The increasing complexity of distributed computing environments necessitates efficient resource management strategies to optimize performance and minimize resource consumption. Although proactive horizontal autoscaling dynamically adjusts computational resources based on workload predictions, existing approaches primarily focus on improving workload resource consumption, often neglecting the overhead introduced by the autoscaling system itself. This could have dire ramifications on resource efficiency, since many prior solutions rely on multiple forecasting models per compute node or group of pods, leading to significant resource consumption associated with the autoscaling system. To address this, we propose GraphOpticon, a novel proactive horizontal autoscaling framework that leverages a singular global forecasting model based on Spatiotemporal Graph Neural Networks. The experimental results demonstrate that GraphOpticon is capable of providing improved service performance, and resource consumption (caused by the workloads involved and the autoscaling system itself). As a matter of fact, GraphOpticon manages to consistently outperform other contemporary horizontal autoscaling solutions, such as Kubernetes’ Horizontal Pod Autoscaler, with improvements of 6.62% in median execution time, 7.62% in tail latency, and 6.77% in resource consumption, among others.

In the fast-evolving field of artificial intelligence, Reinforcement Learning (RL) plays a crucial role in developing agents that can make decisions. As these systems become increasingly complex, the need for standardized and automated training methods becomes apparent. This paper presents a rule-based framework that integrates Large Language Models (LLMs) and heuristic-based code detectors to ensure compliance with best practices in RL training pipelines. We define a set of architectural rules that target best practices in important areas of RL-based architectures, such as checkpoints, hyperparameter tuning, and agent configuration. We validated our approach through a large-scale industrial case study and ten open-source projects. The results show that LLM-based detectors generally outperform heuristic-based detectors, especially when handling more complex code patterns. This approach effectively identifies best practices with high precision and recall, demonstrating its practical applicability.

In Reinforcement Learning (RL) environments, detecting environment drift is essential for maintaining robust policy performance in production systems, particularly within the context of MLOps. This paper proposes EDSVM, a novel environment drift detection method, which trains Support Vector Machines on undrifted and synthetic drifted examples generated by altering transition dynamics. By using decision function values as drift indicators, our method achieves competitive results compared to state-of-the-art baselines for the area-under-the-curve (AUC) metric. Additionally, we evaluate the performance of EDSVM when integrated with various Change Point Detection algorithms in terms of delay and false alarms, highlighting its potential for automating the monitoring of RL policies and supporting adaptive updates to production pipelines in MLOps workflows.

Continuous Integration/Deployment (CI/CD) pipelines are critical for integrating developer changes and maintaining high-quality software deployments. The increasing frequency of commits and deployments places significant demands on CI/CD systems, requiring improved speed and efficiency. While numerous tools and techniques have been proposed to increase the velocity of CI/CD pipelines, there is a notable gap in architectural guidance for developers on key design decisions and best practices. To address this, we conducted a grey literature review using Straussian Grounded Theory to develop a UML-based model to guide software architects and developers in their decision-making. Our research focuses on identifying architectural design decisions (ADDs) and best practices as decision options that improve the speed and efficiency of CI/CD pipelines. The study analyses 38 sources, building a formal model comprising 6 ADDs and 30 best practices. This work contributes a structured, architecturally guided approach to optimizing CI/CD systems.

As artificial intelligence continues to advance, Reinforcement Learning (RL) has established itself as a core approach for developing intelligent agents that make decisions over time. As RL systems grow in complexity, the need for standardized training practices becomes critical. This paper introduces a rule-based assessment approach to enforce best practices in RL training. We define a comprehensive set of architectural rules focused on RL pipeline practices, models versioning, multi-agents deployment and managing models in inference. Our methodology integrates Large Language Models (LLMs) and custom-based code detectors to ensure compliance with these best practices across diverse RL systems. We developed a ML pipeline insights service to automatically validate RL training practices directly from the source code. We validate our approach by applying it in a large-scale industrial case study and sixteen open-source case studies. Our evaluation showed that custom-based detectors achieved near-perfect precision and recall ( $$ F_1 \approx 0.98 $$ ), while LLM-based detectors provided scalable validation with moderate $$ F_1 $$ scores (0.67–0.71), demonstrating the hybrid approach’s strength in balancing accuracy and automation. The results demonstrate our tool’s accuracy in identifying and enforcing best practices with high precision and recall rates, highlighting its practical applicability and automation feasibility.

While microservice architectures have become a widespread option for designing distributed applications, designing secure microservice systems remains challenging. Although various security-related guidelines and practices exist, these systems' sheer size, complex communication structures, and polyglot tech stacks make it difficult to manually validate whether adequate security tactics are applied throughout their architecture. To address these challenges, we have devised a novel solution that involves the automatic generation of security-annotated software decomposition models and the utilization of security-based metrics to guide software architectures through the assessment of security tactics employed within microservice systems. To evaluate the effectiveness of our artifacts, we conducted a controlled experiment where we asked 60 students from two universities and ten experts from the industry to identify and assess the security features of two microservice reference systems. During the experiment, we tracked the correctness of their answers and the time they needed to solve the given tasks to measure how well they could understand the security tactics applied in the reference systems. Our results indicate that the supplemental material significantly improved the correctness of the participants' answers without requiring them to consult the documentation more. Most participants also stated in a self-assessment that their understanding of the security tactics used in the systems improved significantly because of the provided material, with the additional diagrams considered very helpful. In contrast, the perception of architectural metrics varied widely. We could also show that novice developers benefited most from the supplementary diagrams. In contrast, senior developers could rely on their experience to compensate for the lack of additional help. Contrary to our expectations, we found no significant correlation between the time spent solving the tasks and the overall correctness score achieved, meaning that participants who took more time to read the documentation did not automatically achieve better results. As far as we know, this empirical study is the first analysis that explores the influence of security annotations in component diagrams to guide software developers when assessing microservice system security.

Infrastructure as Code (IaC) empowers software developers and operations teams to automate the deployment and management of IT infrastructure through code. This is particularly valuable for continuously released deployments such as microservices and cloud-based systems. IaC technologies offer flexibility in provisioning and deploying application architectures. However, if the structure is not well-designed, it can lead to severe issues related to coupling aspects. Unfortunately, a lack of comprehensive coupling guidelines for IaC makes ensuring adherence to best practices challenging. Leveraging IaC-based models, metrics, and source code can enhance the comprehension and implementation of coupling measures. Our objective was to investigate how developers understand information derived from system source code and compare it to formal IaC system diagrams and metrics. We conducted a controlled experiment involving a group of participants to evaluate the understandability of IaC system architecture descriptions through source code inspection and formal representations. We hypothesized that providing formal IaC system diagrams and metrics as supplementary materials would improve the understanding of IaC coupling-related practices measured by task correctness . We also expected that these supplementary resources would lead to a significant increase in task duration and that there would be a notable correlation between correctness and duration . The results suggest that including formal IaC system diagrams and metrics as supplementary materials significantly enhances the comprehension of IaC coupling-related practices, as indicated by task correctness . Moreover, providing these formal representations does not significantly prolong task duration , indicating that they do not hinder understanding. A substantial correlation between task correctness and duration is evident when formal IaC system diagrams and metrics are available.

Machine learning (ML) has emerged as a transformative subject, using various algorithms to help systems analyze data and make predictions. Deep Learning (DL) uses neural networks to address hard problems. Reinforcement Learning (RL) is a way to solve problems by making consecutive decisions. Understanding ML systems based only on the source code is often a challenging task, especially for inexperienced developers. In a controlled experiment involving one hundred fifty-eight participants, we assessed the understandability of ML-based systems and workflows through source code inspection compared to semi-formal representations in models and metrics. We hypothesize that ML system diagrams modeling details of ML workflows and practices like transfer learning and checkpoints can enhance the understandability of ML practices in system design comprehension tasks, assessed through task correctness . Additionally, providing these sources could lead to an increase in task duration , and we expect a significant correlation between correctness and duration . Our findings show that providing semi-formal ML system diagrams with the source code improves the effectiveness of the correctness for the DL relevant tasks. The control group had an average correctness of 0.7121, while the experimental group had a higher average correctness of 0.7759. On the other hand, participants who received only the system source code showed slightly better performance in the correctness task (average correctness 0.6808) within the RL relevant tasks compared to those who also received the semi-formal diagrams (average correctness of 0.6612). However, no significant difference was found in the duration task between the two. The control group, for the DL relevant tasks, took an average of 1571.62 s, whereas the experimental group took an average of 1763.85 s. For the RL relevant tasks, the control group had an average of 1883.80 s, while the experimental group 1925.46 s. However, semi-formal ML system diagrams can benefit specific scenarios.

