Diverse Software Research Articles

A Framework for Multi-Variant Execution Environment

Software diversity has been proven to be an effective approach to enhance system security. To make the best of the advantage brought by software diversity, a multi-variant execution environment is needed. However, although some MVEEs have been proposed, most of them are either too simple or only focusing one aspect which limits their widely adoption in industry. In this paper we propose a framework for multi-variant execution environment to enhance the security of software systems. The framework addresses different aspects when implementing a MVEE and can help to make the best of software diversity to enhance the system’s security.

Multi-Variant Execution Research of Software Diversity

As more and more software products are threatened by malicious reverse analysis, along with software products are pirated, tampered with and so on, it is of great significance to study software security protection technology in depth. As a software security protection technology, software diversification introduces uncertainty into the target program and provides probabilistic protection for the target program. Multi-Variant Execution (MVE) are fine-grained implementation of software diversification that produces functionally identical variants at the system call level. This article first introduces the related concepts of multi-variant execution. Secondly, it expounds the key technologies of multi-variant execution implementation-variant generation, variant monitor, input/output and synchronization, monitor-variant communication. Security of monitors and different variant communication technologies are analyzed and compared, their advantages and defects are pointed out respectively. Several implementation methods of multi-variant execution design are summarized. Finally, the reasons for the false negatives and false positives of attack events are analyzed, and the prospects and challenges of using multi-variant execution techniques to implement security systems are summarized.

Software quality assessment model: a systematic mapping study

Quality model is regarded as a well-accepted approach for assessing, managing and improving software product quality. There are three categories of quality models for software products, i.e., definition model, assessment model, and prediction model. Quality assessment model (QAM) is a metric-based approach to assess the software quality. It is typically regarded as of high importance for its clear method on how to assess a system. However, the current state-of-the-art in QAM research is under limited investigation. To address this gap, the paper provides an organized and synthesized summary of the current QAMs. In detail, we conduct a systematic mapping study (SMS) for structuring the relevant articles. We obtain a total of 716 papers from the five databases, and 31 papers are selected as relevant studies at last. In summary, our work focuses on QAMs from the following aspects: software metrics, quality factors, aggregation methods, evaluation methods and tool support. According to the analysis results, our work discovers five needs that researchers in this area should continue to address: (1) new method and criteria to tailor a quality framework (i.e., structure of software metrics and quality factors) according to different specifics, (2) systematic investigations on the effectiveness, strength and weakness of different aggregation methods to guide the method selection in different context, (3) more investigations on evaluating QAMs in the context of industrial cases, (4) further investigations or real-world case studies on the QAMs related tools, and (5) building a public and diverse software benchmark which can be adopted in different application context.

A game-based resource pricing and allocation mechanism for profit maximization in cloud computing

In cloud computing environment, Software as a Service (SaaS) providers offer diverse software services to customers and commonly host their applications and data on the infrastructures supplied by Infrastructure as a Service (IaaS) providers. From the perspective of economics, the basic challenges for both SaaS and IaaS providers are to design resource pricing and allocation policies to maximize their own final revenue. However, IaaS providers seek an optimal price policy of virtual machines to generate more revenue, while SaaS providers want to minimize the cost of using infrastructure resources, and comply with service-level agreement contracts with users at the same time. In this situation, there exists conflict in maximizing revenue of both IaaS and SaaS providers simultaneously. In this paper, we model this revenue maximization problem as the Stackelberg game and analyze the existence and uniqueness of the game equilibrium. Moreover, considering the impact of resource price on users’ willing to access service, we propose a dynamic pricing mechanism to maximize the revenue of both SaaS and IaaS providers. The simulation results demonstrate that, compared to fixed pricing and auction-based pricing mechanisms, the proposed mechanism is superior in the revenue maximization and resource utilization.

Widgetcon: A website and program for quick conversion among common population genetic data formats.

One of the most tedious steps in genetic data analyses is the reformatting data generated with one program for use with other applications. This conversion is necessary because comprehensive evaluation of the data may be based on different algorithms included in diverse software, each requiring a distinct input format. A platform-independent and freely available program or a web-based tool dedicated to such reformatting can save time and efforts in data processing. Here, we report widgetcon, a website and a program which has been developed to quickly and easily convert among various molecular data formats commonly used in phylogenetic analysis, population genetics, and other fields. The web-based service is available at https://www.widgetcon.net. The program and the website convert the major data formats in four basic steps in less than a minute. The resource will be a useful tool for the research community and can be updated to include more formats and features in the future.

