SUMMARY Software maintenance including design is difficult because it is usually performed on someone else's work over a period of time. Maintaining a pattern‐based design is especially much more difficult when the information on specific patterns that have been used are not available in the corresponding design documents. Also, finding a maintainer who has a similar level of knowledge on specific patterns that the initial designer had is not easy. Pattern‐based design, the use of design patterns during the software design process, has become widely used in the object‐oriented community because of its many benefits such as its reuse. However, the defects in pattern‐based design can be introduced during the design maintenance phase when the changes are made to the requirements and the initial design, but the conformance to the original patterns is neglected. This conformance process is laborious and time consuming; no systematic process exists to guide the defects discovery and maintenance. Also, deep and correct knowledge of design patterns and their characteristics are required because this process is conducted by human experts. Failure to follow this conformance process and to maintain correct designs during software design evolution may cause serious problems in later software development and maintenance stages by not providing the benefits of pattern‐based design that would have been possible if followed correctly. There is a strong need of a systematic design and maintenance method for preventing defects in design patterns introduced during the evolution of pattern‐based software design and its maintenance. Because conventional UML design methods do not provide such systematic ways of assessing pattern‐based design conformance to the evolutionary changes, we have developed the pattern instance changes with UML profiles (PICUP) design method, which is an improved design method for perfective and corrective UML pattern‐based design maintenance and assessment. Design pattern in UML profiles (DPUP) is developed for the use of instantiation, maintenance, and assessment of UML pattern‐based designs to support the formal specification of a design pattern. DPUPs, as the main part of the PICUP design method, provide metamodel‐level UML design constraints using UML stereotype notations and metamodel‐level Object Constraint Language design constraints. Assessment of pattern‐based designs in UML class diagram with the corresponding DPUPs enforces maintainers to make necessary and correct changes to keep the principles of the original designs. Pattern‐related information is annotated using stereotype notations to help assess pattern‐based designs when changes are made. Furthermore, the structural conformance checking of a given UML pattern‐based design can be automated by using the assessment tool. The major contributions of this paper are: (i) specifying design patterns using extended UML profile; (ii) providing a means of how to instantiate pattern‐based designs from DPUPs with naming conventions; and (iii) providing design constraints for maintaining pattern‐based design to guide correct changes of a given design in PICUP method. Explanatory type case studies were performed to better understand and evaluate the effectiveness of the PICUP design method with DPUPs. Answers to the case study questionnaires and the pattern defects discovered from the case studies support the hypothesis that the PICUP method is an improved design method that ensures structural conformance of UML pattern‐based designs to the corresponding design patterns during perfective and corrective design maintenance for software systems. Copyright © 2011 John Wiley & Sons, Ltd.

Security breaches most often occur due to a cascading effect of failure among security constraints that collectively contribute to overall secure system behavior in a socio-technical environment. Therefore, during security certification activities, analysts must systematically take into account the nexus of causal chains that exist among security constraints imposed by regulatory requirements. Numerous regulatory requirements specified in natural language documents or listed in spreadsheets/databases do not facilitate such analysis. The work presented in this article outlines a stepwise methodology to discover and understand the multidimensional correlations among regulatory requirements for the purpose of understanding the potential for risk due to noncompliance during system operation. Our lattice algebraic computational model helps estimate the collective adequacy of diverse security constraints imposed by regulatory requirements and their interdependencies with each other in a bounded scenario of investigation. Abstractions and visual metaphors combine human intuition with metrics available from the methodology to improve the understanding of risk based on the level of compliance with regulatory requirements. In addition, a problem domain ontology that classifies and categorizes regulatory requirements from multiple dimensions of a socio-technical environment promotes a common understanding among stakeholders during certification and accreditation activities. A preliminary empirical investigation of our theoretical propositions has been conducted in the domain of The United States Department of Defense Information Technology Security Certification and Accreditation Process (DITSCAP). This work contributes a novel approach to understand the level of compliance with regulatory requirements in terms of the potential for risk during system operation.

Services as abstractions of functionality have enabled the engineering of systems that support well-defined processes with relative ease. This success leads to aspirations for achieving greater complexity with the service-oriented paradigm. In particular, we address the case where the process definition is tailored differently in each instantiation based on negotiations among stakeholders of a socio-technical context. For such cases the process definition invariably crosscuts the architecture of a process-support system that composes available services. However, use of pre-defined process variations may bias the tailoring effort and thus, act against the original motivation of having a flexible definition. On the other hand, the characteristics of process complexity and tailorability introduce differences between stakeholder understanding of the process activities and their manifestation in tool support. We encounter these issues while developing a service-oriented process-support system for a security Certification and Accreditation (C&A) process. In this paper, we present our approach to effectively separate the C&A process definition from the architecture of its process-support system. We employ ontological modeling techniques to explicitly model the process definition and later expose it as a service to provide weaving rules for dynamically composing the process-support system architecture at runtime. The feasibility of our approach has been demonstrated in the design of a service-oriented architecture for a prototype workbench that supports the Department of Defense Certification and Accreditation Process (DITSCAP).

