Attack trees (ATs) are a popular formalism for security analysis, and numerous variations and tools have been developed around them. These were mostly developed independently, and offer little interoperability or ability to combine various AT features. We present ATTop, a software bridging tool that enables automated analysis of ATs using a model-driven engineering approach. ATTop fulfills two purposes: 1. It facilitates interoperation between several AT analysis methodologies and resulting tools (e.g., ATE, ATCalc, ADTool 2.0), 2. it can perform a comprehensive analysis of attack trees by translating them into timed automata and analyzing them using the popular model checker Uppaal, and translating the analysis results back to the original ATs. Technically, our approach uses various metamodels to provide a unified description of AT variants. Based on these metamodels, we perform model transformations that allow to apply various analysis methods to an AT and trace the results back to the AT domain. We illustrate our approach on the basis of a case study from the AT literature.

We propose a model-driven engineering approach that facilitates the production of tool chains that use the popular model checker Uppaal as a back-end analysis tool. In this approach, we introduce a metamodel for Uppaal's input model, containing both timed-automata concepts and syntax-related elements for C-like expressions. We also introduce a metamodel for Uppaal's query language to specify temporal properties; as well as a metamodel for traces to interpret Uppaal's counterexamples and witnesses. The approach provides a systematic way to build software bridging tools (i.e., tools that translate from a domainspecific language to Uppaal's input language) such that these tools become easier to debug, extend, reuse and maintain. We demonstrate our approach on five different domains: cyber-physical systems, hardwaresoftware co-design, cyber-security, reliability engineering and software timing analysis. IntroductionUppaal [3] is a leading model checker for real-time systems, allowing one to verify automatically whether a system meets its timing requirements. Uppaal and its extensions have been applied to a large number of domains, ranging from communication protocols [28], over planning [4] to systems biology [31]. As such, Uppaal is a popular back-end for various other real-time analysis tools, such as ANIMO [31], sdf2ta [13] and STATE [19]. Typically such tools take their inputs in a domain-specific language (DSL) and translate these inputs into timed automata, which are then fed into Uppaal to perform the analysis. In this way, domain experts can write their models in a DSL that they are familiar with, while still using Uppaal's powerful analysis algorithms behind the scenes.A disadvantage of this approach is, however, that the tools that translate from a DSL to Uppaal's input language, i.e., software bridging tools, are often implemented ad hoc, and hence difficult to debug, reuse, extend and maintain.

Model-based verification allows to express behavioral correctness conditions like the validity of execution states, boundaries of variables or timing at a high level of abstraction and affirm that they are satisfied by a software system. However, this requires expressive models which are difficult and cumbersome to create and maintain by hand. This paper presents a framework that automatically derives behavioral models from real-sized Java programs. Our framework builds on the EMF/ECore technology and provides a tool that creates an initial model from Java bytecode, as well as a series of transformations that simplify the model and eventually output a timed-automata model that can be processed by a model checker such as UPPAAL. The framework has the following properties: (1) consistency of models with software, (2) extensibility of the model derivation process, (3) scalability and (4) expressiveness of models. We report several case studies to validate how our framework satisfies these properties.Comment: In Proceedings MARS 2017, arXiv:1703.0581

Current trends in software engineering show that large software projects have to operate with teams that are working in different locations. The reason behind this globalization of software development stems from clear business goals such as reducing cost of development, solving local IT skills shortage, and supporting outsourcing and offshoring. There is ample reason that these factors will be even stronger in the future, and as such we will face a further globalization of software development. To cope with these problems, the concept of Global Software Development (GSD) is introduced. GSD is a relatively new concept in software development that can be considered as the coordinated activity of software development that is not localized and central but geographically distributed.Designing a proper architecture of GSD is important to meet the requirements for the communication, coordination and control of distributed GSD teams.However, an analysis of the literature on GSD shows that research in this area has been generally focused on social issues focusing on some concerns such as intercultural communication problems and coordination. It is generally accepted that software architecture design plays a fundamental role in coping with the inherent difficulties of the development of large-scale and complex software.Unfortunately, in both GSD and software architecture design communities, the architecture design of GSD systems has not been explicitly addressed.

In order to meet the communication, coordination and control requirements of distributed Global Software Development (GSD) teams, it is necessary to define a proper software architecture. Designing a GSD architecture, however, involves a multitude of design decisions that are related in different ways. As such, it is not trivial for the architect to design a system that meets the different GSD concerns. To assist the architect in designing a suitable GSD architecture we propose the tool framework Global Architect. The tool framework is based on a common meta-model for GSD and a question framework, which includes a predefined set of questions that are related to abstract design rules for designing GSD systems. Based on the answers provided to the questions of the question framework, the tool automatically selects and instantiates the necessary rules and generates the GSD architecture. Global Architect has been applied to design the GSD architecture for a real industrial project of Cybersoft, a leading GSD company in Turkey.