1645447
A framework for an active interface to characterise compositional security contracts of software components
This paper presents a framework for constructing compositional security contracts (CsC) based on the security property exposed by the atomic component. The framework uses interface structure of components in order to determine the CsC of software components. An active interface provides the component a basis for reasoning and assessing a component's suitability to meet certain security requirements of a particular application. Based on the security information available from the component interface, an active interface can reason whether the candidate component meets the security requirements for an envisaged systemwide application. Any security mismatches or discrepancies between components can be identified by the participating components before an actual composition takes place. Exposing the security properties of software components can be the basis for a trust relationship among components, and the exposed security could affect the underlying security of the enclosing system.
1659291
A Software Engineering Perspective for Services Security
Services are usually developed and deployed independently; and systems can be formed by composing relevant services to achieve set goals. In such an open and dynamic environment, security is of paramount importance. We have seen much work in the traditional area of information and network security, focusing on developing various security techniques. More recently, there have been efforts in integrating the security techniques into languages and infrastructural support that are used for developing services and systems. In fact, the development of services and the composition of service-based systems are software engineering activities. As such, they need to be viewed from a software engineering perspective. In this paper, we introduce an approach to services security engineering, to answer the questions like what the security properties of services and service-based systems are and how they meet the user’s security requirements. It deals with the issues of (1) security property characterisation for services, (2) compositional security analysis for service-based systems, and (3) certification of services.
1745958
Industrial Perspective on the Usefulness of Design Rationale for Software Maintenance: A Survey
Software maintenance is widely known as a problematic area that may consume up to 80% of a software project's resources. It has been claimed that providing an effective mechanism to access design rationale (DR) has great potential to improve software maintenance processes. However, we postulate that the first step towards exploring the potential of DR for improving software maintenance should be to gain a better understanding of what DR means to practitioners, how valuable they consider DR to be and how they use DR. To determine the perceived usefulness of DR, we surveyed a large number of software designers. This exploratory study has discovered that practitioners recognize the importance of DR to understand existing designs and frequently use it to reason about proposed modifications. The results of this study establish that DR is perceived by practitioners to be useful and the efforts required to capture DR for the purpose of maintenance are worthwhile. The findings allow us to identify areas of further research on DR support that have the potential to improve the maintenance process
629310
Semantic and Usage Packaging for Software Components
Current models for software components have made component-based software engineering practical. However, these models are limited in the sense that their support for the specification of software components primarily deals with syntactic issues. To facilitate interoperability and proper use of software components, more comprehensive specification of these components is required. In this paper, we present an approach to software component packaging aimed at comprehensive component specification, especially its support for semantic and usage specification.
17910560
Providing configuration management support in software engineering environments
Software configuration management (CM) is a key element of any software development project. A software engineering environment should not only provide support for software products and software processes in general, but also pay attention to high-level software engineering concepts like CM. In this paper, we present an overview of our approach to software engineering environments and demonstrate how CM can be achieved in such environments with minimal effort by codifying a CM model. Issues addressed include the structures and consistency of CM components and their relationships, the definition and activation of CM operations, and the definition of presentation views that facilitate CM activities.
3251598
TRAM: a tool for requirements and architecture management
Management of system requirements and system architectures is part of any software engineering project. But it is usually very tedious and error prone. In particular, managing the traceability between system requirements and system architectures is critical but difficult. The article introduces a tool, TRAM, for managing system requirements, system architectures and more importantly the traceability between them. Its primary design objective is "being practical" and ready for practitioners to use without much overhead. The issues discussed in the paper include an information model that underlies the capture of requirements, architectures and their traceability, a set of document templates implementing the information model, and the support tool.
3443494
Mining Compressed Frequent-Pattern Sets
A major challenge in frequent-pattern mining is the sheer size of its mining results. In many cases, a high min_sup threshold may discover only commonsense patterns but a low one may generate an explosive number of output patterns, which severely restricts its usage.In this paper, we study the problem of compressing frequent-pattern sets. Typically, frequent patterns can be clustered with a tightness measure δ (called δ-cluster), and a representative pattern can be selected for each cluster. Unfortunately, finding a minimum set of representative patterns is NP-Hard. We develop two greedy methods, RPglobal and RPlocal. The former has the guaranteed compression bound but higher computational complexity. The latter sacrifices the theoretical bounds but is far more efficient. Our performance study shows that the compression quality using RPlocal is very close to RPglobal, and both can reduce the number of closed frequent patterns by almost two orders of magnitude. Furthermore, RPlocal mines even faster than FPClose[11], a very fast closed frequent-pattern mining method. We also show that RPglobal and RPlocal can be combined together to balance the quality and efficiency.
