@inproceedings{WeissRennerMottoketal., author = {Weiss, Nils and Renner, Sebastian and Mottok, J{\"u}rgen and Matoušek, V{\´a}clav}, title = {Automated Threat Evaluation of Automotive Diagnostic Protocols}, series = {ESCAR USA, 2021, Virtual}, booktitle = {ESCAR USA, 2021, Virtual}, url = {http://nbn-resolving.de/urn:nbn:de:bvb:898-opus4-29882}, pages = {20}, abstract = {Diagnostic protocols in automotive systems can offer a huge attack surface with devastating impacts if vulnerabilities are present. This paper shows the application of active automata learning techniques for reverse engineering system state machines of automotive systems. The developed black-box testing strategy is based on diagnostic protocol communication. Through this approach, it is possible to automatically investigate a highly increased attack surface. Based on a new metric, introduced in this paper, we are able to rate the possible attack surface of an entire vehicle or a single Electronic Control Unit (ECU). A novel attack surface metric allows comparisons of different ECUs from different Original Equipment Manufacturers (OEMs), even between different diagnostic protocols. Additionally, we demonstrate the analysis capabilities of our graph-based model to evaluate an ECUs possible attack surface over a lifetime.}, language = {en} } @misc{ReuterLangerHauseretal., author = {Reuter, Rebecca and Langer, Thomas and Hauser, Florian and Muckelbauer, Daniel and Gegenfurtner, Andreas}, title = {Automatic generation of areas of interest in eye tracking: The case of software engineering}, series = {Earli Book of Abstracts}, journal = {Earli Book of Abstracts}, publisher = {RWTH Aachen}, language = {en} } @misc{RennerPozzobonMottok, author = {Renner, Sebastian and Pozzobon, Enrico and Mottok, J{\"u}rgen}, title = {Current and Future Efforts in Benchmarking NIST LWC Ciphers}, series = {4th Lightweight Cryptography Workshop 2020 at NIST, Gaithersburg, USA}, journal = {4th Lightweight Cryptography Workshop 2020 at NIST, Gaithersburg, USA}, language = {en} } @misc{Kraemer, author = {Kr{\"a}mer, Stefan}, title = {Effects of Arbitrary Hardware Faults on Multicore Scheduling in Safety-critical Applications - Evaluation by enhanced Markov models and discrete event simulation}, series = {2014 PESW - The 2nd Prague Embedded Systems Workshop, June 2014}, journal = {2014 PESW - The 2nd Prague Embedded Systems Workshop, June 2014}, language = {en} } @misc{BaerwaldMottok, author = {B{\"a}rwald, Andreas and Mottok, J{\"u}rgen}, title = {Zertifizierung von Werkzeugen und Werkzeugketten}, series = {Software im Automobil, Stuttgart, 04./05. Mai 2010}, journal = {Software im Automobil, Stuttgart, 04./05. Mai 2010}, language = {de} } @misc{DeubzerMottokFlugetal., author = {Deubzer, Michael and Mottok, J{\"u}rgen and Flug, Christian and Zeitler, Thomas}, title = {A method of performance analysis for embedded system architectures}, series = {8. Tag der Technik am 13. Juni 2008 an der Hochschule Regensburg}, journal = {8. Tag der Technik am 13. Juni 2008 an der Hochschule Regensburg}, language = {en} } @misc{HobelsbergerMottokDumke, author = {Hobelsberger, Martin and Mottok, J{\"u}rgen and Dumke, Reiner}, title = {A model based safety analysis approach for embedded system architectures}, series = {Tag der Technik 2008}, journal = {Tag der Technik 2008}, language = {en} } @misc{GegenfurtnerBoucheixGruberetal., author = {Gegenfurtner, Andreas and Boucheix, Jean-Michel and Gruber, Hans and Hauser, Florian and Lehtinen, Erno and Lowe, Richard K.}, title = {Der Gaze Relational Index als Indikator visueller Expertise}, series = {51. Kongress der Deutschen Gesellschaft f{\"u}r Psychologie : 15. bis 20. September 2018, Goethe-Universit{\"a}t Frankfurt am Main, Campus Westend}, journal = {51. Kongress der Deutschen Gesellschaft f{\"u}r Psychologie : 15. bis 20. September 2018, Goethe-Universit{\"a}t Frankfurt am Main, Campus Westend}, issn = {2573-2773}, pages = {402}, abstract = {Eye tracking is a powerful technique that helps reveal how people process visual information. This paper discusses a novel metric for indicating expertise in visual information processing. Named the Gaze Relational Index (GRI), this metric is defined as the ratio of mean fixation duration to fixation count. Data from two eye-tracking studies of professional vision and visual expertise in using 3D dynamic medical visualizations are presented as cases to illustrate the suitability and additional benefits of the GRI. Calculated values of the GRI were higher for novices than for experts, and higher in non-representative, semi-familiar / unfamiliar task conditions than in domain-representative familiar tasks. These differences in GRI suggest that, compared to novices, experts engaged in more knowledge-driven, top-down processing that was characterized by quick, exploratory visual search. We discuss future research aiming to replicate the GRI in professional domains with complex visual stimuli and to identify the moderating role of cognitive ability on GRI estimates.}, language = {de} } @misc{AlfransederSchmidhuberMuchaetal., author = {Alfranseder, Martin and Schmidhuber, Stefan and Mucha, Matthias and Sailer, Andreas and Mottok, J{\"u}rgen}, title = {How to improve the reactiveness and efficiency of embedded multicore systems by use of probabilistic simulation and optimization techniques: A case study}, series = {Advanced Research Workshop: Improving Disaster Resilience and Mitigation - New Means and Tools, Trends, Iasi}, journal = {Advanced Research Workshop: Improving Disaster Resilience and Mitigation - New Means and Tools, Trends, Iasi}, language = {en} } @inproceedings{FrauenschlaegerDentgenMottok, author = {Frauenschl{\"a}ger, Tobias and Dentgen, Manuel and Mottok, J{\"u}rgen}, title = {Systemarchitektur eines Sicherheitsmoduls im Energiesektor}, series = {Tagungsband 2. Symposium Elektronik und Systemintegration ESI 2020: "Intelligente Systeme und ihre Komponenten: Forschung und industrielle Anwendung"}, booktitle = {Tagungsband 2. Symposium Elektronik und Systemintegration ESI 2020: "Intelligente Systeme und ihre Komponenten: Forschung und industrielle Anwendung"}, address = {Landshut}, url = {http://nbn-resolving.de/urn:nbn:de:bvb:860-opus4-2092}, pages = {29 -- 38}, abstract = {Aufgrund der immer weiter anwachsenden Vernetzung