In this paper we outline our approach to discover and understand multi-dimensional correlations among regulatory security certification requirements in the context of a complex software system. A thorough understanding of these correlations is necessary to assure that diverse constraints imposed by numerous certification requirements are adequate for collectively contributing to emergent security properties in a highly interconnected socio-technical environment. We elaborate on methodological support to discover an exhaustive set of applicable certification requirements in a given operational scenario of the target software system. We then describe techniques to systematically understand the multi-dimensional correlations among these requirements with application to security risk assessment. The case study of applying our approach to a regulatory certification process of The United States Department of Defense (DoD) is presented.

Numerous interdependent quality requirements imposed by regulatory Certification and Accreditation (C&A) processes enable a rich context to gather compliance evidences for promoting software assurance. The goal of the r-AnalytiCA workbench is to make sense out of the large collection of available evidences for a complex software system though multidimensional requirements-driven problem domain analysis. The requirements analytics employed in the workbench support C&A activities by leveraging the expressiveness of ontologies used to model C&A requirements and their interdependencies.

The process of engineering software-intensive systems that comply with their Certification and Accreditation (C&A) requirements involves many critical decision-making activities for the related stakeholders. Considering the exhaustive nature of C&A activities together with the complexity of software-intensive systems, effective decision making relies heavily on the ways to understand and structure the problem domain concepts concerning decision points for interpretation, applicability, scope, evaluation, and impact of the enforced C&A requirements. These decision points are further complicated by natural language specifications of inherently non-functional C&A requirements scattered across multiple regulatory documents with complex interdependencies at different levels of abstractions in the organizational hierarchy, which often result in subjective interpretations and non-standard implementations of the C&A process. To address these issues, we define a systematic methodology using novel techniques from software Requirements Engineering (RE) and knowledge engineering for understanding and structuring the problem domain concepts based on a uniform representation format that promotes common understanding among stakeholders. Specifically, we use advanced ontological engineering techniques driven by theoretical RE foundations to systematically elicit, model, understand, and analyze problem domain concepts concerning significant and difficult decision points throughout the C&A process. We demonstrate the appropriateness of our methodology in creating decision support problem domain ontology using several examples derived from our experiences on automating the Department of Defense Information Technology Security C&A Process (DITSCAP).

Software-intensive systems are systems of systems that rely on complex interdependencies among themselves as well as with their operational environment to satisfy the required behavior. As we integrate such systems to create information infrastructures that are critical to the quality of our lives and the businesses they support, the need to effectively predict, control and evolve their behavior is ever increasing. To deal with their complexity, an important first step is to understand and model software-intensive systems, their environments and the interdependencies among them at different levels of abstractions from multiple dimensions. In this paper, we present an ontology-based active requirements engineering (Onto-ActRE) framework that adopts a mixed-initiative approach to elicit, represent and analyze the diversity of factors associated with software-intensive systems. The Onto-ActRE framework integrates various RE modeling techniques with complementary semantics in a unifying ontological engineering process. We also present examples from the practice of our framework with appropriate tool support that combines theoretical and practical aspects.

This paper addresses a new DCT-based embedded significance tree image sequence coding for progressive image transmission. In order to maintain compatibility with the conventional standardized algorithms and achieve an improvement of coding efficiency at very low bit rate, the MC/DCT hybrid image coding structure is fully utilized. Rearranging the DCT transformed coefficients into the significance tree structure, and using a modified embedded zerotree quantizer, a new image sequence coder can be built, from which we can achieve an excellent coding performance for progressive image sequence transmission and precise user-specified rate control. In the simulations, the proposed new image coder can give better rate-distortion performance than that of wavelet-based one.

In the recognition of fingerprint, preprocessing such as smoothing, binarization and thinning is needed. Then fingerprint minutiae feature is extracted. Some fingerprint identification algorithm (such as using FFT etc.) may require so much computation as to be impractical. Wavelet based algorithm may be the key to making a low cost fingerprint identification system that would operate on a small computer. We present a fast and effective method to identify fingerprint.