A criação e atualização de bases de conhecimentos com dados que comprovem, ou não, a eficácia de métodos, técnicas ou produtos de software podem ser facilitadas por meio de estudos experimentais e suas replicações em diferentes contextos, para que a base de conhecimento possa ser ampliada e consolidada. Porém, a condução dessas replicações gera uma grande quantidade de dados que devem ser coletados e armazenados, e posteriormente analisados, sendo que a gestão dessas informações de forma manual é propensa a erros. Nesse contexto, o Projeto Readers - um projeto de pesquisa colaborativa formado por pesquisadores brasileiros e norte-americanos - no qual este trabalho está inserido, teve como objetivos principais desenvolver, validar, empacotar e consolidar uma base de conhecimento sobre algumas técnicas, como por exemplo a PBR (Perspective Based Reading), que é uma técnica de leitura para detecção de defeitos em artefatos de software. Com as várias replicações de estudos experimentais que foram conduzidas no âmbito desse projeto, em particular replicações do Experimento PBR (Basili et al., 1996), ficou evidenciada a necessidade de apoio computacional em diversas etapas do processo de experimentação. Sendo assim, neste trabalho foi definida, modelada e implementada a ferramenta ExpVVT com a finalidade de automatizar as atividades de Planejamento e Operação do Experimento PBR. A ferramenta foi implementada com base em uma estrutura de meta-tabelas, o que facilita possíveis alterações no âmbito desse experimento. Salienta-se que o Pacote de Laboratório, o qual contém todos os artefatos necessários para que um estudo experimental possa ser replicado, também fica armazenado eletronicamente, com o apoio da ferramenta, o que facilita o registro de sua evolução. O uso da ferramenta foi explorado simulando-a com os dados de uma das replicações do Experimento PBR que foi conduzida no contexto do Projeto Readers. Embora tenha sido apenas uma simulação, pode-se perceber o auxílio que essa ferramenta pode trazer para futuras replicações desse experimento, reduzindo os custos associados com todo material necessário para uma replicação e também guiando os participantes do experimento, para que as atividades sejam feitas de forma mais controlada. / The creation and update of knowledge bases with data that provide evidences of the efficacy, or non-efficacy, of software methods, techniques or products can be facilitated by experimental studies and their replications in diverse contexts, so that the knowledge base can grow and be consolidated. However, replications generate great amount of data which must be collected, stored, and on later, analyzed, making the non-automated management of such information very error-prone. In this context, the Readers Project ? a collaborative research project formed by Brazilian and North-American researchers ? which this work is part of, has had as main goals the development, validation, packaging and consolidation of a knowledge base on some techniques, such as PBR (Perspective Based Reading), which is a reading technique used to defect detection in software artifacts. With the several replications of experimental studies that were conducted along this project, in particular the replications of the PBR Experiment (Basili et al., 1996), it has become evident the need of computational support in several activities of the experimentation process. Therefore, in this work, the ExpVVT tool was defined, designed and implemented with the goal to automate the Planning and Operation activities of the PBR Experiment. The tool was implemented based on a meta-table structure, which facilitates possible evolutions in this experiment context. It is emphasized that the Lab Package, which contains all the necessary artifacts needed to replicate an experimental study, is also stored electronically, with the tool support, which facilitates the tracing of its evolution. The tool?s use was explored simulating with data of some of the PBR Experiment replications which were conducted at the Readers Project context. Although just a single simulation took place, it can already be noticed the support that the tool can provide to future replications of this experiment, reducing the costs associated with every necessary material in a replication and also guiding the experiment participants, so that the activities are made in a more controlled way.

