Critical Software Research Articles

Addressing visual impairments: Essential software requirements for image caption solutions

ABSTRACT Visually impaired individuals actively utilize devices like computers, tablets, and smartphones, due to advancements in screen reader technologies. Integrating freely available deep learning models, image captioning can further enhance these readers, providing an affordable assistive tech solution. This research outlines the critical software requirements necessary for image captioning tools to effectively serve this demographic. Two qualitative investigations were conducted to determine these requirements. An online survey was first conducted to identify the main preferences of visually impaired users in relation to audio descriptive software, with findings visualized using word clouds. A subsequent study evaluated the proficiency of existing deep learning captioning models in addressing these stipulated requirements. Emphasizing the need for comprehensive image data, the results highlighted three primary areas: 1) characteristics of individuals, 2) color specifics of objects, and 3) the overall context of images. The research indicates that current captioning tools are not entirely effective for the visually impaired. Based on the delineated requirements and suggested future research paths, there is potential for the development of improved image captioning systems, advancing digital accessibility for the visually impaired.

Development of a calibration management and critical analysis software using NFC technology

The ISO 17025 standard from 2017 aims to ensure the quality of services and results obtained through laboratory equipments. The standard guarantees that equipment testing, calibration, and maintenance are carried out according to internationally accepted quality standards, which ensures greater efficiency, lower costs, and conveys more trust to clients. In this work, it is presented the development of an application to manage the calibration of equipment in a company, along with a critical analysis of certificates. This application was developed for Android and iOS using the Flutterflow tool, and all the information regarding the equipment is securely and efficiently stored in a Firebase Firestore database. The application also supports the use of NFC tags integrated with the equipment to facilitate access to information in hard-to-reach environments. The solution is already in operation in two companies and has shown great potential for use in other companies for equipment calibration management.

Classifying Critical Software Components Using Multi-Level Formalization and Knowledge Graphs

Classifying Critical Software Components Using Multi-Level Formalization and Knowledge Graphs

SpChar: Characterizing the sparse puzzle via decision trees

Sparse matrix computation is crucial in various modern applications, including large-scale graph analytics, deep learning, and recommender systems. The performance of sparse kernels varies greatly depending on the structure of the input matrix, making it difficult to gain a comprehensive understanding of sparse computation and its relationship to inputs, algorithms, and target machine architecture. Despite extensive research on certain sparse kernels, such as Sparse Matrix-Vector Multiplication (SpMV), the overall family of sparse algorithms has yet to be investigated as a whole. This paper introduces SpChar, a workload characterization methodology for general sparse computation. SpChar employs tree-based models to identify the most relevant hardware and input characteristics, starting from hardware and input-related metrics gathered from Performance Monitoring Counters (PMCs) and matrices. Our analysis enables the creation of a characterization loop that facilitates the optimization of sparse computation by mapping the impact of architectural features to inputs and algorithmic choices. We apply SpChar to more than 600 matrices from the SuiteSparse Matrix collection and three state-of-the-art Arm Central Processing Units (CPUs) to determine the critical hardware and software characteristics that affect sparse computation. In our analysis, we determine that the biggest limiting factors for high-performance sparse computation are (1) the latency of the memory system, (2) the pipeline flush overhead resulting from branch misprediction, and (3) the poor reuse of cached elements. Additionally, we propose software and hardware optimizations that designers can implement to create a platform suitable for sparse computation. We then investigate these optimizations using the gem5 simulator to achieve a significant speedup of up to 2.63× compared to a CPU where the optimizations are not applied.

Recailibrating the Use of Zero-Day Vulnerabilities

Zero-day vulnerabilities in critical software systems are of the highest priority for government agencies, black market hackers, and private software vendors. Each of these parties has different priorities and uses for zero-day vulnerabilities, but because of the global economy’s reliance on technology and software, they represent a significant threat to much of the critical infrastructure of the United States. The United States Intelligence Community is among one of the most sophisticated players in the zero-day market, and their decision making with respect to these unknown vulnerabilities has widespread impacts. This note examines the current state of the Vulnerabilities Equities Process, the executive branch policy designed to weigh various equities when determining the fate of a zero-day vulnerability discovered by the Intelligence Community; to use the zero-day to collect intelligence or to disclose the vulnerability and see that it is patched. I argue that the current Vulnerabilities Equities Process does not produce the most optimal outcomes, and that the decision making process must be ‘recalibrated’ to properly weigh all relevant equities and to ensure that zero-day vulnerabilities are not being used irresponsibly.