Topology-Aware Software Assignment in Networked Systems

Cyberspace mimic defense has been proven to be a revolutionary defense technology that “changes the rules of the game” to ensure the security of cyberspace. However, the software diversity inherent in mimic defense technology may increase the difficulty in managing software executable binaries, especially when updating or debugging a software. In this paper, we study the problem of software assignment in a networked system to minimise the number of binaries generated by mimic compilers. Mimic compilers can help to generate functional equivelant software executables which exhibits diverse characteristics such as binary size etc. Theoretically the software assignment problem is equal to the traditional graph coloring problem. To guarantee network severity, we apply a Welsh-Powell-based Software Assignment (WPSA) algorithm to determine the number of binaries needed and the assignment of these binaries to hosts in a network. We conduct experiments on real world network topologies. Experimental results show that our algorithm can effectively reduce the number of binaries needed in networked systems.

The software and hardware architecture of the real-time protection of in-vessel components in JET-ILW

For the first time, the JET operation in deuterium–tritium (D–T) plasma, which is scheduled to take place on JET in 2020, will be performed in the ITER mix of plasma-facing component materials. In view of the preparation of the DT campaign (DTE2), several aspects of the plasma operation require significant improvements, such as a real-time protection of the first wall. The risk of damaging the metallic PFCs caused by beryllium melting or cracking of tungsten owing to thermal fatigue required a new reliable D–T compatible active protection system. Therefore, the future development of the JET real time first wall protection is focused on the D–T campaign and the ITER relevant conditions which may cause failure of camera electronics within the Torus hall. In addition to the technological aspect, the intensive preparation of the diverse software tools and real time algorithms for hot spot detection as well as alarm handling strategy required for the wall protection is in progress.This contribution describes the improved design, implementation, and operation of the near infrared (NIR) imaging diagnostic system of the JET-ILW plasma experiment and its integration into the existing JET protection architecture. To provide the reliable wall protection during the DTE2, two more sensitive logarithmic NIR camera systems equipped with new optical relays to take images and cameras outside of the biological shield have been installed on JET-ILW and calibrated with an in-vessel calibration light source (ICLS). Additionally, post-pulse data visualization and advanced analysis of all types of imaging data is provided by the new software framework JUVIL (JET users video imaging library). The formation of hot spots is recognized as a significant threat due to rapid surface temperature rise. Because it could trigger the protection system to stop a pulse, it is important to identify the mechanisms and conditions responsible for the formation of such hot spots. To address this issue the new software tool ‘Hotspot Editor’ has been developed.

Dynamical analysis of a malware propagation model considering the impacts of mobile devices and software diversification

The aim has been to model the dynamics of malware propagation in scale-free networks (SFNs) with birth and death rates. The proposed model is a variant of susceptible–exposed–infectious–recovered–susceptible with a vaccination (SEIRS-V). This model is extended for modeling malware propagation between computer nodes and mobile devices (MDs), which is called MD-SEIRS-V. Unlike other existing models, MD-SEIRS-V principally considers the impacts of diversification as a defense mechanism to reduce epidemic spreading in SFNs. Dynamical behavior of the model is determined by the basic reproductive ratio. Furthermore, we calculate the critical number of diverse software packages installed on computer nodes that can be used as a parameter to prevent epidemic spreading. The dynamics of malware propagation is analyzed and shown that the local and global stability of malware-free equilibrium are equivalent. We have also carried out a series of numerical simulations to evaluate the dynamical behaviors of malware propagation in SFNs.

