Max E. Kramer

A Systematic Review of Model-Driven Security

To face continuously growing security threats and requirements, sound methodologies for constructing secure systems are required. In this context, Model-Driven Security (MDS) has emerged since more than a decade ago as a specialized Model-Driven Engineering approach for supporting the development of secure systems. MDS aims at improving the productivity of the development process and quality of the resulting secure systems, with models as the main artifact. This paper presents how we systematically examined existing published work in MDS and its results. The systematic review process, which is based on a formally designed review protocol, allowed us to identify, classify, and evaluate different MDS approaches. To be more specific, from thousands of relevant papers found, a final set of the most relevant MDS publications has been identified, strictly selected, and reviewed. We present a taxonomy for MDS, which is used to synthesize data in order to classify and evaluate the selected MDS approaches. The results draw a wide picture of existing MDS research showing the current status of the key aspects in MDS as well as the identified most relevant MDS approaches. We discuss the main limitations of the existing MDS approaches and suggest some potential research directions based on these insights.

View-centric engineering with synchronized heterogeneous models

Model-Driven Engineering provides an abstract representation of systems through the use of models and views. For complex systems, however, finding a single model and a single view to represent all relevant information of the system is infeasible. Specialized models for specific subsystems, domains or abstractions are more concise and thus more efficient than monolithic models. Furthermore, different tasks and concerns often require different views on the same model. Sustaining the consistency between different views and models is hard, especially if new models and views are dynamically added. In this paper, we present an approach that supports flexible views that may involve multiple models conforming to different metamodels. The approach is based on Orthographic Software Modeling and synchronizes individual instances using model transformations. These transformations are generated from view type definitions, metamodel correspondence rules and invariants, which are defined in a domain-specific language. We illustrate our approach with an application that combines component-based architectures with object-oriented source code and class diagrams.

Mapping aspect-oriented models to aspect-oriented code

When aspect-oriented modeling techniques are used in the context of Model-Driven Engineering, a possible way of obtaining an executable from an aspect-oriented model is to map it to code written in an aspect-oriented programming language. This paper outlines the most important challenges that arise when defining such a mapping: mapping structure and behavior of a single aspect, mapping instantiation of structure and behavior in target models, mapping conflict resolution between aspects, and mapping aspect dependencies and variability. To explain these mapping issues, our paper presents details on how to map Reusable Aspect Models (RAM) to AspectJ source code. The ideas are illustrated by presenting example models and corresponding mapped code from the AspectOPTIMA case study.

An extensive systematic review on the Model-Driven Development of secure systems

Context: Model-Driven Security (MDS) is as a specialised Model-Driven Engineering research area for supporting the development of secure systems. Over a decade of research on MDS has resulted in a large number of publications.Objective: To provide a detailed analysis of the state of the art in MDS, a systematic literature review (SLR ) is essential.Method: We conducted an extensive SLR on MDS. Derived from our research questions, we designed a rigorous, extensive search and selection process to identify a set of primary MDS studies that is as complete as possible. Our three-pronged search process consists of automatic searching, manual searching, and snowballing. After discovering and considering more than thousand relevant papers, we identified, strictly selected, and reviewed 108 MDS publications.Results: The results of our SLR show the overall status of the key artefacts of MDS, and the identified primary MDS studies. For example, regarding security modelling artefact, we found that developing domain-specific languages plays a key role in many MDS approaches. The current limitations in each MDS artefact are pointed out and corresponding potential research directions are suggested. Moreover, we categorise the identified primary MDS studies into 5 significant MDS studies, and other emerging or less common MDS studies. Finally, some trend analyses of MDS research are given.Conclusion: Our results suggest the need for addressing multiple security concerns more systematically and simultaneously, for tool chains supporting the MDS development cycle, and for more empirical studies on the application of MDS methodologies. To the best of our knowledge, this SLR is the first in the field of Software Engineering that combines a snowballing strategy with database searching. This combination has delivered an extensive literature study on MDS.

