Systematic construction of goal-oriented COTS taxonomies

The use of Commercial Off-The-Shelf (COTS) components is becoming a strategic need because they offer the possibility to build systems at reduced costs and within shorter development time. Having efficient and reliable COTS components selection methods is a key issue not only for exploiting the potential benefits of this technology, but also for facing the problems and risks involved. Searching COTS components requires overcoming several obstacles: the growing size and evolvability of the COTS marketplace, the dependencies from the components to be selected with others, and the type of descriptions currently available for those components. The main goal of this thesis is to provide support for a reliable and comprehensive structuring of a reuse infrastructure for the COTS components marketplace. With this aim, we propose a method for the construction and maintenance of goal-oriented COTS taxonomies based on a solid domain analysis; guiding the gathering of sources of information, modeling requirements and dependency relationship among domains, and organizing knowledge in any segment of the COTS marketplace.Peer ReviewedPostprint (author’s final draft

Systematic construction of goal-oriented COTS taxonomies

El proceso de construir software a partir del ensamblaje e integración de soluciones de software pre-fabricadas, conocidas como componentes COTS (Comercial-Off-The-Shelf) se ha convertido en una necesidad estratégica en una amplia variedad de áreas de aplicación. En general, los componentes COTS son componentes de software que proveen una funcionalidad específica, que están disponibles en el mercado para ser adquiridos e integrados dentro de otros sistemas de software. Los beneficios potenciales de esta tecnología son principalmente la reducción de costes y el acortamiento del tiempo de desarrollo, a la vez que fomenta la calidad. Sin embargo, numerosos retos que van desde problemas técnicos y legales deben ser afrontados para adaptar las actividades tradicionales de ingeniería de software para explotar los beneficios del uso de COTS para el desarrollo de sistemas.Actualmente, existe un incrementalmente enorme mercado de componentes COTS; así, una de las actividades más críticas en el desarrollo de sistemas basados en COTS es la selección de componentes que deben ser integrados en el sistema a desarrollar. La selección está básicamente compuesta de dos procesos principales: La búsqueda de componentes candidatos en el mercado y su posterior evaluación con respecto a los requisitos del sistema. Desafortunadamente, la mayoría de los métodos existentes para seleccionar COTS, se enfocan en el proceso de evaluación, dejando de lado el problema de buscar los componentes en el mercado. La búsqueda de componentes en el mercado no es una tarea trivial, teniendo que afrontar varias características del mercado de COTS, tales como su naturaleza dispersa y siempre creciente, cambio y evolución constante; en este contexto, la obtención de información de calidad acerca de los componentes no es una tarea fácil. Como consecuencia, el proceso de selección de COTS se ve seriamente dañado. Además, las alternativas tradicionales de reuso también carecen de soluciones apropiadas para reusar componentes COTS y el conocimiento adquirido en cada proceso de selección. Esta carencia de propuestas es un problema muy serio que incrementa los riesgos de los proyectos de selección de COTS, además de hacerlos ineficientes y altamente costosos. Esta disertación presenta el método GOThIC (Goal- Oriented Taxonomy and reuse Infrastructure Construction) enfocado a la construcción de infraestructuras de reuso para facilitar la búsqueda y reuso de componentes COTS. El método está basado en el uso de objetivos para construir taxonomías abstractas, bien fundamentadas y estables para lidiar con las características del mercado de COTS. Los nodos de las taxonomías son caracterizados por objetivos, sus relaciones son declaradas como dependencias y varios artefactos son construidos y gestionados para promover la reusabilidad y lidiar con la evolución constante.El método GOThIC ha sido elaborado a través de un proceso iterativo de investigación-acción para identificar los retos reales relacionados con el proceso de búsqueda de COTS. Posteriormente, las soluciones posibles fueron evaluadas e implementadas en varios casos de estudio en el ámbito industrial y académico en diversos dominios. Los resultados más relevantes fueron registrados y articulados en el método GOThIC. La evaluación industrial preliminar del método se ha llevado a cabo en algunas compañías en Noruega.The process of building software systems by assembling and integrating pre-packaged solutions in the form of Commercial-Off-The-Shelf (COTS) software components has become a strategic need in a wide variety of application areas. In general, COTS components are software components that provide a specific functionality, available in the market to be purchased, interfaced and integrated into other software systems. The potential benefits of this technology are mainly its reduced costs and shorter development time, while maintaining the quality. Nevertheless, many challenges ranging form technical to legal issues must be faced for adapting the traditional software engineering activities in order to exploit these benefits.Nowadays there is an increasingly huge marketplace of COTS components; therefore, one of the most critical activities in COTS-based development is the selection of the components to be integrated into the system under development. Selection is basically composed of two main processes, namely: searching of candidates from the marketplace and their evaluation with respect to the system requirements. Unfortunately, most of the different existing methods for COTS selection focus their efforts on evaluation, letting aside the problem of searching components in the marketplace. Searching candidate COTS is not an easy task, having to cope with some challenging marketplace characteristics related to its widespread, evolvable and growing nature; and the lack of available and well-suited information to obtain a quality-assured search. Indeed, traditional reuse approaches also lack of appropriate solutions to reuse COTS components and the knowledge gained in each selection process. This lack of proposals is a serious drawback that makes the whole selection process highly risky, and often expensive and inefficient. This dissertation introduces the GOThIC (Goal- Oriented Taxonomy and reuse Infrastructure Construction) method aimed at building a domain reuse infrastructure for facilitating COTS components searching and reuse. It is based on goal-oriented approaches for building abstract, well-founded and stable taxonomies capable of dealing with the COTS marketplace characteristics. Thus, the nodes of these taxonomies are characterized by means of goals, their relationships declared as dependencies among them and several artifacts are constructed and managed for reusability and evolution purposes. The GOThIC method has been elaborated following an iterative process based on action research premises to identify the actual challenges related to COTS components searching. Then, possible solutions were envisaged and implemented by several industrial and academic case studies in different domains. Successful results were recorded to articulate the synergic GOThIC method solution, followed by its preliminary industrial evaluation in some Norwegian companies

