Thesis (M.S. in Computer Science)--Vanderbilt University, May 2006. / Title from title screen. Includes bibliographical references.

Doctor en Ciencias, Mención Computación / La adaptación de procesos de software es la actividad de adaptar el proceso de software de una organización a las necesidades de proyectos particulares. La ingeniería basada en modelos (MDE) se ha aplicado con este fin, utilizando modelos para formalizar el proceso de software y el contexto del proyecto, y transformaciones del modelo para adaptar estos procesos. A pesar de que la adaptación basada en MDE ha demostrado ser técnicamente factible, su uso en la práctica requiere conocimiento sobre cómo adaptar procesos y construir modelos y transformaciones. Existen algunas propuestas para la generación automática de transformaciones como una forma de reducir la complejidad de adaptar los procesos de software. Estas propuestas generalmente generan transformación solo parcialmente, y luego deben completarse manualmente. Estos enfoques no son adecuados para la adaptación de procesos de software porque no superan por completo las dificultades técnicas de adopción. Para enfrentar estos desafíos esta tesis propone un enfoque automático de generación de transformaciones, que aborda tanto la formalidad requerida por MDE, como la usabilidad que necesitan los ingenieros de proceso a cargo de las adaptaciones. Para ello, especificamos las reglas de adaptación utilizando un lenguaje específico de dominio (DSL). Además, definimos una transformación de orden superior (HOT) que toma las reglas de adaptación especificadas como entrada y genera automáticamente la transformación de adaptación de procesos requerida. Tanto el DSL como el HOT son genéricos y, por lo tanto, pueden reutilizarse en cualquier organización. Con el fin de mejorar la usabilidad, desarrollamos un conjunto de herramientas integradas (ATAGeTT) que incorpora ambas contribuciones. ATAGETT se aplicó en un estudio de caso exploratorio en dos pequeñas empresas de software, para evaluar su capacidad y corrección de adaptar el proceso de estas compañías. Los resultados obtenidos muestran queusuarios pudieron especificar todas las reglas de adaptación requeridas. Luego, se llevó cabo un caso de estudio en otra empresa para validar la usabilidad de ATAGeTT y la expresividad del lenguaje de decisión propuesto. Los usuarios pudieron especificar todas las reglas de ajuste de una manera simple, y de ejecutar la adaptación de procesos de manera automática. Los resultados muestran que ATAGeTT es fácil de aprender, usable y útil para sus potenciales usuarios. Aunque los resultados aún no son suficientes, son altamente positivos y consistentes; por lo tanto, esperamos que esta propuesta pueda ayudar a mejorar esta actividad, particularmente en organizaciones pequeñas y medianas, que generalmente están más limitadas para realizar adaptacion de procesos de software. / Este trabajo ha sido financiada por la beca CONICYT-PFCHA/Doctorado Nacional para Extranjeros/2013-63130130, y apoyada parcialmente por los proyectos FONDEF D09I-1171 /ADAPTE) y FONDEF IDeA IT13I20010 (GEMS), y el Programa de Becas de NIC Chile

