Requirements engineering for COTS-based software systems

Process- and data-centric software systems require a tight integration of processes, functions, data, and users. Thereby, the behavioral perspective is described by process models, while the information perspective is captured in a data model. Eliciting and capturing requirements of such software systems in a consistent way is a challenging task, demanding that both process and data model are well aligned and consistent with each other. While traditional software modeling languages do not allow for an explicit integration of data and process models, activity-centric process modeling languages tend to neglect the role of data as a driver of process execution; i.e., business objects are usually outside the control of the process, normally stored in external databases. To overcome this drawback, PHILharmonicFlows provides a comprehensive framework for enabling object-aware process support. In addition, a sound specification of process- and object-centric software systems becomes possible. In this paper, we present a requirements modeling approach that provides methodological guidance for modeling large process-and data-centric software systems based on PHILharmonicFlows. Such guidance will foster the introduction of respective software systems in the large scale.

Reverse engineering aims at obtaining high-level representations of software systems from existing low-level artifacts, such as binaries, source code, execution traces or historical information. Reverse engineering methods and technologies play an important role in many software engineering tasks and quite often are the only way to get an understanding of large and complex software systems. Given for example the task to understand certain aspects of the test code in large software systems, such as Eclipse. How would you figure out the answers to the following questions:

Certain software defects require corrective changes repeatedly in a few components of the system. One type of such defects spans multiple components of the system, and we call such defects pervasive multiple-component defects (PMCDs). In this paper, we describe an empirical study of six releases of a large legacy software system (of approx. size 20 million physical lines of code) to analyze PMCDs with respect to: (1) the complexity of fixing such defects and (2) the persistence of defect-prone components across phases and releases. The overall hypothesis in this study is that PMCDs inflict a greater negative impact than do other defects on defect-correction efficacy. Our findings show that the average number of changes required for fixing PMCDs is 20-30 times as much as the average for all defects. Also, over 80% of PMCD-contained defect-prone components still remain defect-prone in successive phases or releases. These findings support the overall hypothesis strongly. We compare our results, where possible, to those of other researchers and discuss the implications on maintenance processes and tools.

Scientific missions in the Earth sciences frequently require cost-effective, highly reliable, and easy-to-use software, which can be a challenge for software developers to provide. The NASA Earth Science Enterprise (ESE) spends a significant amount of resources developing software components and other software development artifacts that may also be of value if reused in other projects requiring similar functionality. In general, software reuse is often defined as utilizing existing software artifacts. Software reuse can improve productivity and quality while decreasing the cost of software development, as documented by case studies in the literature. Since large software systems are often the results of the integration of many smaller and sometimes reusable components, ensuring reusability of such software components becomes a necessity. Indeed, designing software components with reusability as a requirement can increase the software reuse potential within a community such as the NASA ESE community. The NASA Earth Science Data Systems (ESDS) Software Reuse Working Group is chartered to oversee the development of a process that will maximize the reuse potential of existing software components while recommending strategies for maximizing the reusability potential of yet-to-be-designed components. As part of this work, two surveys of the Earth science community were conducted. The first was performed in 2004 and distributed among government employees and contractors. A follow-up survey was performed in 2005 and distributed among a wider community, to include members of industry and academia. The surveys were designed to collect information on subjects such as the current software reuse practices of Earth science software developers, why they choose to reuse software, and what perceived barriers prevent them from reusing software. In this paper, we compare the results of these surveys, summarize the observed trends, and discuss the findings. The results are very similar, with the second, larger survey confirming the basic results of the first, smaller survey. The results suggest that reuse of ESE software can drive down the cost and time of system development, increase flexibility and responsiveness of these systems to new technologies and requirements, and increase effective and accountable community participation.

