Requirements engineering within a large-scale security-oriented research project : lessons learned

Requirements engineering has been recognized as a fundamental phase of the software engineering process. Nevertheless, the elicitation and analysis of requirements are often left aside in favor of architecture-driven software development. This tendency, however, can lead to issues that may affect the success of a project. This paper presents our experience gained in the elicitation and analysis of requirements in a large-scale security-oriented European research project, which was originally conceived as an architecture-driven project. In particular, we illustrate the challenges that can be faced in large-scale research projects and consider the applicability of existing best practices and off-the-shelf methodologies with respect to the needs of such projects. We then discuss how those practices and methods can be integrated into the requirements engineering process and possibly improved to address the identified challenges. Finally, we summarize the lessons learned from our experience and the benefits that a proper requirements analysis can bring to a project

Requirements engineering within a large-scale security-oriented research project : lessons learned

Requirements engineering has been recognized as a fundamental phase of the software engineering process. Nevertheless, the elicitation and analysis of requirements are often left aside in favor of architecture-driven software development. This tendency, however, can lead to issues that may affect the success of a project. This paper presents our experience gained in the elicitation and analysis of requirements in a large-scale security-oriented European research project, which was originally conceived as an architecture-driven project. In particular, we illustrate the challenges that can be faced in large-scale research projects and consider the applicability of existing best practices and off-the-shelf methodologies with respect to the needs of such projects. We then discuss how those practices and methods can be integrated into the requirements engineering process and possibly improved to address the identified challenges. Finally, we summarize the lessons learned from our experience and the benefits that a proper requirements analysis can bring to a project

A MDE-based process for the design, implementation and validation of safety critical systems

Distributed Real-Time Embedded (DRE) systems have critical requirements that need to be verified. They are either related to functional (e.g. stability of a furnace controller) or non-functional (e.g. meeting deadlines) aspects. Model-Driven Engineering (MDE) tools have emerged to ease DRE systems design. These tools are also capable of generating code. However, these tools either focus on the functional aspects or on the runtime architecture. Hence, the development cycle is partitioned into pieces with heterogeneous modeling notations and poor coordination. In this paper, we propose a MDE-based process to create DRE systems without manual coding. We show how to integrate functional and architecture concerns in a unified process. We use industry-proven modeling languages to design functional elements of the system, and automatically integrate them using our AADL toolchain

A Component-based Framework for Distributed Business Simulations in E-Business Environments

Simulations preserve the knowledge of complex dynamic systems and consequently transfer the knowledge of the cohesions of its elements to a specified target group. As the progress in information technology and therefore the dynamic e-business driven economy adapts even faster to the business demands, new ways to preserve this growing amount of knowledge have to be found. This paper presents an extensible business simulation framework which is realized as a component-based distributed Java Version 2 Enterprise Edition (J2EE) architecture. The framework aspires to offer an extensible and domain independent simulation environment which ensures the return of investment in the sense of implementing this framework once and extending it to the future requirements of diverse domains in e-business. The system architecture follows the requirements in offering distributed deployment of its components on highly standardized level by nevertheless staying vendor independent. The architecture itself was developed by model driven architecture (MDA)-conform software engineering methods using best of breed design patterns composed to a flexible micro-architecture which possess import facilities for simulation entities (business objects) and (business) processes from e-business solutions. Combining the features of the framework, the layered pattern driven micro-architecture, and the distributed J2EE architecture, the postulated knowledge transfer from rapid changes in e-business can be realized

Towards the Model-Driven Engineering of Secure yet Safe Embedded Systems

We introduce SysML-Sec, a SysML-based Model-Driven Engineering environment aimed at fostering the collaboration between system designers and security experts at all methodological stages of the development of an embedded system. A central issue in the design of an embedded system is the definition of the hardware/software partitioning of the architecture of the system, which should take place as early as possible. SysML-Sec aims to extend the relevance of this analysis through the integration of security requirements and threats. In particular, we propose an agile methodology whose aim is to assess early on the impact of the security requirements and of the security mechanisms designed to satisfy them over the safety of the system. Security concerns are captured in a component-centric manner through existing SysML diagrams with only minimal extensions. After the requirements captured are derived into security and cryptographic mechanisms, security properties can be formally verified over this design. To perform the latter, model transformation techniques are implemented in the SysML-Sec toolchain in order to derive a ProVerif specification from the SysML models. An automotive firmware flashing procedure serves as a guiding example throughout our presentation.Comment: In Proceedings GraMSec 2014, arXiv:1404.163