In machine learning (ML) and machine learning operations (MLOps), automation serves as a fundamental pillar, streamlining the deployment of ML models and representing an architectural quality aspect. Support for automation is especially relevant when dealing with ML deployments characterised by the continuous delivery of ML models. Taking automation in MLOps systems as an example, we present novel metrics that offer reliable insights into support for this vital quality attribute, validated by ordinal regression analysis. Our method introduces novel, technology-agnostic metrics aligned with typical Architectural Design Decisions (ADDs) for automation in MLOps. Through systematic processes, we demonstrate the feasibility of our approach in evaluating automation-related ADDs and decision options. Our approach can itself be automated within continuous integration/continuous delivery pipelines. It can also be modified and extended to evaluate any relevant architectural quality aspects, thereby assisting in enhancing compliance with non-functional requirements and streamlining development, quality assurance and release cycles. • Introduces a semi-automated method for assessing MLOps system architecture qualities. • Models twenty-two MLOps architectures and develops a reusable metamodel. • Defines technology-agnostic metrics for evaluating automation in MLOps. • Employs a systematic process for sourcing and assessing various MLOps architectures. • Validates metrics through ordinal regression for reliable prediction models.

Infrastructure as Code (IaC) automates IT infrastructure deployment, which is particularly beneficial for continuous releases, for instance, in the context of microservices and cloud systems. Despite its flexibility in application architecture, neglecting security can lead to vulnerabilities. The lack of comprehensive architectural security guidelines for IaC poses challenges in adhering to best practices. We studied how developers interpret IaC scripts (source code) in two IaC technologies, Ansible and Terraform, compared to semi-formal IaC deployment architecture models and metrics regarding design-level security understanding. In a controlled experiment involving ninety-four participants, we assessed the understandability of IaC-based deployment architectures through source code inspection compared to semi-formal representations in models and metrics. We hypothesized that providing semi-formal IaC deployment architecture models and metrics as supplementary material would significantly improve the comprehension of IaC security-related practices, as measured by task correctness . Our findings suggest that semi-formal IaC deployment architecture models and metrics as supplementary material enhance the understandability of IaC security-related practices without significantly increasing duration . We also observed a significant correlation between task correctness and duration when models and metrics were provided.

In the dynamic landscape of artificial intelligence and machine learning, Reinforcement Learning (RL) has emerged as a powerful paradigm for training intelligent agents in sequential decision-making. As RL architectures progress in complexity, the need for informed decision-making regarding training strategies and related consequences on the software architecture becomes increasingly intricate. This work addresses this challenge by presenting the outcomes of a qualitative, in-depth study focused on best practices and patterns within training strategies for RL architectures, as articulated by practitioners. Leveraging a model-based qualitative research method, we introduce a formal architecture decision model to bridge the gap between scientific insights and practical implementation. We aim to enhance the understanding of practitioners' approaches in RL architecture. The paper analyzes 33 knowledge sources to discern established industrial practices, patterns, relationships, and decision drivers. Based on this knowledge, we introduce a formal Architectural Design Decision (ADD) model, encapsulating 6 decisions, 29 decision options, and 19 decision drivers, providing robust decision-making support for this critical facet of RL-based software architectures.

This study introduces a novel two-stage method, GPAction, for detecting environment drift in reinforcement learning settings. We first train a Gaussian process predicting the reinforcement learning agents' actions and then detect environment drifts by monitoring the mean squared error between the predicted actions of a Gaussian process action predictor and actual actions. Our proposed method is evaluated against three baselines across four environments with continuous action spaces. Results demonstrate the superior performance of GPAction in detecting environment drift. In an ablation study, by analyzing the plots and AUC values of the MSEs, we show that our method GPAction can provide more distinguishable monitoring metrics than the Gaussian process state predictor.

Infrastructure-from-Code (IfC) is a new approach to DevOps and an advancement of Infrastructure-as-Code (IaC). One of its key concepts is to provide a higher level of abstraction facilitated by new programming languages or software development kits, which automatically generate the necessary code and configurations to provision the infrastructure, deploy the application, and manage the cloud services. IfC approaches promise higher developer productivity by reducing DevOps-specific tasks and the expert knowledge required. However, empirical studies on developers' performance, perceived ease of use, and usability related to IfC are missing. We conducted a controlled experiment (n=40) to assess the usability of the cloud programming languages (PL) and software development kits (SDK). Both approaches involve similar effectiveness. We found that the PL-based approach was moderately less efficient but increased correctness with time spent on programming. Tracing generated infrastructure configurations from code was more challenging with the SDK-based approach. Applying thematic analysis, 19 themes emerged related to usability barriers, supporting factors, security, cloud cost, and enhancement areas. We conclude with five findings and future directions.

Models of software systems are used throughout the software development lifecycle. Dataflow diagrams (DFDs), in particular, are well-established resources for security analysis. Many techniques, such as threat modelling, are based on DFDs of the analysed application. However, their impact on the performance of analysts in a security analysis setting has not been explored before. In this paper, we present the findings of an empirical experiment conducted to investigate this effect. Following a within-groups design, participants were asked to solve security-relevant tasks for a given microservice application. In the control condition, the participants had to examine the source code manually. In the model-supported condition, they were additionally provided a DFD of the analysed application and traceability information linking model items to artefacts in source code. We found that the participants (n = 24) performed significantly better in answering the analysis tasks correctly in the model-supported condition (41 % increase in analysis correctness). Further, participants who reported using the provided traceability information performed better in giving evidence for their answers (315% increase in correctness of evidence). Finally, we identified three open challenges of using DFDs for security analysis based on the insights gained in the experiment.

Microservice architectures are widely used today to implement distributed systems. Securing microservice architectures is challenging because of their polyglot nature, continuous evolution, and various security concerns relevant to such architectures. This article proposes a novel, model-based approach providing detection strategies to address the automated detection of security tactics (or patterns and best practices) in a given microservice architecture decomposition model. Our novel detection strategies are metrics-based rules that decide conformance to a security recommendation based on a statistical predictor. The proposed approach models this recommendation using Architectural Design Decisions (ADDs). We apply our approach for four different security-related ADDs on access management, traffic control, and avoiding plaintext sensitive data in the context of microservice systems. We then apply our approach to a model data set of 10 open-source microservice systems and 20 variants of those systems. Our results are detection strategies showing a very low bias, a very high correlation, and a low prediction error in our model data set.

Machine Learning Operations (MLOps) is the practice of streamlining and optimising the machine learning (ML) workflow, from development to deployment, using DevOps (software development and IT operations) principles and ML-specific activities. Architectural descriptions of MLOps systems often consist of informal textual descriptions and informal graphical system diagrams that vary considerably in consistency, quality, detail, and content. Such descriptions only sometimes follow standards or schemata and may be hard to understand. We aimed to investigate informal textual descriptions and informal graphical MLOps system architecture representations and compare them with semi-formal MLOps system diagrams for those systems. We report on a controlled experiment with sixty-three participants investigating the understandability of MLOps system architecture descriptions based on informal and semi-formal representations. The results indicate that the understandability (quantified by task correctness) of MLOps system descriptions is significantly greater using supplementary semi-formal MLOps system diagrams, that using semi-formal MLOps system diagrams does not significantly increase task duration (and thus hinder understanding), and that task correctness is only significantly correlated with task duration when semi-formal MLOps system diagrams are provided.

Dynamic reconfiguration is commonly used in service-and cloud-based applications. In combination with autoscalers, dynamic routers can adapt the system to the resource demands, e.g., in an e-commerce application offering discounts for services in a specific location. Without such measures, the quality-of-service measures are affected negatively, and a system overload can lead to an application being non-responsive. However, the cost of cloud resource usage must be considered when performing these reconfiguration steps to avoid adding high additional costs. This paper proposes a cost-aware multifaceted reconfiguration of dynamic routing applications. We study the depletion and rescheduling of idle components and use an infrastructure-as-code module to apply changes to the infrastructure. Moreover, when system components are in a steady state, our approach dynamically self-adapts between more central or distributed routing to optimize reliability and performance. This adaptation is calculated based on a system-wide optimization analysis. When components are overloaded, we perform a per-component optimization to autoscale components multidimensionally. Our extensive systematic evaluation shows significant improvements in quality trade-off adaptations and system overload prevention. We provide prototypical tool support to demonstrate our concepts with illustrative sample cases.

The Infrastructure as Code (IaC) concept enables IT infrastructure to be managed as software: resources can be managed, monitored, and provisioned automatically instead of manually by developers or operations teams. Many industries have already embraced this concept widely. However, research on IaC-based deployments, particularly research focusing on loose coupling, often does not offer methods for evaluating architectural conformance, spotting architecture smells, and support for correcting the found smells. Our work strives to provide an automatic method for continuously developing microservice-based systems and the associated infrastructure. We aim to offer an automated architectural refactoring method that checks if IaCbased deployments adhere to patterns and best practices and do not contain potential architectural smells. We provide architects with viable options for enhancing architectural conformance during microservice development. In short, by continuously detecting architectural smells and suggesting possible fixes, we aim to support architecture evolution within the framework of continuous delivery practices. We evaluate our approach using three case studies and variants based on open-source microservice architectures.