The motivation for seeking hardware solutions to database management functions traditionally carried out by software has been apparent to data-base designers for sometime now. Firstly, database management software has grown in complexity and size over the years. This growth is prompted by the increase in user requirements, by the formulation of sophisticated models and by the change in data processing mode from an off-line, batched, single user environment to an on-line, concurrent and multi-user environment. Large and complex software systems tend to be failure-prone. Further-more, practical verification methods for software systems are still not in sight. On the other hand, methods for verifying hardware functionality, design and production have long been available. Advanced technology has also overcome some of the problems of the logic complexity and capacity requirements, making the construction of relatively large and complex computers viable. By incorporating basic database management functions into hardware, not only can we provide more reliable basic functions, but we can also improve the software reliability since the software requirements will be less complex and the system software will be smaller in size.

The detection of function clones in software systems is valuable for the code adaptation and error checking maintenance activities. This paper presents an efficient metrics-based data mining clone detection approach. First, metrics are collected for all functions in the software system. A data mining algorithm, fractal clustering, is then utilized to partition the software system into a relatively small number of clusters. Each of the resulting clusters encapsulates functions that are within a specific proximity of each other in the metrics space. Finally, clone classes, rather than pairs, are easily extracted from the resulting clusters. For large software systems, the approach is very space efficient and linear in the size of the data set. Evaluation is performed using medium and large open source software systems. In this evaluation, the effect of the chosen metrics on the detection precision is investigated.

In the context of software maintenance, legacy software systems are continuously re-engineered in order to correct errors, provide new functionality, or port them into modern platforms. However, software re-engineering activities should not occur in a vacuum, and it is important to incorporate non-functional requirements as part of the re-engineering process. We present an incremental reengineering framework that allows for quality requirements to be modeled as soft-goals, and transformations to be applied selectively towards achieving specific quality requirements for the target system. To deal with large software systems, we decompose the system into a collection of smaller clusters. The reengineering framework can be applied incrementally to each of these clusters and results are assembled to produce the final system.

Large software systems are often built from loosely-coupled subsystems. When a programmer uses a third-party software component as a building block of her system, she doesn’t want the code she imports to break the whole system. She needs some methods guaranteeing that linking the foreign software component to her system is safe. The most widely used methods for ensuring safe linking are type checking and code signing. Checking the type of the interfaces between two software components ensures that two components agree on the types they are using. Although type checking is quite strong and easy to use, it doesn’t guarantee that the code will behave in an expected way. Different static checking mechanisms have been suggested to address specific security properties of programs: a security-sensitive type system [5], wrappers which encapsulate untrusted programs and implement security-concerned properties [7], and so on. They give the users better facilities to address security properties than typical type-checking does, but they still suffer from a lack of expressiveness since their security or linking policies are fixed and encoded in their type or logic systems.

For large software systems, refactoring activities can be a challenging task, since for keeping component complexity under control the overall architecture as well as many details of each component have to be considered. Product metrics are therefore often used to quantify several parameters related to the modularity of a software system. This paper devises an approach for automatically suggesting refactoring opportunities on large software systems. We show that by assessing metrics for all components, move methods refactoring an be suggested in such a way to improve modularity of several components at once, without hindering any other. However, computing metrics for large software systems, comprising thousands of classes or more, can be a time consuming task when performed on a single CPU. For this, we propose a solution that computes metrics by resorting to GPU, hence greatly shortening computation time. Thanks to our approach precise knowledge on several properties of the system can be continuously gathered while the system evolves, hence assisting developers to quickly assess several solutions for reducing modularity issues.

A software system's requirements are often specified by textual use cases due to the latter's concrete and narrative style of expressions. However, they have limitation in the synthesis of the system behavior since they have a poor basis for the formal interpretation. Existing synthesis techniques are either largely manual or focus on the use case interactions. We present a framework from a model-based point of view to automatically synthesize system behavior from textual use cases to a Petri net model. The generated net model can well describe component module interactions and thus can be used to check the requirement properties. The function of Send-Railway-Emergency-Call of European Integrated Railway Radio Enhanced Network is used to show the proposed method. Moreover, the experimental results on a set of examples demonstrate the effectiveness of the proposed method.

