8361551
Composing Security-Aware Software
This article addresses a key issue in security: how to inspire trust by disclosing security properties of software components to others in a component-based software development environment. The authors introduce a component security characterization framework in this endeavor that characterizes security properties by exposing software security profiles to others. The active interface lets software engineers know up front the impact of security properties of a composition's candidate components.
17910560
Providing configuration management support in software engineering environments
Software configuration management (CM) is a key element of any software development project. A software engineering environment should not only provide support for software products and software processes in general, but also pay attention to high-level software engineering concepts like CM. In this paper, we present an overview of our approach to software engineering environments and demonstrate how CM can be achieved in such environments with minimal effort by codifying a CM model. Issues addressed include the structures and consistency of CM components and their relationships, the definition and activation of CM operations, and the definition of presentation views that facilitate CM activities.
1745958
Industrial Perspective on the Usefulness of Design Rationale for Software Maintenance: A Survey
Software maintenance is widely known as a problematic area that may consume up to 80% of a software project's resources. It has been claimed that providing an effective mechanism to access design rationale (DR) has great potential to improve software maintenance processes. However, we postulate that the first step towards exploring the potential of DR for improving software maintenance should be to gain a better understanding of what DR means to practitioners, how valuable they consider DR to be and how they use DR. To determine the perceived usefulness of DR, we surveyed a large number of software designers. This exploratory study has discovered that practitioners recognize the importance of DR to understand existing designs and frequently use it to reason about proposed modifications. The results of this study establish that DR is perceived by practitioners to be useful and the efforts required to capture DR for the purpose of maintenance are worthwhile. The findings allow us to identify areas of further research on DR support that have the potential to improve the maintenance process
1659291
A Software Engineering Perspective for Services Security
Services are usually developed and deployed independently; and systems can be formed by composing relevant services to achieve set goals. In such an open and dynamic environment, security is of paramount importance. We have seen much work in the traditional area of information and network security, focusing on developing various security techniques. More recently, there have been efforts in integrating the security techniques into languages and infrastructural support that are used for developing services and systems. In fact, the development of services and the composition of service-based systems are software engineering activities. As such, they need to be viewed from a software engineering perspective. In this paper, we introduce an approach to services security engineering, to answer the questions like what the security properties of services and service-based systems are and how they meet the user’s security requirements. It deals with the issues of (1) security property characterisation for services, (2) compositional security analysis for service-based systems, and (3) certification of services.
629310
Semantic and Usage Packaging for Software Components
Current models for software components have made component-based software engineering practical. However, these models are limited in the sense that their support for the specification of software components primarily deals with syntactic issues. To facilitate interoperability and proper use of software components, more comprehensive specification of these components is required. In this paper, we present an approach to software component packaging aimed at comprehensive component specification, especially its support for semantic and usage specification.
3251598
TRAM: a tool for requirements and architecture management
Management of system requirements and system architectures is part of any software engineering project. But it is usually very tedious and error prone. In particular, managing the traceability between system requirements and system architectures is critical but difficult. The article introduces a tool, TRAM, for managing system requirements, system architectures and more importantly the traceability between them. Its primary design objective is "being practical" and ready for practitioners to use without much overhead. The issues discussed in the paper include an information model that underlies the capture of requirements, architectures and their traceability, a set of document templates implementing the information model, and the support tool.
2286606
Scene-Level Analysis for Tennis Sports Video using Weighted Linear Combination of Visual Cues
We present a scene-level analysis system that takes TV broadcasted tennis footage as input and produces a behavior analysis of the moving-players in the scene. To achieve this functionality, our algorithm relies on two modular blocks. The first one detects and tracks a number of key objects in the image domain, like moving-players and the playing-field. Afterwards, a camera-calibration algorithm is applied that uses the lines of the court as a reference and transforms image coordinates to physical positions to compute the camera parameters. The second block firstly models several important events of a tennis game, such as service and net-approach, based on four real-world visual features provided by the first block. This paper proposes a new improved model, since it weights the importance of each visual cue to different events, rather than providing a simple combination of these four visual cues as was done in previous work. Based on the new model, we can accurately determine what kind of event the current input frame belongs to. Furthermore, we detect the start time and end time of each event using a simple but efficient temporal filter. Our proposed system is capable of classifying each tennis play into three semantic categories, which are popular and familiar to most viewers. This paper presents details of the system, together with results on a number of tennis video sequences.
