ABSTRACT Background There exists an important and open problem with the encrypting of database connection strings in that related connection strings start with well known identical initial sub‐strings. When these initial sub‐strings are longer than the encrypting algorithm's block size, the resulting encrypted text for related database connection strings will have identical initial sub‐strings which could increase the chance of breaking the encryption key used to encrypt the connection strings. Aims The objective of our work was to find a simple, easy to implement, well known algorithm that would eliminate the identical initial sub‐strings in the encrypted text of related database connection strings. Methods Our methodology was to apply an obfuscation function to the database connection strings before encrypting them with the 3DES and AES encryption algorithms. The obfuscation functions we chose for our tests were the Roman Keyword cipher or the Greek Scytale cipher. Discussion The results of applying the two obfuscation functions to the related database connection strings before encrypting them with the symmetric encryption algorithms. This process effectively eliminated the commonality in the encrypted text of the database connection strings. Conclusion While both the Keyword and Scytale obfuscation functions were able to eliminate the commonality in the encrypted text. We found that the Scytale function was superior to the Keyword function due to some minor limitations of the Keyword functions and the fact that the Scytale function geometrically increased the number of possible known strings within the plain text connection string before encryption.

There is growing interest in U.S. cities to shift resources towards community-led solutions to crime and disorder. However, there is a simultaneous need to provide community organizations with access to real-time data to facilitate decision making, to which only the police normally have access. In this work we present a low-cost gunshot detection system with localization that has been developed for community-based violence interruption. The distributed real-time gunshot detection sensor network is linked to a mobile phone-based alert and tasking system for exclusive use by civilian gang interventionists. Here we present details on the system architecture and gunshot detection model, which consists of an Audio Spectrogram Transformer (AST) neural network. We then combine gradient maps of the input to the AST for time of arrival identification with a Bayesian maximum a posteriori estimation procedure to identify the location of gunshots. We conduct several experiments using simulated data, open data from the commercial ShotSpotter detection system in Pittsburgh, and data collected using our devices during live-fire experiments at the Indianapolis Metropolitan Police Department (IMPD) gun firing range. We then discuss potential applications of the system and directions for future research.

Research has shown that police officer involved shootings, misconduct and excessive use of force complaints exhibit network effects, where officers are at greater risk of being involved in these incidents when they socialize with officers who have a history of use of force and misconduct. In this work, we first construct a network survival model for the time-to-event of use of force incidents involving new police trainees. The model includes network effects of the diffusion of risk from field training officer (FTO) to trainee. We then introduce a network rewiring algorithm to maximize the expected time to use of force events upon completion of field training. We study several versions of the algorithm, including constraints that encourage demographic diversity of FTOs. Using data from Indianapolis, we show that rewiring the network can increase the expected time (in days) of a recruit's first use of force incident by 8%. We then discuss the potential benefits and challenges associated with implementing such an algorithm in practice.

This paper investigates two aspects of using dynamic binary instrumentation for real-time instrumentation of a distributed software systems. First, this paper investigates techniques for achieving different levels of visibility (i.e., ensuring all parts of a system are represented, or visible, in final results) into a software system without compromising software system performance. Secondly, this paper investigates how using reservoir sampling can be used to further reduce instrumentation overhead. The results of the research show that reservoir sampling can be used to reduce instrumentation overhead when compared to regular sampling methods like Constant, Percentage and Exhaustive sampling while also providing the desired system visibility.

This paper presents an approach for real-time detection of the More is Less software performance anti-pattern in MySQL databases. This project uses dynamic analysis paired with machine learning techniques to train a binary classifier on a collection of system-level metrics, database metrics, and MySQL status variables. After training, the classifier is loaded, at runtime, into the dynamic analysis code where the model can classify unlabeled data in real-time. The results of our approach show that the binary classifier can predict the More is Less software performance anti-pattern with 99.1% sensitivity.