der Stromnetze wird die Kommunikation zwischen der Leitstelle des Energieversorgers und den Infrastrukturkomponenten innerhalb eines Umspannwerks immer bedeutsamer. Dabei werden sowohl Steuerbefehle als auch Daten f{\"u}r {\"U}berwachungsfunktionen {\"u}bertragen. In den aktuellen Netzwerkarchitekturen findet diese Kommunikation ohne eine kryptografische Absicherung statt, was einen Angriffspunkt f{\"u}r gezielte Attacken und damit eine potenzielle Gef{\"a}hrdung der Energieversorgung darstellt. Um solchen Angriffen in Zukunft entgegenzuwirken, wird das ES³M-Sicherheitsmodul entwickelt. Dieses soll in das Netzwerk zwischen den beiden Kommunikationspartnern eingesetzt werden und so den Datenverkehr absichern. Mithilfe einer Bedrohungsanalyse wurden Anforderungen abgeleitet, die neben kryptografischen Maßnahmen auch Themen wie funktionale Sicherheit und Langlebigkeit umfassen. Um diese zu erf{\"u}llen, wurde eine spezielle Systemarchitektur auf Basis einer Aufgabenteilung entworfen. Diese Architektur und korrespondierende Designentscheidungen werden pr{\"a}sentiert.}, language = {de} } @article{MaierSchlattlGuessetal., author = {Maier, Robert and Schlattl, Andreas and Guess, Thomas and Mottok, J{\"u}rgen}, title = {CausalOps - Towards an industrial lifecycle for causal probabilistic graphical models}, series = {Information and Software Technology}, journal = {Information and Software Technology}, publisher = {Elsevier}, issn = {0950-5849}, doi = {10.1016/j.infsof.2024.107520}, url = {http://nbn-resolving.de/urn:nbn:de:bvb:898-opus4-73350}, abstract = {Context: Causal probabilistic graph-based models have gained widespread utility, enabling the modeling of cause-and-effect relationships across diverse domains. With their rising adoption in new areas, such as safety analysis of complex systems, software engineering, and machine learning, the need for an integrated lifecycle framework akin to DevOps and MLOps has emerged. Currently, such a reference for organizations interested in employing causal engineering is missing. This lack of guidance hinders the incorporation and maturation of causal methods in the context of real-life applications. Objective: This work contextualizes causal model usage across different stages and stakeholders and outlines a holistic view of creating and maintaining them within the process landscape of an organization. Method: A novel lifecycle framework for causal model development and application called CausalOps is proposed. By defining key entities, dependencies, and intermediate artifacts generated during causal engineering, a consistent vocabulary and workflow model to guide organizations in adopting causal methods are established. Results: Based on the early adoption of the discussed methodology to a real-life problem within the automotive domain, an experience report underlining the practicability and challenges of the proposed approach is discussed. Conclusion: It is concluded that besides current technical advancements in various aspects of causal engineering, an overarching lifecycle framework that integrates these methods into organizational practices is missing. Although diverse skills from adjacent disciplines are widely available, guidance on how to transfer these assets into causality-driven practices still need to be addressed in the published literature. CausalOps' aim is to set a baseline for the adoption of causal methods in practical applications within interested organizations and the causality community.}, language = {en} } @inproceedings{StauferHauserEzeretal., author = {Staufer, Susanne and Hauser, Florian and Ezer, Timur and Grabinger, Lisa and Nadimpalli, Vamsi Krishna and R{\"o}hrl, Simon and Bugert, Flemming and Bittner, Dominik and Mottok, J{\"u}rgen}, title = {EVALUATION OF THE LEARNING MANAGEMENT SYSTEM PYTHIA}, series = {EDULEARN Proceedings: 16th International Conference on Education and New Learning Technologies, Palma, Spain. 1-3 July, 2024}, booktitle = {EDULEARN Proceedings: 16th International Conference on Education and New Learning Technologies, Palma, Spain. 1-3 July, 2024}, publisher = {IATED}, issn = {2340-1117}, doi = {10.21125/edulearn.2024.2189}, url = {http://nbn-resolving.de/urn:nbn:de:bvb:898-opus4-73474}, pages = {9089 -- 9098}, abstract = {Learning management systems gain importance due to the Corona pandemic. To personalize such a learning management system, a Moodle adaption named Pythia was created. Pythia is implemented as a Moodle plugin solution. The possibility of generating learning paths with various algorithms and the change of the graphical user interface is significant. Learning paths are generated with two different algorithms. Nestor algorithm generates learning paths with a Bayesian network, while Tyche algorithm uses a Markov model. The graphical user interface is adapted to the generated learning paths where learning element symbols are customized and the individual learning paths are depicted. This paper presents the results of a qualitative survey among German students with the aim of evaluating the first version of the learning management system Pythia. 25 students took the subject "Software Engineering for Safe and Secure Systems" in the winter term of 2023/24. The 68 asked questions focus on usage behavior, graphical user interface, usability, preferences, volume, and quality of learning elements, and learning paths. Our Moodle course for the lecture contains seven sections, each section has minimum one subsection on which the learning path is calculated. Last three sections are designed by presenting minimum one learning element of each learning element category except the collaboration tool. In a previous work, ten learning element categories were designed and evaluated comprising manuscript, brief overview, learning goal, quiz, exercise, summary, three types of additional material, and collaboration tool. The first sections are left as they are initially designed by the lecturer (normal section). The survey considers the difference between normal sections and diverse sections. Furthermore, the generated learning paths are evaluated. 13 students undertook Nestor learning paths, whereas 12 undertook Tyche learning paths. The results suggest that for the majority of students, the learning element symbols are well-chosen. Moreover, all students wish the elements relevant to the exam to be labelled. 