2286606
Scene-Level Analysis for Tennis Sports Video using Weighted Linear Combination of Visual Cues
We present a scene-level analysis system that takes TV broadcasted tennis footage as input and produces a behavior analysis of the moving-players in the scene. To achieve this functionality, our algorithm relies on two modular blocks. The first one detects and tracks a number of key objects in the image domain, like moving-players and the playing-field. Afterwards, a camera-calibration algorithm is applied that uses the lines of the court as a reference and transforms image coordinates to physical positions to compute the camera parameters. The second block firstly models several important events of a tennis game, such as service and net-approach, based on four real-world visual features provided by the first block. This paper proposes a new improved model, since it weights the importance of each visual cue to different events, rather than providing a simple combination of these four visual cues as was done in previous work. Based on the new model, we can accurately determine what kind of event the current input frame belongs to. Furthermore, we detect the start time and end time of each event using a simple but efficient temporal filter. Our proposed system is capable of classifying each tennis play into three semantic categories, which are popular and familiar to most viewers. This paper presents details of the system, together with results on a number of tennis video sequences.
6112726
Pseudo Trust: Zero-Knowledge Based Authentication in Anonymous Peer-to-Peer Protocols
Most of the current trust models in peer-to-peer (P2P) systems are identity based, which means that in order for one peer to trust another, it needs to know the other peer's identity. Hence, there exists an inherent tradeoff between trust and anonymity. To the best of our knowledge, there is currently no P2P protocol that provides complete mutual anonymity as well as authentication and trust management. We propose a zero-knowledge authentication scheme called pseudo trust (PT), where each peer, instead of using its real identity, generates an unforgeable and verifiable pseudonym using a one-way hash function. A novel authentication scheme based on zero-knowledge proof is designed so peers can be authenticated without leaking any sensitive information. With the help of PT, most existing identity-based trust management schemes become applicable in mutual anonymous P2P systems. We analyze the levels of security and anonymity in PT, and evaluate its performance using trace-driven simulations and a prototype implementation. The strengths of pseudo trust include the lack of need for a centralized trusted party or CA, high scalability and security, low traffic and cryptography processing overheads, and man-in-middle attack resistance. We aim for the pseudo trust design to be included in the P2P trust and anonymity context.
1695422
New Public-Key Cryptosystem Using Braid Groups
The braid groups are infinite non-commutative groups naturally arising from geometric braids. The aim of this article is twofold. One is to show that the braid groups can serve as a good source to enrich cryptography. The feature that makes the braid groups useful to cryptography includes the followings: (i) The word problem is solved via a fast algorithm which computes the canonical form which can be efficiently manipulated by computers. (ii) The group operations can be performed efficiently. (iii) The braid groups have many mathematically hard problems that can be utilized to design cryptographic primitives. The other is to propose and implement a new key agreement scheme and public key cryptosystem based on these primitives in the braid groups. The efficiency of our systems is demonstrated by their speed and information rate. The security of our systems is based on topological, combinatorial and group-theoretical problems that are intractible according to our current mathematical knowledge. The foundation of our systems is quite different from widely used cryptosystems based on number theory, but there are some similarities in design.
43402198
Mining Closed Relational Graphs with Connectivity Constraints
Relational graphs are widely used in modeling large scale networks such as biological networks and social networks. In a relational graph, each node represents a distinct entity while each edge represents a relationship between entities. Various algorithms were developed to discover interesting patterns from a single relational graph (Z. Wu et al., 1993). However, little attention has been paid to the patterns that are hidden in multiple relational graphs. One interesting pattern in relational graphs is frequent highly connected subgraph which can identify recurrent groups and clusters. In social networks, this kind of pattern corresponds to communities where people are strongly associated. For example, if several researchers co-author some papers, attend the same conferences, and refer their works from each other, it strongly indicates that they are studying the same research theme.