Test Driven Development (TDD), Model-Driven Development (MDD), and Test Case Generation with their associated practices and tools each in their own right promise to deliver robust higher quality code more economically then other approaches. These process are not mutually exclusive but are not typically used together. This thesis develops a combined approach using complimentary aspects of each of the above three process. Test cases are described, generated, and then injected back into the model, which is then used to produce the test and production code. We have enhanced a model-driven tool to support the approach, adding a test case generator, capable of understanding augmented MDD software model and utilizing the constraints captured in our test-centric language to generate model-level test cases back into the model. Our results show that, with a reduction in overall effort one can produce a tested model-based system in which its test and implementation for multiple platforms such as C and Java, using one of multiple test xUnit frameworks.

O objetivo da pesquisa apresentada neste trabalho foi investigar como simular modelos descritos em Unified Modelling Language (UML) para sistemas de software especificados em nível de negócio. Um simulador de um modelo UML em nível de negócio pode ser uma ferramenta útil para um projetista que procura por erros ou modelos incompletos. Usando abordagens de desenvolvimento tradicionais, estes tipos de erros seriam encontrados apenas em estágios posteriores do ciclo de vida de desenvolvimento do sistema. Os principais resultados deste trabalho são a especificação de uma arquitetura de uma máquina virtual capaz de executar todas as ações descritas em um modelo UML, e o protótipo chamado ModSim, o qual executa um modelo UML recebido no formato XML Metadata Interchange (XMI). / The main goal of the research presented in this Master Thesis was to investigate how to simulate UML based models for software systems specified on business level. A simulator of a UML model on business level can be a useful tool for a designer looking for errors or incomplete models. Using traditional development approaches, these kind of errors would be found only on lates stages of the system development. The main results of this work are the specification of an architecture of a virtual machine capable of executing all actions described in the UML model, and the prototype named ModSim, which executes a UML model received in XMI format.

No description available.

Penetration testing is widely used in industry as a test method for web application security assessment. However, penetration testing is often performed late in a software development life cycle as an isolated task and usually requires specialized security experts. There is no well-defined test framework providing guidance and support to general testers who usually do not have in-depth security expertise to perform a systematic and cost-efficient penetration test campaign throughout a security-oriented software development life cycle. In this thesis, we propose a model-driven penetration test framework for web applications that consists of a penetration test methodology, a grey-box test architecture, a web security knowledge base, a test campaign model, and a knowledge-based PenTest workbench. The test framework enables general testers to perform a penetration test campaign in a model-driven approach that is fully integrated into a security-oriented software development life cycle. Security experts are still required to build up and maintain a web security knowledgebase for test campaigns, but the general testers are capable of developing and executing penetration test campaigns with reduced complexity and increased reusability in a systematic and cost-efficient approach. A prototype of the framework has been implemented and applied to three web applications: the benchmark WebGoat web application, a hospital adverse event management system (AEMS), and a palliative pain and symptom management system (PAL-IS). An evaluation of the test framework prototype based on the case studies indicates the potential of the proposed test framework to improve how penetration test campaigns are performed and integrated into a security-oriented software development life cycle.

Penetration testing is widely used in industry as a test method for web application security assessment. However, penetration testing is often performed late in a software development life cycle as an isolated task and usually requires specialized security experts. There is no well-defined test framework providing guidance and support to general testers who usually do not have in-depth security expertise to perform a systematic and cost-efficient penetration test campaign throughout a security-oriented software development life cycle. In this thesis, we propose a model-driven penetration test framework for web applications that consists of a penetration test methodology, a grey-box test architecture, a web security knowledge base, a test campaign model, and a knowledge-based PenTest workbench. The test framework enables general testers to perform a penetration test campaign in a model-driven approach that is fully integrated into a security-oriented software development life cycle. Security experts are still required to build up and maintain a web security knowledgebase for test campaigns, but the general testers are capable of developing and executing penetration test campaigns with reduced complexity and increased reusability in a systematic and cost-efficient approach. A prototype of the framework has been implemented and applied to three web applications: the benchmark WebGoat web application, a hospital adverse event management system (AEMS), and a palliative pain and symptom management system (PAL-IS). An evaluation of the test framework prototype based on the case studies indicates the potential of the proposed test framework to improve how penetration test campaigns are performed and integrated into a security-oriented software development life cycle.

The most dominant architecture in the contemporary business domain is Service Oriented Architecture (SOA). The large number of the existing service description and discovery systems available today, including the ones proposed in research proposals, reveals an increasing need for adaptive, semantically enriched and context-aware, wide-area service discovery. This need will become more intense in the years to come as the number of available services increases rapidly. The main reason behind the existence of a plethora of such systems is that before these initiatives, the standard in service discovery was taking into account only the syntactic descriptions of the services, causing conflicts when services, with similar syntactic descriptions, needed to be evaluated. The research solutions available today offer efficient and accurate discovery at the syntactic, functional semantic and non-functional semantic level. However, the problem is that there is no general consensus yet regarding service discovery. Research by its very nature, leads to point solutions rather than complete systems. Based on these observations, we propose an adaptive service description and discovery framework for carrier applications, enabling the model-driven specification of services and client profiles, and also, for allowing the dynamic configuration of the services to meet specific quality requirements defined by the clients. The framework was implemented in the context of Model Driven Development, to ensure platform independence at the level of the specification of services. The framework takes the union of the point solutions offered by research proposals in the area of service description and discovery, creates an abstract model, and can compile that model to platform specific code. More specifically, services for carrier applications can be specified in a platform independent way both in terms of service signatures (syntactic properties) and in terms of the functionality and the QoS service characteristics (semantic properties). A model transformation framework allows for the creation of a platform specific model for the description of services in a specific technology platform (e.g., Web services). The framework is extensible to accommodate future extensions. In addition, as a proof of concept, we designed and developed an Eclipse Rich Client Platform (RCP) prototype tool, implementing our proposal.