Many studies have been performed on integrating the Internet of Things (IoT) with cloud services. As these systems become widely used, quality metrics are of concern. For example, users might specify access control to restrict their sensitive data being processed in the cloud. Routers, e.g., API gateways, message brokers, or sidecars, can provide this access control by blocking or routing device data to a specific cloud service. However, a static routing application might not suit the dynamic behavior of IoT applications well. For example, in a centralized schema, where all device data is routed to a component for control checking, performance can be an issue. On the other hand, distributed routing can harm the reliability of a system, as device data might be lost due to an unresponsive service. We present the Smart and Adaptive Routing (SAR) architecture that creates an optimal reconfiguration solution using a deep neural network based on the quality metrics of an IoT application. To design our architecture, we give a background of the published studies and a review of the gray literature, e.g., practitioner blogs, to categorize the knowledge in the domain of IoT-cloud traffic management. We systematically evaluate our approach in an extensive evaluation of 4500 cases and compare SAR with an empirical data set of 1200 hours. The results show that our approach significantly improves quality-of-service measures by adapting the IoT-cloud system at runtime.

The extensive use of APIs as the entry point to many Cloud-based applications has created challenging problems, especially concerning API quality properties such as performance and reliability. API best practices and patterns, such as bundling requests, rate limiting, or load balancing, have been proposed to solve these challenges. Unfortunately, no study investigating the impact of existing API practices and patterns on such quality properties exists beyond informal recommendations. In this paper, we fill this gap by proposing a pattern-based, automated recommendation approach to improve the performance and reliability of API operations. We provide a benchmark suite based on a realistic open-source microservice application to enable the automatic generation of comprehensive decision tree models. These models are then processed to generate API design recommendation algorithms to improve API operations regarding performance and reliability stored in catalogs for reuse. We validate our algorithms using extensive data sets generated by running the benchmark on a private cloud and AWS. For both environments, based on the decision tree models automatically generated from the measured data, API design recommendation algorithms have been calculated using our approach.

Designing Cyber-Physical Systems (CPS) is a complex task involving integrating physical and digital components to achieve specific objectives. This process consolidates data from various Internet of Things (IoT) devices and sources to generate meaningful insights and actionable outcomes. IoT-cloud data communication comprises multiple stages, e.g., data collection, processing, analysis, and visualization. Adopting a comprehensive approach that considers physical and digital aspects is essential to ensure effective data communication in CPS. As a result, architectural design choices are crucial in determining CPS functionality and runtime qualities, e.g., performance, security, and reliability. While numerous CPS architectural patterns and practices have been proposed, much of the relevant knowledge remains scattered across various sources, such as practitioner blogs and system documentation. These sources are often based on personal experiences and lack consistency. To address this gap, our study presents the outcomes of an in-depth qualitative investigation into practitioners' descriptions of the best practices and patterns in CPS architecture. We have developed a formal architectural decision model using a model-based qualitative research method. We aim to bridge the division between scientific understanding and practical use cases, enhance comprehension of practitioners' approaches to CPS, and provide decision-making support for designing CPS applications.

Many dynamic routing architectural patterns are available, including distributed routing, e.g., using the sidecar pattern, or centralized routing, e.g., using event stores or service buses. Different Quality-of-Service (QoS) factors influence routing schemas and technology selection, such as performance, reliability, scalability, and control properties offered by the patterns. An analytical model can formalize the QoS factors and facilitate the architectural decision-making when changing the routing scheme, i.e., to more distributed or centralized routing. So far, the impact of these architectural patterns on performability, i.e., the overall performance of a system with impeded reliability, has not been extensively studied. This is important because deciding to increase performance, e.g., by parallel processing of requests, may lead to decreased reliability because of the added points of a crash. We propose an analytical performability model during component crashes. For the empirical validation of our proposed model, we ran an extensive experiment of 2412 hours of runtime on a private cloud infrastructure and Google Cloud Platform. The low prediction error of 1.75 % indicates the high accuracy of our performability model. These results provide important insights when making architectural decisions regarding service- and cloud-based dynamic routing.

The microservices architectural style improves flexi-bility and performance but might come at the cost of complexity and cognitive effort. Understanding how architectural design decision affects cognitive effort can support software engineers in designing and building more maintainable systems. However, little research exists measuring the impact of architectural styles on developers' cognitive processes. To the best of our knowledge, no empirical study on navigation and comprehension strategies compares a microservice-based and monolithic variant of a trading system, which is widely used for empirical research on information system evolution. To assess the cognitive processes, we conducted an eye-tracking study (n=42) of typical maintenance tasks. We randomly assigned participants to two groups performing a feature location and a code change task using the trading system's monolithic or microservices-based implementation. Efficacy is significantly higher in the monolith variant. We investigate the reasons and propose a cognitively-grounded method to analyse comprehension strategies and estimate maintenance effort. We measure differences in comprehension strategies (top-down and bottom-up comprehension) and conclude that 1) there is a significant difference in visual effort and time taken to identify a specific feature, and 2) bottom-up comprehension is more frequently applied in microservices than in the monolith variant. Finally, we discuss our findings and their implications for practitioners and the research community.

The Digital Twin (DT) concept has overcome its initial definition based on a purely descriptive approach focusing on modelling physical objects, often using CAD. Today DT often describes a behavioural approach that can simulate an object’s dynamics, monitor its state, and control or predict its behaviour. Although DTs are attracting significant attention and offer many advantages in the design of especially cyber-physical systems, most proposals have focused on developing DTs for a specific use case or need without providing a more holistic approach to its design. We aim to propose a domain-agnostic approach for architecting DTs. Here, DTs are directly supported by Domain-Driven Design’s notion of Bounded Contexts (BCs), hiding all the domain-inherent specifications behind BC boundaries. These BCs are also the central abstraction in many microservice architectures and can be used to describe DTs. A Wind Turbine DT architecture is used as a running example to describe how every relevant DT property can be satisfied following our proposal for architecting digital twins. A qualitative evaluation of this case by five external practitioners shows that our DDD-based proposal consistently outperforms the 5-dimension model used as the reference approach.

There are many challenges in maintaining the desired quality of service levels in modern microservice and cloud applications. Numerous techniques and patterns, such as API Rate Limit, Load Balancing, and Request Bundle, have been suggested for API services and clients to improve quality properties related to performance and reliability. However, no study has measured the impact of these techniques and their combinations in a specific configuration, especially using a large distributed system workload setting. This paper experimentally studies the effects of combining the API Rate Limit, Load Balancing, and Request Bundle patterns based on a realistic, third-party microservice-based application deployed in a private cloud and on the Amazon Web Services cloud (AWS) using 130 different configurations. We have run each configuration 500 times in the private cloud, totaling more than 4500 hours of runtime, and 200 times on AWS, totaling more than 3900 hours of runtime. We developed regression models from the collected data to predict the performance and reliability impacts of combining such techniques and patterns. We found that the models provide acceptable prediction errors below 30% on the private cloud and AWS. Further, we found that the models work best in highly reliable environments like AWS. In addition to the concrete analyses provided in our work, we propose a general and largely automated method that can be followed iteratively to evaluate similar techniques and patterns for their quality properties.

Microservice architectures are increasingly being used to develop application systems. Despite many guidelines and best practices being published, architecting microservice systems for security is challenging. Reasons are the size and complexity of microservice systems, their polyglot nature, and the demand for the continuous evolution of these systems. In this context, to manually validate that security architecture tactics are employed as intended throughout the system is a time-consuming and error-prone task. In this article, we present an approach to avoid such manual validation before each continuous evolution step in a microservice system, which we demonstrate using three widely used categories of security tactics: secure communication, identity management, and observability. Our approach is based on a review of existing security guidelines, the gray literature, and the scientific literature, from which we derived Architectural Design Decisions (ADDs) with the found security tactics as decision options. In our approach, we propose novel detectors to detect these decision options automatically and formally defined metrics to measure the conformance of a system to the different options of the ADDs. We apply the approach to a case study data set of 10 open source microservice systems, plus another 20 variants of these systems, for which we manually inspected the source code for security tactics. We demonstrate and assess the validity and appropriateness of our metrics by performing an assessment of their conformance to the ADDs in our systems’ dataset through statistical methods.

The microservice architecture presents many challenges from a security perspective, due to the large amount of services, leading to an increased attack surface and an unmanageble cognitive load for security analysts. Several benchmarks exist to guide the secure configuration of the deployment infrastructure for microservice applications, including containers (e.g., Docker), orchestration systems (e.g., Kubernetes), cloud platforms (e.g., AWS), and even operating systems (e.g., Linux). In this paper we approach the creation of a benchmark for the design of the microservice applications themselves. To this aim, we inventorize a number of relevant security rules for the architectural design of microservice applications and assess (in a preliminary way) how these rules could be checked automatically.