23 students are overwhelmed by the number of learning elements in the last sections of the Moodle course. In the future, some suggestions will be implemented such as the labelling of exam relevant learning elements. To overcome the overload of learning elements, a strategy could be developed like hiding learning elements not preferred by the learning path algorithm.}, language = {en} } @inproceedings{GrabingerMottok, author = {Grabinger, Lisa and Mottok, J{\"u}rgen}, title = {On selecting hypothesis tests for group differences}, series = {ICERI2024 Proceedings: 17th Annual International Conference of Education, Research and Innovation, 11th-13th November 2024, Seville, Spain}, booktitle = {ICERI2024 Proceedings: 17th Annual International Conference of Education, Research and Innovation, 11th-13th November 2024, Seville, Spain}, publisher = {IATED}, doi = {10.21125/iceri.2024.0272}, url = {http://nbn-resolving.de/urn:nbn:de:bvb:898-opus4-78200}, pages = {702 -- 712}, abstract = {Deciding on the right method of analyzing empirical research data can be difficult - especially when it comes to choosing specific methods of inferential statistics, where there is often not one right way, but a variety of valid options (e.g., using an ANOVA or its non-parametric alternative for data that is not perfectly normally distributed). Novice researchers not only lack the experience to know when a particular hypothesis test is appropriate, but struggle to find suitable literature to familiarize themselves (i.e., literature that is not too superficial, yet comprehensible). With the present article we provide a remedy following the didactic method of scaffolding: We present a systematization of the most elementary inferential statistical methods, namely hypothesis tests for group differences. We start by explaining basic terms (e.g., independent variable) and then give step-by-step instructions for choosing a proper hypothesis test based on data properties, implementing it from scratch, and reporting or interpreting its results. With these practical cookbook-like guidelines, this article serves as a concise starting point for young researchers entering the field of empirical research, as a valuable resource for their instructors, and as a basis for automating statistical procedures in a software system.}, language = {en} } @article{GrabingerHauserMottok, author = {Grabinger, Lisa and Hauser, Florian and Mottok, J{\"u}rgen}, title = {On the perception of graph layouts}, series = {Journal of Software: Evolution and Process}, journal = {Journal of Software: Evolution and Process}, publisher = {Wiley}, doi = {10.1002/smr.2599}, url = {http://nbn-resolving.de/urn:nbn:de:bvb:898-opus4-62973}, abstract = {In the field of software engineering, graph-based models are used for a variety of applications. Usually, the layout of those graphs is determined at the discretion of the user. This article empirically investigates whether different layouts affect the comprehensibility or popularity of a graph and whether one can predict the perception of certain aspects in the graph using basic graphical laws from psychology (i.e., Gestalt principles). Data on three distinct layouts of one causal graph is collected from 29 subjects using eye tracking and a print questionnaire. The evaluation of the collected data suggests that the layout of a graph does matter and that the Gestalt principles are a valuable tool for assessing partial aspects of a layout.}, language = {en} } @inproceedings{SailerSchmidhuberDeubzeretal., author = {Sailer, Andreas and Schmidhuber, Stefan and Deubzer, Michael and Mottok, J{\"u}rgen}, title = {Amalthea - Plattform f{\"u}r kontinuierliche, modellbasierte Entwicklung}, series = {Tagungsband, 6th Embedded Software Engineering, Kongress 2013, 2. bis 6. Dezember 2013, Sindelfingen}, booktitle = {Tagungsband, 6th Embedded Software Engineering, Kongress 2013, 2. bis 6. Dezember 2013, Sindelfingen}, pages = {538 -- 544}, language = {de} } @inproceedings{SoskaSchummJosephetal., author = {Soska, Alexander and Schumm, Michael and Joseph, Saskia and Reschke, Michael and Mottok, J{\"u}rgen and Niemetz, Michael and Schroll-Decker, Irmgard}, title = {Comparison of Frontal Lecture and Workshop Learning Arrangements in a Software Engineering Education Project}, series = {2014 IEEE Global Engineering Education Conference (EDUCON), Istanbul, Turkey}, booktitle = {2014 IEEE Global Engineering Education Conference (EDUCON), Istanbul, Turkey}, doi = {10.1109/EDUCON.2014.6826162}, pages = {653 -- 658}, abstract = {The increase in complexity of software and its creation over the last decades requires an increase in the quality of the education of software engineering professionals. The number of Universities which answer this call by replacing or extending lectures with simulated software projects is constantly rising. However, the question how to best transfer new technological knowledge needed to be successful within this projects to the students remains open. Therefore this paper will present a comparison between the classical frontal lecture and a modern workshop learning arrangement used within these projects. By the use of workshops not only the knowledge transfer but also the acquisition of personal and social competences will be facilitated. Furthermore positive experiences with workshops at university level will support life-long learning.}, language = {en} } @inproceedings{DeubzerHobelsbergerMottoketal., author = {Deubzer, Michael and Hobelsberger, Martin and Mottok, J{\"u}rgen and Schiller, Frank and Dumke, Reiner and Siegle, Markus and Margull, Ulrich and Niemetz, Michael and Wirrer, Gerhard}, title = {Modeling and Simulation of Embedded Real-Time Multi-Core Systems}, series = {Proceedings of the 3rd Embedded Software Engineering Congress, 7. bis 9. Dezember 2010, Sindelfingen}, booktitle = {Proceedings of the 3rd Embedded Software Engineering Congress, 7. bis 9. Dezember 2010, Sindelfingen}, language = {en} } @inproceedings{HobelsbergerDumkeMottoketal., author = {Hobelsberger, Martin and Dumke, Reiner and Mottok, J{\"u}rgen and Niemetz, Michael and Wirrer, Gerhard}, title = {An Experience-Based Repository of Reusable Components for an Component-Based Automotive Software System}, series = {Applied Software Measurement, proceedings of the joined International Conferences on Software Measurement IWSM/MetriKon/Mensura 2010, 10.