Made available in DSpace on 2014-06-12T15:56:54Z (GMT). No. of bitstreams: 2 arquivo3088_1.pdf: 3675787 bytes, checksum: 37a4c170a186d859bd4fc51979cf5556 (MD5) license.txt: 1748 bytes, checksum: 8a4605be74aa9ea9d79846c1fba20a33 (MD5) Previous issue date: 2009 / Conselho Nacional de Desenvolvimento Científico e Tecnológico / Modelos oferecem abstrações de um sistema que possibilitam aos engenheiros raciocinarem sobre o sistema se focando apenas nos aspectos relevantes, ignorando detalhes que não são relevantes. UML se tornou um padrão de fato para análise e projeto de sistemas, mas possui algumas limitações óbvias: (1) o conjunto de elementos é muito heterogêneo e grande, e (2) o suporte de ferramentas não é satisfatório. Faz-se necessário um sistema de regras que governem o processo de análise e projeto; UML é geral demais. Desenvolvido pela UFPE em conjunto com a Universidade de Mannheim, o objetivo do método KobrA2 é resolver essas limitações através da incorporação de visões especiais de layout, navegação e comportamento de componentes de interface gráfica do usuário (GUI), e pela introdução do conceito de engenharia de software ortográfica, na qual a construção de Modelos Independentes de Plataforma (PIM) para cada componente de software é realizado em pequenas partes através da construção ortogonal de visões específicas para cada preocupação do componente. Estas visões são então integradas dentro de um Modelo Unificado (SUM) que por sua vez verifica a conformidade com os artefatos do meta-modelo de KobrA2. Para gerar ganhos de produtividade, esta integração e verificação deve ser automaticamente implementada através da transformação de modelos interna a uma ferramenta CASE. Consequentemente, para ter sucesso, KobrA2 precisa de uma ferramenta que dê suporte ao seu processo de engenharia de sistemas. Esta dissertação de mestrado é parte do projeto WAKAME (Wep App KobrA2 Modeling Environment) que tem por objetivo a construção desta ferramenta CASE. Além de ser a primeira ferramenta CASE dirigida por processo e que dá suporte a um ambiente OO, ortográfico, dirigido por modelos e baseado em componentes, para engenharia de aplicações, incluindo a construção de GUI PIMs, WAKAME também procura inovar por ser (a) distribuída em uma plataforma de cloud computing e acessível universalmente através de qualquer navegador Web, (b) ser de muito fácil aprendizagem graças a sua GUI minimalista, com poucos ícones, no estilo do Google, e (c) de uso eficiente graças ao seu cliente projetado para ser leve e com pouco uso de memória e que forneça um esquema de navegação multidimensional, ortográfico e independente de plataforma, entre visões de baixa granularidade, específica a preocupações, e locais, de um componente. Dentro do projeto WAKAME, esta dissertação de mestrado investiga três principais questões em aberto. A primeira é o projeto de KWAF (KobrA2 Web App Framework), um modelo independente de plataformas de um ambiente OO genérico para ser instanciado para projetos específicos de aplicações Web. A segunda é o PIM detalhado de WAKAME como um exemplo de instanciação de KWAF. A terceira é a implementação e avaliação de componentes de GUI, cobrindo (a) as visões estruturais de componentes KobrA2 que minimamente estendem um subconjunto mínimo de diagramas de classes UML e restrições estruturais de OCL, e (b) as visões operacionais de componentes KobrA2 que consistem de precondições, pós-condições e restrições body de OCL sobre operações UML. As principais contribuições desta dissertação são: (a) o projeto de KWAF, o primeiro estudo de caso para avaliação do processo KobrA2 para aplicações Web ricas com gráficos 2D, (b) o projeto de alto nível do WAKAME como estudo de caso para avaliação de KWAF, (c) a implementação de um cliente Web fácil de usar e eficiente para o projeto ortográfico de PIMs de composição de componentes KobrA2, e (d) a integração e teste deste cliente GUI com os serviços baseados em nuvem computacional de WAKAME para integração, verificação e persistência de visões PIM dentro do SUM

No description available.

Penetration testing is widely used in industry as a test method for web application security assessment. However, penetration testing is often performed late in a software development life cycle as an isolated task and usually requires specialized security experts. There is no well-defined test framework providing guidance and support to general testers who usually do not have in-depth security expertise to perform a systematic and cost-efficient penetration test campaign throughout a security-oriented software development life cycle. In this thesis, we propose a model-driven penetration test framework for web applications that consists of a penetration test methodology, a grey-box test architecture, a web security knowledge base, a test campaign model, and a knowledge-based PenTest workbench. The test framework enables general testers to perform a penetration test campaign in a model-driven approach that is fully integrated into a security-oriented software development life cycle. Security experts are still required to build up and maintain a web security knowledgebase for test campaigns, but the general testers are capable of developing and executing penetration test campaigns with reduced complexity and increased reusability in a systematic and cost-efficient approach. A prototype of the framework has been implemented and applied to three web applications: the benchmark WebGoat web application, a hospital adverse event management system (AEMS), and a palliative pain and symptom management system (PAL-IS). An evaluation of the test framework prototype based on the case studies indicates the potential of the proposed test framework to improve how penetration test campaigns are performed and integrated into a security-oriented software development life cycle.

