Aspect-oriented programming is a comparatively new programming paradigm which intends to overcome some limitations that approaches such as procedural programming and object-oriented programming have. Traditional approaches are unable to properly capture some design decisions. Aspect-oriented programming introduces some new properties that we don’t find in the structural programming or object-oriented programming. New design patterns of aspect-oriented software introduce new fault types and new challenges for testing. Testing is an important part in the software development to produce quality software. Research on testing aspect-oriented software has been going on for several years but it still remains to invent testing approaches that cover all features of aspect-oriented software. This dissertation surveys test methods for aspect-oriented software and presents a comparison among the testing methods which reveals the strengths and weaknesses of current methods for testing of aspect-oriented software. This comparative overview of proposed test methods can be helpful for testers who intend to test aspect-oriented software. The conclusion presents the research contribution of this dissertation and proposes future work.

Different computation problem domains such as sorting, matrix multiplication, etc. usually require different data representations and algorithms variants implementations in order to be adapted and re-designed to context-aware composition (CAC). Context-aware composition is a technique for the design of applications that can adapt its behavior according to changes in the program. We considered two application domains: matrix multiplication and graph algorithms (DFS algorithm in particular). The main problem in the implementation of the representation mechanisms applied in these problem domains is time spent on the data representation conversion that in the end should not influence the application performance.        This thesis work presents a flexible aspect-based architecture that includes the data structure representation adaptation in order to reduce implementation efforts required for adaptation different application domains.      Although, manual approach has small overhead 4-10% for different problems compared to the AOP-based approach, experiments show that the manual adaptation to CAC requires on average three times more programming effort in terms of lines of code than AOP-based approach. Moreover, the AOP-based approach showed the average speed-up over baseline algorithms that use standard data structures of 2.1.

We introduce a class of program editors that present a program using a rich set of transformations; we call these kinds of editors composable presentation editors. Proper use of these kinds of editors appears to lead to more expressive programs-programs whose structure are aligned with the problem they are trying to solve. By default, the composable presentation editor presents program elements textually as concrete syntax and enables typical editor commands on the program. Metadata on program elements control how the transformations are applied. Customized metadata can re-order, pictorialize, collapse, duplicate, or expand the displayed form of program elements and can additionally alter the available editor commands. We have developed a set of presentation techniques to be used by presentation designers (i.e., the programmers who design how a program is presented in the editor. These techniques relate to well-understood programming language design, editor design, and programming best-practices techniques including scoping, higher order functions, refactoring, prettyprinting, naming conventions, syntax highlighting, and text hovers. We introduce two implementations of composable presentation editors and a number of examples showing how programs can be made more expressive when presentation techniques are properly used. The first implementation is the ETMOP, an open editor, where a metaobject protocol is provided that allows language and editor designers to customize the way program elements are displayed. These customizations are called presenta- tion extensions and the corresponding presentation extension protocol acts in a way similar to the way that syntax macros extend the syntax of a language. The second implementation is Embedded CAL, a closed editor that uses these presentation techniques to embed one language (CAL) inside a host language (Java) through the use of presentation techniques, without changing the syntax or compiler of either language. / Science, Faculty of / Computer Science, Department of / Graduate

Following the success of software engineering design patterns, security patterns are a promising approach to aid in the design and development of more secure software systems. At the same time, recent work on aspect-oriented programming (AOP) suggests that the cross-cutting nature of software security concerns makes it a good candidate for AOP techniques. This work uses a set of software metrics to evaluate and compare object-oriented and aspect-oriented implementations of five security patterns--Secure Base Action, Intercepting Validator, Authentication Enforcer, Authorization Enforcer, and Secure Logger. Results show that complete separation of concerns was achieved with the aspect-oriented implementations and the modularity of the base application was improved, but at a cost of increased complexity in the security pattern code. In most cases the cohesion, coupling, and size metrics were improved for the base application but worsened for the security pattern package. Furthermore, a partial aspect-oriented solution, where the pattern code is decoupled from the base application but not completely encapsulated by the aspect, demonstrated better modularity and reusability than a full aspect solution. This study makes several contributions to the fields of aspect-oriented programming and security patterns. It presents quantitative evidence of the effect of aspectization on the modularity of security pattern implementations. It augments four existing security pattern descriptions with aspect-oriented solution strategies, complete with new class and sequence diagrams based on proposed aspect-oriented UML extensions. Finally, it provides a set of role-based refactoring instructions for each security pattern, along with a proposal for three new basic generalization refactorings for aspects.

