No description available.

SystemC has emerged as a de facto standard modeling language for hardware and embedded systems. However, the current standard does not provide support for temporal specifications. Specifically, SystemC lacks a mechanism for sampling the state of the model at different types of temporal resolutions, for observing the internal state of modules, and for integrating monitors efficiently into the model's execution. This work presents a novel framework for specifying and efficiently monitoring temporal assertions of SystemC models that removes these restrictions. This work introduces new specification language primitives that (1) expose the inner state of the SystemC kernel in a principled way, (2) allow for very fine control over the temporal resolution, and (3) allow sampling at arbitrary locations in the user code. An efficient modular monitoring framework presented here allows the integration of monitors into the execution of the model, while at the same time incurring low overhead and allowing for easy adoption. Instrumentation of the user code is automated using Aspect-Oriented Programming techniques, thereby allowing the integration of user-code-level sample points into the monitoring framework. While most related approaches optimize the size of the monitors, this work focuses on minimizing the runtime overhead of the monitors. Different encoding configurations are identified and evaluated empirically using monitors synthesized from a large benchmark of random and pattern temporal specifications. The framework and approaches described in this dissertation allow the adoption of assertion-based verification for SystemC models written using various levels of abstraction, from system level to register-transfer level. An advantage of this work is that many existing specification languages call be adopted to use the specification primitives described here, and the framework can easily be integrated into existing implementations of SystemC.

External world skeptics argue that we have no knowledge of the external world. Contextualist theories of knowledge attempt to address the skeptical problem by maintaining that arguments for skepticism are effective only in certain contexts in which the standards for knowledge are so high that we cannot reach them. In ordinary contexts, however, the standards for knowledge fall back down to reachable levels and we again are able to have knowledge of the external world. In order to address the objection that contextualists confuse the standards for knowledge with the standards for warranted assertion, Keith DeRose appeals to the knowledge account of warranted assertion to argue that if one is warranted in asserting p, one also knows p. A skeptic, however, can maintain a context-invariant view of the knowledge account of assertion, in which case such an account would not provide my help to contextualism.

<p>Trust has played a central role in the design of open distributed systems that span distinct administrative domains. When components of a distributed system can assess the trustworthiness of their peers, they are in a better position to interact with them. There are numerous examples of distributed systems that employ trust inference techniques to regulate the interactions of their components including peer-to-peer file sharing systems, web site and email server reputation services and web search engines.</p> <p>The recent rise in popularity of Online Social Networking (OSN) services has made an additional dimension of trust readily available to system designers: social trust. By social trust, we refer to the trust information embedded in social links as annotated by users of an OSN. This thesis' overarching contribution is methods for employing social trust embedded in OSNs to solve two distinct and significant problems in distributed information systems. </p> <p>The first system proposed in this thesis assesses the ability of OSN users to correctly classify online identity assertions. The second system assesses the ability of OSN users to correctly configure devices that classify spamming hosts. In both systems, an OSN user explicitly ascribes to his friends a value that reflects how trustworthy he considers their classifications. In addition, both solutions compare the classification input of friends to obtain a more accurate measure of their pairwise trust. Our solutions also exploit trust transitivity over the social network to assign trust values to the OSN users. These values are used to weigh the classification input by each user in order to derive an aggregate trust score for the identity assertions or the hosts.</p> <p>In particular, the first problem involves the assessment of the veracity of assertions on identity attributes made by online users. Anonymity is one of the main virtues of the Internet. It protects privacy and freedom of speech, but makes it hard to assess the veracity of assertions made by online users concerning their identity attributes (e.g, age or profession.) We propose FaceTrust, the first system that uses OSN services to provide lightweight identity credentials while preserving a user's anonymity. FaceTrust employs a ``game with a purpose'' design to elicit the</p> <p>opinions of the friends of a user about the user's self-claimed identity attributes, and uses attack-resistant trust inference to compute veracity scores for the attributes. FaceTrust then provides credentials, which a user can use to corroborate his online identity assertions. </p> <p>We evaluated FaceTrust using a crawled social network graph as well as a real-world deployment. The results show that our veracity scores strongly correlate with the ground truth, even when a large fraction of the social network users are dishonest. For example, in our simulation over the sample social graph, when 50% of users were dishonest and each user employed 1000 Sybils, the false assertions obtained approximately only 10% of the veracity score of the true assertions. We have derived the following lessons from the design and deployment of FaceTrust: a) it is plausible to obtain a relatively reliable measure of the veracity of identity assertions by relying on the friends of the user that made the assertion to classify them, and by employing social trust to determine the trustworthiness of the classifications; b) it is plausible to employ trust inference over the social graph to effectively mitigate Sybil attacks; c) users tend to mostly correctly classify their friends' identity assertions.</p> <p>The second problem in which we apply social trust involves assessing the trustworthiness of reporters (detectors) of spamming hosts in a collaborative spam mitigation system. Spam mitigation can be broadly classified into two main approaches: a) centralized security infrastructures that rely on a limited number of trusted monitors (reporters) to detect and report malicious traffic; and b) highly distributed systems that leverage the experiences of multiple nodes within distinct trust domains. The first approach offers limited threat coverage and slow response times, and it is often proprietary. The second approach is not widely adopted, partly due to the </p> <p>lack of assurances regarding the trustworthiness of the reporters. </p> <p>Our proposal, SocialFilter, aims to achieve the trustworthiness of centralized security services and the wide coverage, responsiveness, and inexpensiveness of large-scale collaborative spam mitigation. It enables nodes with no email classification functionality to query the network on whether a host is a spammer. SocialFilter employs trust inference to weigh the reports concerning spamming hosts that collaborating reporters submit to the system. To the best of our knowledge, </p> <p>it is the first collaborative threat mitigation system that assesses the trustworthiness of the reporters by both auditing their reports and by leveraging the social network of the reporters' human administrators. Subsequently, SocialFilter weighs the spam reports according to the trustworthiness of their reporters to derive a measure of the system's belief that a host is a spammer. </p> <p>We performed a simulation-based evaluation of SocialFilter, which indicates its potential: </p> <p>during a simulated spam campaign, SocialFilter classified correctly 99% of spam, while yielding no false positives. The design and evaluation of SocialFilter offered us the following lessons: a) it is plausible to introduce Sybil-resilient OSN-based trust inference mechanisms to improve the reliability and the attack-resilience of collaborative spam mitigation; b) using social links to obtain the trustworthiness of reports concerning spammers (spammer reports) can result in comparable spam-blocking effectiveness with approaches that use social links to rate-limit spam (e.g., Ostra); c) unlike Ostra, SocialFilter yields no false positives. We believe that the design lessons from SocialFilter are applicable to other collaborative entity classification systems.</p> / Dissertation

