Vol 2 No.3

Papers

1. Checking Design Constraints at Run-time Using OCL and AspectJ

   pp. 5-28

   Carmen Avila . Cuauhtemoc Munoz . Steve Roach . Yoonsik Cheon .

   ABSTRACT  Design decisions and constraints of a software system can be specified precisely using a formal notation such as the Object Constraint Language (OCL). However, they are not executable, and assuring the conformance of an implementation to its design is hard. The inability of expressing design constraints in an implementation and checking them at runtime invites, among others, the problem of design drift and corrosion. We propose runtime checks as a solution to mitigate this problem. The key idea of our approach is to translate design constraints written in a formal notation such as OCL into aspects that, when applied to a particular implementation, check the constraints at run-time. Our approach enables runtime verification of design-implementation conformance and detects design corrosion. The approach is modular and plug-and-playable; the constraint checking logic is completely separated from the implementation modules which are oblivious of the former. We believe that a significant portion of constraints translation can be automated.

2. Using QVT for Byte Code–Level Cross Compilation

   pp. 29-51

   Arno Puder . Pavle Guduric . Rainer Todtenhöfer .

   ABSTRACT Model driven approaches raise the level of abstraction during software development, where the focus of the development process is no longer on programming, but instead on the creation of different models. The OMG is addressing this new methodology with their Model Driven Architecture (MDA). The Query/ Views/Transformation (QVT) specification is part of the OMG’s MDA framework for combining declarative and imperative transformation languages between models. QVT-R uses a declarative (relational) approach to describe mappings between models, whereas QVT-O uses an imperative (operational) approach. Tools in this domain are still in their infancy and there exist no empirical study to compare QVT-O and QVT-R for complex application domains. In this paper we present a use case to show how both QVT-R and QVT-O can be used to map byte code instructions for Microsoft’s .NET virtual machine to Sun Microsystem’s Java Virtual Machine. We provide an extensive comparison between QVT-O and QVT-R and offer some best practices for using either transformation language.

3. Asset Identification for Security Risk Assessment in Web Applications

   pp. 53-74

   Brunil D. Romero . Hisham M. Haddad .

   ABSTRACT As software applications become more complex they require more security, allowing them to reach an appropriate level of quality to manage information, and therefore achieving business objectives. Web applications represent one segment of software industry where security risk assessment is essential. Web engineering must address new challenges to provide new techniques and tools that guarantee high quality application development. This work focuses asset identification, the initial step in security risk assessment for web applications. Risk assessment helps organizations determine security risks in information management systems. The formal approach to identifying information assets for risk assessment is investigated using the MAGERIT methodology and EBIOS method. This work is carried out at Simón Bolivar University (Venezuela) for its Student Opinion Survey Coordination web-based application. Under this research, a methodological tool for asset identification was developed to help the University achieve security risk assessment. Assets are identified according to their priorities in the organizational environment. This work contributes to Web Engineering in general, and to Information Security Management with emphasis on security risk assessment.

4. Generalized Mignotte Sequences and Software Watermarking

   pp.75-84

   Hedley Morris . Mohammed Eyadat .

   ABSTRACT Dynamic Graph Watermarking (DGW) is vulnerable to attack. We propose the use of a multiple secret sharing scheme to improve the robustness of DGW. We propose using Mignotte Sequences as the way to create the watermark shares needed by the method. The new scheme is suitable for inclusion in the SandMark test program. All necessary algorithms are identified.

5. Component-based Software Design and Implementation for Network Security System

   pp. 85-112

   Jianchao Han . Joel Ortiz . Johnly Tomelden . Kazimierz Kowalski . Mohsen Beheshti .

   ABSTRACT A computer network intrusion detection and prevention system consists of collecting network traffic data, discovering user behavior patterns as intrusion detection rules, and applying these rules to prevent malicious and misuse. Many commercial off-the-shelf (COTS) products have been developed to perform each of these tasks. In this paper, the component-based software engineering approach is exploited to integrate these COTS products as components into a computerized system to automatically detect intrusion rules from network traffic data and setup IPTables to prevent future potential attacks. The component- based software architecture of this kind of system is designed, COTS components are analyzed and selected, adaptor components to connect COTS products are developed, the system implementation is illustrated, and the preliminary system experiment is presented.

6. UDB: An Agent-Oriented Source-Level Debugger

   pp. 113-134

   Clinton L. Jeffery . Ziad A. Al-Sharif .

   ABSTRACT Standard debuggers are usually limited in the amount of analysis that they perform in order to assist with debugging. This paper presents UDB, an agent-oriented source-level debugger for the Unicon programming language with a novel architecture and capabilities. UDB combines classical debugging techniques such as those found in GDB with a growing set of extension agents. UDB demonstrates the feasibility of a source-level debugger built on top of a very high level event-based monitoring framework. The debugger is easily extended with new debugging agents that can employ a wide range of automatic debugging and dynamic analysis techniques.

7. Using Robustness Diagrams to Help With Software Understanding: an Eclipse Plug-in

   pp. 135-150

   David Kony . Javier Belmonte . Philippe Dugerdil .

   ABSTRACT In the reverse engineering of a software program, one of the key difficulties is actually to understand the software. While the published techniques work top down or bottom up, our approach works middle-out: before trying to understand the low level code, we first rebuild a hypothetical analysis model from the use cases of the system. This model then represents the target of the understanding task. In fact we try to map the code elements to the analysis objects. For this approach to be useable in large industrial software systems, it must be supported by a powerful tool. This paper presents the Eclipse plug-in we developed to support our methodology, as well as a reverse engineering scenario using this tool. We then discuss the technology we used and the result we obtained.