With the advent of agile programming, lightweight software processes are being favoured over the highly formalised approaches of the 80s and 90s, where the emphasis is on "people, not processes". Likewise, access control may benefit from a less prescriptive approach and an increasing reliance on users to behave ethically. These ideals correlate with optimistic access controls. However, such controls alone may not be adequate as they are retrospective rather proactive. Optimistic access controls may benefit from the stricter enforcement offered by usage control. The latter enables finer-grained control over the usage of digital objects than do traditional access control policies and models, as trust management concerns are also taken into consideration. This thesis investigates the possibility of enhancing optimistic access controls with usage control to ensure that users conduct themselves in a trustworthy manner. Since this kind of approach towards access control has limited applicability, the present study investigates contextualising this approach within a mixed-initiative access control framework. A mixed-initiative access control framework involves combining a minimum of two access control models where the request to information is mediated by a mixture of access policy enforcement agents. In order for this type of integration to be successful, a software development approach was considered that allows for the seamless augmentation of traditional access control with optimistic access control enhanced with usage control, namely the aspect-oriented approach. The aspect-oriented paradigm can facilitate the implementation of additional security features to legacy systems without modifying existing code. This study therefore evaluates the aspect-oriented approach in terms of implementing security concerns. It is evidently difficult to implement access control and in dynamic environments preconfigured access control policies may often change dramatically, depending on the context. In unpredicted circumstances, users who are denied access could often have prevented a catastrophe had they been allowed access. The costs of implementing and maintaining complex preconfigured access control policies sometimes far outweigh the benefits. Optimistic controls are retrospective and allow users to exceed their normal privileges. However, if a user accesses information unethically, the consequences could be disastrous. Therefore it is proposed that optimistic access control be enhanced with some form of usage control, which may prevent the user from engaging in risky behaviour. An initiative towards including security in the earlier phases of the software life cycle is gaining momentum, as it is much easier to design with security from the onset than to use the penetrate-and-patch approach. Unfortunately, incorporating security into software development takes time and developers tend to focus more on the features of the software application. The aspect-oriented paradigm can facilitate the implementation of additional security features in legacy systems without modifying existing code. The current study evaluates the aspect-oriented approach towards enhancing optimistic access control with usage control. The efficacy of the aspect-oriented paradigm has been well established within several areas of software security, as aspect-orientation facilitates the abstraction of these security-related tasks so as to reduce code complexity. / Thesis (PHD)--University of Pretoria, 2010. / Computer Science / unrestricted

[pt] Programaçãoo Orientada a Aspectos (POA) é um paradigma de programação que propõe um novo tipo de abstração - denominado aspecto - que permite a descrição modular de propriedades que, em geral, se encontram espalhadas por vários pontos de um sistema. Há distintas abordagens que podem ser classificadas como orientadas a aspectos. Cada abordagem propõe tipos de abstração, mecanismos de composição e terminologia específicos. Nesta tese, deslocamos o foco de atenção dos mecanismos de implementação que dão suporte µa tecnologia de programação orientada a aspectos, para os conceitos e propriedades que a caracterizam como um paradigma emergente para o desenvolvimento de software. Em particular, focalizamos em como estes conceitos e propriedades podem ser explorados na fase de design para construir sistemas que sejam mais fáceis de compreender, evoluir e reutilizar. Esta tese aborda questões atuais relacionadas a design e modelagem orientados a aspectos e propõe: (i) o modelo de aspectos, um arcabouço conceitual unificador para POA que fornece terminologia consistente e semântica básica para analisar problemas µa luz dos conceitos e propriedades de POA, (ii) aSideML, uma linguagem de modelagem para especificação e comunicação de designs orientados a aspectos. A linguagem aSideML define uma notação