A novel STPA approach to software safety and security in autonomous maritime systems

With higher autonomy in maritime systems, tasks and responsibilities are moved from the human operator to software, increasing the complexity and the importance of safe and reliable functionality. Software failures, however, may be introduced from the early life cycle phases intentionally or unintentionally, and these must therefore be mitigated by safe and secure design approaches. A challenge is that existing methods are not particularly well-suited for analyzing software risks. Thus, the objective of this paper is to propose a systematic and efficient software failure identification approach by extending the Systems-Theoretic Process Analysis (STPA) with a software failure taxonomy and the System Modeling Language (SysML). This enables the control structure in STPA to cover both the dynamic and static aspects of the software functions. Combined with an implementation platform independent questionnaire, this gives a more systematic and guided search for potential software failures than existing approaches. To demonstrate the proposed approach, a case study on a ferry's navigation system that operates in manual control or semi-autonomous mode is performed. In the case study, the focus is on creating an avoidance map data structure, including both moving and static obstacles to be avoided by the ferry, and the subsequent process of collision risk warning calculation. Software failures are identified and evaluated in collision scenarios where the ferry operates under foggy conditions. The paper shows that the proposed systematic approach provides an improved process for identifying and analyzing critical software failures. This facilitates enhanced risk mitigation in the design and testing phases contributing to autonomous systems' safety and security.

For the record: Practicing critical software literacy in writing centers

While “big data” approaches to writing center research represent promising angles from which to understand the intellectual labor happening during tutorials, aggregation strips away the context in which writing center texts and data are originally constructed. In fact, new methods such as the large-scale corpus analysis of writing center session notes highlight the need for more critical analyses of the administrative software used to generate, archive, and distribute these texts. Drawing on Bogost's (2007) conception of procedural rhetoric and Manovich's (2013) understanding of softwarization, this article seeks to address this gap by recontextualizing writing center session notes within the layered arguments constructed by TutorTrac, a scheduling platform used by many centers. I argue this software advances a rhetoric of recordkeeping that, left unrecognized, risks shifting center practices away from stated commitments and values. In demonstrating how writing center practitioners can employ an understanding of procedural rhetoric to interrogate such applications, this study suggests more attention be dedicated to critical readings of software in writing centers.

REQUIREMENT PRIORITIZATION IN THE DEVELOPMENT OF SOFTWARE PROJECTS FOR CRITICAL INFRASTRUCTURE OBJECTS

The objective of the study is to develop an algorithm for prioritizing requirements in the development of software for critical infrastructure object projects. Requirement development is a fundamental phase in any software project, as this phase involves the identification, processing, and manipulation of requirements. The primary source of these requirements is project stakeholders, taking into account project constraints and limits. The number of requirements varies for each software project for a critical infrastructure object, hence the term requirement prioritization pertains to determining the priority order of executing software requirements based on considerations and decisions of stakeholders. Various proposed optimization algorithms are employed to address optimization tasks. This paper presents the main stages of basic optimization algorithms, some of their modifications aimed at enhancing their efficiency in solving such types of problems. Additionally, a hybrid approach based on WOA and GWO optimization algorithms is proposed, combining the advantages of each algorithm to determine the priority of requirements for critical infrastructure object software. Furthermore, a dataset from the SKUDA project is provided, utilized in this research, meeting the requirements of a real software project for evaluating the proposed method. The scientific novelty lies in the modification, application, and combination of results from well-known GWO and WOA algorithms to address the requirement prioritization task for critical infrastructure object software projects. The proposed algorithm achieves an accuracy of 92% for the proposed set of requirements.

An empirical investigation of challenges of specifying training data and runtime monitors for critical software with machine learning and their relation to architectural decisions

The development and operation of critical software that contains machine learning (ML) models requires diligence and established processes. Especially the training data used during the development of ML models have major influences on the later behaviour of the system. Runtime monitors are used to provide guarantees for that behaviour. Runtime monitors for example check that the data at runtime is compatible with the data used to train the model. In a first step towards identifying challenges when specifying requirements for training data and runtime monitors, we conducted and thematically analysed ten interviews with practitioners who develop ML models for critical applications in the automotive industry. We identified 17 themes describing the challenges and classified them in six challenge groups. In a second step, we found interconnection between the challenge themes through an additional semantic analysis of the interviews. We explored how the identified challenge themes and their interconnections can be mapped to different architecture views. This step involved identifying relevant architecture views such as data, context, hardware, AI model, and functional safety views that can address the identified challenges. The article presents a list of the identified underlying challenges, identified relations between the challenges and a mapping to architecture views. The intention of this work is to highlight once more that requirement specifications and system architecture are interlinked, even for AI-specific specification challenges such as specifying requirements for training data and runtime monitoring.