There are many companies operating in the current electricity market and new companies are still forming. This gives every consumer an option to choose a company selling electricity. Electricity dealers can even buy or sell electricity from abroad. Although this situation seems to be natural, it's very complicated to achieve. It's necessary to follow a lot of rules and business processes to be able to establish a functional liberalized market. Because of the amount of business processes it's obvious that liberalized market depends first of all on information systems. However, to develop an information system is usually big investment and it is necessary to find some way to cut the information systems prices. This thesis introduces an effective way of system development for the electricity market domain. This method is introduced as Model Driven Development (MDD) methodology. The idea promoted by MDD is to use models to describe programs and automation code generators to transform models into source code. Model creation is obviously much faster than writing source code, which makes software development more effective. In the category of supporting MDD tools, Damas Energy platform is introduced. The main goal of this thesis is to analyze the usability of Damas Energy with MDD and to show which method to choose when developing information systems for the electricity market domain.

To be able to create quality software system, one need to analyse it well, design, program and test it. The whole process is called software life-cycle and is studied by software engineering. Today, there are many tools making this process easier. For analysing and designing software UML language became favourite. It enables programmers to describe different aspects of software by graphical diagrams and enables them to comprehend them better. Some of them can be translated into source code in chosen programming language. Problem is maintaining those diagrams during later phases when source code was already generated and is used exclusively. This problem is trying to be solved by Model-Driven Development, where programmer is working with well-defined models that can be automatically transformed into the source code that don't have to be edited by hand. Unfortunately this approach is not universal. This work tries to design and create tool that can work with use case diagrams, class diagrams and object-oriented Petri nets. This tool should allow designing those diagrams and be able to synchronise information between them to make the software design easier.