1695422
New Public-Key Cryptosystem Using Braid Groups
The braid groups are infinite non-commutative groups naturally arising from geometric braids. The aim of this article is twofold. One is to show that the braid groups can serve as a good source to enrich cryptography. The feature that makes the braid groups useful to cryptography includes the followings: (i) The word problem is solved via a fast algorithm which computes the canonical form which can be efficiently manipulated by computers. (ii) The group operations can be performed efficiently. (iii) The braid groups have many mathematically hard problems that can be utilized to design cryptographic primitives. The other is to propose and implement a new key agreement scheme and public key cryptosystem based on these primitives in the braid groups. The efficiency of our systems is demonstrated by their speed and information rate. The security of our systems is based on topological, combinatorial and group-theoretical problems that are intractible according to our current mathematical knowledge. The foundation of our systems is quite different from widely used cryptosystems based on number theory, but there are some similarities in design.
21192
Mining Frequent Patterns without Candidate Generation: A Frequent-Pattern Tree Approach
Mining frequent patterns in transaction databases, time-series databases, and many other kinds of databases has been studied popularly in data mining research. Most of the previous studies adopt an Apriori-like candidate set generation-and-test approach. However, candidate set generation is still costly, especially when there exist a large number of patterns and/or long patterns.In this study, we propose a novel frequent-pattern tree (FP-tree) structure, which is an extended prefix-tree structure for storing compressed, crucial information about frequent patterns, and develop an efficient FP-tree-based mining method, FP-growth, for mining the complete set of frequent patterns by pattern fragment growth. Efficiency of mining is achieved with three techniques: (1) a large database is compressed into a condensed, smaller data structure, FP-tree which avoids costly, repeated database scans, (2) our FP-tree-based mining adopts a pattern-fragment growth method to avoid the costly generation of a large number of candidate sets, and (3) a partitioning-based, divide-and-conquer method is used to decompose the mining task into a set of smaller tasks for mining confined patterns in conditional databases, which dramatically reduces the search space. Our performance study shows that the FP-growth method is efficient and scalable for mining both long and short frequent patterns, and is about an order of magnitude faster than the Apriori algorithm and also faster than some recently reported new frequent-pattern mining methods.
6112726
Pseudo Trust: Zero-Knowledge Based Authentication in Anonymous Peer-to-Peer Protocols
Most of the current trust models in peer-to-peer (P2P) systems are identity based, which means that in order for one peer to trust another, it needs to know the other peer's identity. Hence, there exists an inherent tradeoff between trust and anonymity. To the best of our knowledge, there is currently no P2P protocol that provides complete mutual anonymity as well as authentication and trust management. We propose a zero-knowledge authentication scheme called pseudo trust (PT), where each peer, instead of using its real identity, generates an unforgeable and verifiable pseudonym using a one-way hash function. A novel authentication scheme based on zero-knowledge proof is designed so peers can be authenticated without leaking any sensitive information. With the help of PT, most existing identity-based trust management schemes become applicable in mutual anonymous P2P systems. We analyze the levels of security and anonymity in PT, and evaluate its performance using trace-driven simulations and a prototype implementation. The strengths of pseudo trust include the lack of need for a centralized trusted party or CA, high scalability and security, low traffic and cryptography processing overheads, and man-in-middle attack resistance. We aim for the pseudo trust design to be included in the P2P trust and anonymity context.
14694684
A mutual anonymous peer-to-peer protocol design
Peer-to-peer (P2P) computing has become a popular application model because of its easy resource sharing pattern and powerful query search scheme. However, decentralized P2P architecture is scarcely seen to deploy the anonymity on its peers. In this paper, we propose a mutual anonymity protocol, called Secret-sharing-based Mutual Anonymity Protocol (SSMP), for decentralized P2P systems. SSMP employs Shamirs' secret sharing scheme to allow peers to issue queries and responders to deliver requested files anonymously. Compared with previous designs, SSMP achieves mutual anonymity in P2P systems with a high degree of anonymity and a low cryptography processing overhead. We evaluate SSMP by comprehensive simulations.