An Experimental Study of Diversity with Off-The-Shelf AntiVirus Engines

Fault tolerance in the form of diverse redundancy is well known to improve the detection rates for both malicious and non-malicious failures. What is of interest to designers of security protection systems are the actual gains in detection rates that they may give. In this paper we provide exploratory analysis of the potential gains in detection capability from using diverse AntiVirus products for the detection of self-propagating malware. The analysis is based on 1599 malware samples collected by the operation of a distributed honeypot deployment over a period of 178 days. We sent these samples to the signature engines of 32 different AntiVirus products taking advantage of the VirusTotal service. The resulting dataset allowed us to perform analysis of the effects of diversity on the detection capability of these components as well as how their detection capability evolves in time

The Effectiveness of Software Diversity

This research exploits a collection of more than 2,500,000 programs, written to over 1,500 specifications (problems), the Online Judge programming competition. This website invites people all over the world to submit programs to these specifications, and automatically checks them against a benchmark. The submitter receives feedback, the most frequent responses being "Correct" and "Wrong Answer". This enormous collection of programs gives the opportunity to test common assumptions in software reliability engineering about software diversity, with a high confidence level and across several problem domains. The previous research has used collections of up to several dozens of programs for only one problem, which is large enough for exploratory insights, but not for statistical relevance. For this research, a test harness was developed which automatically extracts, compiles, runs and checks the programs with a benchmark. For most problems, this benchmark consists of 2,500 or 10,000 demands. The demands are random, or cover the entirety or a contiguous section of the demand space. For every program the test harness calculates: (1) The output for every demand in the benchmark. (2) The failure set, i.e. the demands for which the program fails. (3) The internal software metrics: Lines of Code, Halstead Volume, and McCabe's Cyclomatic Complexity. (4) The dependability metrics: number of faults and probability of failure on demand. The only manual intervention in the above is the selection of a correct program. The test harness calculates the following for every problem: (1) Various characteristics: the number of programs submitted to the problem, the number of authors submitting, the number of correct programs in the first attempt, the average number of attempts until a correct solution is reached, etc. (2) The grouping of programs in equivalence classes, i.e. groups' of programs with the same failure set. (3) The difficulty function for the problem, i.e. the average probability of failure of the program for different demands. (4) The gain of multipleversion software diversity in a 1-out-of-2 pair as a function of the pfd of the set of programs. (5) The additional gain of language diversity in the pair. (6) Correlations between internal metrics, and between internal metrics and dependability metrics. This research confirms many of the insights gained from earlier studies: (1) Software diversity is an effective means to increase the probability of failure on demand of a 1-out-of- 2 system. It decreases the probability of undetected failure on demand by on average around two orders of magnitude for reliable programs. (2) For unreliable programs the failure behaviour appears to be close to statistically independent. (3) Run-time checks reduce the probability of failure. However, the gain of run-time checks is much lower and far less consistent than that of multiple-version software diversity, i.e. it is fairly random whether a run-time check matches the faults actually made in programs. (4) Language diversity in a diverse pair provides an additional gain in the probability of undetected failure on demand, but this gain is not very high when choosing from the programming languages C, C++ and Pascal. (5) There is a very strong correlation between the internal software metrics. The programs in the Online Judge do not behave according to some common assumptions: (1) For a given specification, there is no correlation between selected internal software metrics (Lines of Code, Halstead Volume and McCabe's Cyclomatic Complexity) and dependability metrics (pfd and Number of Faults) of the programs implementing it. This result could imply that for improving dependability, it is not effective to require programmers to write programs within given bounds for these internal software metrics. (2) Run-time checks are still effective for reliable programs. Often, programmers remove runtIme checks at the end of the development process, probably because the program is then deemed to be correct. However, the benefit of run-time checks does not correlate with pfd, i.e. they. are as effective for reliable as for unreliable programs. They are also shown to have a negliigible adverse impact on the program's dependability

