A Design Theory for Secure Semantic E-Business Processes (SSEBP)

This dissertation develops and evaluates a Design theory. We follow the design science approach (Hevener, et al., 2004) to answer the following research question: "How can we formulate a design theory to guide the analysis and design of Secure Semantic eBusiness processes (SSeBP)?" Goals of SSeBP design theory include (i) unambiguously represent information and knowledge resources involved in eBusiness processes to solve semantic conflicts and integrate heterogeneous information systems; (ii) analyze and model business processes that include access control mechanisms to prevent unauthorized access to resources; and (iii) facilitate the coordination of eBusiness process activities-resources by modeling their dependencies. Business processes modeling techniques such as Business Process Modeling Notation (BPMN) (BPMI, 2004) and UML Activity Diagrams (OMG, 2003) lack theoretical foundations and are difficult to verify for correctness and completeness (Soffer and Wand, 2007). Current literature on secure information systems design methods are theoretically underdeveloped and consider security as a non-functional requirement and as an afterthought (Siponen et al. 2006, Mouratidis et al., 2005). SSeBP design theory is one of the first attempts at providing theoretically grounded guidance to design richer secure eBusiness processes for secure and coordinated seamless knowledge exchange among business partners in a value chain. SSeBP design theory allows for the inclusion of non-repudiation mechanisms into the analysis and design of eBusiness processes which lays the foundations for auditing and compliance with regulations such as Sarbanes-Oxley. SSeBP design theory is evaluated through a rigorous multi-method evaluation approach including descriptive, observational, and experimental evaluation. First, SSeBP design theory is validated by modeling business processes of an industry standard named Collaborative Planning, Forecasting, and Replenishment (CPFR) approach. Our model enhances CPFR by incorporating security requirements in the process model, which is critically lacking in the current CPFR technical guidelines. Secondly, we model the demand forecasting and capacity planning business processes for two large organizations to evaluate the efficacy and utility of SSeBP design theory to capture the realistic requirements and complex nuances of real inter-organizational business processes. Finally, we empirically evaluate SSeBP, against enhanced Use Cases (Siponen et al., 2006) and UML activity diagrams, for informational equivalence (Larkin and Simon, 1987) and its utility in generating situational awareness (Endsley, 1995) of the security and coordination requirements of a business process. Specific contributions of this dissertation are to develop a design theory (SSeBP) that presents a novel and holistic approach that contributes to the IS knowledge base by filling an existing research gap in the area of design of information systems to support secure and coordinated business processes. The proposed design theory provides practitioners with the meta-design and the design process, including the system components and principles to guide the analysis and design of secure eBusiness processes that are secure and coordinated

A REVIEW OF PROBLEMS AND CHALLENGES OF USING MULTIPLE CONCEPTUAL MODELS

Conceptual models are used to visualise, envisage, and communicate the requirements, structure, and behaviour of a system. Particularly, during design and analysis phases, a model can serve as a tool to recognise different components, elements, actors, and relationships involved in a system. However, as a domain becomes complex, multiple models are needed to capture different aspects of a system. Further, each conceptual model develops using different grammars, methods, and tools. Therefore, using multiple models to represent a complex system may result in several problems, and challenges. This research aims to identify, analyse, and classify the different problems and issues encountered when using multiple models during information systems analysis and design through a structured literature review. Several problems are identified and are classified into seven main categories based on their common characteristics. The results of this study may serve as a baseline information for researchers in further understand-ing different modelling approaches and how multiple models can be used in harmony and reduce risks and issues. Also, the list of problems gathered will give insights to professionals on which issues they may possibly encounter when inter-relating various models

Assessing the effectiveness of goal-oriented modeling languages: A family of experiments