As software systems are growing in complexity and size, reliability becomes a major concern. A large degree of industrial and academic efforts for increasing software reliability are directed towards design, testing and validation—activities performed before the software is deployed. While such activities are fundamental for achieving high levels of confidence in software systems, bugs still occur after deployment resulting in costly software failures. This dissertation presents assertion-based repair, a novel approach for error recovery from insidious bugs that occur after the system is deployed. It describes the design and implementation of a repair framework for Java programs and evaluates the efficiency and effectiveness of the approach on repairing data structure errors in both software libraries and open-source stand-alone applications. Our approach introduces a new form of assertions, assertAndRepair, for developers to use when checking the consistency of the data structures manipulated by their programs with respect to a set of desired structural and data properties. The developer provides the properties in a Java boolean method, repOk, which returns a truth value based on whether a given data structure satisfies these properties. Upon an assertion violation due to a faulty structure, instead of terminating the execution, the structure is repaired, i.e., its fields are mutated such that the resulting structure satisfies the desired properties, and the program proceeds with its execution. To aid developers in detecting the causes of the fault, repair-logs are generated which provide useful information about the performed mutations. The repair process is performed using a novel algorithm that uses a systematic search based on symbolic execution to determine valuations for the structures’ fields that result in a valid structure. Our experiments on repairing both library data structures, as well as, stand-alone applications demonstrate the utility and efficiency of the approach in repairing large structures, enabling programs to recover from crippling errors and proceed with their executions. Assertion-based repair presents a novel post-deployment mechanism that integrates with existing and newly developed software, providing them with the defensive ability to recover from unexpected runtime errors. Programmers already understand the advantages of using assertions and are comfortable with writing them. Providing new analyses and powerful extensions for them presents an attractive direction towards building more reliable software. / text

The last few years have seen a resurgence of interest in the use of symbolic execution--program analysis technique developed more than three decades ago to analyze program execution paths. However, symbolic execution remains an expensive technique and scaling it remains a key technical challenge. There are two key factors that contribute to its cost: (1) the number of paths that need to be explored and (2) the cost of constraint solving, which is typically required for each path explored. Our insight is that the cost of symbolic execution can be reduced by an incremental approach, which uses static analysis and dynamic analysis to focus on relevant parts of code and reuse previous analysis results, thereby addressing both the key cost factors of symbolic execution. This dissertation presents Memoized Incremental Symbolic Execution, a novel approach that embodies our insight. Using symbolic execution in practice often requires several successive runs of the technique on largely similar underlying problems where successive problems differ due to some change, which may be to code, e.g., to fix a bug, to analysis parameters, e.g., to increase the path exploration depth, or to correctness properties, e.g., to check against stronger specifications that are written as assertions in code. Memoized Incremental Symbolic Execution, a three-fold approach, leverages the similarities in the successive problems to reduce the total cost of applying the technique. Our prototype tool-set is based on the Symbolic PathFinder. Experimental results show that Memoized Incremental Symbolic Execution enhances the efficacy of symbolic execution. / text

