Data- and Value-Driven Software Engineering with Deep Customer Insight : Proceedings of the Seminar No. 58314308

There is a need in many software-based companies to evolve their software development practices towards continuous integration and continuous deployment. This allows a company to frequently and rapidly integrate and deploy their work and in consequence also opens opportunities for getting feedback from customers on a regular basis. Ideally, this feedback is used to support design decisions early in the development process, e.g., to determine which features should be maintained over time and which features should be skipped. In more general terms, the entire R&D system of an organization should be in a state where it is able to respond and act quickly based in instant customer feedback and where actual deployment of software functionality is seen as a way of fast experimenting and testing what the customer needs. Experimentation refers here to fast validation of a business model or more specifically validating a value hypothesis. Reaching such a state of continuous experimentation implies a lot of challenges for organizations. Selected challenges are how to develop the "right" software while developing software "right", how to have an appropriate tool infrastructure in place, how to measure and evaluate customer value, what are appropriate feedback systems, how to improve the velocity of software development, how to increase the business hit rate with new products and features, how to integrate such experiments into the development process, how to link knowledge about value for users or customers to higher-level goals of an organization. These challenges are quite new for many software-based organizations and not sufficiently understood from a software engineering perspective. These proceedings contain selected seminar papers of the student seminar Data- and Value-Driven Software Engineering with Deep Customer Insight that was held at the Department of Computer Science of the University of Helsinki. The seminar was held during the fall semester of 2014 from September 1st to December 8th. Papers in the seminar cover a wide range of topics related to the creation of value in software engineering. An interview of startups shows that emerging companies face a number of key decision points that shape their future. Value has a different meaning in different contexts. Embedded devices can be used to gather data and provide more value to the users through analysis and adaptation to circumstances. In entertainment, metrics can provide content creators the chance to react to user behavior and provide a more meaningful user experience. Value creation needs an active approach to software development from the companies: software engineering processes need to be incorporated with proper mechanisms to find the correct stakeholders, elicit requirements that provide the highest value and successfully implement the necessary changes with short development cycles. When the right building blocks are in place, companies are able to quickly deliver new software and leverage data from their products and services to continuously improve the perceived value of software

Defining Security Requirements with the Common Criteria: Applications, Adoptions, and Challenges

Advances of emerging Information and Communications Technology (ICT) technologies push the boundaries of what is possible and open up new markets for innovative ICT products and services. The adoption of ICT products and systems with security properties depends on consumers' confidence and markets' trust in the security functionalities and whether the assurance measures applied to these products meet the inherent security requirements. Such confidence and trust are primarily gained through the rigorous development of security requirements, validation criteria, evaluation, and certification. Common Criteria for Information Technology Security Evaluation (often referred to as Common Criteria or CC) is an international standard (ISO/IEC 15408) for cyber security certification. In this paper, we conduct a systematic review of the CC standards and its adoptions. Adoption barriers of the CC are also investigated based on the analysis of current trends in security evaluation. Specifically, we share the experiences and lessons gained through the recent Development of Australian Cyber Criteria Assessment (DACCA) project that promotes the CC among stakeholders in ICT security products related to specification, development, evaluation, certification and approval, procurement, and deployment. Best practices on developing Protection Profiles, recommendations, and future directions for trusted cybersecurity advancement are presented