gráfica, semântica e regras que permitem ao projetista construir modelos em que aspectos são tratados explicitamente como cidadãos de primeira classe, e (iii) o metamodelo aSide, um modelo lógico que define a semântica de modelos estruturais e comportamentais representados em aSideML. / [en] Aspect-Oriented Programming (AOP) is a new programming paradigm that promotes advanced separation of concerns by introducing a new modular unit, called aspect, for the modularization of crosscutting concerns. As an emerging programming paradigm, there are many different approaches to AOP, with distinct and varying sets of abstractions and composition mechanisms, specific terminology, properties and language constructs. In this thesis, we shift the focus from the mechanisms that support the aspect-oriented programming technology to the concepts and properties that characterize it as an emerging paradigm for software development. In particular, we focus on how these concepts and properties can be exploited at an early design stage to build systems that are easier to comprehend, evolve and reuse. This thesis addresses current issues related to aspect-oriented design and modeling, and proposes: (i) the aspect model, an unifying conceptual framework for AOP that provides consistent terminology and basic semantics for thinking about a problem in terms of AOP core concepts and properties, (ii) the aSideML, a modeling language for specifying and communicating aspect-oriented designs. The aSideML provides notation, semantics and guidelines that enable the designer to build models in which aspects are explicitly treated as first-class citizens, and (iii) the aSide metamodel, a logical model that defines the semantics of structural and behavioral models supported by the aSideML.

Uma Linha de Produtos de Software (LPS) consiste de um conjunto de sistemas de software que compartilham características comuns e satisfazem às necessidades específicas de um segmento particular. Para tornar o processo de instanciação de produtos mais rápido e menos suscetível a erros, o projeto de uma LPS pode adotar a utilização de geradores de aplicação, que podem gerar os artefatos da LPS utilizando uma especificação das variabilidades de um certo produto. Adicionalmente, notase que determinadas características transversais de uma linha de produtos têm potencial de reúso em diferentes domínios, podendo ser implementadas usando a programação orientada a aspectos (POA). Neste trabalho é proposto um processo para o desenvolvimento de LPS e geração automatizada de produtos levando em consideração os interesses transversais existentes em cada domínio de aplicação. Os interesses transversais são as características comuns espalhadas pelas divisões ou módulos do programa de diferentes domínios. O processo aqui proposto tem a finalidade de aumentar o reúso de características de linhas de produtos por meio da POA, permitindo que as LPSs sejam projetadas de forma mais coesa e, consequentemente, facilitando sua manutenção e evolução. Visando diminuir o esforço necessário para a instanciação dos produtos provenientes dessas linhas de produtos, neste trabalho também é apresentada uma extensão do gerador Captor, denominada Captor-AO. Esse gerador fornece suporte ao processo proposto, permitindo a criação de produtos formados por características de diferentes domínios. Por fim, é apresentado um estudo de caso em que é realizada a configuração de um domínio transversal para o interesse de persistência, a definição de um domínio-base compatível com esse domínio transversal e a geração de produtos formados pelas características de ambos os domínios utilizando o gerador estendido Captor-AO / A Software Product Line (SPL) consists of a set of software systems that share common features and fulfill the specific requirements of a particular domain. In order to make the products instantiation process faster and less prone to errors, the project of a SPL can adopt the utilization of application generators, which can can automatically generate the SPL artifacts based on the specification of the variabilities of a particular product. Additionally, it can be noticed that certain crosscutting features of a product line have potencial to be reused in different domains, so they can be implemented using aspect oriented programming (AOP). In this work, a process is proposed for the development of SPLs and automatic generation of products, considering the crosscutting concerns present in each application domain. The crosscutting concerns are related to the common features that are scattered around program divisions or modules of different domains. The process proposed here has the goal of enhancing the reuse of SPL features using AOP, allowing the design of SPL in a more cohesive way and, thus, easing its maintenance and evolution. Aiming at decreasing the effort needed to instantiate products from these SPL, this work also presents an extension to the Captor application generator, named Captor-AO. This generator supports the proposed process, allowing the creation of products composed by features of different domains. Finally, a case study is presented in which Captor-AO is configured with two domains: a crosscutting domain for the persistence concern and a base domain compatible with this crosscutting domain, such that the generation of products can be done by composing features of both domains

