Refine
Year of publication
Document Type
- Article (386)
- Conference Proceeding (318)
- Part of a Book (71)
- Workingpaper / Report (34)
- Master's Thesis (7)
- Book (5)
- Doctoral Thesis (5)
- Collection (4)
- Patent (3)
- Preprint (3)
Language
- English (847) (remove)
Keywords
- VSVR (39)
- DOAJ (37)
- Virtual (TV) Studio (23)
- FHD (22)
- Forena (12)
- Poster (8)
- security (8)
- security requirement (7)
- DEAL (6)
- Lehre (6)
Department/institution
- Fachbereich - Medien (342)
- Fachbereich - Maschinenbau und Verfahrenstechnik (293)
- Creative Media Production and Entertainment Computing (142)
- Fachbereich - Sozial- & Kulturwissenschaften (90)
- Fachbereich - Elektro- & Informationstechnik (67)
- Sound and Vibration Engineering (42)
- Digitale Vernetzung und Informationssicherheit (30)
- Fachbereich - Architektur (22)
- Fachbereich - Wirtschaftswissenschaften (17)
- Intelligente Mensch-Technik-Interaktion (12)
- Hochschulbibliothek (6)
- Digital Learning and Digital Literacy (4)
- Hochschule Düsseldorf (3)
- Fachbereich - Design (1)
The Security Twin Peaks
(2011)
In this paper, we present an approach to adopt UMLsec, which is defined for UML 1.5, to support the current UML version 2.3. The new profile UMLsec4UML2 is technically constructed as a UML profile diagram, which is equipped with a number of integrity conditions expressed using OCL. Consequently, the UMLsec4UML2-profile can be loaded in any Eclipse-based EMF- and MDT-compatible UML editing tool to develop and analyze different kinds of security models. The OCL constraints replace the static checks of the tool support for the old UMLsec defined for UML 1.5. Thus, the UMLsec4UML2-profile not only provides the whole expresiveness of UML2.3 for security modeling, it also brings considerably more freedom in selecting a basic UML editing tool, and it integrates modeling and analyzing security models. Since UML2.3 comprises new diagram types, as well as new model elements and new semantics of diagram types already contained in UML1.5, we consider a number of these changes in detail. More specifically, we consider composite structure and sequence diagrams with respect to modeling security properties according to the original version of UMLsec. The goal is to use UMLsec4UML2 to specify architectural security patterns.
In this paper, the author aim to present a threat and risk-driven methodology to security requirements engineering. The chosen approach has a strong focus on gathering, modeling, and analyzing the environment in which a secure ICT-system to be built is located. The knowledge about the environment comprises threat and risk models. As presented in the paper, this security-relevant knowledge is used to assess the adequacy of security mechanisms, which are then selected to establish security requirements.
Developing security-critical systems is difficult, and there are many well-known examples of vulnerabilities exploited in practice. In fact, there has recently been a lot of work on methods, techniques, and tools to improve this situation already at the system specification and design. However, security-critical systems are increasingly long-living and undergo evolution throughout their lifetime. Therefore, a secure software development approach that supports maintaining the needed levels of security even through later software evolution is highly desirable. In this chapter, we recall the UMLsec approach to model-based security and discuss on tools and techniques to model and verify evolution of UMLsec models.
The authors present a security engineering process based on security problem frames and concretized security problem frames. Both kinds of frames constitute patterns for analyzing security problems and associated solution approaches. They are arranged in a pattern system that makes dependencies between them explicit. The authors describe step-by-step how the pattern system can be used to analyze a given security problem and how solution approaches can be found. Afterwards, the security problems and the solution approaches are formally modeled in detail. The formal models serve to prove that the solution approaches are correct solutions to the security problems. Furthermore, the formal models of the solution approaches constitute a formal specification of the software to be developed. Then, the specification is implemented by generic security components and generic security architectures, which constitute architectural patterns. Finally, the generic security components and the generic security architecture that composes them are refined and the result is a secure software product built from existing and/or tailor-made security components.