Managing Critical Software Systems through Efficient Monitoring Techniques

Managing Critical Software Systems through Efficient Monitoring Techniques

On the effectiveness of graph data augmentation for source code learning

The methodology that employs deep learning to handle software engineering tasks, such as bug detection, is commonly referred to as source code learning. Given the inherent graph nature of source code, graph learning, bolstered by graph neural networks (GNNs), has seen an increasing adoption in the domain of source code learning. Similar to other contexts within deep learning, source code learning also relies on extensive high-quality training data, and the scarcity of such data has become a primary impediment that leads to performance bottlenecks. In practice, data augmentation is often used as a countermeasure to mitigate this issue, by synthesizing additional training data based on existing ones. However, most existing practice of data augmentation in source code learning is limited to simple program transformation methods, such as code refactoring, thus not sufficiently effective. In this work, in light of the graph nature of source code, we propose to apply the data augmentation methods used for graph-structured data in graph learning to the tasks of source code learning, and we conduct a comprehensive empirical study to evaluate whether such new data augmentation approaches bring better effectiveness, in terms of producing more accurate and robust models. Specifically, we evaluate four critical software engineering tasks and seven neural network architectures to assess the effectiveness of five data augmentation methods. Experimental results identify that, compared to the data augmentation-free training approach, the Manifold-Mixup method can significantly improve both the accuracy and robustness of the trained models of source code learning, for up to 1.60% and 4.09%, respectively.

MLBRSA: Multi-Learning-Based Reptile Search Algorithm for Global Optimization and Software Requirement Prioritization Problems.

In the realm of computational problem-solving, the search for efficient algorithms tailored for real-world engineering challenges and software requirement prioritization is relentless. This paper introduces the Multi-Learning-Based Reptile Search Algorithm (MLBRSA), a novel approach that synergistically integrates Q-learning, competitive learning, and adaptive learning techniques. The essence of multi-learning lies in harnessing the strengths of these individual learning paradigms to foster a more robust and versatile search mechanism. Q-learning brings the advantage of reinforcement learning, enabling the algorithm to make informed decisions based on past experiences. On the other hand, competitive learning introduces an element of competition, ensuring that the best solutions are continually evolving and adapting. Lastly, adaptive learning ensures the algorithm remains flexible, adjusting the traditional Reptile Search Algorithm (RSA) parameters. The application of the MLBRSA to numerical benchmarks and a few real-world engineering problems demonstrates its ability to find optimal solutions in complex problem spaces. Furthermore, when applied to the complicated task of software requirement prioritization, MLBRSA showcases its capability to rank requirements effectively, ensuring that critical software functionalities are addressed promptly. Based on the results obtained, the MLBRSA stands as evidence of the potential of multi-learning, offering a promising solution to engineering and software-centric challenges. Its adaptability, competitiveness, and experience-driven approach make it a valuable tool for researchers and practitioners.

THREAT PREVENTION & VULNERABILITY ANALYSIS OF SMART CONTRACTS IN BLOCKCHAIN NETWORKS

Blockchain technology now relies heavily on smart contracts, which offer self-executing code for the exchange of goods and data. Smart contracts enable financial activities like payments and auctions on blockchain systems. Even if bugs are found, they cannot be changed. They are frequently used to automate the implementation of agreements so that all parties may be confident in the conclusion without the need for an intermediary. But because of their openness and how they interact with one another in the blockchain ecosystem, these contracts are vulnerable to security risks. Smart contract security research has advanced significantly in recent years. The research community of smart contract security has made a significant improvement recently. Researchers have identified several security flaws in smart contracts and have created frameworks for verification and static analysis to find them. This study attempts to identify the most critical software security issues that affect smart contracts. These are then handled utilizing a variety of methods and equipment common to the sector

A manifesto for applicable formal methods

Recently, formal methods have been used in large industrial organisations (including AWS, Facebook/Meta, and Microsoft) and have proved to be an effective part of a software engineering process finding important bugs. Perhaps because of that, practitioners are interested in using them more often. Nevertheless, formal methods are far less applied than expected, particularly for safety-critical systems where they are strongly recommended and have the most significant potential. We hypothesise that formal methods still seem not applicable enough or ready for their intended use in such areas. In critical software engineering, what do we mean when we speak of a formal method? And what does it mean for such a method to be applicable both from a scientific and practical viewpoint? Based on what the literature tells about the first question, with this manifesto, we identify key challenges and lay out a set of guiding principles that, when followed by a formal method, give rise to its mature applicability in a given scope. Rather than exercising criticism of past developments, this manifesto strives to foster increased use of formal methods in any appropriate context to the maximum benefit.