La vulnérabilité est le degré de stress ou de perturbation qu’un système humain et environnemental est capable de supporter avant d’être endommagé. Au cours des dernières années, c’est devenu un sujet central de l’étude du changement global (incluant le changement climatique), et l’évaluation de la vulnérabilité des agro-écosystèmes aux changements climatiques s’inscrit en effet dans les axes prioritaires de l’Institut National de la Recherche Agronomique (INRA). La littérature sur le changement climatique contient de nombreuses explications de la vulnérabilité, basée sur la notion de sensibilité et faisant éventuellement appel à des idées plus complexes, depuis la prise en compte de l’exposition jusqu’aux impacts résiduels du changement climatique après mise en place de mesures d’adaptation. Dans le cadre des activités de l’Unité de Recherche sur les Ecosystèmes Prairiaux (UREP), l’intérêt porte sur la vulnérabilité des systèmes prairiaux et d’élevage face aux risques de réduction de la production laitière et herbagère, ainsi que la problématique de l’augmentation des émissions de gaz à effet de serre qui accompagne la production des services d’un écosystème prairial.Compte-tenu du fait que l’analyse de vulnérabilité s’apparente à une forme d’analyse de sensibilité et de la cascade d’incertitudes lors des évaluations des impacts du changement climatique, un grand nombre de simulations sont nécessaires. Dans ce cadre, afin de réduire le temps d’attente utilisateur, la conception d’un plan expérimental approprié est nécessaire, ainsi que l’utilisation du calcul à haute performance. De plus, l’analyse de vulnérabilité peut se composer de nombreuses étapes parmi lesquelles on trouve la conception (choix du modèle agro-écologique, des variables d’intérêt, des scénarii et des seuils de référence, la distribution des paramètres, …), la génération de plans expérimentaux, la création de surfaces de réponse, le calcul de métriques (par exemple des indices de vulnérabilité) et l’optimisation (à travers la conception et l’évaluation de mesures d’adaptation) de la vulnérabilité. À notre connaissance, aucun outil spécifique n’a été conçu ou validé dans le but de faciliter l’exécution de la majeure partie des tâches énoncées précédemment. Ainsi, la problématique de cette thèse a été de proposer une méthode générique pour la réalisation d’une analyse de vulnérabilité sous changement climatique. Le travail réalisé dans cette thèse a donc commencé par une révision du concept de vulnérabilité et la proposition d’une démarche générique, en s’appuyant sur une synthèse critique des notions de l’état de l’art. Ensuite, avec une approche d’Ingénierie Dirigée par les Modèles, nous avons conçu un outil informatique pour l’analyse de vulnérabilité. Cet outil, implémenté avec le cadriciel Eclipse Modeling Framework (EMF),est générique, modulaire et permet la distribution et l’interprétation des simulations. Enfin,des exemples applicatifs d’analyse de vulnérabilité au changement climatique ont été réalisés à l’aide des solutions proposées précédemment. Cette démarche s’est notamment appuyée sur l’utilisation du modèle biogéochimique d’écosystème prairial PaSim ([Riedo et al., 1998], [Vuichard 2007a], [Graux 2011]). / Vulnerability is the degree to which human or environmental systems are likely toexperience harm due to a perturbation or a stress. In the last years, it has become a centralfocus of the global change (including climate change). Assessing the vulnerability of agroecosystemsto climate change is one of the priority areas of the French National Institute ofAgronomic Research (INRA). The climate change literature contains many explanations ofvulnerability, stemming from the notion of sensitivity to more complex ideas, yet takinginto account the exposure history of the system up to residual impacts of climate changeafter adaptation. In the framework of the activities of the INRA’s Grassland EcosystemResearch Unit (UREP) of Clermont-Ferrand, interest is on vulnerability of grassland andlivestock systems against the risk of reduced milk and forage production, and against theproblem of increased greenhouse gas emissions that comes with the production ofgrassland ecosystem services.Vulnerability assessment has similarities with sensitivity analysis and is based onsimulations of the target system, forced to respond to the changes of stress factors. Due tothe cascade of uncertainties in climate change impacts assessment, a large number ofsimulations are necessary. In this context, the need to reduce user waiting time calls for theconception of an appropriate experimental plan, as well as the use of high performancecomputing. Moreover, vulnerability assessment may consist of many steps, such asdesigning the experiment (choice of agro-ecological model, variables of interest, scenarios,reference thresholds, parameters distribution …), designing of the experimental plans,regressing response surfaces, computing metrics (e.g. vulnerability indices) and optimizingvulnerability (through designing and evaluating adaptation measures). To our knowledge,no specific tool has been built or validated, in order to facilitate the implementation ofmost of these tasks. Thus, the goal of this thesis was to propose a generic method toperform a comprehensive vulnerability analysis to climate change. The work in this thesishas begun with a review of the concept of vulnerability and the proposal of a genericapproach, based on a critical synthesis of the state of the art. Then, with a Model DrivenEngineering approach, we have developed a computer tool for vulnerability analysis. Thistool, implemented with the modelling framework Eclipse Modeling Framework (EMF) isgeneric, modular and allows the distribution and interpretation of simulation results.Finally, application examples of climate change vulnerability assessment were achievedwith the previously proposed solutions. This approach relied, in particular, on the use ofthe grassland ecosystem biogeochemical model PaSim ([Riedo et al., 1998], [Vuichard2007a], [Graux 2011]).