On the Application of Statistical Analysis for Interpretation of Experimental Results in Environmental Microbiology

Statistical analysis is an integral part of every experiment, since it helps researchers to make conclusions out of the work done. Textbooks with detailed description of the algorithms for statistical analysis exist, as well as diverse software packages. Statistical methods are, however, often applied incorrectly, which leads to erroneous and inadequate conclusions. The present article is an attempt to determine the main problems emerging in the course of statistical analysis of experimental results in the field of environmental microbiology. For instance, the classical parametric tests, which are most often used in experimental articles (t-test, analysis of variance, Pearson correlation coefficient, etc.), are applicable only when a random variable of n independent observations has normal distribution. Importantly, the normality of the distribution must be proved, and it is possible to do only for minimal sample size of 20‒30 independent observations per group. The latter is crucial for the incubation, isotope, and molecular biological experiments. The family of normal distributions is not the only family of parameter-dependent (parametric) distributions of random variables. Moreover, real-life distributions usually differ from the normal ones, and normal distribution may be considered only as a certain approximation. High diversity of parametric families complicates the choice of criteria and statistical tests for analysis of a set of data collected from n independent observations. Nonparametric statistics may be of help, since it is free of sample size and distribution requirements, although, as any method of analysis, it also has limitations. An increasing number of experimental data, including those in the field of environmental microbiology, are nowadays analyzed by using nonparametric statistics, which indicates a certain tendency for substitution of parametric methods by nonparametric ones.

In silico prediction of prolactin molecules as a tool for equine genomics reproduction.

The prolactin hormone is involved in several biological functions, although its main role resides on reproduction. As it interferes on fertility changes, studies focused on human health have established a linkage of this hormone to fertility losses. Regarding animal research, there is still a lack of information about the structure of prolactin. In case of horse breeding, prolactin has a particular influence; once there is an individualization of these animals and equines are known for presenting several reproductive disorders. As there is no molecular structure available for the prolactin hormone and receptor, we performed several bioinformatics analyses through prediction and refinement softwares, as well as manual modifications. Aiming to elucidate the first computational structure of both molecules and analyse structural and functional aspects related to these proteins, here we provide the first known equine model for prolactin and prolactin receptor, which obtained high global quality scores in diverse software's for quality assessment. QMEAN overall score obtained for ePrl was (- 4.09) and QMEANbrane for ePrlr was (- 8.45), which proves the structures' reliability. This study will implement another tool in equine genomics in order to give light to interactions of these molecules, structural and functional alterations and therefore help diagnosing fertility problems, contributing in the selection of a high genetic herd.

Resilience of business strategy to emergent and future conditions

Assuring future performance of systems-of-systems through advanced-technology investments is a perpetual challenge of industry and agencies. Among the complicating factors are technology innovation, escalating scales, and diversity of software and hardware applications, increasing availability and scrutiny of big data, and evolving business, environmental, and legal contexts. These factors are engaging system owner/operators to continually reprioritize these investments, even as transparent principles for investment are needed for appropriate oversight and auditing. In this paper, a branch of resilience analysis offers to address multiple layers of uncertainty that arise from technology plans around future disruptions to large-scale systems-of-systems. The paper presents a methodology to quantify and manage the disruptive influence of individual systems perspectives to the prioritization of technology investments across the system-of-systems. The methodology is demonstrated through a case study on an information technology investment portfolio of the US Department of Commerce, USA. The experience suggests how fiscal limitations, combining with several other factors, has the largest disruption to the prioritization of investments. The results furthermore describe how investments perform relative to one another and characterize where the system-of-systems might be resilient to the perspectives of constituent systems. Abbreviations: BEA: Bureau of Economic Analysis; BIS: Bureau of Industry and Security; DOC: United States Department of Commerce; FY: Fiscal Year; IT: Information Technology; MCDA: Multicriteria Decision Analysis; NOAA: National Oceaic and Atmospheric Administration; NTIA: National Telecommunications and Information Administration; USPTO: United States Patent and Trademark Office.

Portable and Configurable Implementation of ARINC-653 Temporal Partitioning for Small Civilian UAVs

The ARINC-653 standard defines temporal partitioning that enables multiple avionics applications to execute independently from each other without interference in terms of CPU resources. Though partitioning has been mainly discussed from the viewpoint of manned aircraft, it can also efficiently integrate multiple applications on civilian Unmanned Aerial Vehicles (UAVs) that have even severer limitations on size, weight, power, and cost. In order to employ ARINC-653 temporal partitioning to civilian UAVs, its implementation must be flexible enough to be applied to diverse run-time software environments and computing hardware platforms. In this paper, we suggest a portable and configurable implementation of ARINC-653 for small-sized civilian UAVs aiming for low cost, easy development, and easy extension. Our implementation provides the Operating System (OS) abstraction layer that defines the essential OS-level features and the OS-independent interfaces to the upper layer that actually implements the ARINC-653 standard. Our implementation is also modularized so that the policies of resource management in CPU scheduling and memory allocation can be easily extended and selectively configured. In addition, we implement the advanced resource management schemes to promote the benefits of multi-core processors that are already widely deployed in Commercial Off-The-Shelf (COTS) systems. We show that our ARINC-653 implementation is portable across different OS, such as Linux and RTEMS, reusing the most of source codes thanks to the layered and modular design. We also analyze the overheads of the ARINC-653 APEX interfaces and multi-core scheduling. Moreover, we conduct a case study for a small-sized quad-copter.

