Technical reports / Department Informatik
- Department Informatik (11) (remove)
- Architecture-Violation Management for Internal Software Ecosystems: An Industry Case Study (2016)
- Large-scale intra-organizational, yet decentralized software projects that involve various self-contained organizational units require architecture guidelines to coordinate development. Tool support allows for managing architecture-guideline violations to ensure software quality. However, the decentralized development across units results in significant violation-management hurdles that must be considered. Derived from our previous research, we have elaborated a set of capabilities required to manage guideline violations within two of these large-scale software projects at Siemens. Their main purpose is process support for resolving violations, aiming to reduce the architects' and developers' effort required to handle them. We developed a prototype that implements the capabilities and conducted a qualitative case study on their usefulness, involving 9 experts from our study systems. Our capabilities are considered as very important and reveal great potential to ease violation management for large-scale software engineering.
- A Flexible, Adaptive System for Data-Stream Processing in Energy-Constrained Ad-hoc Networks (2015)
- Today's generation of sensor networks reflect several changes in system characteristics over traditional sensor networks. These changes affect three key aspects: energy as a fundamental resource, stream data processing, and the inherently dynamic structure of the overall system. In this paper we extract and present eight distinct challenges aligned to the key aspects which need to be addressed in the future. We use data of ongoing science and research projects to extract the most important challenges. These challenges need to be tackled in order to provide the basis for a flexible and adaptive system design which supports data-stream processing in energy-constrained ad-hoc networks.
- Privacy-Preserving Email Forensics (2015)
- In many digital forensic investigations, email data needs to be analyzed. However, this poses a threat to the privacy of the individual whose emails are being examined and in particular becomes a problem if the investigation clashes with privacy laws. This is commonly addressed by allowing the investigator to run keyword searches and to reveal only those emails that contain at least some of the keywords. While this could be realized with standard cryptographic techniques, further requirements are present that call for novel solutions: (i) for investigation-tactical reasons the investigator should be able to keep the search terms secret and (ii) for efficiency reasons no regular interaction should be required between the investigator and the data owner. We close this gap by introducing a novel cryptographic scheme that allows to encrypt entire email boxes before handing them over for investigation. The key feature is that the investigator can non-interactively run keyword searches on the encrypted data and decrypt those emails (and only those) for which a configurable number of matches occurred. Our implementation as a plug-in for a standard forensic framework confirms the practical applicability of the approach.
- Inner Source in Platform-Based Product Engineering (2015)
- Inner source is an approach to collaboration across intra-organizational boundaries for the creation of shared reusable assets. Prior project reports on inner source suggest improved code reuse and better knowledge sharing. Using a multiple-case case study research approach, we analyze the problems that three major software development organizations were facing in their platform-based product engineering efforts. We find that a root cause, the separation of product units as profit centers from a platform organization as a cost center, leads to delayed deliveries, increased defect rates, and redundant software components. All three organizations assume that inner source can help solve these problems. The article analyzes the expectations that these companies were having towards inner source and the problems they were experiencing or expecting in its adoption. Finally, the article presents our conclusions on how these organizations should adapt their existing engineering efforts.
- An Experiment in Wait-Free Synchronisation of Priority-Controlled Simultaneous Processes: Guarded Sections (2015)
- Wait-free synchronisation gives any process in the system strong progress guarantees, irrespective of number and behaviour of other processes simultaneously competing for shared resources (i.e., data structures and code sections). It ensures completion of any operation in a finite number of steps and, thus, provides the basis to derive bounded above or even constant executions times for non-sequential programs. This characteristic is of special meaning for time-dependent processes typical for real-time (embedded) systems. But wait-free synchronisation against the background of especially arbitrary data and code structures is no bed of roses. This paper is about organising non-sequential programs to the benefit of wait-free synchronisation. Conventional critical sections are designed as so called guarded sections. Unlike critical sections, preferential processes never block at entrance to a guarded section though only one process at a time is allowed to pass through. Competing processes are forced into bypass but, if necessary and by using futures, they can synchronise on concurrent state changes inside the respective section. In consequence of this measure, the execution model of guarded sections constrains the overlapping pattern of interacting (simultaneous) processes. Thereby, efficient wait-free synchronisation of the "guarding operations" is a gratifying by-product. First experiments on a 80-way multi-core system show that non-blocking wait-free synchronised guarded sections outperform lock-based protection schemes such as MCS-locks.