This paper presents a novel technique and framework for decreasing instrumentation overhead in software systems that utilize dynamic binary instrumentation. First, we introduce a lightweight networking framework combined with an easily extensible BSON implementation as a heavy analysis routine replacement. Secondly, we bind instrumentation and analysis threads to non-overlapping cpu cores—allowing analysis threads to execute faster. Lastly, we utilize a lock-free buffering system to bridge the gap between instrumentation and analysis threads, and minimize the overhead to the instrumentation threads. Using this combination, we managed to write a dynamic binary instrumentation tool (DBI) in Pin using Pin++ that is 1000% faster than its counterpart DBI tool with no buffering.

This paper presents a generalized approach for non-intrusive, real-time instrumentation of standards-based distributed middleware for analytical purposes. The approach is implemented in a tool named the Standards-based Distributed Middleware Monitor (SDMM). SDMM uses dynamic binary instrumentation as the method to extract values and other data passed between endpoints. Using dynamic instrumentation allows SDMM to capture information without a priori knowledge of the distributed application under instrumentation. We applied SDMM to applications written in two standards-based middleware, the Data Distribution Service (DDS) and gRemote Procedure Call (gRPC). We show that the data collection process accounts for less than 1% of the performance overhead for both DDS and gRPC case studies.

This paper discusses our work on using software engineering metrics (i.e., source code metrics) to classify an error message generated by a Static Code Analysis (SCA) tool as a true-positive, false-positive, or false-negative. Specifically, we compare the performance of Support Vector Machine (SVM), K-Nearest Neighbor (KNN), Random Forests, and Repeated Incremental Pruning to Produce Error Reduction (RIPPER) over eight datasets. The performance of the techniques is assessed by computing the F-measure metric, which is defined as the weighted harmonic mean of the precision and recall of the predicted model. The overall results of the study show that the F-measure value of the predicted model, which is generated using Random Forests technique, ranges from 83% to 98%. Additionally, the Random Forests technique outperforms the other techniques. Lastly, our results indicate that the complexity and coupling metrics have the most impact on whether a SCA tool with generate a false-positive warning or not.

This paper presents an approach for non-intrusively instrumenting standards-based event-based middle-ware. The approach has been realized in an open-source tool called Component Port Monitor (CPM). CPM uses dynamic binary instrumentation as a means to monitor events published between software components. This allows CPM to operate in contexts without any a priori knowledge of the concrete events in the system, or how the system is composed. We have applied CPM to applications implemented in the Common Object Request Broker Architecture (CORBA). Our results show that once the application is completely instrumented, the performance impact of actually monitoring events is minimal, requiring an additional 2.5 milliseconds.

This paper presents a methodology for automatically detecting the excessive dynamic memory allocation software performance anti-pattern, which is implemented in a tool named Excessive Memory Allocation Detector (EMAD). To the best of author's knowledge, EMAD is the first attempt to detect excessive dynamic memory allocation anti-pattern without human intervention. EMAD uses dynamic binary instrumentation and exploratory data analysis to determine if an application (or middleware) exhibits excessive dynamic memory allocations. Unlike traditional approaches, EMAD's technique does not rely on source code analysis. Results of applying EMAD to several open-source projects show that EMAD can detect the excessive dynamic memory allocations anti-pattern correctly. The results also show that application performance improves when the detected excessive dynamic memory allocations are resolved.

Summary An early understanding of the trust concerns while composing a distributed system from independently developed software services saves time and effort. It also allows the developer of such distributed systems to reason about the trust‐related properties of these systems. Although there are prevalent approaches for evaluating the trust of such systems, it is not clear which approach, if any, is the most comprehensive and best suited for a given situation. Moreover, there is no agreement about a unified approach, for quantifying trust, which can be applied to the entire software life‐cycle of distributed systems. This article, first, motivates the need for such a quantification of trust via a case study from the domain of indoor tracking. It then provides a comprehensive survey of current approaches that define trust, in general domains, and then focuses on the relevant approaches from the domain of software‐oriented distributed systems. These prevalent efforts are categorized into groups using existing clustering tools and then are further analyzed for their comprehensiveness. The analysis depicts: (1) many trust‐related efforts and associated models have their own constrained views of trust; (2) different trust models focus on different aspects of trust and life‐cycle details; and (3) it is difficult to interoperate across different trust models. Hence, the paper identifies a set of principles that can assist in quantifying and evaluating the trust throughout the software life‐cycle of distributed systems. These principles, then, are applied to the aforementioned case study to provide an outline of how trustworthy distributed systems can be composed from independent software services. Copyright © 2015 John Wiley & Sons, Ltd.