Guided Intelligent Hyper-Heuristic Algorithm for Critical Software Application Testing Satisfying Multiple Coverage Criteria

This paper proposes a novel algorithm that combines symbolic execution and data flow testing to generate test cases satisfying multiple coverage criteria of critical software applications. The coverage criteria considered are data flow coverage as the primary criterion, software safety requirements, and equivalence partitioning as sub-criteria. black The characteristics of the subjects used for the study include high-precision floating-point computation and iterative programs. The work proposes an algorithm that aids the tester in automated test data generation, satisfying multiple coverage criteria for critical software. The algorithm adapts itself and selects different heuristics based on program characteristics. The algorithm has an intelligent agent as its decision support system to accomplish this adaptability. Intelligent agent uses the knowledge base to select different low-level heuristics based on the current state of the problem instance during each generation of genetic algorithm execution. The knowledge base mimics the expert’s decision in choosing the appropriate heuristics. black The algorithm outperforms by accomplishing 100% data flow coverage for all subjects. In contrast, the simple genetic algorithm, random testing and a hyper-heuristic algorithm could accomplish a maximum of 83%, 67% and 76.7%, respectively, for the subject program with high complexity. black The proposed algorithm covers other criteria, namely equivalence partition coverage and software safety requirements, with fewer iterations. black The results reveal that test cases generated by the proposed algorithm are also effective in fault detection, with 87.2% of mutants killed when compared to a maximum of 76.4% of mutants killed for the complex subject with test cases of other methods.

From Quality Control Techniques to Self-Organizing Teams: Effective Strategies for Managing Critical Software Systems

From Quality Control Techniques to Self-Organizing Teams: Effective Strategies for Managing Critical Software Systems

PENGEMBANGAN PERANGKAT PEMBELAJARAN BERFIKIR KRITIS APLIKASI PERANGKAT LUNAK DAN DESAIN INTERIOR BANGUNAN DI SMK

The objectives of this research are (1) to analyze the needs for the development of critical thinking learning tools for software applications and building interior design in vocational schools. (2) Describe product validation of critical thinking software applications and interior design of buildings in SMK. (3) Describe the effectiveness of critical thinking products in software applications and interior design of buildings in Vocational High Schools. (4) Describe the practicality of critical thinking products for software applications and building interior design in Vocational High Schools. The type of research used is research and development (Research and Development) which aims to develop and produce a product. The development procedure refers to the ADDIE development model. The results obtained are the development of critical thinking learning tools in the subject of Software Applications and Building Interior Design. The research instrument uses an assessment sheet according to 2 expert lecturers and 25 student responses. The results of the validity, practicality and effectiveness that have been obtained are: 94% material validity, 91.7% practicality and 80% effectiveness.

A novel hybrid requirement’s prioritization approach based on critical software project factors

A novel hybrid requirement’s prioritization approach based on critical software project factors

Architecting complex, long-lived scientific software

Software is a critical aspect of large-scale science, providing essential capabilities for making scientific discoveries. Large-scale scientific projects are vast in scope, with lifespans measured in decades and costs exceeding hundreds of millions of dollars. Successfully designing software that can exist for that span of time, at that scale, is challenging for even the most capable software companies. Yet scientific endeavors face challenges with funding, staffing, and operate in complex, poorly understood software settings. In this paper we discuss the practice of early-phase software architecture in the Square Kilometre Array Observatory’s Science Data Processor. The Science Data Processor is a critical software component in this next-generation radio astronomy instrument. We customized an existing set of processes for software architecture analysis and design to this project’s unique circumstances. We report on the series of comprehensive software architecture plans that were the result. The plans were used to obtain construction approval in a critical design review with outside stakeholders. We conclude with implications for other long-lived software architectures in the scientific domain, including potential risks and mitigations.

MemConFuzz: Memory Consumption Guided Fuzzing with Data Flow Analysis

Uncontrolled heap memory consumption, a kind of critical software vulnerability, is utilized by attackers to consume a large amount of heap memory and consequently trigger crashes. There have been few works on the vulnerability fuzzing of heap consumption. Most of them, such as MemLock and PerfFuzz, have failed to consider the influence of data flow. We proposed a heap memory consumption guided fuzzing model named MemConFuzz. It extracts the locations of heap operations and data-dependent functions through static data flow analysis. Based on the data dependency, we proposed a seed selection algorithm in fuzzing to assign more energy to the samples with higher priority scores. The experiment results showed that the MemConFuzz has advantages over AFL, MemLock, and PerfFuzz with more quantity and less time consumption in exploiting the vulnerability of heap memory consumption.