▵Breakpad: Diversified Binary Crash Reporting

This paper introduces {\Delta}Breakpad. It extends the Breakpad crash reporting system to handle software diversity effectively and efficiently by replicating and patching the debug information of diversified software versions. Simple adaptations to existing open source compiler tools are presented that on the one hand introduce significant amounts of diversification in the code and stack layout of ARMv7 binaries to mitigate the widespread deployment of code injection and code reuse attacks, while on the other hand still supporting accurate crash reporting. An evaluation on SPEC2006 benchmarks demonstrates that the corresponding computational, storage, and communication overheads are small.

Information and Communication Systems Used for Keeping the Register of Real Estate Prices and Values (Rrepv) in Poland

Abstract The Register of Real Estate Prices and Values (RREPV) is among the sources of information used in the process of real estate value estimation. Pursuant to § 74 of the Regulation on the Land and Property Register, the register is kept by the head of the county. Currently there are 380 counties in Poland, including 66 city counties. Such a big number of administrative units within the country, combined with different information and communication system providers, results in a great diversity of software used for keeping RREPV nationwide. The purpose of the article is to present the spatial distribution of information and communication systems in which RREPV is kept. The article describes parameters that characterize the market share of specific programs existing on the market with regard to the number of implementations, estimated number of transactions entered in the system, the coverage area of the specific system and the population handled by the specific system.

On the benefits and challenges of using kanban in software engineering: a structured synthesis study

ContextKanban is increasingly being used in diverse software organizations. There is extensive research regarding its benefits and challenges in Software Engineering, reported in both primary and secondary studies. However, these results have not been synthesized yet.Goalto investigate and identify the actual benefits and challenges of using Kanban in Software Engineering to support practitioners in understanding and analyzing the benefits and challenges of adopting Kanban in their software projects.Methodto use the Structured Synthesis Method to aggregate existing empirically-grounded evidence in the published primary studies regarding using Kanban in Software Engineering.Resultsfrom the 20 selected primary studies in which over 16 benefits were identified, four had the most robust results in the aggregation, i.e., with the most confidence associated, namely: ‘work visibility,’ ‘control of project activities and tasks,’ ‘flow of work,’ and ‘time-to-market.’ Furthermore, the ‘organizational culture’ was identified as the most dominant challenge in Kanban implementations.ConclusionsSyntheses studies represent a fundamental step in organizing the body of evidence as an empirically-grounded reference for decision-making in practice. The benefits with most confidence indeed appear to be the ones intrinsically linked to the Lean thinking and the Kanban approach. As Kanban originated in the manufacturing, it is interesting to observe this kind of confirmation in the software domain. Still, there are several benefits and challenges which still lacks the appropriate level of evidence. We also noticed the absence of negative results reported in the technical literature. These aspects need the additional attention of the research community.

Dynamic security metrics for measuring the effectiveness of moving target defense techniques

Moving Target Defense (MTD) utilizes granularity, flexibility and elasticity properties of emerging networking technologies in order to continuously change the attack surface. There are many different MTD techniques proposed in the past decade to thwart cyberattacks. Due to the diverse range of different MTD techniques, it is of paramount importance to assess and compare their effectiveness. However, each technique causes distinct (dynamic) changes in the network, making an objective comparison difficult. In this paper, we incorporate MTD techniques into a temporal graph-based graphical security model, and develop a new set of dynamic security metrics to assess and compare their effectiveness. To this end, we first categorize and compare different attack and defense efforts. Second, we describe the temporal graph-based graphical security model to capture dynamic changes made by various MTD techniques in the network. We then develop a new set of security metrics for attack and defense efforts to evaluate the effectiveness of the MTD techniques. We implement two different MTD techniques, namely network topology shuffle and software diversity, and show their effectiveness against a targeted attack scenario in our experimental analysis. The results demonstrate that the proposed dynamic security metrics can capture different properties of MTD techniques, permitting a more fine-grained comparison and offering guidance for selecting the most effective MTD technique.

