Model analysis for business event processing

Many signal processing systems make use of event driven mechanisms-typically based on finite state machines (FSMs)-to control the operation of the computationally intensive (data flow) parts. The state machines in turn are often fueled by external inputs as well as by feedback from the signal processing portions of the system. Packet-based transmission systems are a good example for such a close interaction between data and control flow. For a smooth design flow with a maximum degree of modularity it is of crucial importance to be able to model the complete functionality of the system, containing both control and data flow, within one single design environment. While the degree of abstraction should be sufficiently high to model and simulate efficiently, the link to implementation has to be fully supported. For these reasons we developed a computational model that integrates the specification of control and data flow. It combines the notion of multirate dynamic data flow graphs with event driven process activation. Thus, it maintains the flexibility and expressive power of data flow representations while enabling designers to efficiently control these operations by incorporating control automata that may have been designed using protocol compilers or state machine tools.

This paper describes a simple mathematical algorithm to determine the complexity of software that includes control flow and data flow. Two techniques are analyzed using examples to determine the overall complexity. One of them computes the determinant of a square matrix represented as an N2 chart. The other technique that is new and proposed in this paper computes the sum of products of control flow and data flow. It is shown that the determinant value fluctuates randomly whereas the new sum of product is a monotonic function that increases systematically with increasing complexity. This complexity number can be used to determine the amount of effort (cost and time) required for development and verification of software and whether or not the software can be deployed to perform safety-critical functions with high assurance.

Remote attestation is a crucial security service particularly relevant to increasingly popular IoT (and other embedded) devices. It allows a trusted party (verifier) to learn the state of a remote, and potentially malware-infected, device (prover). Most existing approaches are static in nature and only check whether benign software is initially loaded on the prover. However, they are vulnerable to runtime attacks that hijack the application's control or data flow, e.g., via return-oriented programming or data-oriented exploits. As a concrete step towards more comprehensive runtime remote attestation, we present the design and implementation of Control-FLow ATtestation (C-FLAT) that enables remote attestation of an application's control-flow path, without requiring the source code. We describe a full prototype implementation of C-FLAT on Raspberry Pi using its ARM TrustZone hardware security extensions. We evaluate C-FLAT's performance using a real-world embedded (cyber-physical) application, and demonstrate its efficacy against control-flow hijacking attacks.

Verification of behavioral soundness for artifact-centric business process model with synchronizations

Smart contracts on blockchain platforms are susceptible to security issues that can lead to significant financial losses. This study converts the Solidity code into abstract syntax trees and generates control flow graphs and data flow graphs. These graphs train a graph convolutional network model to detect security weaknesses. The proposed system outperforms traditional tools, achieving higher accuracy, recall, precision, and F1 scores when detecting weaknesses such as integer overflow/underflow, reentrancy, delegate call to the untrusted callee, and time-based issues. This study demonstrates that leveraging control and data flow analysis with graph neural networks significantly enhances smart contract security and provides a robust and reliable solution.

Timing analysis is an important prerequisite for the design of embedded real-time systems. In order to get tight and safe bounds for the timing of a program, precise information about its control flow and data flow is needed. While actual timings can only be derived from the machine code, many of the supporting analyses (deriving timing-relevant data such as points-to and loop bound information) operate much more effectively on the source code level. At this level, they can use highlevel information that would otherwise be lost during the compilation to machine code. During the optimization stage, compilers often apply transformations, such as loop unrolling, that modify the program's control flow. Such transformations can invalidate information derived from the source code. In our approach, we therefore apply such optimizations already at the source-code level and transform the analyzed information accordingly. This way, we can marry the goals of precise timing analysis and optimizing compilation. In this article we present our implementation of this concept within the SATIrE source-to-source analysis and transformation framework. SATIrE forms the basis for the TuBound timing analyzer. In the ALL-TIMES EU FP7 project we extended SATIrE to exchange timing-relevant analysis data with other European timing analysis tools. In this context, we explain how timing-relevant information from the source code level can be communicated to a wide variety of tools that apply various forms of static and dynamic analysis on different levels.