Combining SOA and BPM Technologies for Cross-System Process Automation

This paper summarizes the results of an industry case study that introduced a cross-system business process automation solution based on a combination of SOA and BPM standard technologies (i.e., BPMN, BPEL, WSDL). Besides discussing major weaknesses of the existing, custom-built, solution and comparing them against experiences with the developed prototype, the paper presents a course of action for transforming the current solution into the proposed solution. This includes a general approach, consisting of four distinct steps, as well as specific action items that are to be performed for every step. The discussion also covers language and tool support and challenges arising from the transformation

Building a Systematic Legacy System Modernization Approach

A systematic legacy system modernizing approach represents a new approach for modernizing legacy systems. Systematic legacy system modernization has software reuse as an integral part of modernization. We have developed a modernization approach which uses software architecture reconstruction to find reusable components within the legacy system. The practice of software development and modernization continues to shift towards the reuse of components from legacy systems to handle the complexities of software development. Modernization of a legacy system requires reuse of software artefacts from legacy system to conserve the business rules and improve the system’s quality attributes. Software reuse is an integral part of our systematic legacy modernization approach. Software should be considered as an asset and reuse of these assets is essential to increase the return on the development costs. Software reuse ranges from reuse of ideas to algorithms to any documents that are created during the software development life cycle. Software reuse has many potential benefits which include increased software quality, and decreased software development cost and time. Demands for lower software production and maintenance costs, faster delivery of systems and increased quality can only be met by widespread and systematic software reuse. In spite of all these benefits software reuse adoption is not widespread in the software development communities. Software reuse cannot possibly become an engineering discipline so long as issues and concerns have not been clearly understood and dealt with. We have conducted two surveys to understand the issues and concerns of software reuse in the Conventional Software Engineering (CSE) Community and the Software Product Line (SPL) Community where reuse is an integral part of the product development. The quantitative and qualitative analysis of our surveys identified the critical factors which affect and inhibit software engineers and developers adopting software reuse. Software reuse has been talked about in generic terms in software product lines. Though software reuse is a core concept in SPL it has however failed to become a standardized practice. The survey conducted on the SPL Community investigates how software reuse is adopted in SPL so as to provide the necessary degree of support for engineering software product line applications and to identify some of the issues and concerns in software reuse. The identified issues and concerns have helped us to understand the difference between software reuse in the CSE and SPL Communities. It has also given us an indication of how both communities can learn good software reuse practices from each other in order to develop a common software reuse process. Based on the outcome of our surveys we have developed a systematic software reuse process, called the Knowledge Based Software Reuse (KBSR) Process, which incorporates a Repository of reusable software assets to build a systematic legacy system modernization approach. Being able to reuse software artefacts, be it software requirement specification, design, or code, would greatly enhance software productivity and reliability. All of these software artefacts can go in the Knowledge Based Software Reuse Repository and be candidates for reuse

