As ethical concerns continue to arise around the design of digital technologies, there is an increasing need to incorporate ethics education into project and capstone courses. While students frequently receive instruction in ethical theory and philosophy, they also need practical tools and strategies that they can apply to their class projects and carry with them into their careers. For example, ethical toolkits can provide frameworks and methods for identifying, discussing, and prioritizing ethical concerns in technology design and development. In this session we will invite participants to share their experiences with incorporating ethics into project-based learning. Participants will be able to review and discuss existing toolkits and methods for incorporating ethics into project courses.

Industry-sponsored capstone experiences that involve developing software solutions create valuable opportunities for students to engage in teamwork and learn important career skills just prior to joining the software workforce. The collaboration and communication in capstone projects, which typically happen in person, were forced to move online during the COVID-19 pandemic. We leveraged the transition to conduct a two-stage mixed-methods study that compared the in-person and online capstone experiences of students (novice software developers) and project sponsors (experienced industry professionals) to understand how novices engage in online collaboration. We uncovered that novices find online collaboration more challenging compared to experienced professionals. The challenges faced by the novices and the misalignment with experienced professionals point to a number of avenues for training novice software professionals on effective engagement in geographically distributed collaboration, which is increasingly the norm in the software industry.

With the mainstream adoption of Large Language Models (LLMs) over the last year, members of both academia and the media have raised concerns around the potential impact on student learning and pedagogy. Many students and educators wonder about the pedagogical fit of this emerging technology. We aim to measure the adoption and perception of LLMs among the CS education community in an R1 University to distinguish reality from hype. To this end, we conduct a large survey study targeting three populations participating in computing courses at the university: intro-sequence students (ISS), experienced students (ES), and faculty. Our survey seeks to gather insight around the different populations' perceptions of LLMs in education, as well as how these perceptions may be changing as LLMs improve. Our results show several significant differences across the views of 760 respondents. Most students report LLMs' un-paralleled potential for quick information access, yet many harbor concerns about their reliability and impact on academic integrity. Additionally, while ES rapidly integrate LLMs into their learning, ISS and faculty remain cautious, highlighting a stark contrast in adoption rates. Faculty are unconvinced of LLMs' educational benefits and are concerned about potential challenges in evaluating students' learning outcomes. LLMs are reshaping pedagogical approaches and student engagement. However, with the notable reservations expressed by certain segments, particularly by faculty and ISS, there is an imperative for careful, informed, and ethical integration to ensure that these tools enhance rather than compromise the educational experience.

Motivation: The increasing volume and frequency of cyberattacks have made it necessary that all computing professionals be proficient in security principles. Concurrently, modern technology poses greater threats to privacy, making it important that technological solutions be developed to respect end-user privacy preferences and comply with privacy-related laws and regulations. Just as considering security and privacy must be an integral part of developing any technological solution, teaching security and privacy ought to be a required aspect of computer science education. Objective: We set out to demonstrate that a project-based capstone experience provides an effective mechanism for teaching the foundations of security and privacy. Method: We developed ten learning modules designed to introduce and sensitize students to foundational sociotechnical concepts related to the security and privacy aspects of modern technology. We delivered the modules in the treatment sections of a two-term capstone course involving the development of software solutions for external clients. We asked the students in the course to apply the concepts covered in the modules to their projects. Control sections of the course were taught without the modules as usual. We evaluated the effectiveness of the modules by administering pre-treatment and post-treatment assessments of cybersecurity knowledge and collecting written student reflections after the delivery of each module. Results: We found that the students in the treatment condition exhibited statistically significant increases in their knowledge of foundational security and privacy concepts compared to those in the control condition without the modules. Further, student reflections indicate that they appreciated the content of the modules and were readily able to apply the concepts to their projects. Discussion: The modules we developed facilitate embedding the teaching of security and privacy within any project-based learning experience. Embedding cybersecurity instruction within capstone experiences can help create a software workforce that is more knowledgeable about sociotechnical cybersecurity principles.

With the mainstream adoption of Large Language Models (LLMs), members of both academia and the media have raised concerns around their impact on student learning and pedagogy. Many students and educators wonder about the pedagogical fit of this emerging technology. We aim to measure the adoption of and attitudes toward LLMs among the CS student population at an R1 University to determine how students are using these new tools. To this end, we conducted a large survey study targeting two populations participating in computing courses at the university: intro-sequence students (ISS) and experienced students (ES).

This paper reports on experiences in transitioning a capstone course from a single-quarter to three-quarters. A single-quarter project course in software design and development had been offered by our department for over twenty years. More recently, upon formation of a new undergraduate degree in Informatics, this course was transformed into a three-quarter capstone course taken by students in their final year. Correspondingly, some aspects of the course projects, such as the business scope and software complexity, grew in proportion to the increase in the project duration. At the same time, a number of ¿costs¿ were reduced, including the time and effort required to set up the development infrastructure and development environments, and learn new tools and languages. Most importantly, several other factors experienced substantial growth. The longer project duration allowed significant increase in the effort and attention paid to usability engineering and user-centered design, leading to systems that were deployable and more usable for the target users. It also enabled better software testing, deployment and release management. As a result, the final outcome was much closer to production quality than the prototypes and proof-of-concept systems typical of earlier single-quarter projects.

Widespread adoption of model-centric development has created opportunities for software testing, with Model-Based Testing (MBT). MBT supports the generation of test cases from models and the demonstration of model and source-code compliance. Models evolve, much like source code. Thus, an important activity of MBT is selective regression testing, which selects test cases for retest based on model modifications, rather than source-code modifications. This activity explores relationships between model elements and test cases that traverse those elements to locate retest able test cases. We contribute an approach and prototype to model-based selective regression testing, whereby fine-grain traceability relationships among entities in models and test cases are persisted into a traceability infrastructure throughout the test generation process: the relationships represent reasons for test case creation and are used to select test cases for re-run. The approach builds upon existing regression test selection techniques and adopts scenarios as behavioral modeling perspective. We analyze precision, efficiency and safety of the approach through case studies and through theoretical and intuitive reasoning.