Deploying machine learning models to production is challenging, partially due to the misalignment between software engineering and machine learning disciplines but also due to potential practitioner knowledge gaps. To reduce this gap and guide decision-making, we conducted a qualitative investigation into the technical challenges faced by practitioners based on studying the grey literature and applying the Straussian Grounded Theory research method. We modelled current practices in machine learning, resulting in a UML-based architectural design decision model based on current practitioner understanding of the domain and a subset of the decision space and identified seven architectural design decisions, various relations between them, twenty-six decision options and forty-four decision drivers in thirty-five sources. Our results intend to help bridge the gap between science and practice, increase understanding of how practitioners approach deployment of their solutions, and support practitioners in their decision-making.

Dynamic reconfiguration is commonly used to accommodate the dynamic behavior of today’s applications. As cloud-based systems become increasingly complex, it is hard and cost-ineffective to manage them manually. Dynamic routers, such as API Gateways or Message Brokers, in combination with auto-scalers can adapt the system to the resource demands, e.g., when a sudden load spike for a specific part of the system is observed. Without taking costs of cloud resources into account, this reconfiguration can lead to significant increase of charges. We propose a self-adaptive and cost-aware dynamic routing architecture called Adaptive Dynamic Routers. The novel architecture performs a multi-criteria optimization analysis to automatically reconfigure the routers and the services of a cloud-based system considering the costs of reconfiguration. This multidimensional auto-scaling of resources takes incoming load as an input, and uses queuing theory to find an optimal reconfiguration solution. We systematically evaluated our architecture with an extensive number of evaluation cases (9600). On average over cases where an overload is predicted, our approach reduces the overload rate by 46.7% and 61.8% for routers and services, respectively.

Composing Web APIs is a widely adopted practice by developers to speed up the development process of complex Web applications, mashups, and data processing pipelines. However, since most publicly available APIs are built independently of each other, developers often need to invest their efforts in solving incompatibility issues by writing ad-hoc glue code, adapters and message translation mappings. How likely are Web APIs to be directly composable?The paper presents an empirical study to determine the potential composability of a large collection of 20,587 public Web APIs by verifying their schemas’ compatibility. We define three levels of data model elements compatibility – considering matches between property names and/or data types – which can be determined statically based on API descriptions conforming to the OpenAPI specification. The study research questions address: to which extent are Web APIs compatible; the average number of compatible endpoints within each API; the likelihood of finding two APIs with at least one pair of compatible endpoints.To perform the analysis we developed a compatibility checker tool which can statically determine API schema compatibility on the three levels and find matching pairs of API responses which can be directly forwarded as requests to the same or other APIs. We run the tool on a dataset of 751,390 request and response message schemas extracted from publicly available OpenAPI descriptions.The results indicate a relatively high number of compatible APIs when matching their data models only on the level of their elements’ data type. However, this number gets lower narrowing the scope to only the ones handling data objects having identical properties name. The average likelihood of finding two compatible APIs with both matching property names and data types reaches 21%. Also, the number of compatible endpoints within the same API is very low.

Container scheduling is a fundamental part of today’s service and cloud-based applications. Schedulers operate at different levels depending on how much control the system developers have. On the one hand, container orchestration managers such as Google Kubernetes manage the scheduling of containers to different nodes. On the other hand, serverless managers, such as Google Autopilot, take care of the underlying infrastructure automatically, and developers do not need to manage the nodes. However, when it comes to container depletion, i.e., removing the assigned cloud resources to an idle container, current scheduling technologies have limitations. In this paper, we propose our approach to managing cloud resource usage when containers are idle efficiently. For this purpose, we deplete idle containers statefully, i.e., propose a novel manager that monitors idle containers, saves their state, and efficiently depletes them. This manager reconstructs a depleted container using the saved state when reconstruction is needed. In our approach, we suggest an Infrastructure as Code component to automate the creation of new nodes if a depleted container cannot be scheduled on the same node, e.g., because of being overloaded. We provide an analytical model for the stateful depletion of containers and their rescheduling and empirically evaluate the accuracy of our model. For this purpose, we ran an experiment on a private cloud infrastructure and Google Cloud Platform. Our model has a low error rate of 4.28% averaged over public and private clouds.

Domain-driven design (DDD) is commonly used to design microservices. A crucial aspect of microservice design is API design, which includes the design of API endpoints. Our objective is to automate the assessment of conformance to Architectural Design Decisions (ADDs) on the interrelation of DDD and APIs. In particular, we studied link mapping, API operation design, and resource segregation as API endpoint design issues that are linked to domain model design. We particularly aim to address conformance checking in the context of frequent release practices, as frequent manual conformance checking is difficult or infeasible. We suggest a new approach for the automated assessment of conformance to ADD options. The approach suggests automated detectors to detect ADD options selected in a given API endpoint design, as well as an assessment scoring scheme based on empirical results. For the evaluation of our approach, we first manually created a ground truth for 12 cases in a multi-case study, and then compared the results of our automated detectors to the ground truth for each of those cases. With our approach, all ADD options in our multi-case study possibly can be automatically detected. Without further improvements, our approach identifies 83% of the decision points in the multi-case study correctly. A statistical analysis of our data shows only a negligible effect size for differences to the ground truth. Our new approach provides a pragmatic method for automated detection of conformance to ADDs on the interrelation of DDD and APIs. The approach can support the continuous analysis of API endpoint designs.

Context:Various patterns of dynamic routing architectures are used in service- and cloud-based environments, including sidecar-based routing, routing through a central entity such as an event store, or architectures with multiple dynamic routers.Objective:Choosing the wrong architecture may severely impact the reliability or performance of a software system. This article’s objective is to provide models and empirical evidence to precisely estimate the reliability and performance impacts.Method:We propose an analytical model of request loss for reliability modeling. We studied the accuracy of this model’s predictions empirically and calculated the error rate in 200 experiment runs, during which we measured the round-trip time performance and created a performance model based on multiple regression analysis. Finally, we systematically analyzed the reliability and performance impacts and trade-offs.Results and Conclusions:The comparison of the empirical data to the reliability model’s predictions shows a low enough and converging error rate for using the model during system architecting. The predictions of the performance model show that distributed approaches for dynamic data routing have a better performance compared to centralized solutions. Our results provide important new insights on dynamic routing architecture decisions to precisely estimate the trade-off between system reliability and performance.

Microservices are one of the most recommended architectural styles for distributed applications that support independent development and deployment, enable rapid release, and are highly scalable and polyglot. Many well-established patterns and best practices have been documented in the literature. As there are many such guidances, they have numerous interdependencies, and system designs must adhere to many other architecture constraints, too, implementations do not always conform to those guidances. In complex or large systems, it can be hard and tedious to spot violations. Our work aims to offer automated support for architecting during the continuous evolution of microservice-based systems. More specifically we aim to provide the foundations for an automated approach for architecture reconstruction, assessing conformance to patterns and practices specific for microservice architectures, and detect possible violations. Based on this, we provide actionable options to architects for improving architecture conformance as part of a continuous feedback loop. That is, our goal is to support architecting in the context of continuous delivery practices, where architecture violations are continuously analyzed and fix options are continuously suggested.

Microservice API design is a critical aspect in crafting a microservice architecture. While API design in general has been studied, the specific relation of API design to design practices and models commonly used in microservice architectures is yet understudied. In particular, practitioners frequently use Domain-Driven Design (DDD) in their microservice architecture and API designs. We thus decided to study existing Architectural Design Decisions (ADDs), their solutions options, their relations, and the decision drivers in these decisions. Using the Grounded Theory research method we studied grey literature sources. In this study, we identified six ADDs with 27 decision options, numerous relations between them, and 27 decision drivers. The decisions cover mapping domain models to APIs, defining API contracts in relation to domain models, designing API resources based on domain model elements, segregation of API resources, mapping domain model links to the API, and designing the operations of an API resource.

Many different dynamic routing architectures are available, including sidecar-based routing, routing through a central entity such as an event store or gateway, or architectures with multiple routers. These architectures are currently based on vastly different implementation concepts, such as API Gateways, Message Brokers, or Service Proxies. We propose a new approach that abstracts all these architecture patterns using one Adaptive Dynamic Routers architecture. We hypothesize that a dynamic self-adaptation of the routing architecture is beneficial over any fixed architecture selections for reliability and performance trade-offs. That is, if encountered with traffic and load changes, our approach dynamically self-adapts between more central or distributed routing to optimize system reliability and performance. We evaluate our approach by analyzing our previously-measured data during an experiment of 1200 hours of runtime. Our extensive systematic evaluation with 1089 cases confirms that our hypothesis holds and our approach is beneficial in terms of reliability and performance. Moreover, we empirically validate our results on Google Cloud Platform infrastructure.

Code and design smells, such as the coupling smells examined in this article, are widely studied. Existing empirical studies reveal gaps between the scientific theory and practice, not yet explained by the scientific literature. Only basic coupling smell detection approaches and metrics seem to have been transferred to practice so far. This article aims to study the current practitioner’s understanding of coupling smells. Based on grey literature sources containing practitioner views on coupling smells, we performed a Grounded Theory (GT) study. We used UML-based modeling to precisely encode our findings and performed a rigorous analysis of our codes and models. Our results are defining factors of coupling smells, as well as smell impacts, trade-offs, relationships to other smells, relationships to practices and patterns, and fix options as perceived by practitioners. We further identified gaps in the understanding of coupling smells between science and practice, and derived opportunities and challenges for future scientific work. Five lessons are presented as opportunities and challenges for future research. Our results can help scientists to get a better understanding of practitioner concerns, and practitioners to get an overview of the current perception of other practitioners on coupling smells.

