Effectiveness and performance analysis of model-oriented security requirements engineering to elicit security requirements: a systematic solution for developing secure software systems

Software systems are becoming more and more critical in every domain of human society. These systems are used not only by corporates and governments, but also by individuals and across networks of organizations. The wide use of software systems has resulted in the need to contain a large amount of critical information and processes, which certainly need to remain secure. As a consequence, it is important to ensure that the systems are secure by considering security requirements at the early phases of software development life cycle. In this paper, we propose to consider security requirements as functional requirements and apply model-oriented security requirements engineering framework as a systematic solution to elicit security requirements for e-governance software systems. As the result, high level of security can be achieved by more coverage of assets and threats, and identifying more traces of vulnerabilities in the early stages of requirements engineering. This in turn will help to elicit effective security requirements as countermeasures with business requirements.     

Vocal markers of emotion: Comparing induction and acting elicitation

The search for vocal markers of emotion has been hampered by the difficulty of obtaining access to speech samples that represent authentic expressions of the speaker's felt emotions. The recent trend to privilege real-life, naturalistic speech tokens, often obtained by convenience sampling, encounters two major problems: (1) the assumption that speech recorded in the field or from the media is a direct, uncontrolled expression of the speaker's “true” feeling state is unrealistic, given the widespread use of expression control due to display rules and strategic concerns; (2) the use of convenience samples, often of rare events, can engender the neglect of minimal requirements for experimental control of important determinants. Conversely, the use of performance induction of affect allows systematic control of influence factors and shows that even subtle variations of task characteristics and appraisal can produce major paralinguistic differences. The disadvantage of this type of elicitation is that the emotional effects are often weak and vary greatly over individuals. In this paper, the results of a study comparing the effects of an established psychological mood induction technique (the Velten procedure) with a classic acting/portrayal approach on a set of major acoustic parameters are reported. The elicitation of positive/happy and negative/sad utterance through both tasks yields essentially the same differences in both tasks for energy, F0, spectral, and temporal parameters. In comparison, task differences have much less effect. As three different language groups were used, the important effects of the speaker's language, especially in interacting with task and emotion factors, can be demonstrated. It is suggested that enacting studies using professional mental imagery techniques are an important part of the available experimental paradigms, as they allow extensive experimental control and as the results seem to be comparable with other induction techniques. They are especially useful if the purpose of the research is to study the listener attribution of emotion from vocal cues, rather than the diagnosis of symptoms of “true” underlying emotions (which remains elusive and presents a major challenge for future research).     

Investigation of task performance variations according to task requirements and alertness across the 24-h day in shift workers

The study investigated time-of-day effects on task performance in shift workers in different tasks (reaction time, discrimination, probe recognition, free recall), by varying task-specific features. On each of six recordings, each programmed on a different day and in a randomised order, operators rated alertness and performed different tasks. Self-rated alertness varied according to a typical diurnal trend. Time of day also affected reaction time (slower responses at 03:00 hours), discrimination performance (lower accuracy at 03:00 hours in the most difficult condition) and recall (superior recall at 07:00 and 11:00 hours following deeper processing at encoding). The data demonstrated time-of-day effects on cognitive processes also involved in many real-job activities, despite the lack of control for a number of exogenous factors known to interfere with performance in work settings. Since in the cognitively more loaded tasks, time-of-day effects depended on task conditions, the findings are of operational concern in shift-work situations involving differential task requirements. In a real-job setting, performance variations were observed according to time of day and task requirements in a set of cognitively more or less demanding tasks. Task-specific research across the 24-h day enables a better understanding of operators' tasks and the development of supporting technology.     