Outdoor operations of multiple quadrotors in windy environment

Coordinated multiple small unmanned aerial vehicles (sUAVs) offer several advantages over a single sUAV platform. These advantages include improved task efficiency, reduced task completion time, improved fault tolerance, and higher task flexibility. However, their deployment in an outdoor environment is challenging due to the presence of wind gusts. The coordinated motion of a multi-sUAV system in the presence of wind disturbances is a challenging problem when considering collision avoidance (safety), scalability, and communication connectivity. Performing wind-agnostic motion planning for sUAVs may produce a sizeable cross-track error if the wind on the planned route leads to actuator saturation. In a multi-sUAV system, each sUAV has to locally counter the wind disturbance while maintaining the safety of the system. Such continuous manipulation of the control effort for multiple sUAVs under uncertain environmental conditions is computationally taxing and can lead to reduced efficiency and safety concerns. Additionally, modern day sUAV systems are susceptible to cyberattacks due to their use of commercial wireless communication infrastructure. This dissertation aims to address these multi-faceted challenges related to the operation of outdoor rotor-based multi-sUAV systems. A comprehensive review of four representative techniques to measure and estimate wind speed and direction using rotor-based sUAVs is discussed. After developing a clear understanding of the role wind gusts play in quadrotor motion, two decentralized motion planners for a multi-quadrotor system are implemented and experimentally evaluated in the presence of wind disturbances. The first planner is rooted in the reinforcement learning (RL) technique of state-action-reward-state-action (SARSA) to provide generalized path plans in the presence of wind disturbances. While this planner provides feasible trajectories for the quadrotors, it does not provide guarantees of collision avoidance. The second planner implements a receding horizon (RH) mixed-integer nonlinear programming (MINLP) model that is integrated with control barrier functions (CBFs) to guarantee collision-free transit of the multiple quadrotors in the presence of wind disturbances. Finally, a novel communication protocol using Ethereum blockchain-based smart contracts is presented to address the challenge of secure wireless communication. The U.S. sUAV market is expected to be worth $92 Billion by 2030. The Association for Unmanned Vehicle Systems International (AUVSI) noted in its seminal economic report that UAVs would be responsible for creating 100,000 jobs by 2025 in the U.S. The rapid proliferation of drone technology in various applications has led to an increasing need for professionals skilled in sUAV piloting, designing, fabricating, repairing, and programming. Engineering educators have recognized this demand for certified sUAV professionals. This dissertation aims to address this growing sUAV-market need by evaluating two active learning-based instructional approaches designed for undergraduate sUAV education. The two approaches leverages the interactive-constructive-active-passive (ICAP) framework of engagement and explores the use of Competition based Learning (CBL) and Project based Learning (PBL). The CBL approach is implemented through a drone building and piloting competition that featured 97 students from undergraduate and graduate programs at NJIT. The competition focused on 1) drone assembly, testing, and validation using commercial off-the-shelf (COTS) parts, 2) simulation of drone flight missions, and 3) manual and semi-autonomous drone piloting were implemented. The effective student learning experience from this competition served as the basis of a new undergraduate course on drone science fundamentals at NJIT. This undergraduate course focused on the three foundational pillars of drone careers: 1) drone programming using Python, 2) designing and fabricating drones using Computer-Aided Design (CAD) and rapid prototyping, and 3) the US Federal Aviation Administration (FAA) Part 107 Commercial small Unmanned Aerial Vehicles (sUAVs) pilot test. Multiple assessment methods are applied to examine the students’ gains in sUAV skills and knowledge and student attitudes towards an active learning-based approach for sUAV education. The use of active learning techniques to address these challenges lead to meaningful student engagement and positive gains in the learning outcomes as indicated by quantitative and qualitative assessments