Abstract State Machine (ASM) theory is a well-known state-based formal method to analyze and specify software and hardware systems. As in other state-based formal methods, the proposed modeling languages for ASMs still lack easy-to-comprehend abstractions to structure state and behavior aspects of specifications. Modern object-oriented languages offer a variety of advanced language constructs, and most of them either offer interfaces, mixins, or traits in addition to classes and inheritance. Our goal is to investigate these language constructs in the context of state-based formal methods using ASMs as a representative of this kind of formal methods. We report on a controlled experiment with 105 participants to study the understandability of the three language constructs in the context of ASMs. Our hypotheses are influenced by the debate of object-oriented communities. We hypothesized that the understandability (measured by correctness and duration variables) shows significantly better understanding for interfaces and traits compared to mixins, as well as at least a similar or better understanding for traits compared to interfaces. The results indicate that understandability of interfaces and traits show a similar good understanding, whereas mixins shows a poorer understanding. We found a significant difference for the correctness of understanding comparing interfaces with mixins.

Abstract State Machine (ASM) theory is a well-known state-based formal method. As in other state-based formal methods, the proposed specification languages for ASMs still lack easy-to-comprehend abstractions to express structural and behavioral aspects of specifications. Our goal is to investigate object-oriented abstractions such as interfaces and traits for ASM-based specification languages. We report on a controlled experiment with 98 participants to study the specification efficiency and effectiveness in which participants needed to comprehend an informal specification as problem (stimulus) in form of a textual description and express a corresponding solution in form of a textual ASM specification using either interface or trait syntax extensions. The study was carried out with a completely randomized design and one alternative (interface or trait) per experimental group. The results indicate that specification effectiveness of the traits experiment group shows a better performance compared to the interfaces experiment group, but specification efficiency shows no statistically significant differences. To the best of our knowledge, this is the first empirical study studying the specification effectiveness and efficiency of object-oriented abstractions in the context of formal methods.

Temporal properties are important in a wide variety of domains for different purposes. For example, they can be used to avoid architectural drift in software engineering orto support the regulatory compliance of business processes. In this work, we study the understandability of three majortemporal property representations: (1) LinearTemporal Logic (LTL) is a formal and well-established logic that offers temporal operators to describe temporal properties; (2) Property Specification Patterns (PSP) are a collection of recurring temporal properties that abstract underlying formal and technical representations; (3) Event Processing Language (EPL) can be used for runtime monitoring of event streams using Complex Event Processing. We conducted two controlled experiments with 216 participants in total to study the understandability of those approaches using a completely randomized design with one alternative per experimental unit. We hypothesized that PSP, as a highly abstracting pattern language, is easier to understand than LTL and EPL, and that EPL, due to separation of concerns (as one or more queries can be used to explicitly define the truth value change that an observed event pattern causes), is easier to understand than LTL. We found evidence supporting our hypotheses which was statistically significant and reproducible.

Models describe a software system on an abstraction level higher than its actual implementation. Recent research results show that bringing models and a running system closer together by establishing traceability links between recorded runtime events and corresponding model elements improves the analysis performance of human observers when assessing the behaviour of the running system. Despite these results, common techniques for analyzing runtime events are rarely integrated into the models that are used for assessing the system behaviour from a high-level perspective. This paper presents a controlled experiment where model-integrated analysis facilities are compared with a more traditional analysis approach based on SQL queries to a system's database in terms of correctness and completion time of analysis tasks. The results show that model-integrated analyses allow analysts to give more correct answers to questions about the system behaviour, but provide no improvement of the time spent for completing the analysis tasks.

Mature verification and monitoring approaches, such as complex event processing and model checking, can be applied for checking compliance specifications at design time and runtime. Little is known about the understandability of the different formal and technical languages associated with these approaches. This uncertainty regarding understandability might be a major obstacle for the broad practical adoption of those techniques. This article reports a controlled experiment with 215 participants on the understandability of modeling compliance specifications in representative modeling languages, namely linear temporal logic (LTL), the complex event processing-based event processing language (EPL) and property specification patterns (PSP). The formalizations in PSP were overall more correct. That is, the pattern-based approach provides a higher level of understandability than EPL and LTL. More advanced users, however, seemingly are able to cope equally well with PSP and EPL in modeling compliance specifications.

This article reports a controlled experiment with 116 participants on the understandability of representative graphical and textual pattern-based behavioral constraint representations from the viewpoint of novice software designers. Particularly, graphical and textual behavioral constraint patterns present in the declarative business process language Declare and textual behavioral constraints based on Property Specification Patterns are the subjects of this study. In addition to measuring the understandability construct, this study assesses subjective aspects such as perceived difficulties regarding learning and application of the tested approaches. An interesting finding of this study is the overall low achieved correctness in the experimental tasks, which seems to indicate that pattern-based behavioral constraint representations are hard to understand for novice software designers in the absence of additional supportive measures. The results of the descriptive statistics regarding achieved correctness are slightly in favor of the textual representations, but the inference statistics do not indicate any significant differences in terms of understandability between graphical and textual behavioral constraint representations.

Models are popular artefacts in the software development process which promise to improve stakeholder communication and the overall quality of a software system under construction. Recent research proposes that the usefulness of models is not limited only to the software design phase: Empirical evidence indicates that manual analysis of a running system is improved when models are linked to recorded runtime events. However, software architects are confronted with various design decisions when designing a system that yields the required runtime events and correlates them to the model elements they originate from. The contribution of this paper is a taxonomy of architectural design decisions distilled from a series of qualitative studies following a multi-method research study design: We utilized coding techniques from Grounded Theory to build an initial taxonomy from architectural concepts found in the literature, and verified and extended the taxonomy independently by five novice software architects in a practical scenario. The resulting taxonomy captures essential architectural decisions when implementing a system that supports the analysis of its runtime behaviour using models. We then performed initial steps towards a architectural guidance model by applying the taxonomy to another realistic scenario, following the Design Science Research method, in order to analyze the properties and deepen our own technical understanding of the captured concepts in the taxonomy.

In the process of software-intensive systems engineering, architectures need to be designed that are compliant to the requirements. For this, architects need to examine those requirements with regard to their architectural impact. Accessing and interpreting the requirements is however not always possible, for instance if custom requirements are yet unknown at the time when the architecture is modeled. Ideally, architectural knowledge as derived from custom requirements could be imposed upon architecture models. This paper proposes a novel concept for automated refactoring of architecture models in order to meet such requirements by formalizing architectural knowledge using model verification and model transformations. Industrial application within a telecommunications service provider is demonstrated in the domain of cloud application orchestration: service providers are enabled to autonomously customize solutions predefined by vendors according to their own internal requirements.

Software systems are getting increasingly complex, which makes them inherently harder to understand and instrument when their behaviours should be analyzed and adapted. Observing a system requires an examination of its implementation and writing the appropriate monitoring code. This process can be both time consuming and error prone, especially if high-level system properties should be analyzed which are not directly reflected in the implementation. Furthermore, analysis needs often arise at runtime and are handled in an unsystematic way that is not reusable: For similar analysis tasks, the process of examining the system and writing the monitoring logic must be repeated. In this paper we present a language to specify recurring monitoring patterns which are automatically expanded into monitoring code for given models of the analyzed system. As a consequence, the effort for writing monitoring code is reduced and recurring analysis tasks are better supported through automatic code generation.

Software architecture compliance is concerned with the alignment of implementation with its desired architecture and detecting potential inconsistencies. The work presented in this paper is specifically concerned with behavioral architecture compliance. That is, the focus is on semantic alignment of implementation and architecture. In particular, this paper evaluates three representative approaches for describing semantic constraints in terms of their understandability, namely natural language descriptions as used in many architecture documentations today, a structured language based on specification patterns that abstract underlying temporal logic formulas, and a structured cause-effect language that is based on Complex Event Processing. We conducted a controlled experiment with 190 participants using a simple randomized design with one alternative per experimental unit. Overall all approaches support a high level of correct understanding, and the statistical inference suggests that all tested approaches are equally well suited for describing semantic constraints for behavioral architecture compliance in terms of understandability. In consequence this indicates that it is possible to benefit from the tested structured languages with underlying formal representations for automated verification without having to suffer from decreased understandability. Vice versa, the results suggest that the use of natural language can be a suitable way to document architecture semantics when reliable automated support for formal verification is of minor importance.