Investigation of task performance variations according to task requirements and alertness across the 24-h day in shift workers

The study investigated time-of-day effects on task performance in shift workers in different tasks (reaction time, discrimination, probe recognition, free recall), by varying task-specific features. On each of six recordings, each programmed on a different day and in a randomised order, operators rated alertness and performed different tasks. Self-rated alertness varied according to a typical diurnal trend. Time of day also affected reaction time (slower responses at 03:00 hours), discrimination performance (lower accuracy at 03:00 hours in the most difficult condition) and recall (superior recall at 07:00 and 11:00 hours following deeper processing at encoding). The data demonstrated time-of-day effects on cognitive processes also involved in many real-job activities, despite the lack of control for a number of exogenous factors known to interfere with performance in work settings. Since in the cognitively more loaded tasks, time-of-day effects depended on task conditions, the findings are of operational concern in shift-work situations involving differential task requirements. In a real-job setting, performance variations were observed according to time of day and task requirements in a set of cognitively more or less demanding tasks. Task-specific research across the 24-h day enables a better understanding of operators' tasks and the development of supporting technology.     

A method to elicit architecturally sensitive usability requirements: its integration into a software development process

In the Human-Computer Interaction (HCI) community, software usability has primarily been concerned with the presentation of information, more precisely with the user interface. However, some usability problems can prove costly to fix if the changes require modifications that reach beyond the presentation layer, namely those that cannot be easily accommodated by the software architecture. Taking into account some usability requirements earlier in the software development cycle, specifically prior to the architectural design phase, can reduce the cost of these modifications. There is a scarcity of methods and guidelines with the scope to direct users in eliciting the usability requirements that can impact the software architecture. This paper proposes a usability-driven adaptation of the quality attribute workshop (QAW) to assist software development organizations in discovering and documenting usability requirements. It shows how this method can be integrated into a software development process, by discussing how the existing software framework workflows can be adjusted to take this new activity into consideration. A preliminary exercise was conducted to help discern the utility and the limits of the proposed method. Participants with different levels of knowledge of usability and comprehension of the system being developed found the method constructive, as it guided them in identifying the architecturally relevant usability requirements. It also helped determine the usability aspects that would not necessarily have been defined if this technique had not been employed.     

An integrative approach to requirements analysis: How task models support requirements reuse in a user-centric design framework

Many software systems fail to address their intended purpose because of a lack of user involvement and requirements deficiencies. This paper discusses the elaboration of a requirements-analysis process that integrates a critical-parameter-based approach to task modeling within a user-centric design framework. On one hand, adapting task models to capture requirements bridges the gap between scenarios and critical parameters which benefits design from the standpoint of user involvement and accurate requirements. On the other hand, using task models as a reusable component leverages requirements reuse which benefits design by increasing quality while simultaneously reducing development costs and time-to-market. First, we present the establishment of both a user-centric and reuse-centric requirements process along with its implementation within an integrated design tool suite. Secondly, we report the design, procedures, and findings of two user studies aimed at assessing the feasibility for novice designers to conduct the process as well as evaluating the resulting benefits upon requirements-analysis deliverables, requirements quality, and requirements reuse.     

Commercial perspective when applying ai techniques and traditional IT skills

RH&H's role in the HINT project was to focus on integration, finishing, utilisation, and marketability of the overall technological result. The other HINT partners were responsible for separate AI techniques and system units, which RH&H integrated to create a commercial product. To identify the industrial requirements of a commercial product, RH&H carried out a survey based on qualitative interviews with experienced, technical managers. We realised that to turn a R&D Project into a commercial product, it is crucial first of all to understand the industrial functional needs and the industry's way to conceptualise the world.     

Tool-supported requirements prioritization: Comparing the AHP and CBRank methods

Requirements prioritization aims at identifying the most important requirements for a software system, a crucial step when planning for system releases and deciding which requirements to implement in each release. Several prioritization methods and supporting tools have been proposed so far. How to evaluate their properties, with the aim of supporting the selection of the most appropriate method for a specific project, is considered a relevant question.In this paper, we present an empirical study aiming at evaluating two state-of-the art tool-supported requirements prioritization methods, AHP and CBRank. We focus on three measures: the ease of use, the time-consumption and the accuracy. The experiment has been conducted with 23 experienced subjects on a set of 20 requirements from a real project. Results indicate that for the first two characteristics CBRank overcomes AHP, while for the accuracy AHP performs better than CBRank, even if the resulting ranks from the two methods are very similar. The majority of the users found CBRank the “overall best” method.     

