International audience

International audience

Research on self-adaptive systems (SASs) has proliferated in the last fifteen years. Approaches resting on models at run-time have been proposed (e.g., to model system variants), as well as methods that aim at giving requirements a key role in driving the adaptation process (e.g., to choose the most appropriate system variant). More recent research focuses on automating model-based decisions, such as requirements revision, by exploiting data generated at execution time.Uncertainty is considered a first-class citizen in SAS engineering. A well recognised technique for dealing with uncertainty is risk management. Several risk management methods exist, as well as visual modelling languages that aim at supporting risk analysis.Our objective is to investigate how complementing requirements modelling with risk modelling could support automating risk-driven requirements analysis. While risk could be identified and modelled at design-time using domain knowledge and data generated by previous system executions, their estimation will be done at run-time, and guide the selection of system behaviour that minimises the risk of the system not being compliant with requirements.In this paper, we introduce our research objective that concerns the definition of an engineering framework, called Risk4SAS, that enables risk-driven requirements analysis in SASs life-cycle and describe first steps towards its realisation, including a meta-model, which captures the dependency between risk and the characteristics of a SAS’s variants. We conclude by presenting our research road-map.

Automated decision-making techniques are useful to support engineers when performing requirements engineering tasks. However, to be effectively used in practice they need to be integrated into the organisational context, in which stakeholder engagement becomes a critical adoption factor. In this paper, we propose a tool-supported collaborative requirements prioritisation process, called GRP, which exploits gamification elements to engage distributed stakeholders to contribute to the overall decision-making process. Analytic Hierarchy Process is used as key component of the game engine, and enables an iterative prioritisation process. The GRP process has been evaluated through an exploratory case study, which has been conducted at a small software company, providing us with preliminary evidence about the effectiveness of the proposed solution. The main findings and lessons learned from the case study are presented.

Automated decision-making techniques have been proposed to support engineers in selecting and prioritising requirements. However, to be effectively used in practice they need to be integrated into the organisational context, and their users, namely the members of the development team, and more generally the project's stakeholders, need to be engaged in the resulting tool-supported decision-making process. In this demo paper, we present a tool-supported collaborative requirements prioritisation process, which exploits game elements to engage distributed stakeholders to contribute to the overall decision-making process. AHP and Genetic Algorithms are used as key component of the game engine, which enables an iterative prioritisation process. The tool is part of the tool-suite developed in the SUPERSEDE project which aims at supporting a flexible feedback-anddata-driven software evolution approach.

Gamification has been applied in software engineering contexts, and more recently in requirements engineering with the purpose of improving the motivation and engagement of people performing specific engineering tasks. But often an objective evaluation that the resulting gamified tasks successfully meet the intended goal is missing. On the other hand, current practices in designing gamified processes seem to rest on a try, test and learn approach, rather than on first principles design methods. Thus empirical evaluation should play an even more important role.We combined gamification and automated reasoning techniques to support collaborative requirements prioritization in software evolution. A first prototype has been evaluated in the context of three industrial use cases. To further investigate the impact of specific game elements, namely point-based elements, we performed a quasi-experiment comparing two versions of the tool, with and without pointsification. We present the results from these two empirical evaluations, and discuss lessons learned.

As different types of user feedback are becoming available, from a variety of sources and in large amount, several analysis techniques have been developed with the purpose of extracting information that can be useful for requirements engineering purposes. For instance, automated extraction and prioritization of feature requests have been recently investigated for the specific case of app development, where the key prioritization criterion is value for the user. For other types of software applications and services, software evolution relies on multi-criteria requirements prioritization, which may take into account different stakeholders' perspectives, thus leading to a complex decision-making problem. Different automated reasoning techniques have been proposed to support multi-criteria requirements prioritization, aimed at reducing human effort and improving the quality of the resulting ranking of the candidate requirements.The goal of our research is to understand how we can exploit user feedback in tool-supported multi-criteria requirements prioritization processes. Towards this objective, we discuss the properties of user feedback which are relevant for requirements prioritization, formulate a multi-criteria requirements prioritization problem, and outline a possible solution that integrates state of the art automated reasoning techniques which we extend to cope with information derived from user feedback.

In the field of access control, many security breaches occur because of a lack of early means to evaluate if access control policies are adequate to satisfy privileges requested by subjects which try to perform actions on objects. This paper proposes an approach based on UMLsec, to tackle this problem. We propose to extend UMLsec, and to add OrBAC elements. In particular, we add the notions of context, inheritance and separation. We also propose a methodology for modeling a security policy and assessing the security policy modeled, based on the use of MotOrBAC. This assessment is proposed in order to guarantee security policies are well-formed, to analyse potential conflicts, and to simulate a real situation.