User reviews are important resources for mobile developers for maintaining and evolving mobile applications that have been released. Since there can be a lot of user reviews, it is cumbersome for the mobile development team to go through all user reviews to identify which ones contain useful information for further maintenance and evolution. This paper proposes an initial attempt to facilitate the maintenance and evolution process of a mobile development team by automating the generation of functional requirements from mobile application user reviews on the App Store and Play Store. Specifically, these functional requirements serve as change requirements for maintaining existing functions of the application or enhancing the application with new functions. The proposed approach is based on machine learning and natural language processing and consists of three steps. Firstly, user reviews that identify functional requirements are classified by text classification algorithms. Secondly, since some user reviews may address the same issues, distinct user reviews are identified by clustering techniques and text similarity. Finally, relevant information is extracted from the user reviews to generate functional requirements based on user review patterns and requirement boilerplates. In an evaluation, the generated functional requirements obtained moderate to high scores in terms of readability, unambiguity, completeness, and validity. The proposed approach can help the development team identify functional requirements from direct feedback of the users which should be considered and further refined in the maintenance and evolution of the mobile application.

Stack Overflow is a question-answer community that provides rich information about computer programming and technology for software developers. Users can ask and answer questions on a wide range of programming topics as well search for problems that other users have faced and find solutions that other users have suggested. From a viewpoint of a technology product owner, Stack Overflow can report various issues that product users have, and this serves as valuable input to the product improvement process. This paper proposes an automated approach to classifying questions that are posted on Stack Overflow with regard to a certain kind of products, i.e. database products in particular. The categories of questions are defined at two levels, i.e problem and subproblem. The problem level includes development, installation, and performance tuning, while the subproblem level consists of design, limitation, and discussion. By cross-combining the two levels, questions can be classified into nine problem-subproblem classes. Natural language processing and text classification are used with several machine learning algorithms, i.e. Naïve Bayes, Decision Tree, Extra Trees, Random Forest, Logistic Regression, Stochastic Gradient Descent, Deep Learning Neural Network, and Convolutional Neural Network. The best classifiers for all classes are used further in a web-based tool that can classify each question by a problem-subproblem tag and also report the number of problems that users of a database product have posted. This information can benefit the owner of a database product in planning product maintenance and evolution.

SQL antipatterns are frequently-made missteps that are commonly found in the design of relational databases, the use of SQL, and the development of database applications. They are intended to solve certain problems but will eventually lead to other problems. The motivation of this paper is how to assist database administrators in diagnosing SQL antipatterns and suggest refactoring techniques to solve the antipatterns. Specifically, we attempt to automate the detection of logical database design antipatterns by developing a tool that uses Transact-SQL language to query and analyze the database schema. The tool reports on potential antipatterns and gives an instruction on how to refactor the database schema. In an evaluation based on three databases from the industry, the performance of the tool is satisfactory in terms of recall of the antipatterns but the tool detects a number of false positives which affect its precision. It is found that SQL antipatterns detection still largely depends on the semantics of the data and the detection tool should rather be used in a semi-automated manner, i.e it can point out potential problematic locations in the database schema which require further diagnosis by the database administrators. This approach would be useful especially in the context of large databases where manual antipatterns inspection is very difficult.

Identity management (IDM) refers to a security discipline that employs technologies to manage information about the identity of users and control their access to organization resources. Various IDM products are in the market to offer corporate customers productivity and security while lowering costs of identity management. System integrators who implement the IDM solutions for their corporate customers often face problems when choosing the right IDM products for integrating with the customers' enterprise systems. This paper proposes a decision model for IDM product selection which is used in evaluating and ranking IDM products based on the proposed customer requirements questionnaire. The model is comprehensive in that its decision criteria comprise not only the technical specifications of the products but also other important aspects including price and accountability of system integrators and product vendors. Based on the decision model, product selection is conducted using a multi-criteria decision making technique called fuzzy analytic hierarchy process (fuzzy AHP). In an evaluation, a leading system integrator company in Thailand applies the proposed approach to IDM product selection for its customer and the result is quite satisfactory.