Proper testing is an essential and critical part of any development effort. However, software testing is a complex undertaking, especially in the midst of today's security threats. Hackers, social engineering scams, and unaware users, are just a few potential threats that developers must consider not only during development, but more importantly during testing. There are significant reputation and financial losses related to security aspects that could have been addressed during requirements specification. While a variety of approaches to security requirements specification have been proposed, there is a tangible lack in the support that they offer during testing. In this paper we describe the tool support of a new security requirements engineering technique called SURE-Secure and Usable Requirements Engineering. ASSURE - Automated Support for Secure and Usable Requirements Engineering -, is a system developed to aid in the mapping of security requirements into testing artifacts. This support goes beyond mapping and aids also in the management of users and projects.

Requirements specification is an important problem in software engineering. Key challenges in Requirements Engineering (RE) include enabling different stakeholders to understand and validate the requirements, and enabling collaboration among different types of stakeholders with different skills and expertise and potentially conflicting needs and expectations. We contend that collaboration among both technical and non-technical stakeholders is improved by a requirements specification technique that provides both precision and usability - and a better balance of the two. We implement our specification technique in iMuse - Interactive Model-based Use-case and Storytelling Environment. In this demo, we show how iMuse can be used by stakeholders to express and view narrative functional requirements.

Throughout their life cycle, software artifacts are modified, and selective regression testing is used to identify the negative impact of modifications. Code-based regression test selection retests test cases sub-set that traverse code modifications. It uses recovered relationships between code parts and test cases that traverse them to locate test cases for retest when code is modified. Broad adoption of model-centric development has created opportunities for software testing. It enabled driving testing processes at higher abstraction levels and demonstrating code to model compliance by means of Model-Based Testing (MBT). Models also evolve, so an important activity of MBT is selective regression testing. It selects test cases for retest based on model modification, so it relies on relationships between model elements and test cases that traverse those elements to locate test cases for retest. We contribute an approach and prototype that during test case generation creates fine-grained traceability relationships between model elements and test cases, which are used to support model-based regression test selection.

Typical software systems in financial firms are message- based server-side systems , the regression testing of which is currently done through a 'log- replay' mechanism. As the production volumes are large and continue to grow rapidly, this approach leads to many problems such as scalability, resource crunch, reconciliation, redundancy, production impact. The approach in this paper continues to use the production log as the basis for regression testing. However, it deviates from the current approach in not using the entire production log but only a subset or sample of it.This approach has been implemented for regression testing of production systems in a major financial firm. The result was that the number of test cases executed converged to a small fraction of the number previously being executed, while still retaining a high degree of confidence in the code- coverage quality of the selected sample.

As technology continues to evolve, so do different entities that threaten the security of this technology. We believe that in order to build dependable software security should be treated just as any other important aspect of a system; to do this we must emphasize it at the beginning of our development cycle and be able to carry these security requirements down the cycle. We focus on a technique known as the Common Criteria, which allows for the development of security requirements. We extend the capabilities of Common Criteria beyond the requirements phase, to allow us to take security requirements into further stages of the cycle. In this paper we describe CCARCH, a technique accompanied by a set of tools, that takes Common Criteria expressed security requirements to the architectural level. Our approach aids in making the usage of Common Criteria more beneficial and applicable.

The adoption of model-driven development is leading to increased use of models in conjunction with source code in software testing. Model-based testing, however, introduces new challenges for testing activities, which include creation and maintenance of traceability information among test-related artifacts. Traceability is required to support activities such as model-based result evaluation, regression testing and coverage analysis. In this paper, we present an automated approach that leverages model transformation techniques to support test generation. The test generation process includes creation of test-related models and fine-grained relationships among these models. We also motivate our approach with a simple example demonstrating support for model-based regression testing

This paper presents a specification-based approach that addresses several known challenges including false positives and domain knowledge errors. Our approach begins with a goal graph and plans. Source code is annotated with goals and events and precompiled to emit those at run time. Plans are automatically translated into a rule-based recognizer. An oracle is produced from the pre- and postconditions associated with the plan's goals. When the program is executed, goals and events are emitted and automatically tested against plans and oracles. The concept is demonstrated on a small example and a larger publicly available case study

The lifetime of many software systems is surprisingly long, often far exceeding initial plans and expectations. During software evolution and maintenance, developers and managers frequently gain or lose confidence in software artifacts, especially when existing uncertainties are relieved or new ones are encountered. Fluctuations in developers' confidences may in turn affect process actions or decisions, e.g. in determining the impact of change, whether regression testing is needed or when to stop testing. We present an approach that allows developers' confidences or “beliefs” regarding software components to be modeled and updated directly. This approach is part of an overall strategy that calls for explicit modeling of software uncertainties using the technique called Bayesian belief networks. Initially, we present several kinds of software uncertainty and how they may be modeled. This is followed by introducing Bayesian belief networks and how they may be used to either confirm, evaluate or predict software uncertainties. We discuss our experiences in constructing Bayesian-network models for an existing software system under development at Beckman Instruments. Once constructed, these models may be used by developers and managers in future software understanding, evolution and maintenance activities. We also list several factors that may affect confidence as identified in conjunction with the Beckman study. Finally, we describe the design and implementation of a Java program that allows software systems and associated beliefs to be modeled explicitly