Discrete event simulation is a widely used technique for decision support. The results of the simulation must be reliable for critical decision making problems. Therefore, much research has concentrated on the verification and validation of simulations. In this thesis, we apply a well-known dynamic verification technique, assertion checking method, as a validation technique. Our aim is to validate the particular runs of the simulation model, rather than the model itself. As a case study, the operations of a manufacturing cell have been simulated. The cell, which is METUCIM Laboratory at the Mechanical Engineering Department of METU, has a robot and a conveyor to carry the materials, and two machines to manufacture the items, and a quality control to measure the correctness of the manufactured items. This simulation is monitored and checked by using the Monitoring and Checking (MaC) tool, a prototype developed at the University of Pennsylvania. The separation of low-level implementation details (pertaining to the code) from the high-level requirement specifications (pertaining to the simuland) helps keep monitoring and checking the simulations at an abstract level.

The aim of this study was to analyze the application of the assertion theory as a way to ensure an immediate and effective judicial protection. By means of the procedural autonomy, civil action is defined as the right to ask court an answer to the pleadings addressed to it, regardless of the existence of the substantive law. On account of the inquiry of the theories on the subject of the conditions to exercise capacity to pursue judicial proceedings, several discernments arise as the result of the search to delimitate its legal nature, since the Code of Civil Procedure adopted the eclectic theory of action, whereas the lawsuit is seen as the right for an answer to the claims made in court. Nevertheless, these concepts should be reviewed. Access to Justice as a fundamental right is stipulated in article 5, XXXV, of the Brazilian Federal Constitution, therefore under-constitutional law must not exclude from judicial review any injury or threat to injury to any given right. Consequently, in a preliminary view, the action constitutional guarantees consists in ensuring, therefore, the lawsuit itself, the right to act, the right to exercise a citizenship, the access to a fair, adequate and effective juridical order. Therefore it is essential that the judge is aware of this reality, in order to apply the procedural techniques that best suits the requirements of the substantive law, due to the fundamental right to an effective jurisdiction concerning the requirements for exercising civil action, since procedural law establishes such conditions for a proper judicial answer to the subjective right. Depending on what moment the conditions for exercising a legal demand are analyzed by the judge, doctrine varies to consider them a preliminary issue or question of merit, thus influencing, the nature of the jurisdictional provision. For that reason, we Will briefly review the constitutional precept of access to justice and procedural limitations established by the conditions of action. We will ascertain the eclectic theory adopted by systematic procedural and we will conclude with the doctrinal and jurisprudential understanding that the courts have been giving shelter to the theory of assertion, seeking to ensure a swift and active judicial protection. / O trabalho estuda a aplicação da teoria da asserção como forma de garantir uma tutela jurisdicional célere e efetiva. Com a autonomia processual, a ação surge como direito de exigir do Poder Judiciário uma resposta diante das pretensões a ele dirigidas, independente da existência do direito material. Ao estudar as teorias da ação, surgem vários conceitos para delimitar sua natureza jurídica, tendo o CPC adotado a teoria eclética da ação, na qual a ação é vista como o direito a uma resposta de mérito. O direito abstrato de ação está previsto no artigo 5º, inciso XXXV, da Constituição Federal, pois a lei não poderá excluir da apreciação do Poder Judiciário qualquer lesão ou ameaça de lesão ao direito. Desse modo, o primeiro momento das garantias constitucionais da ação consiste em assegurar, portanto, a própria ação, o direito de agir, o direito de exercer uma cidadania, o acesso à ordem jurídica justa, adequada e efetiva. Assim, é imprescindível que o juiz tenha ciência dessa realidade, a fim de aplicar a técnica processual mais adequada às necessidades do direito material, em decorrência do direito fundamental à jurisdição efetiva acerca das condições da ação, já que a lei processual estabelece tais condições para que o juiz possa julgar o mérito da causa. A depender de que momento as condições da ação venham a ser analisadas, a doutrina pode considerá-las questão preliminar ou mérito, influenciando, assim, na natureza do provimento jurisdicional. Nesse sentido, far-se-á uma análise do preceito constitucional de acesso à justiça e às limitações processuais estabelecidas pelas condições da ação. Analisa-se a teoria eclética adotada pela sistemática processual e finaliza-se com o entendimento doutrinário e jurisprudencial que vêm dando os Tribunais ao acolher a teoria da asserção, buscando garantir uma tutela jurisdicional célere e efetiva.