-12. November 2010, Stuttgart, Germany}, booktitle = {Applied Software Measurement, proceedings of the joined International Conferences on Software Measurement IWSM/MetriKon/Mensura 2010, 10.-12. November 2010, Stuttgart, Germany}, pages = {218 -- 240}, language = {en} } @inproceedings{MottokKraemerDeubzeretal., author = {Mottok, J{\"u}rgen and Kr{\"a}mer, Stefan and Deubzer, Michael and Hobelsberger, Martin and Martin, Felix}, title = {Hardware Based Tracing of Embedded Multi-Core Systems}, series = {4th Applied Research Conference, 5th July 2014, Ingolstadt}, booktitle = {4th Applied Research Conference, 5th July 2014, Ingolstadt}, isbn = {978-3-8440-2875-1}, language = {en} } @inproceedings{HobelsbergerMottok, author = {Hobelsberger, Martin and Mottok, J{\"u}rgen}, title = {Software Qualit{\"a}t - eine Glaubensfrage? Ein {\"U}berblick {\"u}ber Modelle der Softwarezuverl{\"a}ssigkeit}, series = {Proceedings of the 2nd Embedded Software Engineering Congress, 8. bis 10. Dezember 2009, Sindelfingen}, booktitle = {Proceedings of the 2nd Embedded Software Engineering Congress, 8. bis 10. Dezember 2009, Sindelfingen}, pages = {134 -- 148}, language = {de} } @inproceedings{HobelsbergerMottokDumke, author = {Hobelsberger, Martin and Mottok, J{\"u}rgen and Dumke, Reiner}, title = {Modellbasierte Sicherheitsanalysen von Software-Architekturen}, series = {Embedded Software Engineering Kongress, Tagungsband ; 8. bis 10. Dezember 2008, Sindelfingen}, booktitle = {Embedded Software Engineering Kongress, Tagungsband ; 8. bis 10. Dezember 2008, Sindelfingen}, pages = {436 -- 443}, language = {de} } @article{DeubzerMottokHobelsberger, author = {Deubzer, Michael and Mottok, J{\"u}rgen and Hobelsberger, Martin}, title = {Profiling in Embedded Real-Time Software Systemen}, series = {Jahresr{\"u}ckblick 2008 des Bayerischen IT-Sicherheitsclusters}, journal = {Jahresr{\"u}ckblick 2008 des Bayerischen IT-Sicherheitsclusters}, pages = {13}, language = {en} } @article{HobelsbergerMottokDeubzer, author = {Hobelsberger, Martin and Mottok, J{\"u}rgen and Deubzer, Michael}, title = {Modellbasierte Sicherheitsanalysen von Software Architekturen}, series = {Jahresr{\"u}ckblick 2008 des Bayerischen IT-Sicherheitsclusters}, journal = {Jahresr{\"u}ckblick 2008 des Bayerischen IT-Sicherheitsclusters}, pages = {14}, language = {de} } @article{HobelsbergerMottokKuntz, author = {Hobelsberger, Martin and Mottok, J{\"u}rgen and Kuntz, Stefan}, title = {Architekturmodellierung: Vergleich von EAST ADL und SAE AADL}, series = {Hanser Automotive}, journal = {Hanser Automotive}, number = {7-8}, pages = {43 -- 47}, language = {de} } @inproceedings{KraemerSimsekBraunetal., author = {Kr{\"a}mer, Stefan and Simsek, Erol and Braun, J{\"u}rgen and Deubzer, Michael and Stingl, Armin and Hobelsberger, Martin and Mottok, J{\"u}rgen}, title = {Mut zu Fehlern, um die Qualit{\"a}t zu steigern - Fault-Injection zur Steigerung der Zuverl{\"a}ssigkeit}, series = {Tagungsband, 6th Embedded Software Engineering, Kongress 2013, 2. bis 6. Dezember 2013, Sindelfingen}, booktitle = {Tagungsband, 6th Embedded Software Engineering, Kongress 2013, 2. bis 6. Dezember 2013, Sindelfingen}, isbn = {978-3-8343-2408-5}, pages = {577 -- 585}, language = {de} } @inproceedings{SailerSchmidhuberDeubzeretal., author = {Sailer, Andreas and Schmidhuber, Stefan and Deubzer, Michael and Hobelsberger, Martin and Mottok, J{\"u}rgen}, title = {Requirements engineering for a continuous design flow and methodology}, series = {2nd Applied Research Conference 2012 (ARC 2012) 25./26. June 2012, Nuremberg}, booktitle = {2nd Applied Research Conference 2012 (ARC 2012) 25./26. June 2012, Nuremberg}, publisher = {Shaker}, address = {Aachen}, isbn = {978-3-8440-1093-0}, pages = {76 -- 79}, language = {en} } @inproceedings{SchmidhuberSailerDeubzeretal., author = {Schmidhuber, Stefan and Sailer, Andreas and Deubzer, Michael and Hobelsberger, Martin and Mottok, J{\"u}rgen}, title = {Overview of the itea2-project amalthea}, series = {2nd Applied Research Conference 2012 (ARC 2012) 25./26. June 2012, Nuremberg}, booktitle = {2nd Applied Research Conference 2012 (ARC 2012) 25./26. June 2012, Nuremberg}, publisher = {Shaker}, address = {Aachen}, isbn = {978-3-8440-1093-0}, pages = {60 -- 62}, language = {en} } @inproceedings{FritzSchmidMottok, author = {Fritz, Florian and Schmid, Michael and Mottok, J{\"u}rgen}, title = {Accelerating Real-Time Applications with Predictable Work-Stealing}, series = {Architecture of computing systems - ARCS 2020: 33rd international conference, Aachen, Germany, May 25-28, 2020, proceedings}, booktitle = {Architecture of computing systems - ARCS 2020: 33rd international conference, Aachen, Germany, May 25-28, 2020, proceedings}, editor = {Brinkmann, Andr{\´e}}, doi = {10.1007/978-3-030-52794-5_18}, pages = {241 -- 255}, abstract = {Modern compute architectures often consist of multiple CPU cores to achieve their performance, as physical properties put a limit on the execution speed of a single processor. This trend is also visible in the embedded and real-time domain, where programmers are forced to parallelize their software to keep deadlines. Additionally, embedded systems rely increasingly on modular applications, that can easily be adapted to different system loads and hardware configurations. To parallelize applications under these dynamic conditions, often dispatching frameworks like Threading Building Blocks (TBB) are used in the desktop and server segment. More recently, Embedded Multicore Building Blocks (EMB2) was developed as a task-based programming solution designed with the constraints of embedded systems in mind. In this paper, we discuss how task-based programming fits such systems by analyzing scheduler implementation variants, with a focus on classic work-stealing and the libraries TBB and EMB2. Based on the state of the art we introduce a novel resource-trading concept that allows static memory allocation in a work-stealing runtime holding strict space and time bounds. We conduct benchmarks between an early prototype of the concept, TBB and EMB2, showing that resource-trading does not introduce additional runtime overheads, while unfortunately also not improving on execution time variances.