Nous nous sommes intéressés aux systèmes embarqués temps-réel critiques (SETRC) qui soulèvent des problématiques de criticité, de respect de contraintes temporelles et de disponibilité des ressources telles que la mémoire. Pour maîtriser la complexité de conception de ces systèmes, l’Ingénierie Dirigée par les Modèles (IDM) propose de les modéliser pour les analyser au regard de leurs exigences et pour générer en partie leur code d’exécution. Cependant ces deux phases doivent s’articuler correctement de sorte que le système généré respecte toujours les propriétés du modèle initialement analysé. Par ailleurs, le générateur de code doit s’adapter à de multiples critères : notamment pour assurer le respect des performances ou bien pour cibler différentes plates-formes d’exécution qui ont leurs propres contraintes et sémantiques d’exécution. Pour réaliser cette adaptation, le processus de développement requiert de faire évoluer les règles de transformation selon ces critères. Son architecture doit également de permettre de sélectionner les composants logiciels répondant à ces critères. Nous répondons à cette problématique en proposant un processus de génération s’appuyant sur l’IDM. Lorsque l’utilisateur a spécifié et validé un modèle de haut niveau, une transformation traduit automatiquement ce modèle en un second modèle détaillé proche du code généré. Pour assurer la conservation des exigences, le modèle détaillé est exprimé dans le même formalisme que le modèle initial de sorte qu’il reste analysable. Cette démarche détermine l’impact de la stratégie du générateur sur les performances du système final et permet au générateur de changer de stratégie, à une étape donnée, pour assurer le respect des contraintes du système. Pour faciliter le développement et la sélection de stratégies alternatives, nous proposons une méthodologie qui s’articule autour d’un formalisme pour l’orchestration des transformations, un ensemble de patrons de transformation (qui factorisent et généralisent les règles de transformation) et une adaptation de composants logiciels selon leur impact sur les performances. Nous avons mis en place ce processus au sein de l’environnement OSATE, pour lequel nous avons développé le framework RAMSES (Refinment of AADL Models for Synthesis of Embedded Systems). Nous l’avons expérimenté sur la génération des communications entre tâches pour lesquelles plusieurs stratégies d’implémentation ont été définies / We focused on real-time embedded critical systems (RTECS) which present different problems: criticality, respect of time constraints and resources availability such as memory. In order to master design complexity of such systems, Model Driven Engineering (MDE) proposes to model it for analysis purposes and to generate, partially or totally, its execution code. However, these two phases must be correctly connected to ensure the generated code is always enforcing all the properties of the model initially analysed. In addition, the code generator must be adapted to several criteria: in particular to ensure respect of performances or to target different execution platforms which have their own execution constraints and semantics. To realize such an adaptation, the development process requires to evolve transformation rules according to these criteria. Its architecture needs also to allow the selection of the generated software components respecting these criteria.We answer such a problem by proposing a generation process based on the MDE. When the user specifies and validates a high-level model, a model transformation translates automatically this model into a detailed model close to the generated code. To ensure the conservation of the requirements, the detailed model is expressed in the same formalism as the initial model so that it remains analysable (by the same tools initially used). This approach determines the impact of the code generation strategy on the performances of the final system and allows the generator to adapt its strategy, in a given stage, to insure the respect of the system constraints. To facilitate the development and the selection of alternative strategies, we propose a methodology which articulates around a formalism for the orchestration of the transformations, a set of transformation patterns (which factorize and generalize the transformation rules) and an adaptation of software components according to their impact on the performances. We set up this process within the environment OSATE, for which we have developed the framework RAMSES (Refinement of AADL Models for Synthesis of Embedded Systems). We have experimented it on the code generation of the communications between tasks for which several strategies of implementation were defined.

The growing demand for UI test automation has triggered the development of many tools. Researchers and developers have been continuously working to further improvise the existing approaches. If we look at GUI test evolution we can observe a clear progress from manual testing towards complete automation. Numerous approaches have been made to automate the GUI testing process. Record and playback tools, key-word driven methodologies, event flow exploration strategies, model based approaches are continuously evolving with higher level of automation. Similarly, new ideas and strategies to make these tests efficient are also emerging. Optimization of this resource consuming activity is another very important aspect in this area.  Dependencies between different tests can create deadlock scenarios, while running larger test suites. A concept of Ordered Test Suite can be used to cope with such dependencies. Following the Model Driven Architecture initiative by Object Management Group, a new global trend of Model Driven Engineering is creating a big sensation in the field of model based software development. Using the same principle, studies have also been made to automatically generate tests from models. Behavioral models can be made using the model driven approaches and these models can be analyzed to generate tests automatically. This master thesis addresses different approaches made for Graphical User Interface test automation, some optimization issues and solutions, a case study done at a software company to automate User Interface testing and a model driven approach for automatic test case generation.