Sistemas de gestão integrados: desenvolvimento de um modelo para avaliação do nível de maturidade

Tese de doutoramento do Programa Doutoral em Engenharia Industrial e de SistemasIntegração é definida como “o ato ou processo de tornar inteiro” e sistema como “arranjo de elementos interrelacionados e interatuantes, tais como processos que utilizam vários recursos de modo a atingir objetivos predefinidos”. As organizações humanas despendem uma grande quantidade de trabalho a desafiar um dos conceitos mais básicos da física: a entropia. A “ponta do iceberg” visível desta guerra intestina contra a tendência das organizações para a desordem são os sistemas de gestão. Os sistemas de gestão mais reportados a coexistirem num Sistema de Gestão Integrado (SGI) são o Sistema de Gestão da Qualidade (SGQ), implementado segundo a norma ISO 9001, o Sistema de Gestão Ambiental (SGA), implementado segundo a norma ISO 14001 e o Sistema de Gestão de Segurança e Saúde no Trabalho (SGSST), implementado segundo a norma OHSAS 18001. O objetivo do trabalho realizado foi o de analisar o fenómeno da integração de sistemas de gestão, identificar áreas de investigação abertas, propor soluções para colmatá-las, nomeadamente através do desenvolvimento de um modelo que permita avaliar a maturidade de um SGI. Como ponto de partida, a revisão bibliográfica efetuada procedeu ao levantamento de todas as questões abordadas pela literatura científica relacionada com a integração de sistemas e com modelos de maturidade e, a partir da caracterização do estado-da-arte, identificou as áreas para as quais ainda não há respostas ou onde, apesar de já existirem, as mesmas são de natureza difusa. Constatou-se que a integração de sistemas de gestão é um fenómeno caracterizado pelo número elevado de variáveis envolvidas, nomeadamente, a estratégia utilizada, o processo de implementação, a tipologia de auditorias e o nível de integração atingido, entre outras. A revisão bibliográfica inicial permitiu também o desenvolvimento de questionários, que se revelou a principal metodologia de investigação adotada. O recurso a metodologias alternativas na análise de resultados confirmou a relação existente entre as motivações iniciais para implementação de um SGI e os benefícios daí resultantes. A clarificação da posição do SGQ num contexto de integração, identificando as várias posições que este subsistema pode assumir, contribuiu com informação crítica para a gestão de topo, focando o sucesso do processo de integração. O contributo final desta tese consubstanciou-se na elaboração de um modelo de maturidade que permite avaliar a maturidade de um SGI assente em dois componentes: o back office e o front office. Esta tarefa permitiu que outros contributos fossem também possíveis, nomeadamente, a realização de uma macro-análise ao fenómeno da integração de sistemas de gestão a nível mundial, ao desenvolvimento de indicadores macro e à avaliação da sua assertividade por comparação com outros indicadores baseados em diferentes fontes. A natureza diversa da pesquisa bibliográfica realizada permitiu também a identificação de conceitos externos ao processo de integração, mas cuja adoção permite um acréscimo à maturidade dos SGIs. Tópicos como a avaliação e gestão do ciclo de vida, a macroergonomia, a sustentabilidade e a responsabilidade social foram identificados como coadjuvantes para uma integração mais profunda, contribuindo para um SGI com maior maturidade. O desenvolvimento de indicadores macro para avaliação da dispersão a nível mundial dos SGIs permitiu concluir que a sua evolução, durante o período temporal de 1999 a 2011, se traduz num acréscimo acentuado em todas as macro regiões consideradas. A nível nacional, as empresas que desenvolveram um SGI situam-se, principalmente, nas regiões Norte, Centro e de Lisboa sendo a tipologia de SGI mais adotada aquela na qual estão integrados os SGQ, SGA e SGSST. Os resultados do questionário dirigido aos peritos permitiram distinguir empresas com um alto nível de integração. A utilização das mesmas ferramentas e metodologias organizacionais em cada subsistema e o alinhamento de objetivos, bem como o facto de a empresa monitorizar os seus processos com base em indicadores integrados são evidências de um nível de integração máximo. No modelo de maturidade desenvolvido é possível constatar que três variáveis dão um contributo superior às restantes para a variável latente “Maturidade do SGI”. São elas a visão