[EN] Context Several goal-oriented languages focus on modeling stakeholders' objectives, interests or wishes. However, these languages can be used for various purposes (e.g., exploring system solutions or evaluating alternatives), and there are few guidelines on how to use these models downstream to the software requirements and design artifacts. Moreover, little attention has been paid to the empirical evaluation of this kind of languages. In a previous work, we proposed value@GRL as a specialization of the Goal Requirements Language (GRL) to specify stakeholders' goals when dealing with early requirements in the context of incremental software development. Objective: This paper compares the value@GRL language with the i* language, with respect to the quality of goal models, the participants' modeling time and productivity when creating the models, and their perceptions regarding ease of use and usefulness. Method: A family of experiments was carried out with 184 students and practitioners in which the participants were asked to specify a goal model using each of the languages. The participants also filled in a questionnaire that allowed us to assess their perceptions. Results: The results of the individual experiments and the meta-analysis indicate that the quality of goal models obtained with value@GRL is higher than that of i*, but that the participants required less time to create the goal models when using i*. The results also show that the participants perceived value@GRL to be easier to use and more useful than i* in at least two experiments of the family. Conclusions: value@GRL makes it possible to obtain goal models with good quality when compared to i*, which is one of the most frequently used goal-oriented modeling languages. It can, therefore, be considered as a promising emerging approach in this area. Several insights emerged from the study and opportunities for improving both languages are outlined.This work was supported by the Spanish Ministry of Science, Innovation and Universities (Adapt@Cloud project, grant number TIN2017-84550-R) and the Programa de Ayudas de Investigación y Desarrollo (PAID-01-17) from the Universitat Politècnica de València.Abrahao Gonzales, SM.; Insfran, E.; González-Ladrón-De-Guevara, F.; Fernández-Diego, M.; Cano-Genoves, C.; Pereira De Oliveira, R. (2019). Assessing the effectiveness of goal-oriented modeling languages: A family of experiments. Information and Software Technology. 116:1-24. https://doi.org/10.1016/j.infsof.2019.08.003S12411

AVENTIS - An architecture for event data analysis

Time-stamped event data is being generated at an exponential rate from various sources (sensor networks, e-markets etc.), which are stored in event logs and made available to researchers. Despite the data deluge and evolution of a plethora of tools and technologies, science behind exploratory analysis and knowledge discovery lags. There are several reasons behind this. In conducting event data analysis, researchers typically detect a pattern or trend in the data through computation of time-series measures and apply the computed measures to several mathematical models to glean information from data. This is a complex and time-consuming process covering a range of activities from data capture (from a broad array of data sources) to interpretation and dissemination of experimental results forming a pipeline of activities. Further, data-analysis is conducted by domain-users, who are typically non-IT experts but data processing tools and applications are largely developed by application developers. End-users not only lack the critical skills to build a structured analysis pipeline, but are also perplexed by the number of different ways available to derive the necessary information. Consequently, this thesis proposes AVENTIS (Architecture for eVENT Data analysIS), a novel framework to guide the design of analytic solutions to facilitate time-series analysis of event data and is tailored to the needs of domain users. The framework comprises three components; a knowledge base, a model-driven analytic methodology and an accompanying software architecture that provides the necessary technical and operational requirements. Specifically, the research contribution lies in the ability of the framework to enable expressing analysis requirements at a level of abstraction consistent with the domain users and readily make available the information sought without the users having to build the analysis process themselves. Secondly, the framework also facilitates an abstract design space for the domain experts to enable them to build conceptual models of their experiment as a sequence of structured tasks in a technology neutral manner and transparently translate these abstract process models to executable implementations. To evaluate the AVENTIS framework, a prototype based on AVENTIS is implemented and tested with case studies taken from the financial research domain

Relationship analysis : improving the systems analysis process

A significant aspect of systems analysis involves discovering and representing entities and their inter-relationships. Guidelines exist to identify entities but do not provide a rigorous and comprehensive process to explicitly capture the relationship structure of the problem domain. Whereas, other analysis techniques lightly address the relationship discovery process, Relationship Analysis is the only systematic, domain-independent analysis technique focusing exclusively on a domain\u27s relationship structure. The quality of design artifacts, such as class diagrams, and development time necessary to generate these artifacts can be improved by first representing the complete relationship structure of the problem domain. The Relationship Analysis Model is the first theory-based taxonomy to classify relationships. A rigorous evaluation was conducted, including a formal experiment comparing novice and experienced analysts with and without Relationship Analysis. It was shown that the Relationship Analysis Process based on the model does provide a fuller and richer systems analysis, resulting in improved quality of and reduced time in generating class diagrams. It also was shown that Relationship Analysis enables analysts of varying experience levels to achieve a similar level of quality of class diagrams. Relationship Analysis significantly enhances the systems analyst\u27s effectiveness, especially in the area of relationship discovery and documentation resulting in improved analysis and design artifacts