}, language = {en} } @inproceedings{SeebauerJahnMottok, author = {Seebauer, Stefan and Jahn, Sabrina and Mottok, J{\"u}rgen}, title = {Learning from Escape Rooms? A Study Design Concept Measuring the Effect of a Cryptography Educational Escape Room}, series = {2020 IEEE Global Engineering Education Conference (EDUCON): 27-30 April 2020, Porto, Portugal}, booktitle = {2020 IEEE Global Engineering Education Conference (EDUCON): 27-30 April 2020, Porto, Portugal}, doi = {10.1109/EDUCON45650.2020.9125333}, pages = {1684 -- 1685}, abstract = {Experts predict that more IT-Security specialists will be needed in the coming years, but in current higher education in engineering disciplines, this topic is hardly addressed. Newer learning methods such as game-based learning (GBL) are enjoying an increasing popularity as their improvement in the education of subject specific topics can be proven by a variety of studies. We chose Educational Escape Rooms (EduER) as a GBL-tool to impart IT-Security in higher education of engineers. In our Escape Room (ER), the students try to solve puzzles and riddles with learned knowledge on the emphasis of cryptography. This paper first deals with a brief introduction to GBL and EduERs, followed by the design of our ER concept, containing different tasks with focus on the topic of cryptography. The tasks cover different cryptographic methods and hash algorithms, e.g. AES, RSA, SHA3. Afterwards the experimental study is presented. The study of the EduER was carried out with students from the bachelor's program in Electrical Engineering and Information Technology at the OTH Regensburg. The participants were divided into three groups of 5 to 8 persons each. They received a briefing with important information, followed by the ER execution, a debriefing afterwards and an exam-like evaluation sheet to test their learned knowledge. Finally, first basic results are presented.}, language = {en} } @inproceedings{FrauenschlaegerRennerMottok, author = {Frauenschl{\"a}ger, Tobias and Renner, Sebastian and Mottok, J{\"u}rgen}, title = {Security Improvements by Separating the Cryptographic Protocol from the Network Stack onto a Multi-MCU Architecture}, series = {Architecture of Computing Systems - ARCS 2020: 33rd international conference, Aachen, Germany, May 25-28, 2020, proceedings}, booktitle = {Architecture of Computing Systems - ARCS 2020: 33rd international conference, Aachen, Germany, May 25-28, 2020, proceedings}, publisher = {Springer International Publishing}, doi = {10.1007/978-3-030-52794-5_14}, pages = {185 -- 199}, abstract = {The number of IoT devices in SCADA and ICS systems is rising quickly, especially in the domain of critical infrastructures. But these kinds of systems are performing mission critical tasks like controlling devices in industrial facilities or substations in the smart grid. Therefore, they are subject to a lot of regulatory standards. Yet, to provide remote access over the internet, special architectures are developed to integrate a network interface into these devices without inferring with the actual functionality. However, these architectures either lack security measures against cyber-attacks or do not offer the necessary performance for time-critical communication interfaces. To solve that, an architecture consisting of three units is introduced in this paper to provide a network interface with extensive security measures and a high performance. The main feature is the isolation of the cryptographic functionality onto an additional MCU. After proposing the basic concept, the paper presents many implementation details. Based on the current state of implementation, a concept validation of the realized architecture is described.}, language = {en} } @inproceedings{KloppGoldVeerkampAbkeetal., author = {Klopp, Marco and Gold-Veerkamp, Carolin and Abke, J{\"o}rg and Borgeest, Kai and Reuter, Rebecca and Jahn, Sabrina and Mottok, J{\"u}rgen and Sedelmaier, Yvonne and Lehmann, Alexander and Landes, Dieter}, title = {Totally Different and yet so Alike: Three Concepts to Use Scrum in Higher Education}, series = {Proceedings of the 4th European Conference on Software Engineering Education (ECSEE '20): June 2020, Seeon/Bavaria, Germany}, booktitle = {Proceedings of the 4th European Conference on Software Engineering Education (ECSEE '20): June 2020, Seeon/Bavaria, Germany}, doi = {10.1145/3396802.3396817}, pages = {12 -- 21}, abstract = {Software process models are important in software projects in order to give the work of a project guidelines or a framework. However, teaching process models in higher education seems to be quite challenging. This has to do with the fact that undergraduates have no experience with projects in which process models are used. The theoretical mediation of process models is initially on a very abstract level. For this reason, we chose to combine two didactic approaches, namely problem-based learning and project work. Various traditional plan-driven process models have been expanded in courses in Software Engineering with agile process models. The Scrum Framework is the focus of consideration of this paper. Three Universities of Applied Sciences which cooperate in the EVELIN project focused on Scrum as a process model and integrated it into their teaching. Since the respective concepts of implementation differ, they should be presented and compared in this article to presents some practice approaches. The goal of this presentation of is a uniform evaluation in order to obtain insights from different perspectives. This comparison can draw conclusions for possible necessary improvements of the respective concepts.