Multi-server distributed systems are becoming increasingly popular with the emergence of cloud computing. These systems need to provide high throughput with low latency, which is a difficult task to achieve. Manual performance tuning and diagnosis of such systems, however, is hard as the amount of relevant performance diagnosis data is large. To help system developers with performance diagnosis, we have developed a tool called Performance Anomaly Detector (PAD). PAD combines user-driven navigation analysis with automatic correlation and comparative analysis techniques. The combination results in a powerful tool that can help find a number of performance anomalies. Based on our experience in applying PAD to the Orleans system, we discovered that PAD was able to reduce developer time and effort detecting anomalous performance cases and improve a developer's ability to perform deeper analysis of such behaviors.

This paper presents a framework named Pin++. Pin++ is an object-oriented framework that uses template metaprogramming to implement Pintools, which are analysis tools for the dynamic binary instrumentation tool named Pin. The goal of Pin++ is to simplify programming a Pintool and promote reuse of its components across different Pintools. Our results show that Pintools implemented using Pin++ can have a 54% reduction in complexity, increase its modularity, and up to 60% reduction in instrumentation overhead.

The Visitor pattern is a behavioral software design pattern where different objects represent an operation to be performed on elements of an object structure. Despite the benefits of the Visitor pattern, its rigid structure has limitations. Owing to the Visitor pattern's usefulness and importance to software design, many researchers have extended and modified the original Visitor pattern to overcome its limitations. Researchers have even replaced the Visitor pattern with more refined design patterns (e.g., Reflective Visitor pattern, Java Walkabout Class, and Dynamic Dispatcher) that bear minimal resemblance to the original Visitor pattern's structure while retaining its major advantages (e.g., ability to add new operations to an object structure without changing the classes of objects, localizing related behavior, and accumulating state). This article therefore provides a comprehensive survey of the Visitor pattern for software practitioners. Within the survey, we focus on major enhancements that have been made to the original Visitor pattern to overcome its limitations. On the basis of our survey results, we found that variations of the Visitor pattern can be separated into two categories: extended Visitor patterns where the original Visitor pattern structure stays intact and alternative Visitor patterns where the structure of the original Visitor pattern is altered. Copyright © 2012 John Wiley & Sons, Ltd.

Composing a distributed software system out of independently developed and publically hosted services leads to savings in effort, time, and cost. Such an approach requires a careful selection of a set of services for realizing a particular distributed software system. Hence, identifying and quantifying the trust of such publically available services becomes a prerequisite for composing distributed software systems. The quantification of the trust associated with a service is a challenging task due to the subjective nature of trust, lack of standards, and associated uncertainty. Moreover, the trust of a service is not a static value and should be updated periodically. To achieve a proper quantification of a trust associated with a service, there is a need to periodically collect, monitor, and aggregate various evidences available about that service. This paper augments previously defined quantification of the trust by monitoring and aggregating various available evidences. This enhanced approach is used to improve the service selection process. Publically available mobile app services from the Android marketplace are utilized, as the dataset, to empirically validate this approach.

Software instrumentation is an important aspect of software-intensive distributed real-time and embedded (DRE) systems because it enables real-time feedback of system properties, such as resource usage and component state, for performance analysis. Although it is critical not to collect too much instrumentation data to ensure minimal impact on the DRE system's existing performance properties, the design and implementation of software instrumentation middleware can impact how much instrumentation data can be collected. This can indirectly impact the DRE system's existing properties and performance analysis, and is more of a concern when using general-purpose software instrumentation middleware for DRE systems. This paper provides two contributions to instrumenting software-intensive DRE systems. First, it presents two techniques named the Standard Flat-rate Envelope and Pay-per-use for improving the performance of software instrumentation middleware for DRE systems. Secondly, it quantitatively evaluates performance gains realized by the two techniques in the context the Open-source Architecture for Software Instrumentation of Systems (OASIS), which is open-source dynamic instrumentation middleware for DRE systems. Our results show that the Standard Flat-rate Envelope improves performance up to 57% and the Pay-per-use improves performance up to 49%.