Towards model-driven requirements analysis for context-aware well-being systems

Research interest in the domain of pervasive systems has seen a rapid increase, evident from the amount of research papers being published each year. These systems are to blend in with everyday life, being completely unobtrusive. Through the use of sensors, pervasive systems can become context-aware. As such, they are able to use this context information in order to improve the services provided to the user. Interesting fields of application are those of health-care and well-being. The COMMIT SWELL project aims to improve both physical and mental well-being by developing a sensor-based context-aware system. This system is to (i) aid the user into improving his own lifestyle by giving him insight in his personal activity, and (ii) support the user in his work. In the domain of context-aware systems, we find that requirements have to align perfectly with the features to be offered by the system. If not, the system will become a hindrance to the user, who will then neglect it. Requirements engineering and architectural development for this type of system is largely unexplored territory. A bottom-up approach is often used: little attention is paid to requirements engineering up front, and architectures are created without having reuse in mind. Our objective is to improve the reuse of system requirements and architecture, resulting in an improvement of alignment between these artifacts. In order to facilitate this alignment, we aim to create a model-driven method that allows for bi-directional transformation between requirements and architecture at design time. Current results in the project include a literature study, a list of domain requirements for context-aware well-being systems and a reference architecture and descriptions for two demonstrators within the COMMIT SWELL project. From literature, we found that current methods for requirements engineering in this domain are either too high, or too low level, preventing proper reuse of artifacts in the next phase of the design process, as well as the need for high levels of both domain and system modeling expertise. Furthermore, we found that tool support model-driven development of context-aware well-being applications is currently lacking. Future research will initially focus on the specific requirements found in the context-aware application domain. After this, we will be looking at the link between specific requirements and architectural components, and whether this link exists uni-directionally or bi-directionally. Finally, we will be investigating if automatic alignment between requirements and architecture can be achieved

OpenUP/MDRE: A Model-Driven Requirements Engineering Approach for Health-Care Systems

The domains and problems for which it would be desirable to introduce information systems are currently very complex and the software development process is thus of the same complexity. One of these domains is health-care. Model-Driven Development (MDD) and Service-Oriented Architecture (SOA) are software development approaches that raise to deal with complexity, to reduce time and cost of development, augmenting flexibility and interoperability. However, many techniques and approaches that have been introduced are of little use when not provided under a formalized and well-documented methodological umbrella. A methodology gives the process a well-defined structure that helps in fast and efficient analysis and design, trouble-free implementation, and finally results in the software product improved quality. While MDD and SOA are gaining their momentum toward the adoption in the software industry, there is one critical issue yet to be addressed before its power is fully realized. It is beyond dispute that requirements engineering (RE) has become a critical task within the software development process. Errors made during this process may have negative effects on subsequent development steps, and on the quality of the resulting software. For this reason, the MDD and SOA development approaches should not only be taken into consideration during design and implementation as usually occurs, but also during the RE process. The contribution of this dissertation aims at improving the development process of health-care applications by proposing OpenUP/MDRE methodology. The main goal of this methodology is to enrich the development process of SOA-based health-care systems by focusing on the requirements engineering processes in the model-driven context. I believe that the integration of those two highly important areas of software engineering, gathered in one consistent process, will provide practitioners with many benets. It is noteworthy that the approach presented here was designed for SOA-based health-care applications, however, it also provides means to adapt it to other architectural paradigms or domains. The OpenUP/MDRE approach is an extension of the lightweight OpenUP methodology for iterative, architecture-oriented and model-driven software development. The motivation for this research comes from the experience I gained as a computer science professional working on the health-care systems. This thesis also presents a comprehensive study about: i) the requirements engineering methods and techniques that are being used in the context of the model-driven development, ii) known generic but flexible and extensible methodologies, as well as approaches for service-oriented systems development, iii) requirements engineering techniques used in the health-care industry. Finally, OpenUP/MDRE was applied to a concrete industrial health-care project in order to show the feasibility and accuracy of this methodological approach.Loniewski, G. (2010). OpenUP/MDRE: A Model-Driven Requirements Engineering Approach for Health-Care Systems. http://hdl.handle.net/10251/11652Archivo delegad