}, language = {en} } @inproceedings{DentgenRennerMottok, author = {Dentgen, Manuel and Renner, Sebastian and Mottok, J{\"u}rgen}, title = {Equally Distributed Bus-Communication Access Rights for Inter MCU Communication Using Multimaster SPI}, series = {Architecture of Computing Systems - ARCS 2020: 33rd international conference, Aachen, Germany, May 25-28, 2020, proceedings}, booktitle = {Architecture of Computing Systems - ARCS 2020: 33rd international conference, Aachen, Germany, May 25-28, 2020, proceedings}, editor = {Brinkmann, Andr{\´e} and Karl, Wolfgang and Lankes, Stefan and Tomforde, Sven and Pionteck, Thilo and Trinitis, Carsten}, doi = {10.1007/978-3-030-52794-5_15}, pages = {200 -- 212}, abstract = {With the rising complexity and processing power of modern computer systems, the amount of MCU on a single PCB also rises. These microcontrollers often need to communicate with each other to exchange payload and control information in a bidirectional manner. Today's well-established communication protocols in MCUs either do not fit modern transmission speed requirements or do have an inappropriate master-slave attribute, which does not allow the communication partners to have equal bus access rights. Therefore, this paper introduces an extension of the Serial Peripheral Interface (SPI) to allow an equally distributed access right for the communication interface between two microcontrollers. It simultaneously does fit modern transmission speed requirements of a common network interface, so that the message transmission does not constitute a bottleneck in data processing. Besides the protocol design, we do also provide a first prototype implementation, which constitutes a proof of concept.}, language = {en} } @inproceedings{JahnMottok, author = {Jahn, Sabrina and Mottok, J{\"u}rgen}, title = {Work in Progress: Towards an Academic Secure Software Engineering Curriculum for Engineers}, series = {2020 IEEE Global Engineering Education Conference (EDUCON): 27-30 April 2020, Porto, Portugal}, booktitle = {2020 IEEE Global Engineering Education Conference (EDUCON): 27-30 April 2020, Porto, Portugal}, doi = {10.1109/EDUCON45650.2020.9125210}, pages = {1713 -- 1717}, abstract = {In the age of the Internet of Things, it is becoming increasingly important to integrate knowledge about the development of secure systems (Secure Software Engineering) into academic teaching. However, teaching IT Security and Secure Software Engineering to non-computer scientists is rare. Therefore, we focus our research on the integration of IT Security into software engineering education of non-computer scientists, particularly electrical engineers, by means of inductive teaching- and learning-arrangements. After collecting students' preconceptions of IT Security and Secure Software Engineering in prior work, this paper now contributes with a first mapping of these preconceptions with corresponding learning content as well as suitable inductive teaching methods to be able to create new lecture and exercise units and improve academic learning and teaching in both areas.}, language = {en} } @inproceedings{WeissRennerMottoketal., author = {Weiss, Nils and Renner, Sebastian and Mottok, J{\"u}rgen and Matoušek, V{\´a}clav}, title = {Transport Layer Scanning for Attack Surface Detection in Vehicular Networks}, series = {CSCS '20: Computer Science in Cars Symposium}, booktitle = {CSCS '20: Computer Science in Cars Symposium}, number = {7}, address = {Feldkirchen}, doi = {10.1145/3385958.3430476}, pages = {1 -- 8}, abstract = {In the beginning of every security analysis or penetration test of a system, information about the target has to be gathered. On IT-Systems a port scan is usually performed as a first step of an investigation. Since the communication protocols differ in automotive systems, generic port scanning tools can't be used for a security analysis of CANs. More complex protocols have a higher likelihood of implementation errors and bugs. On CAN networks, such payloads are transferred through International Standard Transport Protocol (ISO-TP) communication. We designed a new methodology to identify ISO-TP endpoints in automotive networks. Every of these endpoints can provide exploitable application layer protocols and therefor has to be considered during penetration testing and security analysis. We contribute a new scan approach for the automated evaluation of possible attack surfaces in automotive CAN networks which has a higher coverage and multiple advantages than state of the art approaches.}, language = {en} } @inproceedings{RennerPozzobonMottok, author = {Renner, Sebastian and Pozzobon, Enrico and Mottok, J{\"u}rgen}, title = {A Hardware in the Loop Benchmark Suite to Evaluate NIST LWC Ciphers on Microcontrollers}, series = {Information and Communications Security: 22nd International Conference, ICICS 2020, Copenhagen, Denmark, August 24-26, 2020, Proceedings}, booktitle = {Information and Communications Security: 22nd International Conference, ICICS 2020, Copenhagen, Denmark, August 24-26, 2020, Proceedings}, editor = {Meng, Weizhi}, publisher = {Springer}, address = {Cham}, doi = {10.1007/978-3-030-61078-4_28}, pages = {495 -- 509}, abstract = {The National Institute of Standards and Technology (NIST) started the standardization process for lightweight cryptography algorithms in 2018. By the end of the first round, 32 submissions have been selected as 2nd round candidates. NIST allowed designers of 2nd round submissions to provide small updates on both their specifications and implementation packages. In this work, we introduce a benchmarking framework for evaluating the performance of NIST Lightweight Cryptography (LWC) candidates on embedded platforms. We show the features and application of the framework and explain its design rationale. Moreover, we provide information on how we aim to present up-to-date performance figures throughout the NIST LWC competition. In this paper, we present an excerpt of our software benchmarking results regarding speed and memory requirements of selected ciphers. All up-to-date results, including benchmarking different test cases for multiple variants of each 2nd round algorithm on five different microcontrollers, are periodically published to a public website. While initially only the reference implementations were available, the ability of automatically testing the performance of the candidate algorithms on multiple platforms becomes especially relevant as more optimized implementations are developed. Finally, we show how the framework can be extended in different directions: support for more target platforms can be easily added, different kinds of algorithms can be tested, and other test metrics can be acquired. The focus of this paper should rather lay on the framework design and testing methodology than on the current results, especially for reference code.