Object-oriented design patterns are used to solve recurring problems in the design of object-oriented software. The success of existing design patterns encourages researchers and practitioners to propose new design patterns especially for solving recurring design problems in specific domains. Assessing the quality of the design patterns being developed is an important task for a design pattern developer to determine which parts of the patterns need improvement. This paper presents a hierarchical quality model for object-oriented design patterns under development. The model focuses on two quality attributes, i.e. Embedded Knowledge and Pattern Language quality, of the object-oriented design patterns. The model relates several properties of the design pattern descriptions, i.e. usefulness, completeness, consistency, and understandability, to the two quality attributes. Four quality metrics are proposed to quantitatively measure those properties of the design pattern descriptions. In an evaluation, we obtain a satisfactory result as the proposed quality assessment model can be used to complement other existing design pattern evaluation methods.

Privacy is a major quality attribute of any software. Since personal data of users are collected, stored, processed, and transferred by the applications they use, they need to be assured that proper data protection is in place. Since privacy principles should be taken into account and incorporated into application design, this paper aims to promote privacy by design and presents a development of privacy design patterns. The patterns follow the privacy principles of the Organisation for Economic Co-operation and Development (OECD) and describe details of the privacy principles and how to apply them to the design and implementation of the applications. Software design models realizing the privacy principles are also proposed, using UML notations, so as to enable reuse of the design in privacy-aware applications.

Software installed on a computer does have security vulnerabilities to which an attacker can have access and do harm to the computer. It is known to be a good practice to install updates or upgrade versions of the software regularly to improve features, stability, and security, but often those updates and upgrades are ignored or delayed for several reasons. In addition, the new releases may come with some other vulnerabilities themselves. The motivation of this paper is to give information to computer users about the impact of software upgrade in terms of severity of the vulnerabilities that would result from the upgrade, in comparison with that of the vulnerabilities of the currently installed software. We propose a method to assess security vulnerabilities of the installed and the latest versions based on the CVSS vulnerability scoring system. Severity of vulnerabilities will be reported to suggest whether the upgrade is really needed to improve security. We also present an assessment tool that supports both personal and corporate use.

AngularJS is one of the widely used frameworks for modern single-page web application development which is designed to support dynamic views in the applications. To further assist AngularJS developers, this research proposes how the concept of model-driven development can be applied to AngularJS-based development. We propose a UML profile for AngularJS for building a model of an AngularJS web application, and a set of transformations that transform the model into a code template. The developer can then fill in the template to make a complete workable web application. Also, a transformation tool is developed to assist in constructing the code template. Using a case study application, the evaluation in terms of transformation rate shows that the automatically generated code covers 87% of the complete code of the case study, which means it could greatly help reduce development time.

Cloud provider assessment is important for cloud consumers to determine, when outsourcing computing work, which providers can serve their business and system requirements. This paper presents an initial attempt to assess security requirements compliance of cloud providers by following the Goal Question Metric approach and defining a weighted scoring model for the assessment. The security goals and questions that address the goals are taken from Cloud Security Alliance's Cloud Controls Matrix and Consensus Assessments Initiative Questionnaire. We then transform such questions into more detailed ones and define metrics that help provide quantitative answers to the transformed questions based on evidence of security compliance provided by the cloud providers. The scoring is weighted by quality of evidence, i.e. its compliance with the associated questions and its completeness. We propose a scoring system architecture which utilizes CloudAudit and assess Amazon Web Services as an example.

A Business Process Model (BPM) describes a large system of activities that altogether perform a business function. As a particular business function may be required among business processes of the same or different business domains, its corresponding BPM can be reused. Adopting an existing principle of business component fabrication, this paper discusses a methodology for fabricating reusable business process components. The methodology follows the proposed Business Process Component Design (BupCod) model which, based on the BPM of a business, derives business process components by decomposing the BPM into smaller partitions for use in modeling other business processes. The partitioning into business process components is based on five characteristics of component structure (i.e. inter-component coupling, intra-component cohesion, number of components, component size, and complexity) and considers five managerial goals in component fabrication (i.e. cost effectiveness, ease of assembly, customization, reusability, and maintainability). A genetic algorithm is used to automate the design and recommend to a business process component designer the partitioning that optimally achieves the required managerial goals. A design example is given through the process of opening an Internet trading account with a financial securities company in Thailand. The evaluation of the methodology and its automation, based on experiments and feedback from the industry, obtains positive results.