Methodological issues in product evaluation: the influence of testing environment and task scenario

This article examines the utility of two commonly used approaches in the evaluation of interactive consumer products: lab-based testing and single task scenarios. These are compared to two more complex and resource-demanding approaches (field-based testing and dual task scenarios) with regard to the test results they produce. An experiment with N = 80 users was carried out, employing a 2 (laboratory vs. field) by 2 (single task vs. dual task scenario) by 2 (on-product information: present vs. absent) between-subjects design. On-product information (advising users to save water and electricity during kettle usage) represented the intervention, of which the effects on user behaviour were compared under the different experimental conditions. The main finding was that the impact of on-product information on user behaviour was strongest in the lab-based testing environment using a single task scenario (i.e., most economical testing condition), compared to the three other experimental conditions. The work found similar effects for self-report measures. The findings of the study point to the risk that the effects of system redesign on user behaviour may be overestimated if low-fidelity testing approaches are employed. The relevance of these findings for other application areas is also discussed (e.g., design of warnings).     

Managing requirements conflicts in software product lines: A goal and scenario based approach

The product line approach is recognized as a successful approach to reuse in software development. However, in many cases, it has resulted in interactions between requirements and/or features. Interaction detection, especially conflict detection between requirements has become more challenging. Thus, detecting conflicts between requirements is essential for successful product line development. Formal methods have been proposed to address this problem, however, they are hard to understand by non-experts and are limited to restricted domains. In addition, there is no overall process that covers all the steps for managing conflicts. We propose an approach for systematically identifying and managing requirements conflicts, which is based on requirements partition in natural language and supported by a tool. To demonstrate its feasibility, the proposed approach has been applied to the home integration system (HIS) domain and the results are discussed.     

A heuristic approach to robot path planning based on task requirements using a genetic algorithm

In order to enhance integration between CAD and robots, wer propose a scheme to plan kinematically feasible paths in the presence of obstacles based on task requirements. Thus, the feasibility of a planned path from a CAD system is assured before the path is sent for execution. The proposed scheme uses a heuristic approach to deal with a rather complex search space, involving high-dimensional C-space obstacles and task requirements specified in Cartesian space. When the robot is trapped by the local minimum in the potential field related to the heuristic, a genetic algorithm is then used to find a proper intermediate location that will guide it to escape out of the local minimum. For demonstration, simulations based on using a PUMA-typed robot manipulator to perform different tasks in the presence of obstacles were conducted. The proposed scheme can also be used for mobile robot planning. The paper falls into Category (5). Please address correspondence to the second author. This work was supported in part by the National Science Council, Taiwan, R.O.C., under grant NSC 82-0422-E-009-403.     

Privacy‐preserving targeted mobile advertising: requirements,design and a prototype implementation

With the continued proliferation of mobile devices, the collection of information associated with such devices and their users—such as location, installed applications and cookies associated with built‐in browsers—has become increasingly straightforward. By analysing such information, organisations are often able to deliver more relevant and better focused advertisements. Of course, such targeted mobile advertising gives rise to a number of concerns, with privacy‐related concerns being prominent. In this paper, we discuss the necessary balance that needs to be struck between privacy and utility in this emerging area and propose privacy‐preserving targeted mobile advertising as a solution that tries to achieve that balance. Our aim is to develop a solution that can be deployed by users but is also palatable to businesses that operate in this space. This paper focuses on the requirements and design of privacy‐preserving targeted mobile advertising and also describes an initial prototype. We also discuss how more detailed technical aspects and a complete evaluation will underpin our future work in this area. Copyright © 2016 John Wiley & Sons, Ltd.     