A criação e atualização de bases de conhecimentos com dados que comprovem, ou não, a eficácia de métodos, técnicas ou produtos de software podem ser facilitadas por meio de estudos experimentais e suas replicações em diferentes contextos, para que a base de conhecimento possa ser ampliada e consolidada. Porém, a condução dessas replicações gera uma grande quantidade de dados que devem ser coletados e armazenados, e posteriormente analisados, sendo que a gestão dessas informações de forma manual é propensa a erros. Nesse contexto, o Projeto Readers - um projeto de pesquisa colaborativa formado por pesquisadores brasileiros e norte-americanos - no qual este trabalho está inserido, teve como objetivos principais desenvolver, validar, empacotar e consolidar uma base de conhecimento sobre algumas técnicas, como por exemplo a PBR (Perspective Based Reading), que é uma técnica de leitura para detecção de defeitos em artefatos de software. Com as várias replicações de estudos experimentais que foram conduzidas no âmbito desse projeto, em particular replicações do Experimento PBR (Basili et al., 1996), ficou evidenciada a necessidade de apoio computacional em diversas etapas do processo de experimentação. Sendo assim, neste trabalho foi definida, modelada e implementada a ferramenta ExpVVT com a finalidade de automatizar as atividades de Planejamento e Operação do Experimento PBR. A ferramenta foi implementada com base em uma estrutura de meta-tabelas, o que facilita possíveis alterações no âmbito desse experimento. Salienta-se que o Pacote de Laboratório, o qual contém todos os artefatos necessários para que um estudo experimental possa ser replicado, também fica armazenado eletronicamente, com o apoio da ferramenta, o que facilita o registro de sua evolução. O uso da ferramenta foi explorado simulando-a com os dados de uma das replicações do Experimento PBR que foi conduzida no contexto do Projeto Readers. Embora tenha sido apenas uma simulação, pode-se perceber o auxílio que essa ferramenta pode trazer para futuras replicações desse experimento, reduzindo os custos associados com todo material necessário para uma replicação e também guiando os participantes do experimento, para que as atividades sejam feitas de forma mais controlada. / The creation and update of knowledge bases with data that provide evidences of the efficacy, or non-efficacy, of software methods, techniques or products can be facilitated by experimental studies and their replications in diverse contexts, so that the knowledge base can grow and be consolidated. However, replications generate great amount of data which must be collected, stored, and on later, analyzed, making the non-automated management of such information very error-prone. In this context, the Readers Project ? a collaborative research project formed by Brazilian and North-American researchers ? which this work is part of, has had as main goals the development, validation, packaging and consolidation of a knowledge base on some techniques, such as PBR (Perspective Based Reading), which is a reading technique used to defect detection in software artifacts. With the several replications of experimental studies that were conducted along this project, in particular the replications of the PBR Experiment (Basili et al., 1996), it has become evident the need of computational support in several activities of the experimentation process. Therefore, in this work, the ExpVVT tool was defined, designed and implemented with the goal to automate the Planning and Operation activities of the PBR Experiment. The tool was implemented based on a meta-table structure, which facilitates possible evolutions in this experiment context. It is emphasized that the Lab Package, which contains all the necessary artifacts needed to replicate an experimental study, is also stored electronically, with the tool support, which facilitates the tracing of its evolution. The tool?s use was explored simulating with data of some of the PBR Experiment replications which were conducted at the Readers Project context. Although just a single simulation took place, it can already be noticed the support that the tool can provide to future replications of this experiment, reducing the costs associated with every necessary material in a replication and also guiding the experiment participants, so that the activities are made in a more controlled way.

Software vulnerabilities and their associated exploits have been increasing over the last several years - this research attempts to reverse that trend. Currently, security experts recommend that concerns for security start at the earliest stage possible, generally during the requirements engineering phase. Having a set of security requirements enables the production of a secure design, and product implementation. Approaches for creating security requirements exist, but all have a similar limitation - a security expert is required. This research provides a set of software security requirements that mitigate the introduction of software vulnerabilities, and reduces the need for security expertise. The security requirements can be implemented by software engineers with limited security experience, and be used with any computer language or operating system. Additionally, a tree structure, called the software security requirements tree (SSRT), is provided to support security requirement selection, based on project characteristics. A graphical interface for the SSRT is provided through a prototype Java tool, to support the identification and selection of appropriate software security requirements. This research also provides a set of security artifacts to support a comprehensive verification, validation, and testing (VV&T) strategy. Those artifacts are generic, and represent design and implementation elements reflecting software security requirements. The security artifacts are used in verification strategies to confirm their necessity and existence in the actual design and implementation products. / Master of Science

Modern software applications are becoming increasingly complex, prompting a need for expandable software security assessment tools. Violable constraints/assumptions presented by Bazaz [1] are expandable and can be modified to fit the changing landscape of software systems. Partial and End-Game Verification, Validation, and Testing (VV&T) strategies utilize the violable constraints/assumptions and are established by this research as viable software security assessment tools. The application of Partial VV&T to the Horticulture Club Sales Assistant is documented in this work. Development artifacts relevant to Partial VV&T review are identified. Each artifact is reviewed for the presence of constraints/assumptions by translating the constraints/assumptions to target the specific artifact and software system. A constraint/assumption review table and accompanying status nomenclature are presented that support the application of Partial VV&T. Both the constraint/assumption review table and status nomenclature are generic, allowing them to be used in applying Partial VV&T to any software system. Partial VV&T, using the constraint/assumption review table and associated status nomenclature, is able to effectively identify software vulnerabilities. End-Game VV&T is also applied to the Horticulture Club Sales Assistant. Base test strategies presented by Bazaz [1] are refined to target system specific resources such as user input, database interaction, and network connections. Refined test strategies are used to detect violations of the constraints/assumptions within the Horticulture Club Sales Assistant. End-Game VV&T is able to identify violation of constraints/assumptions, indicating vulnerabilities within the Horticulture Club Sales Assistant. Addressing vulnerabilities identified by Partial and End-Game VV&T will enhance the overall security of a software system. / Master of Science