Defining and validating a multimodel approach for product architecture derivation and improvement

The final publication is available at Springer via http://dx.doi.org/10.1007/978-3-642-41533-3_24Software architectures are the key to achieving the non-functional requirements (NFRs) in any software project. In software product line (SPL) development, it is crucial to identify whether the NFRs for a specific product can be attained with the built-in architectural variation mechanisms of the product line architecture, or whether additional architectural transformations are required. This paper presents a multimodel approach for quality-driven product architecture derivation and improvement (QuaDAI). A controlled experiment is also presented with the objective of comparing the effectiveness, efficiency, perceived ease of use, intention to use and perceived usefulness with regard to participants using QuaDAI as opposed to the Architecture Tradeoff Analysis Method (ATAM). The results show that QuaDAI is more efficient and perceived as easier to use than ATAM, from the perspective of novice software architecture evaluators. However, the other variables were not found to be statistically significant. Further replications are needed to obtain more conclusive results.This research is supported by the MULTIPLE project (MICINN TIN2009-13838) and the Vali+D fellowship program (ACIF/2011/235).González Huerta, J.; Insfrán Pelozo, CE.; Abrahao Gonzales, SM. (2013). Defining and validating a multimodel approach for product architecture derivation and improvement. En Model-Driven Engineering Languages and Systems. Springer. 388-404. https://doi.org/10.1007/978-3-642-41533-3_24S388404Ali-Babar, M., Lago, P., Van Deursen, A.: Empirical research in software architecture: opportunities, challenges, and approaches. Empirical Software Engineering 16(5), 539–543 (2011)Ali-Babar, M., Zhu, L., Jeffery, R.: A Framework for Classifying and Comparing Software Architecture Evaluation Methods. In: 15th Australian Software Engineering Conference, Melbourne, Australia, pp. 309–318 (2004)Basili, V.R., Rombach, H.D.: The TAME project: towards improvement-oriented software environments. IEEE Transactions on Software Engineering 14(6), 758–773 (1988)Barkmeyer, E.J., Feeney, A.B., Denno, P., Flater, D.W., Libes, D.E., Steves, M.P., Wallace, E.K.: Concepts for Automating Systems Integration NISTIR 6928. National Institute of Standards and Technology, U.S. Dept. of Commerce (2003)Bosch, J.: Design and Use of Software Architectures. Adopting and Evolving Product-Line Approach. Addison-Wesley, Harlow (2000)Botterweck, G., O’Brien, L., Thiel, S.: Model-driven derivation of product architectures. In: 22th Int. Conf. on Automated Software Engineering, New York, USA, pp. 469–472 (2007)Buschmann, F., Meunier, R., Rohnert, H., Sommerlad, P., Stal, M.: Pattern-Oriented software architecture, vol. 1: A System of Patterns. Wiley (1996)Cabello, M.E., Ramos, I., Gómez, A., Limón, R.: Baseline-Oriented Modeling: An MDA Approach Based on Software Product Lines for the Expert Systems Development. In: 1st Asia Conference on Intelligent Information and Database Systems, Vietnam (2009)Carifio, J., Perla, R.J.: Ten Common Misunderstandings, Misconceptions, Persistent Myths and Urban Legends about Likert Scales and Likert Response Formats and their Antidotes. Journal of Social Sciences 3(3), 106–116 (2007)Clements, P., Northrop, L.: Software Product Lines: Practices and Patterns. Addison-Wesley, Boston (2007)Czarnecki, K., Kim, C.H.: Cardinality-based feature modeling and constraints: A progress report. In: Int. Workshop on Software Factories, San Diego-CA (2005)Datorro, J.: Convex Optimization & Euclidean Distance Geometry. Meboo Publishing (2005)Davis, F.D.: Perceived usefulness, perceived