Innovation and new venture creation

[SPA] Crear lo "nuevo" para resolver problemas es una hazaña incierta. Aun así, el ser humano ha innovado y aplicado el ingenio durante milenios, llegando a crear nuevas herramientas, puentes y empresas, a pesar de la falta de recursos o de claridad en los objetivos. En este sentido, el problema de la asimetría de información (cómo se desplegará el futuro) y de la asimetría de recursos (de qué medios se dispondrá) motivó esta tesis. En particular, el problema de cómo los emprendedores crean nuevos emprendimientos e innovan bajo la incertidumbre y sin objetivos iniciales claros. Esta tesis pretende contribuir a la comprensión de la innovación y la creación de nuevos emprendimientos utilizando una lógica no predictiva (effectuation) y métodos ágiles (utilizados por las aceleradoras de startups) como principios orientadores de esta discusión. Effectuation es una lógica común aplicada por los emprendedores expertos para resolver los problemas típicos de la innovación y creación de nuevas empresas. Se trata de una heurística de control no predictiva que los emprendedores ponen en práctica a través de cinco principios de acción effectual al abordar las incertidumbres y sorpresas en la creación de nuevos productos, servicios o mercados: 1) Principio de "pájaro en mano": construyen un nuevo emprendimiento no necesariamente con un objetivo en mente, sino partiendo de sus propios medios y recursos (quiénes son, qué saben, a quienes conocen), 2) Principio de "pérdida asequible": no hacen grandes apuestas con la expectativa de obtener grandes beneficios, sino que evalúan las oportunidades en función de las desventajas aceptables, 3) Principio de "colcha loca": reducen la incertidumbre formando asociaciones y obteniendo compromisos iniciales en las primeras fases de sus nuevas empresas, 4) Principio de la “limonada”: aprovechan las contingencias en lugar de rechazarlas, permaneciendo flexibles y adaptando sus proyectos según sea necesario, 5) Principio del “piloto en el avión”: se centran en controlar lo que sea controlable en su entorno, entendiendo que el futuro no se encuentra ni se predice, sino que se hace a través de la acción humana. Las aceleradoras y los métodos ágiles activan los principios effectual a través de herramientas y prescripciones que reducen sistemáticamente las inversiones mientras se crea un nuevo emprendimiento. Las aceleradoras promueven ampliamente los métodos ágiles (por ejemplo, el modelo de desarrollo de clientes, los sprints de diseño, el ciclo de innovación rápida) para construir prototipos y primeras versiones de productos y servicios mientras se descubren los clientes y partners iniciales. Además, reduce el riesgo para los inversores en todas las fases de crecimiento de las startups al validar la idea del emprendimiento y aclarar qué recursos serán necesarios. En este sentido, esta tesis examinó si, y en qué medida, los emprendedores construyen nuevas empresas utilizando effectuation y métodos ágiles mediante la creación de tres innovaciones reales con aplicaciones en el mundo real. Los tres casos eran pruebas de concepto implementadas en contextos del mundo real con el objetivo explícito de lanzar Productos Mínimos Viables (Minimum Viable Products, MVP) pero bajo incertidumbre y con ambigüedad de objetivos sobre su funcionalidad. Las tres aplicaciones eran soluciones tecnológicas a problemas de congestión del tráfico, pandemias y confianza en las transacciones digitales. La aplicación 1, "Lemur", es una aplicación edge para el control del tráfico; la aplicación 2, "Dolphin", un sistema de geolocalización basado en sensores e Internet de las Cosas (Internet of Things, IoT) aplicado para el control de pandemias y la aplicación 3, "Crypto Degrees", una solución basada en blockchain para verificar títulos universitarios. En todas las etapas del desarrollo de cada aplicación, los equipos implicados la abordaron de forma emprendedora/eficaz, afrontando las incertidumbres y emprendiendo acciones para comprometerse con múltiples partes interesadas al tiempo que apalancaban las contingencias. Tras implementar las tres soluciones y analizar sus resultados e impacto, los tres casos validaron las predicciones teóricas de que, aplicando principios effectual de forma ágil, se pueden crear nuevos emprendimientos de forma emprendedora e innovadora. [ENG] Creating the "new" to solve problems is an uncertain feat. Still, humans have innovated and applied Ingenium for millennia, eventually creating new tools, bridges, and ventures, despite a lack of resources or clarity of objectives. In this sense, the problem of information asymmetry (how the future will deploy) and resource asymmetry (what means will be available) motivated this thesis. In particular, the problem of how entrepreneurs create new ventures and innovate under uncertainty and without clear initial goals. This thesis aims to contribute to understanding innovation and the creation of new ventures using a non-predictive logic (effectuation) and agile methods (used by startup accelerators) as guiding principles of this discussion. Effectuation is a common logic applied by expert entrepreneurs to solve the typical problems of starting new ventures and innovating. It is a non-predictive control heuristics entrepreneurs operationalize through five principles of effectual action while addressing the uncertainties and contingencies in creating new products, services or markets: 1) Bird-in-hand principle: they build a new venture not necessarily with a goal in mind, but starting with their own means and resources (who they are, what they know, who they know), 2) Affordable loss principle: they do not place large bets with the expectation of high returns, but rather assess opportunities based on acceptable downsides, 3) Crazy quilt principle: they reduce uncertainty by forming partnerships and gaining initial commitments early in their new ventures, 4) Lemonade principle: they leverage contingencies instead of rejecting them, remaining flexible and adapting their projects as required, 5) Pilot in the plane principle: they focus on controlling whatever is controllable in their environment, understanding that the future is not found or predicted, but it is made through human action. Accelerators and agile methods activate the effectual principles through tools and prescriptions that systematically reduce investments while creating a new venture. Accelerators extensively promote "agile" methods (e.g., customer development model, design sprints, rapid innovation cycle) to build prototypes and early versions Effectuation is a common logic applied by expert entrepreneurs to solve the typical problems of starting new ventures and innovating. It is a non-predictive control heuristics entrepreneurs operationalize through five principles of effectual action while addressing the uncertainties and contingencies in creating new products, services or markets: 1) Bird-in-hand principle: they build a new venture not necessarily with a goal in mind, but starting with their own means and resources (who they are, what they know, who they know), 2) Affordable loss principle: they do not place large bets with the expectation of high returns, but rather assess opportunities based on acceptable downsides, 3) Crazy quilt principle: they reduce uncertainty by forming partnerships and gaining initial commitments early in their new ventures, 4) Lemonade principle: they leverage contingencies instead of rejecting them, remaining flexible and adapting their projects as required, 5) Pilot in the plane principle: they focus on controlling whatever is controllable in their environment, understanding that the future is not found or predicted, but it is made through human action. Accelerators and agile methods activate the effectual principles through tools and prescriptions that systematically reduce investments while creating a new venture. Accelerators extensively promote "agile" methods (e.g., customer development model, design sprints, rapid innovation cycle) to build prototypes and early versions of products and services while discovering the initial customers and partners. Additionally, it reduces the risk for investors across all startup growth phases by validating the venture idea and clarifying what resources will be required. In this sense, this thesis examined whether and to what extent entrepreneurs build new ventures using effectuation and agile methods by creating three actual innovations with real-world applications. The three cases were proofs of concept implemented in real-world contexts with the explicit goal of launching Minimum Viable Products (MVPs) but under uncertainty and with ambiguity of objectives about its functionality. The three applications were technological solutions to problems of traffic congestion, pandemics, and trust in digital transactions. Application 1, "Lemur," is an edge application for traffic control; application 2, "Dolphin," an Internet of Things (IoT)-based geolocation system applied for pandemic control and application 3, "Crypto Degrees," a blockchainbased solution to verify university degrees. In all stages of each application development, the teams involved approached it in an entrepreneurial/effectual way, facing uncertainties and engaging in actions to engage with multiple stakeholders while leveraging contingencies. After implementing the three solutions and analyzing their results and impact, the three cases validated the theoretical predictions that by applying effectual principles in an agile form, new ventures can be created in an entrepreneurial, innovative way.Escuela Internacional de Doctorado de la Universidad Politécnica de CartagenaUniversidad Politécnica de CartagenaPrograma Doctorado en Tecnologías de la Información y las Comunicacione