A software system complies with a regulation if its operation is consistent with the regulation under all circumstances. The importance of regulatory compliance for software systems has been growing, as regulations are increasingly impacting both the functional and nonfunctional requirements of legacy and new systems. HIPAA and SOX are recent examples of laws with broad impact on software systems, as attested by the billions of dollars spent in the US alone on compliance. In this paper we propose a framework for establishing regulatory compliance for a given set of software requirements. The framework assumes as inputs models of the requirements (expressed in i*) and the regulations (expressed in Nomos). In addition, we adopt and integrate with i* and Nomos a modeling technique for capturing arguments and establishing their acceptability. Given these, the framework proposes a systematic process for revising the requirements, and arguing through a discussion among stakeholders that the revisions make the requirements compliant. Our proposed framework is illustrated through a case study involving fragments of the HIPAA regulation.

As the demand for more flexible, adaptable, extensible, and robust Web based enterprise application systems accelerates, adopting new software engineering methodologies and development strategies becomes critical. These strategies must support the construction of enterprise software systems that assemble highly flexible software components written at different times by various developers. Traditional software development strategies and engineering methodologies, which require development of software systems from scratch, fall short in this regard. Component based software engineering offers an attractive alternative for building Web based enterprise application systems. CBSE works by developing and evolving software from selected reusable software components, then assembling them within appropriate software architectures. By promoting the use of software components that commercial vendors or in-house developers build, the component based software development approach promises large scale software reuse.

Security has become an important concern with the development of large scale distributed and heterogeneous multi-agent systems (MAS). One of the main problems in addressing security during the development of MAS is that security is often an afterthought. The cost involved to patch existing systems against vulnerabilities and attacks after deployment is high. If developers and designers can spend some quality time investigating security aspects before beginning to code then this cost can be reduced significantly. Also, using formal methods to specify the complex behavior of large scale software systems has resulted in reliable software systems. This research effort was focused on using formal methods early in the development lifecycle to specify security requirements for MAS. New solutions are emerging to fix security related issues, but how much thought gets in during the early phases of development in terms of security needs to be answered. In this paper, analysis of security requirements for MAS, existing solutions to secure MAS, and the use of formal methods to specify security requirements has been studied. Descartes-Agent, a formal specification language for specifying agent systems has been taken into study to model the security requirements of MAS early on in the development process. Functional specifications of MAS are modelled along with the non-functional security requirements using the Descartes-Agent specification language. This paper also describes the extensions made to the Agent Unified Modeling Language (AUML) to represent the security requirements of MAS. The extensions proposed to AUML are in accordance with the extensions made to the Descartes-Agent specification language. A case study example is used to illustrate the specification of security requirements in MAS using the Descartes-Agent.

Privacy related elements have become an essential part of any information system. Previous studies reveal a scarcity of research on privacy in software processes, few engineering practices and a lack of methodological support to address privacy requirements in software systems. Introducing Privacy-by-Design (PbD) into software developments is an advantageous solution to tackle privacy related concerns. This paper presents an integration of PbD goals into the ISO/IEC 29110 Basic profile for small software development organizations. The most frequently encountered privacy goals as well as privacy addressing practices from previous methodological proposals were taken into account and included in the form of tasks, work products and roles. As a practical example, we describe a real life project development of a health care system that motivated the creation of the ISO/IEC 29110 PbD extension.

A software system often consists of thousands of source files, which must be translated into thousands of intermediate files, which eventually must be translated into some small number of library and executable files. Collectively, these steps compose its build process. A large software system can be difficult to build. The steps can be numerous and complex. Of course, there are a variety of tools to assist us (e.g. MAKE), but their languages emphasize the specification of low-level details (e.g. compiler names and options), rather than high-level attributes (e.g. host/target platforms and required subsystems). This paper describes a new domain-specific language for specifying the composition and construction of a software system, where the emphasis is on high-level attributes. A specification is processed by a pipeline of fairly simple tools to produce a set of makefiles, which are then processed by MAKE in the usual way.