A programação orientada a aspectos é uma abordagem que utiliza conceitos da separação de interesses para modularizar o software de maneira mais adequada. Com o surgimento dessa abordagem vieram também novos desafios, dentre eles o teste de programas orientados a aspectos. Duas estratégias de ordenação de classes e aspectos para apoiar o teste de integração orientado a aspectos são propostas nesta tese. As estratégias de ordenação tem o objetivo de diminuir o custo da atividade de teste por meio da diminuição do número de stubs implementados durante o teste de integração. As estratégias utilizam um modelo de dependências aspectuais e um modelo que descreve dependências entre classes e aspectos denominado AORD (Aspect and Oriented Relation Diagram) também propostos neste trabalho. Tanto o modelo de dependências aspectuais como o AORD foram elaborados a partir da sintaxe e semântica da linguagem AspectJ. Para apoiar as estratégias de ordenação, idealmente aplicadas durante a fase de projeto, um processo de mapeamento de modelos de projeto que usam as notações UML e MATA para o AORD é proposto neste trabalho. O processo de mapeamento é composto de regras que mostram como mapear dependências advindas da programação orientada a objetos e também da programação orientada a aspectos. Como uma forma de validação das estratégias de ordenação, do modelo de dependências aspectuais e do AORD, um estudo exploratório de caracterização com três sistemas implementados em AspectJ foi conduzido. Durante o estudo foram coletadas amostras de casos de implementação de stubs e drivers de teste. Os casos de implementação foram analisados e classificados. A partir dessa análise e classificação, um catálogo de stubs e drivers de teste é apresentado / Aspect-oriented programming is an approach that uses principles of separation of concerns to improve the sofware modularization. Testing of aspect-oriented programs is a new challenge related to this approach. Two aspects and classes test order strategies to support integration testing of aspect-oriented programs are proposed in this thesis. The objective of these strategies is to reduce the cost of testing activities through the minimization of the number of implemented stubs during integration test. An aspectual dependency model and a diagram which describes dependencies among classes and aspects called AORD (Aspect and Object Relation Diagram) used by the ordering strategies are also proposed. The aspectual dependency model and the AORD were defined considering the syntax constructions and the semantics of AspectJ. As the proposed estrategies should be applied in design phase of software development, a process to map a desing model using UML and MATA notations into a AORD is proposed in order to support the ordering strategies. The mapping process is composed by rules that show how to map both aspect and object-oriented dependencies. A characterization exploratory study using three systems implemented with AspectJ was conducted to validate the ordering strategies, the aspectual dependency model and the AORD. Interesting samples of stubs implementations were collected during the study conduction. The stubs were analyzed and classified. Based on these analysis and classification a catalog of stubs and drivers is presented

As software systems have grown in size and complexity, the costs of maintaining such systems increases steadily. In the early 2000's, IBM launched the autonomic computing initiative to mitigate this problem by injecting feedback control mechanisms into software systems to enable them to observe their health and self-heal without human intervention and thereby cope with certain changes in their requirements and environments. Self-healing is one of several fundamental challenges addressed and includes software systems that are able to recover from failure conditions. There has been considerable research on software architectures with feedback loops that allow a multi-component system to adjust certain parameters automatically in response to changes in its environment. However, modifying the components' source code in response to failures remains an open and formidable challenge. Automatic program repair techniques aim to create and apply source code patches autonomously. These techniques have evolved over