}, language = {en} } @inproceedings{ReuterStarkSedelmaieretal., author = {Reuter, Rebecca and Stark, Theresa and Sedelmaier, Yvonne and Landes, Dieter and Mottok, J{\"u}rgen and Wolff, Christian}, title = {Insights in Students' Problems during UML Modeling}, series = {2020 IEEE Global Engineering Education Conference (EDUCON): Proceedings}, booktitle = {2020 IEEE Global Engineering Education Conference (EDUCON): Proceedings}, doi = {10.1109/EDUCON45650.2020.9125110}, pages = {592 -- 600}, abstract = {UML (Unified Modeling Language) is the current de facto as well as de jure standard (ISO/IEC 19505:2012) notation to visualize models in software development. UML provides essential guidelines and rules to visualize and understand complex software systems. This is the reason why it has become part of curricula for software engineering courses at many universities worldwide. It is well known, however, that UML is hard to grasp for novices, mainly due to its complexity. In order to tackle the problem of teaching UML to novice students appropriately, it is inevitable to understand their needs and problems much better than we do now. This paper presents empirical insights into students' problems when developing common UML diagrams. Identified problems are generalized, giving rise to a problem catalogue that is derived from our empirical findings, thus establishing a basis for addressing these problems through focused learning arrangements.}, language = {en} } @inproceedings{GruberWolffMottoketal., author = {Gruber, Hans and Wolff, Christian and Mottok, J{\"u}rgen and Bazo, Alexander and Hauser, Florian and Schreistetter, Stefan}, title = {Tutorial on Software Engineering Education in Co-Located Multi-User Eye-Tracking-Environments}, series = {Proceedings of the 32nd IEEE Conference on Software Engineering Education and Training: Munich, November 2020}, booktitle = {Proceedings of the 32nd IEEE Conference on Software Engineering Education and Training: Munich, November 2020}, doi = {10.1109/CSEET49119.2020.9206170}, abstract = {We briefly describe a tutorial on the application of Eye-Tracking technology for Software Engineering Education. We will showcase our setup of a large-scale Eye-Tracking-Classroom and its usage for real-time improvement of traditional learning scenarios in Software Engineering Education. We will focus on the integration of gaze data into modern integrated development environments (IDEs) and demonstrate a complete workflow for its usage in co-located multi-user Eye-Tracking-Environments.}, language = {en} } @inproceedings{InderwiesMottok, author = {Inderwies, Tom and Mottok, J{\"u}rgen}, title = {Secure Software Update of a Secure Module in the Power Grid}, series = {Proceedings of the Regensburg Applied Research Conference 2020 (RARC 2020), July 31st}, booktitle = {Proceedings of the Regensburg Applied Research Conference 2020 (RARC 2020), July 31st}, pages = {25 -- 31}, language = {en} } @inproceedings{HauserSchreistetterReuteretal., author = {Hauser, Florian and Schreistetter, Stefan and Reuter, Rebecca and Mottok, J{\"u}rgen and Gruber, Hans and Holmqvist, Kenneth and Schorr, Nick}, title = {Code reviews in C++: Preliminary results from an eye tracking study}, series = {ETRA '20 Short Papers: ACM Symposium on Eye Tracking Research and ApplicationsJune 2020}, booktitle = {ETRA '20 Short Papers: ACM Symposium on Eye Tracking Research and ApplicationsJune 2020}, isbn = {ISBN 9781450371346}, doi = {10.1145/3379156.3391980}, pages = {1 -- 5}, abstract = {Code reviews are an essential part of quality assurance in modern software projects. But despite their great importance, they are still carried out in a way that relies on human skills and decisions. During the last decade, there have been several publications on code reviews using eye tracking as a method, but only a few studies have focused on the performance differences between experts and novices. To get a deeper understanding of these differences, the following experiment was developed: This study surveys expertise-related differences in experts', advanced programmers', and novices' eye movements during the review of eight short C++ code examples, including correct and erroneous codes. A sample of 35 participants (21 novices, 14 advanced and expert programmers) were recruited. A Tobii Spectrum 600 was used for the data collection. Measures included participants' eye movements during the code review, demographic background data, and cued retrospective verbal comments on replays of their own eye movement recordings. Preliminary results give proof for experience-related differences between participants. Advanced and expert programmers performed significantly better in case of error detection and the eye tracking data implies a more efficient reviewing strategy.}, language = {en} } @inproceedings{HauserStarkMottoketal., author = {Hauser, Florian and Stark, Theresa and Mottok, J{\"u}rgen and Gruber, Hans and Reuter, Rebecca}, title = {Deliberate Practice in Programming: How is it carried out by programmers?}, series = {ECSEE '20: Proceedings of the 4th European Conference on Software Engineering Education, Seeon, Germany, June 2020}, booktitle = {ECSEE '20: Proceedings of the 4th European Conference on Software Engineering Education, Seeon, Germany, June 2020}, isbn = {ISBN 9781450377522}, doi = {10.1145/3396802.3396815}, pages = {42 -- 46}, abstract = {This work in progress study examines through which activities programmers perform deliberate practice to improve their own skills in coding and programming. For this reason, a qualitative questionnaire was developed and conducted with a sample of 22 participants. The results indicate that programmers perform formal and informal forms of training and learning. Typically, a classical programming training in the context of a university course or for work-related reasons is a first step in the acquisition of expertise. Building on these basic skills, non-formal and informal learning activities are carried out by the learners. Especially the social interaction and the collaborative work with other programmers is of great importance in this context. The activities mentioned by the test persons fulfil the characteristics of deliberate practice and will be examined more closely in a further study.