- From Computer Forensics to Forensic Computing: Investigators Investigate, Scientists Associate (2014)
- This paper draws a comparison of fundamental theories in traditional forensic science and the state of the art in current computer forensics, thereby identifying a certain disproportion between the perception of central aspects in common theory and the digital forensics reality. We propose a separation of what is currently demanded of practitioners in digital forensics into a rigorous scientific part on the one hand, and a more general methodology of searching and seizing digital evidence and conducting digital investigations on the other. We thereby mark out the route for computer forensics to turn into a true forensic science. To illustrate the feasibility of the proposed path, we supply a couple of practical examples, as well as a list of exemplary questions that should be answered by digital forensic scientists.
- DiOS: Dynamic Privacy Analysis of iOS Applications (2014)
- We present DiOS, a practical system to perform automated dynamic privacy analysis of iOS apps. DiOS provides a highly scalable and fully automated solution to schedule apps from the official Apple App Store for privacy analysis to iOS devices. While apps are automatically executed, user interaction is simulated using random and smart execution strategies, and sensitive API calls as well as network connections are tracked. We evaluated the system on 1,136 of the most popular free apps from the iOS App Store and found out that almost 20% of all investigated apps are tracking users' locations on every app start, one third of all accesses to users' address books are attributed to apps from the social network category and almost half of all apps are tracking users' app usage behavior by incorporating tracking and advertising libraries.
- Erfolgsmethoden der Open-Source-Governance und -Compliance (2014)
- Open-Source-Software ist weit verbreitet und wird nicht nur als alleinstehende Anwendungen eingesetzt, sondern auch als Komponenten in Produkten. Entsprechend wichtig ist es für Unternehmen, die Open-Source-Komponenten verwenden, mittels Open-Source-Governance und -Compliance sicherzustellen, dass die dem Einsatz von Open Source eigenen Risiken rechtzeitig und korrekt adressiert werden. Aufbauend auf früherer Arbeit zu den Risiken der Open-Source-Verwendung stellt dieser Artikel ein Modell und beispielhafte Erfolgsmethoden („Best Practices“) vor, mit denen Produktunternehmen diesen Risiken begegnen können. Das Modell und die Erfolgsmethoden stellen einen Auszug aus einem in Entwicklung befindlich Handbuch zur Open-Source-Governance und -Compliance dar. Weitere Information zu diesem Handbuch kann vom ersten Autor erfragt werden.
- MATINEE: A Quality-of-Service-aware Event Semantics Modeling Language (2014)
- Distributed event-based systems have risen in significance over the last few years across many different application domains. Still, the configuration of available communication middleware solutions remains an elaborate task driven by technical terms and manual performance optimization. We present the M2etis Quality-of-service-aware Semantics Modeling Language (MATINEE), a domain-specific language for modeling the QoS requirements and semantic properties of event-based systems in the terminology of the application domain. No knowledge of the technical terms of the underlying middleware solution is required by the application developers to conduct the configuration. Embedded in a novel configuration methodology provided by the M2etis project, MATINEE specifications are interpreted to automatically derive optimal middleware configurations without the need for manual optimization. The purpose of MATINEE is to provide a flexible language that can easily be adapted to different application domains. We focus on the language specification of MATINEE, briefly sketch our configuration methodology and present related language approaches.
- A Cost Constrained Boosting Algorithm for Fast Object Detection (2013)
- Boosting methods are among the most widely used machine learning techniques in practice for various reasons. In many scenarios, however, their use is prevented by runtime constraints. In this paper we propose a novel technique for reducing the computational complexity of hierarchical classifiers based on AdaBoost, such as the probabilistic boosting tree, which are often used for object detection. We modify AdaBoost training so that the hypothesis generation is no longer based solely on the weak learner’s training error but also on a measure of hypothesis complexity. This is achieved by incorporating a cost function into the optimization process, effectively constraining feature selection, which leads to a reduced overall classifier complexity and thus shorter evaluation times. The validity of the approach is shown in an experimental valuation on real-world data. In a cross validation experiment with a system for automatic segmentation of liver tumors in CT images, the evaluation cost for classifying previously unseen samples could be reduced by up to 76% using the methods described here without losing classification accuracy.