Software Engineering in the IoT Context: Characteristics, Challenges, and Enabling Strategies

L'abstract è presente nell'allegato / the abstract is in the attachmen

A case study of effective practices for the management of global software development projects

Global software development has proliferated in recent years because of rapid globalization, development of telecommunication and information technologies, and maturing of the software development processes. This thesis synthesizes available research on the global software development paradigm into an integrated model. The theoretical study analyzes different aspects of dispersion, their effect on traditional group processes of communication, coordination and control, and the recommendations in the literature for addressing some of these issues. The model developed in the theoretical study was then used to perform a detailed case study of a CMM Level 5 software company that specializes in global software development. A comparison of findings from the literature survey with these insights from a practitioner organization was used to draw inferences about how closely the theoretical model follows the real issues faced by industry, the practices and methodologies actually being used, and some areas of concern that available research does not address adequately. This case study revealed overlaps as well as differences between academic research and practice. Recommendations are made to managers of global software projects and areas of future research are identified

An OMG model-based approach for aligning information systems requirements and architectures with business

Tese de Doutoramento (Programa Doutoral em Tecnologias e Sistemas de Informação)The challenges involved in developing information systems (which are able to adapt to rapidly changing business and technological conditions) are directly related to the importance of their alignment with the business counterpart. These challenges comprise issues that cross management and information systems domains, relating and aligning them in order to attain superior performance for the organization, while identifying its strategy and tailoring its business processes. As this relation is increasingly intertwined its concepts are conducted to pragmatic methods, incorporating both management and information systems components, for how, when and where this alignment really matters. The related topics of the alignment between business and information systems comprise diverse paths of research, though with little common ground established inside the community, where problems arouse due to the fast moving business and technological environments. According to these circumstances, the process of developing information systems to support the alignment benefits from incorporating the use of structured and model-based approaches. So, as the development of evermore complex information systems presents a challenge for the currently available methods, the use of models to support the alignment with business stands as an increasingly important issue. Following those challenges, we set out to question how to develop solutions aligning information systems with business in a model-based approach. Accordingly, we support our research on the need to understand what are the perspectives involved in aligning information systems with business, and, moreover, to comprehend in what sense model adoption drives information systems development. So, the proposed goals for this thesis are: (1) set the basis for the elicitation of business requirements in order to support a well-grounded development of information systems; (2) provide for the generation of business models based on the business requirements, while assuring their alignment and traceability; and (3) arrange for the derivation of information system architectures from the business requirements, while attaining alignment and traceability for their mutual transformation and adaptation. Several issues surrounding these goals have already been described and approached in diverse ways by other researchers, where existing approaches and associated methods achieved good results. Nevertheless, these approaches are not without their shortfalls, sometimes failing to present a complete solution, others being unable to adapt to new challenges, or even incapable of reacting to recent trends. In order to tackle these issues we propose to build upon those approaches by adapting, evolving and innovating on solutions in each of the three proposed goals, respectively intertwining with perspectives from related standards and reference models. Answering the first goal, in what regards the main contributions of this thesis, we propose to broaden the elicitation of requirements by relating functional and nonfunctional requirements from business processes. So, we present a unified metamodel representation for those requirements, accompanied by a customizable method for their joint elicitation, based-on business-driven use-cases, goals and rules. This approach adopts the Rational Unified Process (RUP) development methodology and the Business Motivation Model (BMM) standard model language representation for business requirements. Moreover, the metamodel