The most dominant architecture in the contemporary business domain is Service Oriented Architecture (SOA). The large number of the existing service description and discovery systems available today, including the ones proposed in research proposals, reveals an increasing need for adaptive, semantically enriched and context-aware, wide-area service discovery. This need will become more intense in the years to come as the number of available services increases rapidly. The main reason behind the existence of a plethora of such systems is that before these initiatives, the standard in service discovery was taking into account only the syntactic descriptions of the services, causing conflicts when services, with similar syntactic descriptions, needed to be evaluated. The research solutions available today offer efficient and accurate discovery at the syntactic, functional semantic and non-functional semantic level. However, the problem is that there is no general consensus yet regarding service discovery. Research by its very nature, leads to point solutions rather than complete systems. Based on these observations, we propose an adaptive service description and discovery framework for carrier applications, enabling the model-driven specification of services and client profiles, and also, for allowing the dynamic configuration of the services to meet specific quality requirements defined by the clients. The framework was implemented in the context of Model Driven Development, to ensure platform independence at the level of the specification of services. The framework takes the union of the point solutions offered by research proposals in the area of service description and discovery, creates an abstract model, and can compile that model to platform specific code. More specifically, services for carrier applications can be specified in a platform independent way both in terms of service signatures (syntactic properties) and in terms of the functionality and the QoS service characteristics (semantic properties). A model transformation framework allows for the creation of a platform specific model for the description of services in a specific technology platform (e.g., Web services). The framework is extensible to accommodate future extensions. In addition, as a proof of concept, we designed and developed an Eclipse Rich Client Platform (RCP) prototype tool, implementing our proposal.

Software systems will eventually contribute to their own maintenance using implementations of self-awareness. Understanding how to specify, model, and implement software with a sense of self is a daunting problem. This research draws inspiration from the automatic functioning of a gimbal---a self-righting mechanical device that supports an object and maintains the orientation of this object with respect to gravity independently of its immediate operating environment. A software gimbal exhibits a self-righting feature that provisions software with two auxiliary mechanisms: a historical mechanism and a reflective mechanism. The historical mechanism consists of behavior classifiers trained on statistical models of data that are collected from executions of the program that exhibit known behaviors of the program. The reflective mechanism uses the historical mechanism to assess an ongoing or selected execution. This dissertation presents techniques for the identification and modeling of program execution features as statistical models. It further demonstrates how statistical machine-learning techniques can be used to manipulate these models and to construct behavior classifiers that can automatically detect and label known program behaviors and detect new unknown behaviors. The thesis is that statistical summaries of data collected from a software program's executions can model and predict external behaviors of the program. This dissertation presents three control-flow features and one value-flow feature of program executions that can be modeled as stochastic processes exhibiting the Markov property. A technique for building automated behavior classifiers from these models is detailed. Empirical studies demonstrating the efficacy of this approach are presented. The use of these techniques in example software engineering applications in the categories of software testing and failure detection are described.

Graphic user interface has become the mainstream of today¡¦s web-based systems. The object oriented technique and the diagrams from the Unified Modeling Language (UML) are becoming the major tools for modeling the platform independent model (PIM) of a web-based system. Once the PIM is constructed, the results can then be transformed into its platform specific model and template code based on the model driven architecture (MDA) approach. However, the detailed guideline for the transformation from PIM to the Microsoft .Net platform is lacking. Therefore, this study presents a methodology which provides guidelines for the transformation from PIM to Microsoft .Net platform for a web-based system. The research methodology is articulated using the design science research methodology. A usability evaluation with a real-world web-based system case is performed to demonstrate its applicability. The results indicated that with this proposed method, the system developer can effectively transform the PIM of a web-based system into its Microsoft .Net platform and template code.

Modeling software with unified modeling language (UML) and model driven architechutre (MDA) concept have become the new paradigm of modern systems analysis and design. Several CASE tools have been introduced to facilitate the transformation from platform independent model (i.e., class diagram) to platform specific model, and thereby enhance the efficiency of system development. This research presents a systematic methodology which integrated the UML and MDA concept with CASE tool to transform the class diagram into web-based user interface during the system development process. A real-world case using the integrated techniques is presented and the Rational Rose is used to illustrate the concepts, application, and the advantages of using the proposed methodology. With this approach, the system developer can transform class diagram into web-based user interface automatically and thereby enhance the efficiency of system development.