The main challenge in software development process is to detect and fix the deviations of system's behaviors at different abstraction levels in early phases. For this purpose, UML 2 sequence diagrams are widely used for describing and analyzing the communication behavior of software systems. This paper describes a containment checking approach for UML 2 sequence diagrams to verify whether the behavior (or functions) described by a low-level model conforms those specified in the high-level counterpart based on model checking techniques, in order to improve the system's quality. However, creating consistency constraints and formal specifications for the sequence diagrams is a labor-intensive and error prone task. To alleviate this issue, we propose an automated transformation of sequence diagrams into formal specifications and consistency constraints that enable us to leverage the analytical powers of model checking to automatically verify the containment relationship. In addition, our approach provides the stakeholders more informative and comprehensive feedbacks regarding the inconsistency issues, and therefore helps them to efficiently identify and resolve the problems. The approach is implemented and validated using three realistic scenarios.

In this work we advance the understanding of software eco-systems research by examining the structure and evolution of the R statistical computing open-source ecosystem. Our research attempts to shed light on the following intriguing question: what makes software ecosystems successful? The approach we follow is to perform a quantitative analysis of the R ecosystem. R is a well-established and popular ecosystem, whose community and marketplace are steadily growing. We assess and quantify the ecosystem throughout its history, and derive metrics on its core software components, the marketplace as well as its community. We use our insights to make observations that are applicable to ecosystems in general, validate existing theories from the literature, and propose a predictive model for the evolution of software packages. Our results show that the success of the ecosystem relies on a strong commitment by a small core of users who support a large and growing community.

Much attention is paid nowadays to software architecture of a system as a set of design decisions providing the rationale for the system design. To document and share proven architectural design decisions, decisions made in concrete development projects are mined and distilled into reusable architectural decision models (a.k.a. guidance models). The available distillation approaches, however, remain ad hoc and biased towards the personal experience of few expert architects. Relationships between distilled decisions are not systematically explored. We propose an approach for distilling reusable architectural design decisions with emphasis on their relationships. Architectural knowledge artifacts (e.g., architecture documentation, interviews) are systematically coded for the occurrence of architectural design decisions and their details. Co-occurrences of coded design decisions are then processed for different relationship types using an established data-mining technique: frequent item-sets. The distilled relationships enter the construction of a reusable architectural decision model and contribute to organizing the design space based on empirical data (i.e., frequency patterns of co-occurrences). We report on distilling design-decision relationships from decision data collected during a three-year project on language architectures of 80 UML-based domain-specific modeling languages.

Context: None of the published empirical studies on software traceability have comparatively examined the support for differently sized systems. Objective: This paper reports on two controlled experiments performed with two Enterprise Service Bus (ESB) systems that are comparable in terms of support features and system structure, but are different in their size, in particular, UltraESB Version 2.3.0 and PetalsESB Version 4.2.0, to investigate the effects of system size on the use of traceability links. Method: We conducted two controlled experiments in which the same impact evaluation activities were performed and measured how the control groups (provided with no traceability information) and the experiment groups (provided with traceability information) performed these activities in terms of the quantity and quality of retrieved elements. Results: Our findings show that the 133.71% larger size of one of ESBs does not have a significant influence on the quantity and quality of retrieved elements in the experiment groups. In the control groups, in contrast, this increase in system size significantly increases the quantity of incorrect elements and reduces the overall quality of elements retrieved, while no conclusive evidence concerning the quantity of missing elements was found. Conclusion: It is concluded that traceability is more important in larger software systems.

The main idea of software architecture is to concentrate on the "big picture" of a software system. In the context of object-oriented software systems higher-level architectural structures or views above the level of classes are frequently used to capture the "big picture" of the system. One of the critical aspects of these higher-level views is understandability, as one of their main purposes is to enable designers to abstract away fine-grained details. In this article we present a systematic mapping study on software metrics related to the understandability concepts of such higher-level software structures with regard to their relations to the system implementation. In our systematic mapping study, we started from 3951 studies obtained using an electronic search in the four digital libraries from ACM, IEEE, Scopus, and Springer. After applying our inclusion/exclusion criteria as well as the snowballing technique we selected 268 studies for in-depth study. From those, we selected 25 studies that contain relevant metrics. We classify the identified studies and metrics with regard to the measured artefacts, attributes, quality characteristics, and representation model used for the metrics definitions. Additionally, we present the assessment of the maturity level of the identified studies. Overall, there is a lack of maturity in the studies. We discuss possible techniques how to mitigate the identified problems. From the academic point of view we believe that our study is a good starting point for future studies aiming at improving the existing works. From a practitioner's point of view, the results of our study can be used as a catalogue and an indication of the maturity of the existing research results.

In the development of complex and large scale software systems, it is important to detect and fix the deviations of systems' behaviors at different abstraction levels in early phases. Our main focus here is the containment checking -- a special type of consistency checking -- that verifies whether the behavior (or functions) described by a low-level behavior model encompasses those specified in the high-level counterpart. As shown in our previous work, containment checking can be realized based on model checking, but not always the costly exhaustive searches employed by model checking are necessary for addressing the containment checking problem, leading to potentials for optimization. In addition, model checking and similar techniques often yield the checking results as true (satisfied) or false (unsatisfied) with error traces (e.g., Counter-examples). Unfortunately, such feedback is rather not helpful for users with limited background on the underlying formal methods to analyze and understand the causes of consistency violations. In this paper, we propose a lightweight graph-based approach for addressing the aforementioned problems of containment checking. The theoretical complexity of our approach is a cubic polynomial of the number of elements of the input behavior models. Additionally, we aim at generating feedbacks that are relevant and easy-to-understand for the stakeholders. Our approach is illustrated and evaluated on UML activity diagrams -- that are widely used for modeling behaviors of software systems -- using use cases derived from industrial scenarios.

Today's software is getting more and more complex and harder to understand. Models help to organize knowledge and emphasize the structure of a software at a higher abstraction level. While the usage of model-driven techniques is widely adopted during software construction, it is still an open research topic if models can also be used to make runtime phenomena more comprehensible as well. It is not obvious which models are suitable for manual analysis and which model elements can be related to what type of runtime events. This paper proposes a collection of runtime event types that can be reused for various systems and meta-models. Based on these event types, information can be derived which help human observers to assess the current system state. Our approach is applied in a case study and evaluated regarding generalisability and completeness by relating it to two different meta-models.

In distributed event-driven architectures, components are composed in a highly decoupled way, facilitating high flexibility, scalability and concurrency of distributed systems. However, the intrinsic loose coupling of its components make relations hard to identify making it challenging to analyze, maintain, and evolve an event-based architecture. For understanding the evolution of an event-based architecture, we require knowledge about its components' dependencies, which is often hard to gain due to the absence of explicit information about these dependencies. Furthermore, assisting techniques for analyzing the impacts of certain changes are missing, hindering the implementation of changes in event-driven architectures. We present in this paper a novel approach providing models to describe changes in event-based architectures on different levels of abstraction. The explicit definition of a change enables various types of analysis to increase the quality of the evolving event based systems architecture, like invalid access analysis, dangling actors analysis, change impact analysis, and dead actor analysis.

Decision-making is at the core of software architecture design. However, in order for the architect to take the right design decisions, assistance is required for exploring the architectural knowledge, which encompasses the various architectural solutions, their relationships and distinctions. In the past decades, the number of available technology options has increased significantly, while existing architecture knowledge approaches support technology decisions by representing relations between the different technology solutions, as well as design problems. However, they do not differentiate the candidate technologies according to their offered qualities and drawbacks. Our main goal in this exploratory study is to understand how technology solutions are being considered by the architects during the design process, and how can we enhance existing architecture knowledge concepts to support technology decision making. Our contribution in this paper is differentiating the different technology solutions' features based on a set of architecturally significant aspects, to facilitate considering technologies during the architecture design decisions. In addition, we proposed an extension for existing architecture knowledge models, which characterise the technology design decisions, and their reasoning. We evaluated our results through real examples from practitioners. Moreover, we conducted interviews with experts to validate our proposed concepts.

The links between the software architecture and the source code of a software system should be based on solid traceability mechanisms in order to effectively perform quality control and maintenance of the software system. There are several primary studies on traceability between software architecture and source code but so far no systematic literature review (SLR) has been undertaken. This study presents an SLR which has been carried out to discover the existing traceability approaches and tools between software architecture and source code, as well as the empirical evidence for these approaches, their benefits and liabilities, their relations to software architecture understanding, and issues, barriers, and challenges of the approaches. In our SLR the ACM Guide to Computing Literature has been electronically searched to accumulate the biggest share of relevant scientific bibliographic citations from the major publishers in computing. The search strategy identified 742 citations, out of which 11 have been included in our study, dated from 1999 to July, 2013, after applying our inclusion and exclusion criteria. Our SLR resulted in the identification of the current state-of-the-art of traceability approaches and tools between software architecture and source code, as well as gaps and pointers for further research. Moreover, the classification scheme developed in this paper can serve as a guide for researchers and practitioners to find a specific approach or set of approaches that is of interest to them.