This paper presents a method and tool named the Dataflow Model Auto-Constructor (DMAC). DMAC uses frequent-sequence mining and Dempster-Shafer theory to mine a system execution trace and reconstruct its corresponding dataflow model. Distributed system testers then use the resultant dataflow model to analyze performance properties (e.g., end-to-end response time, throughput, and service time) captured in the system execution trace. Results from applying DMAC to different case studies show that DMAC can reconstruct dataflow models that cover at most 94% of the events in the original system execution trace. Likewise, more than 2 sources of evidence are needed to reconstruct dataflow models for systems with multiple execution contexts.

System execution traces are useful artifacts for validating distributed system quality-of-service (QoS) properties, such as end-to-end response time, throughput, and service time. With proper planning during development phase of the software lifecycle, it is possible to ensure such traces contain required properties to facilitate analysis for QoS validation. In some case, however, it is not possible to ensure system execution traces contain the necessary properties for QoS analysis. This paper presents the System Execution Trace Adaptation Framework (SETAF) for adapting system execution traces to support analysis of QoS properties. It also presents results from applying SETAF to externally developed applications. The results show that it is possible to validate QoS properties by automatically adapting system execution traces at analysis time instead of modifying the application's existing source code.

This paper discusses how DSML semantics and constraints enable proactive modeling---a form of model intelligence that foresees model transformations, automatically executes them, and prompts the modeler for assistance when necessary. This paper also shows how we integrated proactive modeling into the Generic Modeling Environment (GME). Our experience using proactive modeling shows that it can reduce modeling effort by both automatically generating required model elements, and guiding modelers to select what actions should be executed on the model.

Model-driven engineering (MDE) of distributed real-time and embedded (DRE) systems built using distributed middleware technologies typically rely on interface definition language (IDL) to define interfaces and attributes of the system under development. Recent needs for using IDL to design and implement systems composed of heterogeneous communication architectures, however, has realized the limitations of IDL. To address these limitations, vendors have proposed several non-trivial extensions to IDL also known as IDL3+. In order to leverage such extensions in the modeling domain, it is necessary to update existing tools, e.g., domain-specific modeling languages) to support such extensions. This paper provides two contributions to MDE of DRE systems using domain-specific modeling languages (DSMLs). First, this paper highlights the technical challenges associated with modeling IDL3+. Secondly, this paper discusses how to overcome such challenges in the context of a representative DSML for modeling DRE systems designed and implemented using IDL3+. Experience gained from using DSMLs to model IDL3+ shows that DSML environments as is do not suffice and need improved application frameworks to support complex DSMLs, such as IDL3+.

Source code generation from models (e.g., domain specific models) for distributed real-time and embedded (DRE) systems is intended to alleviate tedious, error-prone, and time consume tasks associated with manually hand-crafting the same code. When generating code from models for DRE system programming languages that accidentally support circular dependencies, e.g., the Interface Definition Language (IDL) and C++, it is necessary to resolve circular dependencies in order to generate valid and usable code. Moreover, it is important to do some automatically instead of requiring modelers to construct models that do not contain any circular dependencies, which is hard. This paper provides two contributions to research on source code generation from models for DRE systems. First, it presents A-Circle, an algorithm that automatically removes circular dependencies when generating source code from models for programming languages that inherently enable circular dependencies. Secondly, this paper quantitatively evaluates A-Circle when generating CORBA IDL files. The results show that A Circle algorithm is able to generate IDL files in linear-time.

This paper presents the Component Workload Emulator (CoWork-Er) Utilization Test Suite (CUTS), which is a system execution modeling tool for validating quality-of-service (QoS) properties, e.g., end-to-end response time, throughput, and scalability, on the target architecture continuously throughout the software lifecycle.