the years to take advantage of advancements in programming languages, such as reflection. However, these techniques require mechanisms to evaluate if a candidate patch solves the failure condition. Some rely on test cases that capture the context under which the program failed---the patch applied can then be considered as a successful patch if the test result changes from failing to passing. Although test cases are an effective mechanism to govern the applicability of potential patches, the automatic generation of test cases for a given scenario has not received much attention. ReCrash represents the only known implementation to generate test cases automatically with promising results through the use of low-level instrumentation libraries. The work reported in this thesis aims to explore this area further and under a different light. It proposes the use of Aspect-Oriented Programming (AOP)---and in particular of AspectJ---as a higher-level paradigm to express the code elements on which monitoring actions can be interleaved with the source code, to create a representation of the context at the most relevant moments of the execution, so that if the code fails, the contextual representation is retained and used at a later time to automatically write a test case. By doing this, the author intends to contribute to fill the gap that prevents the use of automatic program repair techniques in a self-healing architecture. The prototype implementation engineered as part of this research was evaluated along three dimensions: memory usage, execution time and binary size. The evaluation results suggest that (1) AspectJ introduces significant overhead with respect to execution time, (2) the implementation algorithm causes a tremendous strain on garbage collection, and (3) AspectJ incorporates tens of additional lines of code, which account for a mean size increase to every binary file of a factor of ten compared to the original size. The comparative analysis with ReCrash shows that the algorithm and data structures developed in this thesis produce more thorough test cases than ReCrash. Most notably, the solution presented here mitigates ReCrash's current inability to reproduce environment-specific failure conditions derived from on-demand instantiation. This work can potentially be extended to apply in less-intrusive frameworks that operate at the same level as AOP to address the shortcomings identified in this analysis. / Graduate

Le Cloud Computing représente une des plus importantes avancées numériques de ces dix dernières années. Le modèle de service offert par le cloud computing est basé sur une allocation élastique et à la demande des ressources et une facturation au plus juste de leur utilisation. Plusieurs catégories d’application sont en train de migrer vers le cloud (par exemple : les NFV et les applications du Big Data). D’autres domaines applicatifs, soumis à une législation plus stricte, sont plus frileux. Leurs exigences sont souvent liées à des problématiques de sécurité et/ou à la non satisfaction par les ressources proposées par un cloud unique, peuvent trouver des réponses dans l’utilisation conjointe de plusieurs fournisseurs de cloud computing (CSPs). L’exploitation simultanée, flexible, efficace et simplifiée de plusieurs clouds requiert des propriétés qui assurent sa viabilité et son acceptation tout d’abord par les fournisseurs de clouds qui proposent des offres hétérogènes et non interopérables et qui souvent pour des raisons commerciales, ne sont pas disposés à coopérer pour faciliter le multi-cloud « à la carte » ; mais aussi du point de vue du consommateur de services cloud dont les contraintes sont le temps de mise en service et le besoin d’exprimer les besoins en services et leur configuration de manière simple et transparente et de permettre la définition de configurations de déploiement adaptées aux besoins de chaque consommateur, comparables à celles offertes par les clouds privés et optimisées pour tirer profit des spécificités de chaque fournisseur de cloud. Dans cette thèse, nous proposons un framework permettant d’exprimer indépendamment de toute solution sous-jacente les besoins en services et en fournisseurs de cloud et de générer efficacement des infrastructures de déploiement extensibles, adaptatives et contrôlables par le consommateur. Cette solution est composée de MANTUS, un outil permettant l’expression des besoins et la génération automatique d’instances, d’ORBITS, des infrastructures de déploiement multi-cloud adaptables dynamiquement grâce aux mécanismes autonomiques offerts par MANTUS.La solution proposée se décline en plusieurs contributions : tout d’abord l’extension d’un framework IaC (Infrastructure as a Code) existant, dédié à la construction de solutions multi-cloud par des mécanismes de tissage, caractéristiques de la programmation par aspects (AOP), permettant ainsi d’injecter et d’extraire des ressources à la demande. Cette extension, expérimentée sur le framework TOSCA a nécessité la proposition du langage TML (Tosca Manipulation Language) permettant de formaliser et de manipuler ces extensions. Les expérimentations effectuées montrent une surcharge acceptable induite par le mécanisme de tissage. La seconde contribution a été de doter le framework IaC TOSCA d’un outil d’expression des besoins et d’un algorithme de matching en terme, d’une part, de nombre et de caractéristiques de fournisseur de cloud -notamment la localisation- et d’autre part en terme de caractéristiques des services proposés par ceux-ci, permettant de trouver la configuration multi-cloud la plus adaptée. La troisième contribution est la définition d’une architecture « template » multi-couche, ORBITS, offrant des mécanismes d’interopérabilité inter-cloud et une vision haut niveau indépendante des clouds sous jacents. Enfin la dernière contribution proposée est la pile de virtualisation U-cloud et les protocoles liée à son déploiement qui permettent de délimiter les zones contrôlables par le consommateur des zones contrôlées par le provider. Cette proposition est basée sur l’utilisation conjointe de la virtualisation imbriquée (Nested Virtualization) et des micro-hyperviseurs réduisant la zone d’attaque (TCB). / Cloud Computing represents one of the most important changes in information and communications technology (ICT) of the latest ten years. However, after a decade since its commercial debut, there are still several applications that cloud computing is not able to fully serve. These are the applications that, due to their particularly stringent requirements, must rely simultaneously on multiple Cloud Service Providers (CSPs), rather than only one. Multiple CSPs can in fact offer a better availability, improve QoS, and break the business dependence w.r.t. a single CSP. A cloud infrastructure based on multiple CSPs is called multi-cloud.Despite the benefits of multi-clouds, organisations (i.e developers and operators of IT services) seldom accept the challenge of building applications and crossing multiple CSP domains. In fact, multi-CSP architectures come at the cost of more complex applications and the logic to in terms of architecture and performance optimization.Recently, Multi-cloud client-oriented architectures emerged as important approach to construct multi-cloud applications. It provides cloud consumers a mechanism to allocate resources over multiple CSPs without requiring any cooperation among the CSPs themselves.In particular, Infrastructure as Code-based (IaC-based) represent the reference paradigm when building multi-cloud applications.However, the adoption of IaC in the multi-cloud context us limited by the fact that the cloud consumer cannot easily reuse the infrastructure code across different applications. This is due to two major problems, which we investigate in this manuscript.First, infrastructure are composed of functional (e.g. resources for applications) and non-functional services (e.g. monitoring). Non-functional related code should be shared at most across different applications and cloud consumers. However, this separation between functional and non-functional code is often blurred and, therefore, non-functional code is hard to be shared across them. This enables the possibility of code re-using across different cloud consumers (e.g., their different multi-cloud infrastructures) and static analysis of infrastructure templates. Furthermore, we present a TML (TOSCA Manipulation Language) aspect specification language to dynamically inject “non-functional” services to the virtual multi-cloud infrastructure. Secondly, the multi-cloud paradigm is limited by the “least common denominator” barrier. The cloud consumer can hardly obtain an optimized usage of resources and services through existing IaC frameworks. Despite compatible with different CSPs, those frameworks do not specialize the output according to deployment context.To tackle the “under-specialization” of multi-cloud templates, we introduce a “context-based matching” scheduling algorithm to select the most compelling set of CSPs according to the cloud consumer needs.To validate such contributions, we defined an end-to-end workflow to optimize a multi-cloud infrastructure definition. More precisely, in our model, the cloud consumer initially models the IaC code as an high-level graph of services, leveraging the combination of TML and context-based matching adoption. The output of this workflow is the instantation of such optimized and fully-featured multi-cloud on most suitable CSPs. We implemented Mantus, a multi-cloud compiler, which encapsulates this workflow and we benchmarked this implementation according to different perspectives as scalability and performance.