With the emergence of big data and cloud technologies, companies now evolve in complex IT environments. This situation requires good practices for data process automation to be adopted to ensure system interoperability. Visual computing helps companies to describe and organize the ways in which information systems, devices, and people must interact. It incorporates a number of fields including modeling and simulation (M&S). This paper focused on M&S of data workflow processes that are key steps to bridging the gap between business views and goals on the one side, and operational implementations on the other side. Simulation adds a dynamic view to static modeling; it increases understanding of the behavior of process mechanisms and the identification of weak areas in data flow. Several research projects have been focused on control flow and data flow, but less attention has been paid to resource characteristics. This work is based on the MDSEA approach and the eBPMN language, and proposes an approach that aims to distinguish the types of resources carrying out process tasks. Furthermore, it introduces a new composite resource made from the relationship between a user (human resource) and a task form (IT resource). Moreover, it proposes a resource aggregation based on process performance combination in order to run and display a global performance measurement of a process path.

The authors present a methodology for regression testing and function or system testers. The methodology involves regression testing of modules where dependencies due to both control flow and data flow are taken into account. The control-flow dependency is modeled as a call graph and a firewall defined to include all affected modules which must be retested. Global variables are considered as the remaining data-flow dependency to be modeled. An approach to testing and regression testing of these global variables is given, and a firewall concept for the data-flow aspect of software change is defined. >

Complex Event Processing (CEP) is a branch of stream data mining, which is usually used to discover event patterns. Generally, a complex event processing engine uses nonprocedural declaration language and state machine to define event patterns. It generates synopses of universe data by sliding window model, therefore could identify event patterns which users care about from rapidly changing and potentially infinite event stream in a relatively short time. Among all the data streams, monitoring data flow is easy to describe by events, so CEP is suitable for supervision or decision control for business system. However, CEP does not support backtracking to eliminate invalid data, which limits CEP in supervision or decision control applications. The traditional complex event processing try to solve this problem by defining more complicated event patterns to avoid invalid results, the side effect of which would be heavier workload onto the engine. For this problem, we propose an optimized complex-event-processing model OCM. OCM will decompose complicated event patterns into small ones according to their relations, and distribute these patterns to more than one CEP engines to hierarchically filter invalid data. It can eliminate invalid data with better performance than the traditional approaches. We have also implemented the prototype and designed experiments to test the effectiveness of OCM. We have applied this model into Aviation Application in EU FP6 project Bridge.

Spatial architecture is a high-performance paradigm that employs control flow graphs and data flow graphs as computation model, and producer/consumer models as execution model. However, existing spatial architectures struggle with control flow handling challenges. Upon thoroughly characterizing their PE execution models, we observe that they lack autonomous, peer-to-peer, and temporally loosely-coupled control flow handling capability. This degrades its performance in intensive control programs. To tackle the existing control flow handling challenges, Marionette, a spatial architecture with an explicit-designed control flow plane, is proposed. We elaborately develop a full stack of Marionette architecture, from ISA, compiler, simulator to RTL. Marionette's flexible Control Flow Plane enables autonomous, peer-to-peer, and temporally loosely-coupled control flow management. Its Proactive PE Configuration ensures computation-overlapped and timely configuration to promote Branch Divergence handling capability. Besides, Marionette's Agile PE Assignment improves pipeline performance of imperfect loops. Compared to state-of-the-art spatial architectures, the experimental results demonstrate that Marionette outperforms Softbrain, TIA, REVEL, and RipTide by geomean 2.88<inline-formula><tex-math notation="LaTeX">$\mathbf{\times}$</tex-math></inline-formula>, 3.38<inline-formula><tex-math notation="LaTeX">$\mathbf{\times}$</tex-math></inline-formula>, 1.55<inline-formula><tex-math notation="LaTeX">$\mathbf{\times}$</tex-math></inline-formula>, and 2.66<inline-formula><tex-math notation="LaTeX">$\mathbf{\times}$</tex-math></inline-formula> in a variety of challenging intensive control programs.