representation and method operationalization are accompanied by a prototype support tool that completes this first contribution. For the second goal, a more business-oriented one correlated to the higher-level requirements, we propose to generate business models directly from the inferred functional and nonfunctional requirements. So, we present a three-dimensional approach built on the relation of the referred requirements with the Balanced Scorecard (BSC) reference model, where an additional mapping to the Business Model Canvas (BMC) is also made available. This proposal provides an associated metamodel representation for the relation between the elements involved and a customizable method for their operationalization, all accompanied by a prototype support tool. On the third goal, focused on system architectures and connected to the lower-level requirements, we propose to derive service-oriented participants from the functional requirements, while aligning the nonfunctional requirements with the quality characteristics of the solution to-be. First, we present an evolution of an existing method for the derivation of a logical architecture, in order to adapt it to a service-oriented approach (SOA). Then, following on the existing relation between the nonfunctional and functional side of the low-level requirements, our approach is able to associate these last with its related services on the derived architecture, in another three-dimensional approach. Additionally, a mapping of the nonfunctional requirements with the system quality characteristics (CISQ) is made available. Once more, an associated metamodel, a customizable method and a prototype support tool are also provided. The development of these three approaches is supported through the execution of tasks which originate artifacts and lead to publications associated to their respective research and development efforts, all according to the Design Science Research (DSR) methodology. These are applied in ongoing projects involving experimental scenarios in industrial settings and associated to established research reference patterns, balancing the interests of both researchers and practitioners while focused both on technology and management audiences. The results obtained from their evaluation reflect the quality and depth of our findings, helping to validate the scientific contribution of this work.Os desafios implicados no desenvolvimento de sistemas de informação (que sejam capazes de se adaptar a condições tecnológicas e de negócios em rápida mutação) estão diretamente relacionados à importância do seu alinhamento com a contraparte do negócio. Esses desafios envolvem questões que cruzam os domínios da gestão e dos sistemas de informação, relacionando-os e alinhando-os com o intuito de alcançar um desempenho superior para a organização, ao mesmo tempo que identificam a sua estratégia e adequam os seus processos de negócio. Como esta relação está cada vez mais interligada, os seus conceitos são canalizados para métodos pragmáticos, incorporando ambos os componentes de sistemas de informação e de gestão, para saber como, quando e onde este alinhamento realmente interessa. Os tópicos relacionados com o alinhamento entre negócio e sistemas de informação abrangem diversos caminhos de pesquisa, embora com poucos alicerces em comum estabelecidos dentro da comunidade, onde os problemas surgem devido às rápidas mudanças nos negócios e nos ambientes tecnológicos. De acordo com estas circunstâncias, o processo de desenvolvimento de sistemas de informação para apoiar o alinhamento beneficia de incorporar o uso de abordagens estruturadas e baseadas em modelos. Assim, dado que o desenvolvimento de sistemas de informação cada vez mais complexos apresenta um desafio para os métodos atualmente disponíveis, o uso de modelos para apoiar o alinhamento com o negócio destaca-se como uma questão cada vez mais importante. Em linha com esses desafios, estabelecemos a questão de como desenvolver soluções para alinhar sistemas de informações com o negócio numa abordagem baseada em modelos. Neste sentido, apoiamos a nossa pesquisa na necessidade de compreender quais são as perspetivas envolvidas no alinhamento dos sistemas de informação com o negócio, e, além disso, de compreender em que sentido a adoção de modelos capacita o desenvolvimento desses sistemas. Assim, os objetivos propostos para esta tese são: (1) definir as bases para o levantamento de requisitos de negócio a fim de suportar um desenvolvimento bem fundamentado de sistemas de informação; (2) disponibilizar a geração de modelos de negócio baseados nos requisitos de negócio, garantindo o alinhamento e a rastreabilidade entre ambos; e (3) estruturar a derivação de arquiteturas de sistema de informação a partir dos requisitos de negócio, preservando o alinhamento e rastreabilidade para a sua mútua transformação e adaptação. Várias questões envolvendo estes objetivos foram já descritas e tratadas de diversas maneiras por outros investigadores, tendo as abordagens existentes e os métodos associados alcançado bons resultados. No entanto, essas abordagens têm as suas lacunas, umas vezes falham em apresentar uma solução completa, noutras são ineficientes ao se adaptarem a