A Survey on Industrial Control System Testbeds and Datasets for Security Research

The increasing digitization and interconnection of legacy Industrial Control Systems (ICSs) open new vulnerability surfaces, exposing such systems to malicious attackers. Furthermore, since ICSs are often employed in critical infrastructures (e.g., nuclear plants) and manufacturing companies (e.g., chemical industries), attacks can lead to devastating physical damages. In dealing with this security requirement, the research community focuses on developing new security mechanisms such as Intrusion Detection Systems (IDSs), facilitated by leveraging modern machine learning techniques. However, these algorithms require a testing platform and a considerable amount of data to be trained and tested accurately. To satisfy this prerequisite, Academia, Industry, and Government are increasingly proposing testbed (i.e., scaled-down versions of ICSs or simulations) to test the performances of the IDSs. Furthermore, to enable researchers to cross-validate security systems (e.g., security-by-design concepts or anomaly detectors), several datasets have been collected from testbeds and shared with the community. In this paper, we provide a deep and comprehensive overview of ICSs, presenting the architecture design, the employed devices, and the security protocols implemented. We then collect, compare, and describe testbeds and datasets in the literature, highlighting key challenges and design guidelines to keep in mind in the design phases. Furthermore, we enrich our work by reporting the best performing IDS algorithms tested on every dataset to create a baseline in state of the art for this field. Finally, driven by knowledge accumulated during this survey's development, we report advice and good practices on the development, the choice, and the utilization of testbeds, datasets, and IDSs

DevOps for Digital Leaders

DevOps; continuous delivery; software lifecycle; concurrent parallel testing; service management; ITIL; GRC; PaaS; containerization; API management; lean principles; technical debt; end-to-end automation; automatio