Considering legal aspects during software development is a challenging problem, due to the cross-disciplinary expertise required. The problem is even more complex for cloud computing systems, because of the international distribution, huge amounts of processed data, and a large number of stakeholders that own or process the data. Approaches exist to deal with parts of the problem, but they are isolated from each other. We present an integrated method for elicitation of legal requirements. A cloud computing online banking scenario illustrates the application of our methods. The running example deals with the problem of storing personal information in the cloud and based upon the BDSG (German Federal Data Protection Act). We describe the structure of the online banking cloud system using an existing pattern-based approach. The elicited information is further refined and processed into functional requirements for software development. Moreover, our method covers the analysis of security-relevant concepts such as assets and attackers particularly with regard to laws. The requirements artifacts then serve as inputs for existing patterns for the identification of laws relevant for the online banking cloud system. Finally, our method helps to systematically derive functional as well as security requirements that realize the previously identified laws.
The discipline of engineering secure software and services brings together researchers and practitioners from software, services, and security engineering. This interdisciplinary community is fairly new, it is still not well integrated and is therefore confronted with differing perspectives, processes, methods, tools, vocabularies, and standards. We present a Common Body of Knowledge (CBK) to overcome the aforementioned problems. We capture use cases from research and practice to derive requirements for the CBK. Our CBK collects, integrates, and structures knowledge from the different disciplines based on an ontology that allows one to semantically enrich content to be able to query the CBK. The CBK heavily relies on user participation, making use of the Semantic MediaWiki as a platform to support collaborative writing. The ontology is complemented by a conceptual framework, consisting of concepts to structure the knowledge and to provide access to it, and a means to build a common terminology. We also present organizational factors covering dissemination and quality assurance.
An ISO 27001 compliant information security management system is difficult to create, due to the the limited support for system development and documentation provided in the standard. We present a structured analysis of the documentation and development requirements in the ISO 27001 standard. Moreover, we investigate to what extent existing security requirements engineering approaches fulfill these requirements. We developed relations between these approaches and the ISO 27001 standard using a conceptual framework originally developed for comparing security requirements engineering methods. The relations include comparisons of important terms, techniques, and documentation artifacts. In addition, we show practical applications of our results.
The “Journal of Virtual Reality and Broadcasting” is an open access E-journal covering advanced media technology for the integration of human computer interaction and modern information systems. The main focus is on the creation of synergies between such basic technologies as computer graphics and state-of-the-art broadcasting techniques.
The main goals are to publish research results in the field of Virtual Reality and Broadcasting, to provoke discussions, and to promote the exchange of ideas and information. Developments in the area have a direct effect on society, therefore social aspects will also be considered. As an interdisciplinary field Virtual Reality requires multilateral collaboration in order to enable new applications.
RB publishes articles consecutively and in electronic form only. All articles are peer-reviewed in a strict review process by at least three independent experts from the appropriate field of research and appear in the English language. The articles are organized in one volume per year with ten to twenty articles. Material that has been previously presented at conferences undergo a major revision and are extended and modified by the authors with at least 20% new material according to the Journal's policy for previously published articles. The Journal has been established in 2004.
Currently, the submission and publication of articles is free of charge. No author fees are applied.
Marktdaten
(2018)
Die in der Schriftenreihe Trading verwendeten Forschungsdaten beinhalten historische Kursdaten, geliefert von Lenz+Partner AG (Deutschland), für eine Auswahl an Aktien. Die Datei „FEBRDUSA_1“ zeigt diese Auswahl in Form der deutschen Wertpapierkennnummer (Spalte „Titel“), des Handelszeitraums (Spalten „Beginn“ und „Ende“) und des Aktiennamens. Kursdaten sind in dieser Datei nicht enthalten, sondern liegen in einer umfangreichen Datenbank vor.