Business process modelling is a tool for requirements engineers or business analysts to express business requirements in terms of what activities are to take place when the application software executes. Since business process models can be shared by different organisations or business domains, we can apply the concept of software component fabrication to the fabrication of process components. A business process model will be partitioned into subprocesses, each of which is a process component that may be used as part of other business process models. This paper proposes an approach to designing process components by using a genetic algorithm. Based on a fitness function, the approach can give a recommendation for a process components design that optimally achieves managerial goals, i.e. cost effectiveness, ease of assembly, customisation, reusability, and maintainability. We present our approach via an example of a flight reservation system.

Service discovery is one key aspect in the enabling technologies for service-oriented system architecture. Current distributed technologies such as CORBA and Web services define a communication protocol for advertising and discovering services but less attention has been paid to service descriptions themselves. The paper proposes attribute-based templates for describing service descriptions. The templates are a compilation of the results from an empirical study on descriptions of software components advertised on the Internet and the attributes listed by related literature. Although the templates should not be considered complete, they act as a common guideline to assist service providers with the specification of their services, and can be adopted by implementations of description repositories. By having a common guideline, services are described in a more uniform way and client enterprises will also have a more consistent view of service descriptions and a more extensive set of information that is useful for service selection.

A trading object or trader provides the ability to discover instances of services offered within a distributed system. This paper proposes a service discovery service (SDS) for a CORBA environment that can assist client providers in the construction of their client programs. By using the SDS, the client providers will obtain knowledge of services with required functionality before writing the client programs to trade for those services with the trader. The SDS gathers XML service descriptions from multiple CORBA traders and can discover information on service types, service interface definitions, and service offers. It can be thought of as a search engine for service descriptions and query is possible via keywords and XML query languages. It is also accessible by both CORBA and WWW clients with the possibility of enlarging search space by a federation of multiple SDS.

Search functionality of a CORBA trader is restricted to search for service offers and assumes clients’ knowledge of service types of those offers. It would be more flexible if the clients can also import other information, i.e. service types and interfaces, before trading for service offers, or conduct keyword search. With this requirement, making service descriptions into XML format can be helpful. This paper focuses on the trader extension that can transform service types and service offers within a CORBA trader into XML service descriptions, and vice versa. The transformation is based on our Document Type Definitions for service types and service offers. This transformer module can be used to create XML service descriptions that will enable flexible XML-based service discovery. The transformer also facilitates clients in viewing details of CORBA services from Web browsers and helps with exporting service descriptions to the trader.

The nature of distribution and autonomy in an open environment makes it difficult to maintain a consistent view of service provision among distributed groups of clients. Change in services may have an impact on current operation of clients if they are not properly informed. Better management for change notification is necessary so that clients are able to prepare for the change accordingly. The paper proposes a service change notification system that can manage service change events for subscribing clients. The architecture of this service is CORBA-based, as it cooperates with a CORBA Trading Service to gather change events and has an Event Notification Service as the core component for change notification. Service providers can also register with this system to announce change events, and clients can subscribe for notification of change in services of their interest, specifying their preference for delivery style, notification format, and quality of service.

Type compatibility is an important issue in the area of service type evolution as it is desirable for a new-version service to still be compatible with its old version in order that existing clients of the old service are affected by the change as little as possible. The paper introduces a new type relationship called an equivalence relationship which concerns functionality compatibility rather than interface signature compatibility when determining substitutability between two service versions. To support this kind of relationship, parts of the CORBA invocation model will be extended to allow information of equivalent service versions to be discovered at run time from the augmented CORBA Interface Repository. A client request to an old service will then be dynamically and transparently composed as a new-version invocation to a new-version service. The proposed extensions will be useful to provide compatibility not only between versions of the same service but also between two distinct services that have equivalent functionality.