Performance analysis tools for enterprise distributed real-time and embedded (DRE) systems require instrumenting heterogeneous sources (such as application- and system-level hardware and software resources). Traditional techniques for software instrumentation of such systems, however, are tightly coupled to system design and metrics of interest. It is therefore hard for system testers to increase their knowledge base and analytical capabilities for enterprise DRE system performance using existing instrumentation techniques when metrics of interest are not known during initial system design. This paper provides two contributions to research on software instrumentation for enterprise DRE systems. First, it presents OASIS, which is service-oriented middleware for instrumenting enterprise DRE systems to collect and extract metrics without design time knowledge of which metrics are collected. Second, this paper empirically evaluates OASIS in the context of a representative enterprise DRE system from the domain of shipboard computing. Results from applying OASIS to a representative enterprise DRE system show that its flexibility enables DRE system testers to precisely control the overhead incurred via instrumentation.

System execution traces are useful artifacts for capturing distributed system behavior and validating quality-of-service (QoS) properties, such as end-to-end response time, throughput, and scalability. Although system execution traces assist in validating QoS properties, system execution traces are very dense. This is because system execution traces capture a system's complete behavior and execution in its target environment, which can consist of many components deployed across many hosts that execute for long periods of time. It therefore can be hard for distributed system testers to effectively analyze different views of QoS properties using system execution traces and/or pinpoint performance bottlenecks that need to be resolved. This paper provides two contributions on validating distributed system QoS properties. First, this paper presents Aspects for System Execution Traces (AsSET), which is a join point model for applying aspects to system execution traces and enabling context-based analysis of system execution traces. Secondly, it shows how applying AsSET to a representative enterprise distributed system can improve QoS analytical capabilities for distributed system testers. The tools and techniques discussed in this paper have been realized in an open-source system execution modeling tool named CUTS, which is currently used on several industry-related projects.

Unit testing component-based distributed systems traditionally involves testing functional concerns of the application logic throughout the software lifecycle. In contrast, testing non-functional distributed system concerns (e.g., end-to-end response time, security, and reliability) typically does not occur until system integration because it requires a complete system to perform such tests, as well as sophisticated techniques to identify and analyze performance metrics that constitute non-functional concerns. Unit testing non-functional concerns is even harder in an agile development environment, due to the disconnect between high-level system specification and low-level performance metrics. This paper describes a methodology and tool called Understanding Non-functional Intentions via Testing and Experimentation (UNITE). UNITE is designed to unit test non-functional concerns of three component-based distributed systems. The results from applying UNITE to a component-based distributed system show how it simplifies unit testing and evaluation of non-functional properties during the early stages of the software lifecycle.

The adage "the whole is not equal to the sum of its parts" is very appropriate in the context of verifying a range of systemic properties, such as deadlocks, correctness, and conformance to quality of service (QoS) requirements, for component-based distributed real-time and embedded (DRE) systems. For example, end-to-end worst case response time (WCRT) in component-based DRE systems is not as simple as accumulating WCRT for each individual component in the system because of inherent complexities introduced by the large solution space of possible deployment and configurations. This paper describes a novel process and tool-based artifacts that simplify the formal specification of component-based DRE systems for verification of systemic QoS properties. Our approach is based on the mathematical formalism of Timed Input/Output Automata and uses generative programming techniques for automating the verification of systemic QoS properties for component-based DRE systems.

Component middleware is popular for enterprise distributed systems because it provides effective reuse of the core intellectual property (i.e., the "business logic"). Component-based enterprise distributed real-time and embedded (DRE) systems, however, incur new integration problems associated with component configuration and deployment. New research is therefore needed to minimize the gap between the development and deployment/configuration of components, so that deployment and configuration strategies can be evaluated well before system integration. This paper uses an industrial case study from the domain of shipboard computing to show how system execution modeling tools can provide software and system engineers with quantitative estimates of system bottlenecks and performance characteristics to help evaluate the performance of component-based enterprise DRE systems and reduce time/effort in the integration phase. The results from our case study show the benefits of system execution modeling tools and pinpoint where more work is needed