Die Marktdaten umfassen 867 Aktien und sind das Ergebnis eines im Jahr 2015 durchgeführten Auswahlprozesses mit dem Ziel, Datenqualität und Handelbarkeit der Aktien zu verbessern. Es wurden folgende Bedingungen gefordert:
- Die Aktien werden an der Frankfurter Börse gehandelt.
- Sie sind in einem der deutschen Aktienindizes DAX, MDAX, TECDAX, SDAX, HDAX, CDAX, Technology All Share, Prime All Share und GEX oder in den amerikanischen Aktienindizes S&P 500 oder Nasdaq 100 gelistet.
- Die Kursdaten der in Frankfurt gehandelten Aktien enden nicht vor dem Jahr 2014.
- Der (unbereinigte) Eröffnungskurs Ende 2013 beträgt mindestens 1 EUR. Diese Bedingung soll dazu beitragen, das Handeln von „penny stocks“ zu verhindern.
Die vorliegende Marktdefinition resultierte in 867 Aktien, die frühestens am 11. Dezember 2014 enden, sodass eine Auswertung der Marktdaten mit vollständigen Kurswerten bis zu diesem Zeitpunkt möglich ist. Der Markt ist groß genug, um interessante Kaufbedingungen mit einer ausreichend großen Anzahl an Kaufkandidaten zu untersuchen.
The OECD Base Erosion Profit Shifting (BEPS) Initiative as well as the current fairness oriented public discussion regarding the taxation of digital business models highlight the importance and complexity of the arm's length principle. In a theoretical model of an internationally fragmented digital good's production process, we show that fairness considerations of tax authorities (namely inequity aversion) can result in a falling apart between a perceived "fair" and arm's length distribution of profits across tax jurisdictions. Our model predicts that a multinational firm follows the fundamental paradigm of international taxation, i.e. the arm's length principle, to properly incentivize internal agents involved in the production of a digital good. However, with inequity averse tax authorities, we find that tax authorities "prefer" a more equal distribution of profits compared to the arm's length allocation. From a multinational firm's perspective, inequity aversion among tax authorities dampens the strategic effect to - in accordance with arm's length principle - shift profits to low tax countries.
Progressive web applications (PWAs) seem to be the next big thing in the mobile landscape. These are web applications with “super-powers” which are meant to provide the kinds of user experiences previously only native mobile applications could. Therefore they are able to match native applications in their capabilities but still thrive on the reachability of the web. They achieve this by implementing certain characteristics which originate from innovative standards and sophisticated best practices. Conveniently, as it is the web, PWAs are working seamlessly cross-platform. One of the closest things to a PWA so far may be an application created with the NativeScript framework. Such an application is also developed with web technologies yet able to use any native interface directly. This is made possible by using a designated runtime for mediating between JavaScript and the mobile system. Eventually, NativeScript is able to offer a high degree nativity yet also of convenient abstraction during development. This paper is set out to deliver further insight into both approaches by contrasting them based on the characteristics of PWAs. For this purpose, these characteristics are elaborated and adjusted to be applicable to native mobile applications. Hence a reasonable basis for what to expect from a native application is derived. Then NativeScript is assessed on this basis by the means of transferable concepts and technologies as well as a prototypic mobile application. Finally, an informed discussion and conclusion is performed based on the results. The comprehensive characteristics of PWAs resolve previous shortcomings with well thought out concepts and new technologies. These are transferable to native mobile applications to a far extent and may also be put into practice with NativeScript. The framework’s approach may be very well called ingenious, however, in the long run it might fall short of the innovative concept of PWAs. Having said this, it is still able to serve as a practical measure for creating appealing user experiences for multiple systems with arguably little effort. Due to large overlap a transformation between the two application types is a realistic option. Either way, web technologies are far from what they used to be and it is exciting to see how the mobile and web landscape will evolve in the future.
