Integrating subsystems developed by different manufacturers is a challenging task. Nevertheless, in fields like Intelligent Transport Systems (ITS), it is imperative for vehicles and infrastructure to constantly communicate. The proposed method models elements from a Threat Analysis and Risk Assessment (TARA) of each subsystem using SysML. Then it applies compatibility conditions to the exported model to generate an output compatibility statement. This statement indicates whether the subsystems are compatible from a security perspective or not. The method enables subsystems to assess their potential for secure integration allowing for independent development by manufacturers. We implement the method and evaluate it on an industrial use case to showcase the method's ability to determine the security compatibility of two subsystems.

Security code smells are receiving increasing attention in the domain of Android app development. They serve as coding guidelines aimed at identifying vulnerabilities originating from the application's source code. Numerous related tools have been proposed to align with DevSecOps guidelines. However, they lack of comparable effort in creating benchmarks for open-source apps, making the thorough evaluation of these tools challenging, and requiring time-consuming manual effort. In this paper, we propose Privbench, an evolving benchmark that captures vulnerabilities related to the Android ecosystem. It incorporates multiple code patterns for each vulnerability. To showcase its significance, we used it to evaluate two well-known tools used to identify Android security code smells. This evaluation focused on Privilege Escalation (PE) vulnerabilities and we present their performance in detecting the vulnerabilities within their scopes. We believe that our benchmark can be useful for advancing the capabilities of state-of-the-art tools, enhancing their effectiveness in vulnerability detection, and increasing developers awareness to evade privilege escalation vulnerabilities.

International audience

In the automotive domain, feature-based software architecture is a widely used software design method to produce cost efficient and reusable software. With increasing complexity of automotive systems and the shift towards automated driving, safety and security measures become even more crucial for these systems. However, safety and security functionalities can undermine each other if they interact in unintended ways.We propose the novel method FIISS for automatic identification of interactions between safety and security features in UML models. We evaluate our implementation of the method by applying it to a real-world component for autonomous driving. We show that the method is able to identify unintended interactions while providing only few false positive findings. Thus, we see that our method can be applied to real-world UML system designs without modifying the underlying models and without applying specialized UML profiles.

We develop a testing approach for validating global adaptation in self-organizing multi-embedded-agent systems. These systems are complex and ever adapting, thus challenging to test. We propose an approach aiming at validating at run-time the adaptation of these systems when the entities composing them, the agents, use self-organization processes. These processes allow agents to change their organization, i.e., their way of interacting, at run-time. Thus, run-time testing is needed to validate self-organization. We propose a decentralized self-organization runtime testing algorithm and we apply it, through simulation, to the Multi-Wireless-Agent Communication model.

Location-based services (LBS) are very important mobile app services, which provide diverse mobility services for mobile users anywhere and anytime.This brings new demands, issues, and challenges in mobile application testing.Today, mobile applications provide location-based service functions based on dynamic location contexts, mobile users and their travel patterns to deliver location-based mobile data, and service actions.Current software testing methods do not consider location-based validation coverage.Hence, there is a lack of research results addressing location-based mobile application testing.This paper focuses on mobile LBS testing.A novel test object model is proposed for quality validation of location-based mobile information services.In addition, the related test coverage metrics are also presented.These metrics can be useful for test engineers in designing test cases.A case study based on student testers is reported to demonstrate the potential application of the proposed model.

Fault tolerance is a key research area for many of applications such as those based on sensor network technologies. In a large scale wireless sensor network (WSN), it becomes important to find new methods for fault-tolerance that can meet new application requirements like Internet of things, urbane intelligence and observation systems. The challenge is beyond the limit of a single wireless sensor network and concerns multiple widely interconnected sub networks. The domain of fault grows considerably because of this new configuration. In this context, the paper proposes a fault fuzzy-ontology (FFO) for large scale WSNs to be used within a Web service architecture for diagnosis and testing.

Several performance monitoring approaches allowing the detection of RFID system defects have been proposed in the past. This article evaluates 3 of these approaches using a SystemC model, SERFID, of a UHF RFID system. SERFID can simulate the EPC C1G2 standard for the UHF tag-reader communication and also allows a realistic bit error injection in their RF channel.

In recent years, radio frequency identification (RFID) systems have been increasingly used in critical domains such as medical field or real-time processing domains. Although important efforts have been made to make this technology more reliable and fault-tolerant, more research is needed to meet the increasing dependability requirements. In this article, we propose a dependability approach consisting in two steps. The first one is an analysis of RFID systems in order to identify potential failures of RFID middleware components and their effects on the whole system. The second one is the modelling of the communication behaviour of RFID systems (that is represented by Low Level Reader Protocol) as a finite state machine. This protocol FSM will be extended to take into consideration the failures identified in the first step and serves as a diagnosis and test tool for the RFID system.

This paper presents an off-line diagnosis strategy for parallel message-passing systems. This strategy, called host-diagnosis, allows an external observer, i.e. the host system, to perform centralized diagnosis of the system state, given results of distributed tests performed among the system processors. Three algorithms that use the host-diagnosis strategy are proposed. The performance of the three algorithms are evaluated and compared to those of a classic distributed self-diagnosis algorithm. The obtained results show an interesting behaviour of the host-diagnosis algorithms in comparison with the self-diagnosis one.

This paper deals with off-line testing of parallel systems. The applicability of distributed self-diagnosis algorithms is investigated. Both static and adaptive testing assignment strategies are studied and evaluated using a queueing network model of the system under test. Key results include testing latency and message load of each algorithm.