integrada revelada pela gestão de topo, a classificação do nível de integração atingido e a tipologia de auditorias realizadas.Integration is defined as “the act or process of making whole or entire” and System defined as “an interrelated elements array, such as processes, using several resources to achieve set goals”. Human organizations take a lot of work in order to defy basic physics laws namely entropy. The visible “iceberg peak” of this subtle war against organizations disorder trend are the management systems. The most commonly reported subsystems combined into a single Integrated Management System (IMS) are the Quality Management System (QMS) implemented according ISO 9001 standard, the Environmental Management System (EMS) implemented according ISO 14001 standard and the Occupational Health and Safety Management System (OHSMS) implemented according OHSAS 18001 standard. The main objective of this thesis is to analyse all management systems integration phenomenon, to identify open research paths and to present solutions, namely, through a model development aiming at IMS maturity assessment. The thorough literature review undertaken, focused on open questions identification related to IMS and maturity models, depicted some unanswered questions, some with diffuse answers and some questions never made. The initial literature review allowed the development of the surveys focused on the organizations and on the selected academic and industry experts being this methodology the thesis corner stone. A back office and front office based maturity model development assessing IMS was the ultimate contribution from this thesis. This contribution, on its own, and sustained on multi-methodological tasks, allowed some other contributions, namely, the macro analysis of the management systems integration phenomenon worldwide, macro-indicators development and their evaluation by comparison with other indicators based on different sources. Some alternative methodologies adopted on results analysis contributed on some issues raised by several authors, namely, by confirming the relation between IMS implementation initial motivation and the benefits collected afterwards. Additionally, the QMS reposition after the integration process was assessed and three main strategies were identified. This identification enables top management with crucial information aiming at an integration successful process. Literature review allowed also external concepts identification that relates to IMS maturity. Topics like life cycle management and assessment, macroergonomics, sustainability and social accountability should be taken into account, enabling a deeper integration, and a more mature IMS. The results promoted several critical success factors identification that should be considered when integrating management subsystems. Some characteristics intrinsically related to high integration level organizations and low integration level organizations were identified. It was possible to conclude that management systems integration phenomenon is characterized by the high number of variables involved. The adopted strategy, the implementation process, the audit typology, the IMS typology, the motivation, the benefits, the obstacles and the achieved integration level are among those variables. Through macro-indicators development aiming the IMS dispersion worldwide analysis one may conclude that they evolved positively and increased in number during the time period between 1999 and 2011. At a national level, it is possible to conclude that the organizations that developed an IMS are mostly located at the North, Centre and Lisbon regions. The integrated QMS, EMS and OHSMS is the IMS typology mostly adopted. The results collected from the survey among academic and industry experts allowed the identification of high integration level organizations. According to these results, the development and adoption of the same tools and methodologies by each subsystem and objectives alignment, processes monitoring based in integrated indicators are evidences of a maximum integration level. The maturity model final version allows the conclusion that three variables contribute the mostly to the “IMS Maturity” latent variable. Those variables are the integrated vision by top management, the integration level classification and the audit typology. External concepts and the eight excellence management pillars relate also to the IMS maturity