Data flow testing is a family of white‐box testing techniques, relying on information deriving from both the flow of control and the flow of data through the program. Most other white‐box testing strategies rely only on the program's flow of control. A second distinction between this family of testing strategies and other white‐box strategies is that data flow strategies assure that different parts of the code that are related by the flow of data are tested together by requiring that test cases be chosen that exercise these related parts together. In contrast to this, most other white‐box strategies, such as statement testing or branch testing, require only that every identified program element be exercised at some point, but not necessarily in combination with other specified program elements. This means that certain meaningful code interactions may go uninspected and hence certain classes of faults may be overlooked even though the code containing these faults is exercised during testing.The data flow criteria are based on analysis that is similar to that done by an optimizing compiler, classifying occurrences of variables in a program as being either definitions or uses. Programs will be represented byflow graphs, consisting of nodes that representblocksor sequences of statements that are always exercised as a unit, and edges that represent the flow of control between blocks. A number of tools have been implemented to assess the degree to which a set of test cases satisfy one of the data flow criteria for a given program. Various definitions of a family of data flow testing criteria are given.

The article analyzes the existing methods of managing data flows in mobile radio communications. During the analysis, the peculiarities of the functioning and construction of these networks were considered. It has been established that such networks have features different from other networks, such as mobility, dynamic topology, independent organization, use of mobile means of communication, lack of fixed data transmission routes, etc. The task of providing routing in mobile radio communication devices, mobile radio networks, and the types of routing in communication networks are considered. The conditions for the implementation of the routing task and the features that characterize the routing process have been established. The levels of the OSI open systems model and the most well-known protocols that work at these levels and are used in data flow management are considered. Data flow management methods are classified by type and a list of requirements for the process of data flow transmission in mobile radio networks is defined, taking into account the peculiarities of the functioning of mobile radio communication means, which must be taken into account when building a mobile radio network management system. It has been established that at the current stage of information technology development, data flow management methods are mostly adapted for use in computer, wired or fixed networks and do not take into account the conditions of use in mobile radio communication devices. It has been established that the construction and operation of an effective data flow control subsystem in the control systems of mobile radio networks and mobile radio communication means requires the use of the latest technologies and modern approaches in the development of data flow control methods and methods that will ensure the functioning of the corresponding data flow control subsystem. When choosing protocols, methods, methods of managing data flows, it is proposed to focus on adaptation, modification of approaches or their combined use based on the target function, taking into account the peculiarities of the functioning of mobile radio networks and mobile radio communication means.

HGE-BVHD: Heterogeneous graph embedding scheme of complex structure functions for binary vulnerability homology discrimination

Semantics and Verification of Data Flow in UML 2.0 Activities

Program slicing is a technique to decompose programs depending on control flow and data flow amongst several lines of code in a program. Conditioned slicing is a generalization of static slicing and dynamic slicing. A variable, the desired program point, and a condition of interest form a slicing criterion for conditioned slicing. This paper proposes an approach to calculate conditioned slices for programs containing multiple procedures. The approach is termed Node-Marking Conditioned Slicing (NMCS) algorithm. In this approach, first and foremost step is to build an intermediate symbolization of a given program code and the next step is to develop an algorithm for finding out conditioned slices. The dependence graph, termed System Dependence Graph (SDG), is used to symbolize intermediate presentation. After constructing SDG, the NMCS algorithm chooses nodes that satisfy a given condition by the process of marking and unmarking. The algorithm also finds out conditioned slices for every variable at every statement during the process. NMCS algorithm employs a stack to save call context of a method. Few edges in SDG are labeled to identify the statement that calls a method. The proposed algorithm is implemented, and its performance is tested with several case study projects.