One usually makes assertions by means of uttering indicative sentences like It is raining. However, not every utterance of an indicative sentence is an assertion. For example, in uttering I will be back tomorrow, one might be making a promise. What is to make an assertion? C.S. Peirce held the view that to assert a proposition is to make oneself responsible for its truth (CP 5.543). In this thesis, I interpret Peirces view of assertion and I evaluate Peirces reasons for holding it. I begin by reconstructing and assessing Peirces case for such view as it appears in (EP 2.140, 1903), (EP 2.312-313, 1904), and (CP 5.546, 1908). Then, I continue by elaborating on three aspects of Peirces view of assertion, namely, assertion as an act involving a certain kind of responsibility, the proposition as what is asserted, and responsibility for truth as a responsibility to give reasons. With respect to these three aspects, I argue for the following claims: (1) Peirce construed the responsibility involved in asserting as a moral responsibility; (2) Peirce held that propositions are types; and (3) Peirce was committed to a dialogical interpretation of responsibility to give reasons. Finally, I end by presenting two objections to Peirces view of assertion and its corresponding replies. I conclude that Peirces account of assertion is a valuable contribution to the philosophical debate on assertion. / Costumamos fazer asserções quando proferimos sentenças indicativas como \"Está chovendo\". Mas, não toda proferição de uma sentença indicativa é uma asserção. Por exemplo, quando dissemos vou voltar amanhã, poderíamos estar fazendo uma promessa. O que é fazer uma asserção? C.S. Peirce argumentou que \"asseverar uma proposição é fazer-se responsável pela sua verdade\" (CP 5.543). O propósito do presente texto é interpretar a visão de Peirce sobre a asserção assim como examinar as razões que a suportam. Para cumprir esse propósito, primeiro reconstruo e examino o argumento que, em defesa da sua visão, Peirce propôs em (EP 2.140, 1903), (EP 2.312-313, 1904), e (CP 5.546, 1908). A continuação aponto para três aspetos constitutivos dessa visão, a saber, a asserção como um ato que envolve certa responsabilidade, a proposição como o que é asseverado, e a responsabilidade pela verdade como a responsabilidade de dar razões. Tendo em consideração esses três aspetos, passo a defender as seguintes teses: (1) Peirce concebeu a responsabilidade envolvida na asserção como uma responsabilidade moral. (2) Peirce pensou que as proposições são types. (3) Peirce interpretou responsabilidade de dar razões de modo dialógico. Para finalizar, apresento duas objeções à visão de Peirce sobre a asserção e as réplicas respetivas. Concluo que a visão de Peirce sobre a asserção é uma contribuição valiosa ao debate filosófico sobre a asserção.

Submitted by Rafael Santana (rafael.silvasantana@ufpe.br) on 2017-08-31T18:01:45Z No. of bitstreams: 2 license_rdf: 811 bytes, checksum: e39d27027a6cc9cb039ad269a5db8e34 (MD5) Tese-tmp - Entrega Biblioteca.pdf: 5443368 bytes, checksum: 91e38ed8db35fc81cfcacf861c54bc96 (MD5) / Made available in DSpace on 2017-08-31T18:01:45Z (GMT). No. of bitstreams: 2 license_rdf: 811 bytes, checksum: e39d27027a6cc9cb039ad269a5db8e34 (MD5) Tese-tmp - Entrega Biblioteca.pdf: 5443368 bytes, checksum: 91e38ed8db35fc81cfcacf861c54bc96 (MD5) Previous issue date: 2016-10-07 / As linguagens declarativas normalmente atuam no desenvolvimento de aplicações multimídia, pois suas características permitem suportar adequadamente a natureza assíncrona e descritiva dessas aplicações. Neste cenário, a robustez surge como um fator determinante para a qualidade dessas aplicações, dada a vasta quantidade de plataformas e dispositivos usuais, que, ocasionalmente, apresentam problemas de execução. Neste contexto, as especificações dessas linguagens são de grande importância para o processo de desenvolvimento, pois além de direcionar a codificação, definindo as restrições léxicas, sintáticas e semânticas, também formalizam como os conteúdos devem ser executados pelos interpretadores. Este trabalho tem por objetivo investigar a viabilidade de se aplicar análises estruturais e comportamentais orientadas a conformidade para o desenvolvimento de aplicações multimídia, a fim de eliminar a dependência de interpretadores para atestar sua corretude. Para tal, a linguagem NCL foi utilizada como alvo do estudo, devido à sua representatividade para o problema. / Declarative languages are typically used in the development of multimedia applications, as its features allow to properly support the asynchronous and descriptive nature of these applications. In such a scenario, robustness appears as a determining factor in the quality of these applications, given the vast amount of platforms and devices that occasionally have implementation problems. In this context, specifications of these languages are of great importance to the development process, as they impose lexical, syntactic and semantic restrictions, and also formalize how content must be interpreted. This work aims at investigating the feasibility of applying structural and behavioral analysis oriented to compliance to the development of multimedia applications in order to eliminate dependence on interpreters to prove its correctness. To this end, NCL was used as a target of study due to its problem representativeness.