Architectural component models represent high level designs and are frequently used as a central view of architectural descriptions of software systems. The components in those models represent important high level organization units that group other components and classes in object-oriented design views. Hence, understandability of components and their interactions plays a key role in supporting the architectural understanding of a software system. In this paper we present a study we carried out to examine the relationships between the effort required to understand a component, measured through the time that participants spent on studying a component, and component level metrics that describe component's size, complexity and coupling in terms of the number of classes in a component and the classes' relationships. The participants were 49 master students, and they had to fully understand the components' functionalities in order to answer 4 true/false questions for each of the 7 components in the architecture of the Soomla Android store system. Correlation, collinearity and multivariate regression analysis were performed. The results of the analysis show a statistically significant correlation between three of the metrics, number of classes, number of incoming dependencies, and number of internal dependencies, on one side, and the effort required to understand a component, on the other side. In a multivariate regression analysis we obtained 3 reasonably well-fitting models that can be used to estimate the effort required to understand a component. In our future work we plan to study more components and investigate more metrics and their relationships to the understandability of components and architectural component models.

The advocates of architecture traceability approaches regularly cite advantages like easier understanding of architectural designs and support for software quality control and maintenance. However, the lack of published empirical data on the usefulness of architecture traceability is one of the reasons that prevents the wide adoption of traceability approaches in industrial settings. This paper reports on two controlled experiments performed with different participants to investigate whether the use of architecture traceability can significantly support architecture-level understanding activities. The replications with different participants allowed us to investigate whether the participants' experience plays a significant role in the understanding of software architectures with or without traceability information. In particular, we designed twelve typical questions aimed at gaining an architecture-level understanding of a representative subject system and measured how a control group (provided with no traceability information) and an experiment group (provided with traceability information) answered these questions in terms of the solutions' correctness and the participants' experience. Our findings show that the correctness of the answers of the participants in the experiment group is significantly higher than in the control group, whereas no significant differences with regard to the experience of the participants are observed.

The process of engineering and provisioning service-based systems (SBS) follows a complex and dynamic lifecycle with different phases and levels of abstraction. We tackle the problem of making this lifecycle explicit, providing development time and runtime support for evolutionary changes in such systems. SBSs are modeled as integrated ecosystems consisting of four conceptual layers (or phases): design, implementation, deployment, and runtime. Our work is driven by the notion that identifying the right changes (monitoring) and effecting of these changes (adaptation) usually takes place individually on each layer. While considering changes on a single layer (e.g., runtime adaptation) is often sufficient, some cases require systematic escalation to adjacent layers. We present a generic lifecycle model that provides an abstracted view of the problem domain and can be mapped to concrete artifacts on each individual layer. We introduce a real-life scenario taken from the telecommunications domain, which serves as the basis for discussion of the challenges and our solution. Based on the scenario and our experience from a research project on Virtual Service Platforms, we evaluate three concrete use cases which illustrate the diversity of evolutionary changes supported by the approach.

Event-based communication styles are potential solutions for facilitating high flexibility, scalability, and concurrency of distributed systems due to the intrinsic loose coupling of the participants. However, software developers often find the event-driven communication style unintuitive, especially for large and complex systems with numerous constituting elements, because of its non-deterministic characteristics. In this paper, we propose a novel approach based on DERA-an event actor-based framework-which can be used to describe distributed event-based systems with reduced nondeterminism. DERA's graphical notations support representing a current snapshot of an event-based system closely to the intuitive perception of the developers. We propose a formal specification of the event actors-based constructs and the graphical notations based on Petri nets in order to enable formal analysis of such snapshots. Based on this, an automated translation from event actors-based constructs to Petri nets using template-based model transformation techniques is also developed. The applicability of our approach is shown through an industrial case study in the field of service platform integration.

CONTEXT: A distributed business process is executed in a distributed computing environment. The service-oriented architecture (SOA) paradigm is a popular option for the integration of software services and execution of distributed business processes. Entailment constraints, such as mutual exclusion and binding constraints, are important means to control process execution. Mutually exclusive tasks result from the division of powerful rights and responsibilities to prevent fraud and abuse. In contrast, binding constraints define that a subject who performed one task must also perform the corresponding bound task(s). OBJECTIVE: We aim to provide a model-driven approach for the specification and enforcement of task-based entailment constraints in distributed service-based business processes. METHOD: Based on a generic metamodel, we define a domain-specific language (DSL) that maps the different modeling-level artifacts to the implementation-level. The DSL integrates elements from role-based access control (RBAC) with the tasks that are performed in a business process. Process definitions are annotated using the DSL, and our software platform uses automated model transformations to produce executable WS-BPEL specifications which enforce the entailment constraints. We evaluate the impact of constraint enforcement on runtime performance for five selected service-based processes from existing literature. RESULTS: Our evaluation demonstrates that the approach correctly enforces task-based entailment constraints at runtime. The performance experiments illustrate that the runtime enforcement operates with an overhead that scales well up to the order of several ten thousand logged invocations. Using our DSL annotations, the user-defined process definition remains declarative and clean of security enforcement code. CONCLUSION: Our approach decouples the concerns of (non-technical) domain experts from technical details of entailment constraint enforcement. The developed framework integrates seamlessly with WS-BPEL and the Web services technology stack. Our prototype implementation shows the feasibility of the approach, and the evaluation points to future work and further performance optimizations.

SUMMARY Architectural patterns are often applied in combination with related patterns within software architectures. The relationships among architectural patterns must be considered when applying a combination of patterns into a system; for example the way the Model‐View‐Controller uses the Observer pattern to implement the change propagation mechanism needs to be carefully designed. However, effective integration of architectural patterns within software architectures remains a challenging task. This is because the integration of any two architectural patterns can take several forms. Furthermore, existing pattern languages define generic and abstract relationships between architectural patterns without going into detail about associations among the participants of architectural patterns. In this paper, we propose to address the pattern integration issue by discovering and defining a set of pattern participants relationships that serve the purpose of effectively integrating architectural patterns. Our findings are validated through a controlled experiment, which provides significant evidence that the proposed relationships support inexperienced designers in integrating patterns. Copyright © 2011 John Wiley & Sons, Ltd.

In a model-driven service-oriented architecture (SOA), the services are in large parts generated from models. To facilitate monitoring, governance, and self-adaptation the information in these models can be used by services that monitor, manage, or adapt the SOA at runtime. If a service for monitoring, management, or adaptation in an SOA is dependent on models, and the metamodel changes, usually the service needs to be manually adapted to work with the new version, recompiled, and redeployed. This manual effort impedes the use of models at runtime. To address this problem, this paper introduces model-aware services that work with models at runtime. These services are supported using a service environment, called Morse. Hiding the complexity of implicit versioning of models from users while respecting the principle of Universally Unique Identifiers (UUIDs), it realizes a novel transparent UUID-based model versioning technique. It uses the model-driven approach to automatically generate and deploy Morse services that are used by the model-aware services to access models in the correct version. In this way, monitoring and adaptation in SOAs can be better supported, and the manual effort to evolve services for monitoring, management, or adaptation, which are based on models at runtime, can be minimized.

Embedded, textual DSLs are often provided as an API wrapped around object-oriented application frameworks to ease framework integration. While literature presents claims that DSL-based application development is beneficial, empirical evidence for this is rare. We present the results of an experiment comparing the complexity of three different object-oriented framework APIs and an embedded, textual DSL. For this comparative experiment, we implemented the same, non-trivial application scenario using these four different APIs. Then, we performed an Object-Points (OP) analysis, yielding indicators for the API complexity specific to each API variant. The main observation for our experiment is that the embedded, textual DSL incurs the smallest API complexity. Although the results are exploratory, as well as limited to the given application scenario and a single embedded DSL, our findings can direct future empirical work. The experiment design is applicable for similar API design evaluations.

In this paper, we present an approach for identity and access management (IAM) in the context of (cross-organizational) service-oriented architectures (SOA). In particular, we defined a domain-specific language (DSL) for role-based access control (RBAC) that allows for the definition of IAM policies for SOAs. For the application in a SOA context, our DSL environment automatically produces WS-BPEL (Business Process Execution Language for Web services) specifications from the RBAC models defined in our DSL. We use the WS-BPEL extension mechanism to annotate parts of the process definition with directives concerning the IAM policies. At deployment time, the WS-BPEL process is instrumented with special activities which are executed at runtime to ensure its compliance to the IAM policies. The algorithm that produces extended WS-BPEL specifications from DSL models is described in detail. Thereby, policies defined via our DSL are automatically mapped to the implementation level of a SOA-based business process. This way, the DSL decouples domain experts' concerns from the technical details of IAM policy specification and enforcement. Our approach thus enables (non-technical) domain experts, such as physicians or hospital clerks, to participate in defining and maintaining IAM policies in a SOA context. Based on a prototype implementation we also discuss several performance aspects of our approach.