While developing for multiple platforms at once seems like a convenient solution, there are several challenges arising when trying to abstract the entire mobile development. This paper is meant to evaluate current cross-platform development for mobile applications. The background for its necessity, its conceptual approach and the problems to face when developing cross-platform were determined and explained in detail. Afterwards, certain solutions were evaluated against the former insights. Based on the results, an informed discussion and conclusion was performed. The mobile environment consist of only two big players by now, Android and iOS. These operating systems differ in architecture, design and consequently in the way applications are developed for each of them. Therefore, high demands are made towards cross-platform solutions. Tools which allow for the creation of applications for multiple platforms at once have to match native applications in regard to user experience and performance. At the same time they need to be able to optimize developments with the goal of being cost efficient. Apache Cordova, Xamarin and NativeScript were selected for evaluation in regard to their ability to meet these requirements. Cordova acts as the comparison group of cross-platform tools. It is the big player in the field and there are reasons for this. However, aspiring solutions with higher nativity and ambitious approaches are emerging. Xamarin and NativeScript deliver top quality results while offering loosely coupled developments. Therefore it is possible to develop high quality applications and still benefit from the advantages of platform-independent solutions. As a consequence mobile development is about to change in the foreseeable future. More sophisticated approaches may lead to a higher number of developments done cross-platform, and rightfully so.
Investing as Random Trial
(2017)
We introduce an investment algorithm for a market of individual securities. The investment algorithm is derived from constraints depending on investment parameters in order to limit the risk and to take into account an individual investor. One constraint is devoted to trading costs. Purchased securities are selected randomly among securities that meet the buy condition, making trading a random trial. Simulations with historical price data are demonstrated for a simple example: The buy condition is evaluated on the basis of the price relationship for two subsequent trading days and the sales condition is defined by holding securities only for one day. A trading expert evaluates the expected return for the investment algorithm with respect to the random selection. Thus, the expert informs precisely on how many market players perform using the same investment algorithm. Its findings are for a parametrized set of buy conditions simultaneously, which makes a trading expert a valuable tool for theorists as well as for practitioners. In our example, the trading expert demonstrated clearly a significant mean reversion effect for a horizon of one day.
Reconciling work and family life is one of the main issues of welfare state policies in the fields of childcare and long-term care. On that account, policy and research are focused almost exclusively on women – often on the reconciliation of work and childbearing – and social policy at the state level. In our study, we concentrate on men who reconcile gainful employment with elderly care, and we include the company level – a level of analysis often neglected in traditional theoretical approaches and typologies of comparative welfare state research. In Germany, during the last decade, the share of sons who are responsible for taking care of their elderly relatives has remarkably increased. In our qualitative research, we carried out comparative case studies in eleven German companies. We conducted around 60 interviews with male employees caring for an elderly relative, as well as with members of the works councils and human resources departments in different kinds of companies. We analysed which familial, social, professional, legal as well as occupational resources are central for these men, how they cope with reconciling work and care, and which gaps in the welfare system they identify. Interestingly, the overwhelming majority of the caring sons claim not to have problems in reconciling work and care, although they spend significant time on caring. In this paper we try to explain this pattern by looking at their typical care arrangements. We found that while women tend to organise employment around care, men rather seem to organise care around their employment. Given the feminist critique of the “adult worker model” this is an interesting result and needs theoretical reflection. Do men have the solution to the care-blindness of the “adult worker model” without falling into the “cold modern model of care”? Which resources are mainly used in “adult worker care arrangements”? Where are the limits of the approach?
The construction of a basis of a certain lattice of interest is a basic tool in many fields of algorithmic number theory. All too often we can not compute with the original lattices because of irrational numbers involved but have to work with approximations of them. While helpful bounds were shown about the reduction of lattice bases in cite{buchmann94reducing}, here we introduce the notion of a $(epsilon,delta)$-constructable basis of a lattice and determine the precision of vectors that is necessary to extend a set to a $(epsilon,delta)$-constructable basis.