novos desafios, ou mesmo incapazes de reagir às novas tendências. Para lidar com estas questões, propomo-nos apoiar nessas abordagens, adaptando, evoluindo e inovando em soluções para cada um dos três objetivos propostos, intersetando-as, respetivamente, com perspetivas de modelos de referência e padrões relacionados. Relativamente ao primeiro objetivo, no que concerne aos principais contributos desta tese, propomos alargar o levantamento de requisitos, relacionando os requisitos funcionais e nãofuncionais dos processos de negócios. Assim, apresentamos um meta-modelo para a representação unificada desses requisitos, acompanhado por um método personalizável para o seu levantamento conjunto, baseada em casos-de-uso, metas e regras orientadas a negócio. Esta abordagem adota a metodologia de desenvolvimento do Rational Unified Process (RUP) e a representação padrão do modelo de linguagem do Business Motivation Model (BMM), para os requisitos de negócio. Além disso, a representação meta-modelo e a operacionalização do método são acompanhados por um protótipo de uma ferramenta de suporte que completa esta primeira contribuição. Quanto ao segundo objetivo, mais orientado ao negócio e correlacionado com os requisitos de nível superior, propomos gerar modelos de negócio a partir dos requisitos funcionais e não-funcionais inferidos. Assim, apresentamos uma abordagem tridimensional, construída sobre a relação dos referidos requisitos com o modelo de referência do Balanced Scorecard (BSC), em que um mapeamento adicional para o Business Model Canvas (BMC) é também disponibilizado. Esta proposta inclui um meta-modelo para representação da relação entre os elementos envolvidos e um método personalizável para a sua operacionalização, tudo acompanhado por um protótipo de uma ferramenta de suporte. No terceiro objetivo, focado em arquiteturas de sistema e ligado aos requisitos de nível inferior, propomos derivar participantes orientados-a-serviços desde os requisitos funcionais, alinhando os requisitos não-funcionais com as características de qualidade da solução a obter. Primeiro, apresentamos uma evolução de um método existente para a derivação de uma arquitetura lógica, adaptando-o a uma abordagem-orientada-a-serviços (SOA). Assim, prosseguindo a relação existente entre o lado não-funcional e funcional dos requisitos de baixo nível, a nossa abordagem associa estes últimos com os serviços relacionados na arquitetura derivada, numa outra abordagem tridimensional. Além disso, um mapeamento dos requisitos não-funcionais com as características de qualidade do sistema (CISQ) é disponibilizado. Mais uma vez, um meta-modelo associado, um método personalizável e um protótipo da ferramenta de suporte são disponibilizados. O desenvolvimento destas três abordagens é suportado pela execução de tarefas, as quais dão origem a artefatos e levam a publicações associadas aos seus esforços de pesquisa e desenvolvimento respetivamente, tudo de acordo com a metodologia DSR. Estas são aplicadas a projetos em andamento, os quais envolvem cenários experimentais em ambientes industriais e associados a padrões de investigação de referência, equilibrando os interesses de investigadores e profissionais assim como dos diferentes públicos de tecnologia e gestão. Os resultados obtidos na sua avaliação refletem a qualidade e a profundidade dos nossos resultados, ajudando a validar a contribuição científica deste trabalho

The Medium of Visualization for Software Comprehension

Although abundant studies have shown how visualization can help software developers to understand software systems, visualization is still not a common practice since developers (i) have little support to find a proper visualization for their needs, and once they find a suitable visualization tool, they (ii) are unsure of its effectiveness. We aim to offer support for identifying proper visualizations, and to increase the effectiveness of visualization techniques. In this dissertation, we characterize proposed software visualizations. To fill the gap between proposed visualizations and their practical application, we encapsulate such characteristics in an ontology, and propose a meta-visualization approach to find suitable visualizations. Amongst others characteristics of software visualizations, we identify that the medium used to display them can be a means to increase the effectiveness of visualization techniques for particular comprehension tasks.We implement visualization prototypes and validate our thesis via experiments. We found that even though developers using a physical 3D model medium required the least time to deal with tasks that involve identifying outliers, they perceived the least difficulty when visualizing systems based on the standard computer screen medium. Moreover, developers using immersive virtual reality obtained the highest recollection. We conclude that the effectiveness of software visualizations that use the city metaphor to support comprehension tasks can be increased when city visualizations are rendered in an appropriate medium. Furthermore, that visualization of software visualizations can be a suitable means for exploring their multiple characteristics that can be properly encapsulated in an ontology