Speech-acts based analysis for requirements discovery from online discussions

Online discussions about software applications and services that take place on web-based communication platforms represent an invaluable knowledge source for diverse software engineering tasks, including requirements elicitation. The amount of research work on developing effective tool-supported analysis methods is rapidly increasing, as part of the so called software analytics. Textual messages in App store reviews, tweets, online discussions taking place in mailing lists and user forums, are processed by combining natural language techniques to filter out irrelevant data; text mining and machine learning algorithms to classify messages into different categories, such as bug report and feature request.Our research objective is to exploit a linguistic technique based on speech-acts for the analysis of online discussions with the ultimate goal of discovering requirements-relevant information. In this paper, we present a revised and extended version of the speech-acts based analysis technique, which we previously presented at CAiSE 2017, together with a detailed experimental characterisation of its properties. Datasets used in the experimental evaluation are taken from a widely used open source software project (161120 textual comments), as well as from an industrial project in the home energy management domain. We make them available for experiment replication purposes. On these datasets, our approach is able to successfully classify messages into Feature/Enhancement and Other, with F-measure of 0.81 and 0.84 respectively. We also found evidence that there is an association between types of speech-acts and categories of issues, and that there is correlation between some of the speech-acts and issue priority, thus motivating further research on the exploitation of our speech-acts based analysis technique in semi-automated multi-criteria requirements prioritisation.

Efficient and secure big data storage system with leakage resilience in cloud computing

With recent advancements in wireless smart terminal manufacture and communication technologies, a huge amount of data are generated from a variety of sources including software applications and hardware devices. To make the most of big data, cloud computing can be exploited to store, share, and process the data. However, data privacy issues are still significantly challenging in practice where users’ secrets may be leaked because of diverse software vulnerabilities and hardware attacks. In this paper, to address the above security challenge of big data, we propose an efficient and secure big data storage system in cloud computing, in which a leakage-resilient encryption scheme serves as the main ingredient. What’s more, our formal security proofs analysis indicates that the proposed scheme can ensure users’ data privacy even if the partial key is leaked in cloud computing. Finally, the leakage resilience analysis indicates that the leakage ratio in our scheme can reach roughly 1/3 and is higher than other schemes. Performance comparisons show the practicability of our scheme for big data security in cloud computing.

Evolutionary approach to generating test data for data flow test

Software testing consumes a significant portion of software effort. Program entities such as branch or definition-use pairs (DUPs) are used in diverse software development tasks. In this study, the authors present a novel evolution-based approach to generating test data for all definition-use coverage. First, the subset of DUPs, which can ensure the coverage adequacy, is computed by a reduction algorithm for the whole DUPs. Then they apply a genetic algorithm to generate test data for the subset of DUPs. Furthermore, the fitness of an individual depends on the matching degree between the traversed path and the definition-clear path of each target DUP. They also investigate the coverage and the size of test cases of test data generation by applying the authors' approach on 15 widely used subject programs. The experimental results show that their approach can reduce the size of test cases that generated without affecting the coverage rate.

Extending the SEMAT Kernel with the TDD practice

Coping with ever increasing complexity is one of the main challenges of software engineering. Applying proven practices through established software processes is a viable way to introduce consistency and tame complexity. The SEMAT is a novel meta-process aiming to encompass commonalities across a disparate set of different software processes. The goal is to create a framework, giving proper jumpstart to any proprietary customisation. This is crucial, as various types of software demand diverse software processes (there is no one-size-fits-all method). On the other hand, all processes strive for a disciplined application of valid development and maintenance routines. This paper analyses a set of methodologies for several software development lines to recognise common and specific development practices. A special emphasise is put on the test-driven development (TDD), showcasing its significant contribution in improving the total quality of the end product. The SEMAT Kernel is extended with additional set of alphas, which are elaborated in detail including containing states, transitions and dependencies. The TDD practice activities were analysed for each introduced alpha as state transition triggers. Consequently, the high-level development plan is expanded with newly defined alphas, providing a powerful tool for performing all sorts of system analysis.