credit cards.” Managers must give much more thought to software and proprietary data assets, and companies should consider the roles they play, and their leadership within, mobile ecosystems, marketplaces, and platforms. As Tercek writes, the “switch from physical to vaporized versions of products requires every business to recast itself as a software company.”

Modeling energy-aware web services and application

Cloud computing provides an infrastructure where large organizations can redundantly distribute their software assets across geographically distributed data centers. Consequently, on the account of the importance of energy efficiency, these organizations have to strategically configure their overall operations to leverage power availability as it changes, reduce their overall energy costs, and promote energy-efficiency throughout the entire system. Traditional state-of-the-art approaches rely on the monitoring and configuration of systems based on load measurements taken directly from their hardware assets. These measurements are largely independent of the underlying software applications. In this work, we introduce a decision support procedure to provide a priori, deterministic understanding of power consumption of modular software assets or services that reside on the hardware devices/servers. The proposed decision support procedure relies on power estimation models that predict power consumption of a software service considering the type of server on which it resides. The proposed procedure also embeds a smart sampling technique that will help monitor and record the system behavior effectively for the provisioning of new software services. Experiments demonstrate favorable predictions of the power consumption of a specific web service or group of web services and the promise of more energy-efficient operations of distributed cloud environments.

RAGE Architecture for Reusable Serious Gaming Technology Components

For seizing the potential of serious games, the RAGE project—funded by the Horizon-2020 Programme of the European Commission—will make available an interoperable set of advanced technology components (software assets) that support game studios at serious game development. This paper describes the overall software architecture and design conditions that are needed for the easy integration and reuse of such software assets in existing game platforms. Based on the component-based software engineering paradigm the RAGE architecture takes into account the portability of assets to different operating systems, different programming languages, and different game engines. It avoids dependencies on external software frameworks and minimises code that may hinder integration with game engine code. Furthermore it relies on a limited set of standard software patterns and well-established coding practices. The RAGE architecture has been successfully validated by implementing and testing basic software assets in four major programming languages (C#, C++, Java, and TypeScript/JavaScript, resp.). Demonstrator implementation of asset integration with an existing game engine was created and validated. The presented RAGE architecture paves the way for large scale development and application of cross-engine reusable software assets for enhancing the quality and diversity of serious gaming.

Features as transformations: A generative approach to software development

The objective of feature modeling is to foster software reuse by enabling to explicitly and abstractly express commonality and variability in the domain. Feature modeling is used to configure other models and, eventually, code. These software assets are being configured by the feature model based on the selection of variable features. However, selecting a feature is far from a naive component based approach where feature inclusion would simply mean including the corresponding component. More often than not, feature inclusion affects several places in models or code to be configured requiring their nontrivial adaptation. Thus, feature inclusion recalls transformation and this is at heart of the approach to feature model driven generation of software artifacts proposed in this paper. Features are viewed as transformations that may be executed during the generative process conducted by the feature model configuration. The generative process is distributed in respective transformations enabling the developers to have a better control over it. This approach can be applied to modularize changes in product customization and to establish generative software product lines by gradual refactoring of existing products.

The Evaluation Knowledge of Standard Software Asset using The Seven Samurai Framework

The knowledge which is needed on automotive software development, increases significantly according to large-scale, complexity of automotive software. Therefore, it is very difficult for an engineer to understand the whole software development. This paper introduces a way of constructing a meta-model, which visualizes the knowledge of expert engineers, based on The Seven Samurai framework. It can solve issues of system development by considering the seven types of elements which are defined in this framework. And then, its name was defined based on the famous Japanese cinema. Additionally, this paper shows the evaluation results of applying the meta-model to the evaluation of actual standard software assets in the product line, and then the effectiveness of the proposed approach is confirmed based on the results.