Synergy between Activity Theory and goal/scenario modeling for requirements elicitation,analysis, and evolution

ContextIt is challenging to develop comprehensive, consistent, analyzable requirements models for evolving requirements. This is particularly critical for certain highly interactive types of socio-technical systems that involve a wide range of stakeholders with disparate backgrounds; system success is often dependent on how well local social constraints are addressed in system design.ObjectiveThis paper describes feasibility research, combining a holistic social system perspective provided by Activity Theory (AT), a psychological paradigm, with existing system development methodologies and tools, specifically goal and scenario modeling.MethodAT is used to understand the relationships between a system, its stakeholders, and the system’s evolving context. The User Requirements Notation (URN) is used to produce rigorous, analyzable specifications combining goal and scenario models. First, an AT language was developed constraining the framework for automation, second consistency heuristics were developed for constructing and analyzing combined AT/URN models, third a combined AT/URN methodology was developed, and consequently applied to a proof-of-concept system.ResultsAn AT language with limited tool support was developed, as was a combined AT/URN methodology. This methodology was applied to an evolving disease management system to demonstrate the feasibility of adapting AT for use in system development with existing methodologies and tools. Bi-directional transformations between the languages allow proposed changes in system design to be propagated to AT models for use in stakeholder discussions regarding system evolution.ConclusionsThe AT framework can be constrained for use in requirements elicitation and combined with URN tools to provide system designs that include social system perspectives. The developed AT/URN methodology can help engineers to track the impact on system design due to requirement changes triggered by changes in the system’s social context. The methodology also allows engineers to assess the impact of proposed system design changes on the social elements of the system context.     

Exploration strategies, performance, and error consequences when learning a complex computer task

When trying to learn a complex task, people can use different strategies. They can use systematic exploration in which they take on an active approach to discover the computer functions and make use of problem solving steps such as planning, evaluation of feedback, and control of emotion and motivation. Alternatively, they can use non-systematic strategies like trial-and-error, rigid exploration, and encapsulation in information seeking. This study examined whether the exploration strategies were related to error consequences and performance when people learned a new computer program. Strategies were assessed by means of coding. Analysis showed strong correlations between strategies, error consequences, and task performance. These results can have implications for training design and human reliability in dealing with complex devices.     

Integration of task abortion and security requirements in GA-based meta-heuristics for independent batch grid scheduling

Scheduling and resource allocation in large scale distributed environments, such as Computational Grids (CGs), arise new requirements and challenges not considered in traditional distributed computing environments. Among these new requirements, task abortion and security become needful criteria for Grid schedulers. The former arises due to the dynamics of the Grid systems, in which resources are expected to enter and leave the system in an unpredictable way. The latter requirement appears crucial in Grid systems mainly due to a multi-domain nature of CGs. The main aim of this paper is to develop a scheduling model that enables the aggregation of task abortion and security requirements as additional, together with makespan and flowtime, scheduling criteria into a cumulative objective function. We demonstrate the high effectiveness of genetic-based schedulers in finding near-optimal solutions for multi-objective scheduling problem, where all criteria (objectives) are simultaneously optimized. The proposed meta-heuristics are experimentally evaluated in static and dynamic Grid scenarios by using a Grid simulator. The obtained results show the fast reduction of the values of basic scheduler performance metrics, especially in the dynamic case, that confirms the usefulness of the proposed approach in real-life scenarios.     

Comparing the task effectiveness of instant messaging and electronic mail for geographically dispersed teams in Taiwan

To improve task effectiveness of geographically dispersed teams, media selection approaches a complex issue involving media features and user characteristics. This study compares user perceptions about task effectiveness between instant messengers (IM) and e-mail (EM). Using a field experiment, the design contrasted teams using EM with teams using IM. Thirty-four teams of two graduate students were enrolled as participants from five universities in Taiwan. Two people were separated geographically and had to communicate accordingly. Results indicate that IM-supported teams generated more ideas and task success. However, no significant difference was found in task difficulty between the IM and EM users.