Atsuto Kubo

Classifying security patterns

Patterns combine experience and good practices to develop basic models that can be used for new designs. Security patterns join the extensive knowledge accumulated about security with the structure provided by patterns to provide guidelines for secure system design and evaluation. In addition to their value for new system design, security patterns are useful to evaluate existing systems. They are also useful to compare security standards and to verify that products comply with some standard. A variety of security patterns has been developed for the construction of secure systems and catalogs of them are appearing. However, catalogs of patterns are not enough because the designer does not know when and where to apply them, especially in a large complex system. We discuss here several ways to classify patterns. We show a way to use these classifications through pattern diagrams where a designer can navigate to perform her pattern selection.

Improving the Classification of Security Patterns

There are a large number of security patterns encapsulating reusable solutions to recurrent security problems. However, catalogs of security patterns are not enough because the designer does not know when and where to apply them, especially in a large complex system. There is a need to conduct more precise classifications of security patterns. We analyze here ways to represent security patterns using specialized models for their precise classification. We define two new types of models, one that describes how a security pattern relates to several classification dimensions (Dimension Graph), and another that describes how security patterns relate to each other (Pattern Graphs). We show these ideas with examples from security patterns.

Model-Driven Security Patterns Application Based on Dependences among Patterns

The spread of open-software services through the Internet increases the importance of security. A security pattern is one of the techniques in which developers utilize security experts’ knowledge. Security patterns contain typical solutions about security problems. However there is a possibility that developers may apply security patterns in inappropriate ways due to a lack of consideration on dependencies among patterns. Application techniques of security patterns that consider such dependencies have not been proposed yet. In this paper, we propose an automated application technique of security patterns in model driven software development by defining applications procedures of security patterns to models as model transformation rules with consideration for pattern dependencies. Our technique prevents inappropriate applications such as the application of security patterns to wrong model elements and that in wrong orders. Therefore our technique supports developers apply security patterns to their own models automatically in appropriate ways.

Automatic Extraction and Verification of Page Transitions in aWeb Application

Demand for reliability in Web applications has increased greatly in recent years as they have begun to be used more for enterprise applications. Model checking is an effective way to increase software reliability, but because most Web applications have short delivery times, preparation and application costs make it difficult to introduce model-checking techniques into the development process. In this paper, we propose a technique for automatically extracting page transitions from a Web application that has been developed using a Web application framework, such as Struts configuration files and Java Server Page templates, and transforming it into a format that can be used by existing model-checking tools. Using the proposed technique, Web application developers will be able to reduce the preparation and application costs of introducing model-checking techniques.

Analyzing relations among software patterns based on document similarity

In software development, many kinds of knowledge are shared and reused as software patterns. However, the relation analysis among software patterns by hand is difficult on the large scale. In this paper, we propose a technique for the automatic relation analysis among the patterns. Our technique is based on a new pattern model to treat various patterns, and utilizes exiting text processing techniques to extract patterns from documents and to calculate the strength of pattern relations. As a result of experiments, the system that implements our technique has extracted appropriate relations among patterns without information on relations described in original pattern documents. Moreover, our system has the ability to suggest relations among patterns that the author has not noticed.

Relation analysis among patterns on software development process

The activity of the software process improvement can be supported by reusing various kinds of knowledge on existing successful software processes in the form of process patterns. There are several catalogs of process patterns available on WWW; however, all of relations among patterns are closed in each pattern catalog. To acquire the cross-cutting relations over the different process pattern catalogs, we have applied the technique for the automatic relation analysis among the patterns. Our technique utilizes existing text processing techniques to extract patterns from documents and to calculate the strength of pattern relations. As a result of experimental evaluations, it is found that the system implementing our technique has extracted appropriate cross-cutting relations over the different process pattern catalogs without information on relations described in original pattern documents. These cross-cutting relations will be useful for dealing with larger problems than those dealt with by individual process patterns.

Selection of metrics for predicting the appropriate application of design patterns

Design patterns are known for their usefulness to solve recurrent problems. Design patterns are a way of transmitting knowledge and experience by using proven, high quality solutions. A problem that emerges when using design patterns is that it is not clear how to measure the impact that has its application on the source code. The relationships between metrics and design patterns is not clear. We propose an experiment for measuring the usefulness of metrics and their success in predicting correct usage of design patterns. With this experiment we will explore which metrics capture best the relationship of design patterns quality of the source code. By using those metrics we will make predictions about the correct usage of the design patterns. In this experiment the selected metrics were not a good predictor, however it is a starting point to explore more metrics and their relationships with design patterns.

Detecting Design Patterns Using Source Code of Before Applying Design Patterns

Detecting design patterns from object-oriented program source-code can help maintainers understand the design of the program. However, the detection precision of conventional approaches based on the structural aspects of patterns is low due to the fact that there are several patterns with the same structure. To solve this problem, we propose an approach of design pattern detection using source-code of before the application of the design pattern.Our approach is able to distinguish different design patterns with similar structures, and help maintainers understand the design of the program more accurately. Moreover, our technique reveals when and where the target pattern has been applied in an ordered series of revisions of the target program. Our technique is useful to assess what kinds of patterns increase what kinds of quality characteristics such as the maintainability.

TCD: A text-based UML class diagram notation and its model converters

Among several diagrams defined in UML, the class diagram is particularly useful through entire software development process, from early domain analysis stages to later maintenance stages. However conventional UML environments are often inappropriate for collaborative modeling in physically remote locations, such as exchanging models on a public mailing list via email. To overcome this issue, we propose a new diagram notation, called “TCD” (Text-based uml Class Diagram), for describing UML class diagrams using ASCII text. Since text files can be easily created, modified and exchanged in anywhere by any computing platforms, TCD facilitates the collaborative modeling with a number of unspecified people. Moreover, we implemented model converters for converting in both directions between UML class diagrams described in the XMI form and those in the TCD form. By using the converters, the reusability of models can be significantly improved because many of UML modeling tools support the XMI for importing and exporting modeling data.

Mining analysis patterns by structure and word similarity

Analysis patterns encapsulating recurrent analysis processes and results are reused for software analysis. Due to high cost of extracting analysis patterns from existing assets, analysis patterns are sometimes unavailable even though there are a lot of requirements and models as assets. Thus we propose a technique for extracting analysis patterns from existing requirements and corresponding analysis models described in the form of UML class diagrams. Our technique analyzes a set of requirements and corresponding analysis models in terms of structure and word similarity, and specifies commonality. By using our technique, it is possible to extract analysis patterns without high cost.