}, language = {en} } @inproceedings{SchmidFritzMottok, author = {Schmid, Michael and Fritz, Florian and Mottok, J{\"u}rgen}, title = {Parallel Programming in Real-Time Systems}, series = {Architecture of computing systems - ARCS 2019, 32nd international conference, Copenhagen, Denmark, May 20-21, 2019, proceedings}, booktitle = {Architecture of computing systems - ARCS 2019, 32nd international conference, Copenhagen, Denmark, May 20-21, 2019, proceedings}, publisher = {VDE-Verlag}, address = {Berlin}, abstract = {The enormous amounts of data modern real-time systems have to process lead to expensive, long-lasting calculations. In order to manage those computations in a timely manner, parallel task models have gained a lot of popularity lately. However, parallel programming can be very cumbersome and verbose. Other computationally intensive sectors have dealt with parallel computing for decades and have accumulated their experience in the development of parallel frameworks. Examples of well known parallel runtime systems are OpenMP, Intel Threading Building Blocks (TBB) and Microsoft Parallel Pattern Library (PPL). These runtime systems allow developers to enhance parallelism in their applications in a straightforward fashion. However, those parallel frameworks and the patternbased interfaces they provide might not be easily applicable in real-time systems. In this paper, we investigate the use of parallel programming frameworks in time-critical systems. On that account, we discuss considerations for the design of real-time applications that make use of such parallel runtime systems. Furthermore, we evaluate three library-based frameworks from different computing sectors, namely Intel Threading Building Blocks, Embedded Multicore Building Blocks (EMBB) and High Performance ParalleX (HPX), by conducting benchmarks of various parallel algorithms on an embedded multicore architecture.}, language = {en} } @inproceedings{MottokSchillerVoelkletal., author = {Mottok, J{\"u}rgen and Schiller, Frank and V{\"o}lkl, Thomas and Zeitler, Thomas}, title = {A concept for a safe realization of a state machine in embedded automotive applications}, series = {Computer safety, reliability, and security, 26th International Conference, SAFECOMP 2007, Nuremberg, Germany, September 18-21, 2007; proceedings}, booktitle = {Computer safety, reliability, and security, 26th International Conference, SAFECOMP 2007, Nuremberg, Germany, September 18-21, 2007; proceedings}, doi = {10.1007/978-3-540-75101-4_2}, pages = {283 -- 288}, abstract = {Currently, both fail safe and fail operational architectures are based on hardware redundancy in automotive embedded systems. In contrast to this approach, safety is either a result of diverse software channels or of one channel of specifically coded software within the framework of Safely Embedded Software. Product costs are reduced and flexibility is increased. The overall concept is inspired by the well-known Vital Coded Processor approach. Since Mealy state machines are frequently used in embedded automotive systems, application software with a general Mealy state machine is realized differently with Safely Embedded Software starting from the high level programming language C with corresponding measurements.}, language = {en} } @article{HummelMottokEgenetal., author = {Hummel, M. and Mottok, J{\"u}rgen and Egen, R. and Schiller, Frank and Mattes, T. and Blum, M. and Druckstein, F.}, title = {Generische Safety-Architektur f{\"u}r Kfz-Software}, series = {Spektrum, das Magazin der Hochschule Regensburg}, journal = {Spektrum, das Magazin der Hochschule Regensburg}, address = {Regensburg}, organization = {Hochschule f{\"u}r Angewandte Wissenschaften Regensburg}, language = {de} } @article{SchillerMottokBlumetal., author = {Schiller, Frank and Mottok, J{\"u}rgen and Blum, M. and Duckstein, F. and Egen, R. and Hummel, M. and Mattes, T.}, title = {Generische Safety-Architektur f{\"u}r KFZ-Software}, series = {Hanser automotive}, journal = {Hanser automotive}, pages = {52 -- 54}, language = {de} } @inproceedings{DeubzerMottokFlugetal., author = {Deubzer, Michael and Mottok, J{\"u}rgen and Flug, Christian and Zeitler, Thomas}, title = {Profiling Performance Analyse von Embedded Real-Time System Architekturen}, series = {Embedded Software Engineering Kongress, Tagungsband ; 8. bis 10. Dezember 2008, Sindelfingen}, booktitle = {Embedded Software Engineering Kongress, Tagungsband ; 8. bis 10. Dezember 2008, Sindelfingen}, pages = {155 -- 167}, language = {en} } @article{FederrathMottokPloessletal., author = {Federrath, H. and Mottok, J{\"u}rgen and Pl{\"o}ßl, K. and V{\"o}lkl, Thomas}, title = {Automotive safety and security}, series = {Jahresr{\"u}ckblick 2007 des Bayerischen IT-Sicherheitsclusters}, journal = {Jahresr{\"u}ckblick 2007 des Bayerischen IT-Sicherheitsclusters}, pages = {25}, language = {de} } @inproceedings{SchmidtMottok, author = {Schmidt, Peter and Mottok, J{\"u}rgen}, title = {"Werkstattbericht" Bioagile Softwareentwicklung}, series = {Embedded Software Engineering Kongress, Tagungsband ; 8. bis 10. Dezember 2008, Sindelfingen}, booktitle = {Embedded Software Engineering Kongress, Tagungsband ; 8. bis 10. Dezember 2008, Sindelfingen}, pages = {455 -- 460}, language = {de} } @inproceedings{MottokSchiller, author = {Mottok, J{\"u}rgen and Schiller, Frank}, title = {MISRA C++:2008 and safely embedded software - a safety framework for C++}, series = {Proceedings of the Automotive Safety \& Security Conference}, booktitle = {Proceedings of the Automotive Safety \& Security Conference}, language = {en} } @inproceedings{SchirdewahnMottok, author = {Schirdewahn, B. and Mottok, J{\"u}rgen}, title = {Implementierungsl{\"o}sungen f{\"u}r die Eigenentwicklung eines deterministischen, nicht preemptiven Echtzeit Betriebssystems zur Verwaltung eingebetteter Applikationen}, series = {Embedded Software Engineering Kongress, Tagungsband ; 8. bis 10. Dezember 2008, Sindelfingen}, booktitle = {Embedded Software Engineering Kongress, Tagungsband ; 8. bis 10. Dezember 2008, Sindelfingen}, pages = {141 -- 147}, language = {de} } @article{Mottok, author = {Mottok, J{\"u}rgen}, title = {Aktuelle Forschungsergebnisse aus dem "Laboratory for Safe and Secure Systems"(LaS3)}, series = {Jahresr{\"u}ckblick 2008 des Bayerischen IT-Sicherheitsclusters}, journal = {Jahresr{\"u}ckblick 2008 des Bayerischen IT-Sicherheitsclusters}, pages = {13 -- 15}, language = {de} }