Change-Driven Consistency for Component Code, Architectural Models, and Contracts

During the development of component-based software systems, it is often impractical or even impossible to include all development information into the source code. Instead, specialized languages are used to describe components and systems on different levels of abstraction or from different viewpoints: Component-based architecture models and contracts, for example, can be used to describe the system on a high level of abstraction, and to formally specify component constraints. Because models, contracts, and code contain redundant information, inconsistencies can occur if they are modified independently. Keeping this information consistent manually can require considerable effort, and can lead to costly errors, for example, when security-relevant components are verified against inconsistent contracts. In this paper, we present an approach for keeping component- based architecture models and contracts specified in the Java Modeling Language (JML) consistent with Java source code. We use change-driven incremental transformations and the Vitruvius framework to automate the consistency preservation where this is possible. Using two case studies, we demonstrate how to detect and propagate changes and refactoring operations to keep models and contracts consistent with the source code.

Building specifications as a domain-specific aspect language

In the construction industry an increasing number of buildings are designed using semantically rich three-dimensional models. In parallel, additional information is specified in a natural-language document called a building specification1. As not all details are present in the model these specifications have to be interpreted whenever costs are estimated or other analyses are performed. In this paper, we argue that building specifications contain cross-cutting concerns. We also argue that domain experts should be given the ability to formulate building specifications using a domain-specific aspect language so that the corresponding details can automatically be integrated into the model. The language needs to support a multitude of domain-specific abstractions that are absent in the building metamodel. Therefore we propose to allow the domain experts to extend the language iteratively by defining interpretation patterns [1]. Such a model enriching specification will improve tasks requiring detailed information and will allow for earlier or even concurrent development of the building specification along with the model.

Aspect-oriented model development at different levels of abstraction

The last decade has seen the development of diverse aspectoriented modeling (AOM) approaches. This paper presents eight different AOM approaches that produce models at different level of abstraction. The approaches are different with respect to the phases of the development lifecycle they target, and the support they provide for model composition and verification. The approaches are illustrated by models of the same concern from a case study to enable comparing of their expressive means. Understanding common elements and differences of approaches clarifies the role of aspect-orientation in the software development process.

An empirical study on the perception of metamodel quality

Despite the crucial importance of metamodeling for Model-Driven Engineering (MDE), there is still little discussion about the quality of metamodel design and its consequences in model-driven development processes. Presumably, the quality of metamodel design strongly affects the models and transformations that conform to these metamodels. However, so far surprisingly few work has been done to validate the characterization of metamodel quality. A proper characterization is essential to automate quality improvements for metamodels such as metamodel refactorings. In this paper, we present an empirical study to sharpen the understanding of the perception of metamodel quality. In the study, 24 participants created metamodels of two different domains and evaluated the metamodels in a peer review process according to an evaluation sheet. The results show that the perceived quality was mainly driven by the metamodels completeness, correctness and modularity while other quality attributes could be neglected.

Achieving Practical Genericity in Model Weaving through Extensibility

Many tasks in Model-Driven Engineering (MDE) involve cross-cutting model modifications that are bound to certain conditions. These transformation tasks may affect numerous model elements and appear in different forms, such as refactoring, model completions or aspect-oriented model weaving. Although the operations at the heart of these tasks are domain-independent, generic solutions that can easily be used and customized are rare. General-purpose model transformation languages as well as existing model weavers exhibit metamodel-specific restrictions and introduce accidental complexity. In this paper, we present a model weaver that addresses these problems using an extensible approach that is defined for metamodelling languages and therefore generic. Through examples of different formalisms we illustrate how our weaver manages homogeneous in-place model transformations that may involve the duplication, merge, and removal of model elements in a generic way. Possibilities to extend and customize our weaver are exemplified for the non-software domain of Building Information Modelling (BIM).

Reuse and configuration for code generating architectural refinement transformations

The transformation of component-based architectures into object-oriented source code for different platforms is a common task in Model-Driven Software Development. Reusing parts that are common to all supported target-platforms for several model-to-text transformations is challenging. Existing approaches, like parameterized transformations and modularity concepts for transformations, make the reuse of transformations parts easier, but cannot be used to visualize design decisions that are common to all supported target-platforms. In this paper, we propose that platform-independent design decisions and their transformation results should be made explicit in an intermediate view. A single parameterized transformation should yield a common object-oriented model before individual transformations for specific platforms are executed. We argue that the additional view makes it possible to analyze decisions on how a component architecture is implemented and increases the maintainability by decoupling the involved transformations.