In service-oriented systems, clients can access services via a network. Service level agreements (SLA) can exist, which specify --- among other things --- performance-related Quality of Service (QoS) properties between the client and the server, such as round-trip time, processing time, or availability. For a service provider serious financial consequences or other penalties can follow in case of not fulfilling the SLAs. The service consumer wants to evaluate that the provider complies with the guaranteed SLAs. Designing and developing a QoS-aware service-oriented system means facing many design challenges, such as where and how to measure the performance-related QoS properties. This paper presents design practices and patterns for measuring such QoS properties by extending and utilizing existing patterns. The focus of the patterns lies on the QoS measuring impact on the client's or service's performance, the extend of separation of concerns, the property of reusability, and the preciseness of the measured QoS properties. The patterns help to build efficient solutions to measure performance-related QoS properties in a service-oriented system.

Governing business compliance with regulations, laws, best practices, contracts, and the like is not an easy task, and so far there are only limited software products available that help a company to express compliance rules and to analyze its compliance state. We argue that todaypsilas SOA-based way of implementing and conducting business (e.g., using Web services and business process engines) lends itself very well to the development of a comprehensive compliance government solution that effectively aids companies in being compliant. In this paper, we contextualize the compliance problem in SOA-based businesses, we highlight which are the most salient research challenges that need to be addressed, and we describe our approach to compliance governance, spanning design, execution, and evaluation concerns.

In a number of scenarios, services generated using a model-driven development (MDD) approach could benefit from “reflective” access to the information in the models from which they have been generated. Examples are monitoring, auditing, reporting, and business intelligence scenarios. Some of the information contained in the models of a service can statically be generated into its source code. In a distributed and changing environment this approach is limited, however, due to the fact that models and their relations evolve after the generation and deployment of a service. For example, the current model of a service might be different than the deployed version of the service. Our approach to solve this issue is a Model-Aware Service Environment (MORSE). It consists of a model repository that manages MDD projects and artifacts, and model-aware services that interact with the repository for performing reflective queries on the models stored in the repository. Thus, MORSE supports the dynamic, reflective lookup of models in service-oriented systems.

Many service-oriented business systems have to comply to various contracts and agreements. Multiple technical and non-technical stakeholders with different background and knowledge are involved in modeling such business concerns. In many cases, these concerns are only encoded in the technical models and implementations of the systems, making it hard for non-technical stakeholders to get involved in the modeling process. In this paper we propose to tackle this problem by providing model-driven Domain-specific Languages (DSL) for specifying the contracts and agreements, as well as an approach to separate these DSLs into sub-languages at different abstraction levels, where each sub-language is tailored for the appropriate stakeholders. We exemplify our approach by describing a Quality-of-Service (QoS) DSL which can be used to describe Service Level Agreements (SLA). This work provides insights into how DSLs can be utilized to model and enrich service-oriented business systems with concerns defined in contracts and agreements.

Abstract Building tailored software systems for a particular application domain is a complex task. For this reason,domain‐specific languages(DSLs) receive a constantly growing attention in recent years. So far the main focus of DSL research is on case studies and experience reports for the development of individual DSLs, design approaches and implementation techniques for DSLs, and the integration of DSLs with other software development approaches on a technical level. In this paper, we identify and describe the different activities that we conduct when engineering a DSL, and describe how these activities can be combined in order to define a tailored DSL engineering process. Our research results are based on the experiences we gained from multiple different DSL development projects and prototyping experiments. Copyright © 2009 John Wiley & Sons, Ltd.

When constructing software systems, software architects must identify and evaluate many competing design options and document the rationale behind any selections made. Two supporting concepts are pattern languages and architectural decision models. Unfortunately, both concepts only provide partial support: Extensive upfront education is needed for practitioners to be in command of' the full pattern literature relevant in their field; retrospective architectural decision modeling is viewed as a painful extra responsibility without immediate gains. In this paper, we combine pattern languages and reusable architectural decision models into a design method that is both comprehensive and comprehensible. Our design method identifies the required decisions in requirements models systematically, gives domain-specific pattern selection advice, and provides traceability from platform-independent patterns to platform-specific decisions. We validate our approach by applying it to enterprise applications as an exemplary application genre and a SOA case study from the finance industry.

Service-oriented middleware architectures should enable the rapid realization of loosely coupled services. Unfortunately, existing technologies used for service-oriented middleware architectures, such as Web services, P2P systems, coordination and cooperation technologies, and spontaneous networking, do not fully support all requirements in the realm of loosely coupled business services yet. Typical problems that arise in many business domains are for instance missing central control, complex cooperation models, complex lookup models, or issues regarding dynamic deployment. We used a pattern-based approach to identify the well working solutions in the different technologies for loosely coupled services. Then we reused this design knowledge in our concept for a service-oriented middleware. This concept is centered around a controlled environment, called a federation. Each remote object (a peer service) is controlled in one or more federations, but within this environment peers can collaborate in a simple-to-use, loosely coupled, and ad hoc style of communication. A semantic lookup service is used to let the peers publish rich metadata about themselves to their fellow peers.

Abstract Software patterns provide reusable solutions to recurring design problems in a particular context. The software architect or designer must find the relevant patterns and pattern languages that need to be considered, and select the appropriate patterns, as well as the best order to apply them. If the patterns and pattern languages are written by multiple pattern authors, it might be necessary to identify interdependencies and overlaps between these patterns and pattern languages first. Out of the possible multitude of patterns and pattern combinations that might provide a solution to a particular design problem, one fitting solution must be selected. This can only be mastered with a sufficient expertise for both the relevant patterns and the domain in which they are applied. To remedy these issues we provide an approach to support the selection of patterns based on desired quality attributes and systematic design decisions based on patterns. We propose to formalize the pattern relationships in a pattern language grammar and to annotate the grammar with effects on quality goals. In a second step, complex design decisions are analyzed further using the design spaces covered by a set of related software patterns. This approach helps to systematically find and categorize the appropriate software patterns—possibly even from different sources. As a case study of our approach, we analyze patterns from a pattern language for distributed object middleware. Copyright © 2006 John Wiley & Sons, Ltd.

Service-oriented architectures are increasingly used in the context of business processes. However, the proven practices for process-oriented integration of services are not well documented yet. In addition, modeling approaches for the integration of processes and services are neither mature nor do they exactly reflect the proven practices. In this article, we propose a pattern language for process-oriented integration of services to describe the proven practices. Our main contribution is a modeling concept based on pattern primitives for these patterns. A pattern primitive is a fundamental, precisely specified modeling element that represents a pattern. We present a catalog of pattern primitives that are precisely modeled using OCL constraints and map these primitives to the patterns in the pattern language of process-oriented integration of services. We also present a model validation tool that we have developed to support modeling the process-oriented integration of services, and an industrial case study in which we have applied our results.

Architectural patterns are a key point in architectural documentation. Regrettably, there is poor support for modeling architectural patterns, because the pattern elements are not directly matched by elements in modeling languages, and, at the same time, patterns support an inherent variability that is hard to model using a single modeling solution. This paper proposes tackling this problem by finding and representing architectural primitives, as the participants in the solutions that patterns convey. In particular, we examine a number of architectural patterns to discover those primitive abstractions that are common among the patterns, and at the same time demonstrate a degree of variability in each pattern. These abstractions belong in the components and connectors architectural view, though more abstractions can be found in other views. We have selected UML 2 as the language for representing these primitive abstractions as extensions of the standard UML elements. The added value of this approach is twofold: it proposes a generic and extensible approach for modeling architectural patterns by means of architectural primitives; it demonstrates an initial set of primitives that participate in several well-known architectural patterns.

Abstract Numerous large applications that have evolved over many years are well‐functioning and reliable, but have severe problems regarding flexibility and reuse. Due to the many fixes that were applied in a system's lifetime, it is often hard to customize, change or exchange system parts. Therefore, it is problematic to migrate such systems to a more flexible architecture or to new technologies. The document archive/retrieval system, discussed in this article, is an example of a large C system that had such problems. As a solution, we will sketch an architectural pattern language that involves patterns well‐suited for a piecemeal migration process. The patterns aim at building and composing highly flexible black‐box component architectures with an object‐oriented glueing layer. We present a re‐engineering case study for the document archive/retrieval system based on these patterns. The patterns are used to wrap the existing C implementations and integrate them with an object system. Moreover, the patterns introduce flexibility hooks into the hot spots of the architecture and let components define their required environment. This enables an easier future evolution of the system. The case study demonstrates a pattern language as an approach for piecemeal legacy migration apart from implementation details. Copyright © 2002 John Wiley & Sons, Ltd.

The management of complexity in large systems is traditionally focused on the modeling and management of classes and hierarchies of classes. In order to improve the compositional flexibility in large systems, this paper turns the focus on objects rather than classes. It demonstrates that a more powerful object system can ease the development of large systems and can improve the degree of code reuse. The paper introduces per-object mixins as a new object-level language construct for object-based system composition. Per-object mixins are implemented in the scripting language XOT/sub CL/ as a straightforward extension of its method chaining mechanism and enables the developer to mix classes into the precedence order of an arbitrary object. Per-object mixins can be used to implement state-specific behavior changes in a clean way. We present per-object mixins as a general approach to hide object specifics from client objects transparently.