ease of use and user acceptance of information technology. MIS Quarterly 13(3), 319–340 (1989)Douglass, B.P.: Real-Time Design Patterns: Robust Scalable Architecture for Real-Time Systems. Addison-Wesley, Boston (2002)Feiler, P.H., Gluch, D.P., Hudak, J.: The Architecture Analysis & Design Language (AADL): An Introduction. Tech. Report CMU/SEI-2006-TN-011. SEI, Carnegie Mellon University (2006)Gómez, A., Ramos, I.: Cardinality-based feature modeling and model-driven engineering: Fitting them together. In: 4th Int. Workshop on Variability Modeling of Software Intensive Systems, Linz, Austria (2010)Gonzalez-Huerta, J., Insfran, E., Abrahao, S.: A Multimodel for Integrating Quality Assessment in Model-Driven Engineering. In: 8th International Conference on the Quality of Information and Communications Technology (QUATIC 2012), Lisbon, Portugal, September 3-6 (2012)Gonzalez-Huerta, J., Insfran, E., Abrahao, S., McGregor, J.D.: Non-functional Requirements in Model-Driven Software Product Line Engineering. In: 4th Int. Workshop on Non-functional System Properties in Domain Specific Modeling Languages, Insbruck, Austria (2012)Guana, V., Correal, V.: Variability quality evaluation on component-based software product lines. In: 15th Int. Software Product Line Conference, Munich, Germany, vol. 2, pp. 19.1–19.8 (2011)Insfrán, E., Abrahão, S., González-Huerta, J., McGregor, J.D., Ramos, I.: A Multimodeling Approach for Quality-Driven Architecture Derivation. In: 21st Int. Conf. on Information Systems Development (ISD 2012), Prato, Italy (2012)ISO/IEC 25000:2005, Software Engineering. Software product Quality Requirements and Evaluation SQuaRE (2005)Kazman, R., Klein, M., Clements, P.: ATAM: Method for Architecture Evaluation (CMU/SEI-2000-TR-004, ADA382629). Software Engineering Institute, Carnegie Mellon University, Pittsburgh (2000), http://www.sei.cmu.edu/publications/documents/00.reports/00tr004.htmlKim, T., Ko, I., Kang, S., Lee, D.: Extending ATAM to assess product line architecture. In: 8th IEEE Int. Conference on Computer and Information Technology, Sydney, Australia, pp. 790–797 (2008)Kitchenham, B.A., Pfleeger, S.L., Hoaglin, D.C., Rosenber, J.: Preliminary Guidelines for Empirical Research in Software Engineering. IEEE Transactions on Software Engineering 28(8) (2002)Kruchten, P.B.: The Rational Unified Process: An Introduction. Addison-Wesley (1999)Martensson, F.: Software Architecture Quality Evaluation. Approaches in an Industrial Context. Ph. D. thesis, Blekinge Institute of Technology, Karlskrona, Sweden (2006)Maxwell, K.: Applied Statistics for Software Managers. Software Quality Institute Series. Prentice-Hall (2002)Olumofin, F.G., Mišic, V.B.: A holistic architecture assessment method for software product lines. Information and Software Technology 49, 309–323 (2007)Perovich, D., Rossel, P.O., Bastarrica, M.C.: Feature model to product architectures: Applying MDE to Software Product Lines. In: IEEE/IFIP & European Conference on Software Architecture, Helsinki, Findland, pp. 201–210 (2009)Robertson, S., Robertson, J.: Mastering the requirements process. ACM Press, New York (1999)Roos-Frantz, F., Benavides, D., Ruiz-Cortés, A., Heuer, A., Lauenroth, K.: Quality-aware analysis in product line engineering with the orthogonal variability model. Software Quality Journal (2011), doi:10.1007/s11219-011-9156-5Saaty, T.L.: The Analytical Hierarchical Process. McGraw- Hill, New York (1990)Taher, L., Khatib, H.E., Basha, R.: A framework and QoS matchmaking algorithm for dynamic web services selection. In: 2nd Int. Conference on Innovations in Information Technology, Dubai, UAE (2005)Wohlin, C., Runeson, P., Host, M., Ohlsson, M.C., Regnell, B., Weslen, A.: Experimentation in Software Engineering - An Introduction. Kluwer (2000