An evaluation of open source software adoption by UK SMEs in the IT industry

This thesis was submitted for the degree of Doctor of Philosophy and awarded by Brunel University.This study evaluates the adoption of Open Source Software (OSS) by IT Small to Medium-sized Enterprises (SMEs) in the UK. The growing popularity and acceptance of OSS continues to draw much attention in research and practice. However, researchers and IT practitioners within the UK SME sector still face challenges in understanding the issues that influence the acceptance, adoption, and diffusion of OSS. While previous research studies have focused mainly on the software development model and the unique characteristics of OSS, the area of OSS adoption by UK SMEs has largely been ignored. Furthermore, there is a lack of widely-acceptable theories that explain the adoption of OSS, implying that there is limited understanding of OSS adoption by UK SMEs. This gap in research has led this thesis to evaluate existing adoption theories and then apply the 'Decomposed Theory of Planned Behaviour' to model the adoption of OSS by SMEs. Based on the emerged conceptual model, an innovative and structured qualitative research design that uses a case study strategy was developed to evaluate the adoption of OSS across 10 UK SMEs in the IT industry. The analysis of the standardised data from the case study interviews led to the definition of the 16 factors of an emergent theory of OSS adoption by IT SMEs. The analysis of that empirical model has led to important conclusions including the following five issues, summarily. (1) The participant IT SMEs were drawn to different benefits, and experienced different challenges, in using OSS, suggesting that there is subjectivity and complexity in the factors influencing OSS adoption. (2) As in most Information and Communication Technology (ICT) adoption, ITcapability was identified to be essential for successful adoption of OSS, and therefore, it presents potential for important cooperative and collaborative support with OSS communities. (3) The emergent theory from this research study provide researchers and practitioners with variables for surveying critical-success-factors and a reference model for understanding the adoption of OSS. (4) The emergent theory and other general findings from this study are likely to have relevance in other areas of Information Systems research and practice, owing to the factors and theoretical framework that are common to OSS and general ICT acceptance, adoption, and diffusion. (5) This study appears to be the first that has focused on developing a widely-acceptable theory of OSS adoption by IT SMEs in the UK, suggesting that this innovative research study is a novel contribution that has important implications for theory and practice in OSS and general ICT acceptance, adoption, and diffusion

An evaluation of open source software adoption by UK SMEs in the IT industry

This study evaluates the adoption of Open Source Software (OSS) by IT Small to Medium-sized Enterprises (SMEs) in the UK. The growing popularity and acceptance of OSS continues to draw much attention in research and practice. However, researchers and IT practitioners within the UK SME sector still face challenges in understanding the issues that influence the acceptance, adoption, and diffusion of OSS. While previous research studies have focused mainly on the software development model and the unique characteristics of OSS, the area of OSS adoption by UK SMEs has largely been ignored. Furthermore, there is a lack of widely-acceptable theories that explain the adoption of OSS, implying that there is limited understanding of OSS adoption by UK SMEs. This gap in research has led this thesis to evaluate existing adoption theories and then apply the 'Decomposed Theory of Planned Behaviour' to model the adoption of OSS by SMEs. Based on the emerged conceptual model, an innovative and structured qualitative research design that uses a case study strategy was developed to evaluate the adoption of OSS across 10 UK SMEs in the IT industry. The analysis of the standardised data from the case study interviews led to the definition of the 16 factors of an emergent theory of OSS adoption by IT SMEs. The analysis of that empirical model has led to important conclusions including the following five issues, summarily. (1) The participant IT SMEs were drawn to different benefits, and experienced different challenges, in using OSS, suggesting that there is subjectivity and complexity in the factors influencing OSS adoption. (2) As in most Information and Communication Technology (ICT) adoption, ITcapability was identified to be essential for successful adoption of OSS, and therefore, it presents potential for important cooperative and collaborative support with OSS communities. (3) The emergent theory from this research study provide researchers and practitioners with variables for surveying critical-success-factors and a reference model for understanding the adoption of OSS. (4) The emergent theory and other general findings from this study are likely to have relevance in other areas of Information Systems research and practice, owing to the factors and theoretical framework that are common to OSS and general ICT acceptance, adoption, and diffusion. (5) This study appears to be the first that has focused on developing a widely-acceptable theory of OSS adoption by IT SMEs in the UK, suggesting that this innovative research study is a novel contribution that has important implications for theory and practice in OSS and general ICT acceptance, adoption, and diffusion.EThOS - Electronic Theses Online ServiceGBUnited Kingdo