• The SAFT-GT toolchain enables semi-automatic Attack-Fault Tree generation for enhanced safety and security assessment in self-adaptive systems. • The toolchain efficiently integrates into the feedback loop of self-adaptive systems, allowing for dynamic updates based on security assessments. • A user study with domain experts confirms the toolchain’s relevance and practical applicability in real-world scenarios. • Performance experiments demonstrate that the Attack-Fault Tree generation pipeline operates within feasible time constraints, supporting real-time applications. • The complete toolchain and resources are provided for download, fostering further research and collaboration in the field. In the rapidly evolving landscape of software engineering, the demand for robust and secure systems has become increasingly critical. This is especially true for self-adaptive systems due to their complexity and the dynamic environments in which they operate. To address this issue, we designed and developed the SAFT-GT toolchain that tackles the multifaceted challenges associated with ensuring both safety and security. This paper provides a comprehensive description of the toolchain’s architecture and functionalities, including the Attack-Fault Trees generation and model combination approaches. We emphasize the toolchain’s ability to integrate seamlessly with existing systems, allowing for enhanced safety and security analyses without requiring extensive modifications and domain knowledge. Our proposed approach can address evolving security threats, including both known vulnerabilities and emerging attack vectors that could compromise the system. As a use case for the toolchain, we integrate it into the feedback loop of self-adaptive systems. Finally, to validate the practical applicability of the toolchain, we conducted an extensive user study involving domain experts, whose insights and feedback underscore the toolchain’s relevance and usability in real-world scenarios. Our findings demonstrate the toolchain’s effectiveness in real-world applications while highlighting areas for future improvements. The toolchain and associated resources are available in an open-source repository to promote reproducibility and encourage further research in this field.

Context: Various approaches aim to support program comprehension by automatically detecting algorithms in source code. However, no empirical evaluations of their helpfulness have been performed. Objective: To empirically evaluate how algorithm labels — which include the algorithm’s name and additional information — impact program comprehension in terms of correctness and time. Method: We conducted a controlled experiment with 56 participants, where the experimental group received code with labeled algorithms. The groups completed exercises designed to measure program comprehension as well as a post-questionnaire on label helpfulness, use cases for algorithm recognition, and reasons for self-implementation of algorithms in practice. Results: Annotating source code with algorithm labels significantly improves program comprehension (p=0.040), with a median improvement of 6 points (~23%), but does not affect completion times (p=0.991). Qualitative analysis revealed that a majority of participants perceived the labels as helpful, especially for recognizing the codes intent. Participants also proposed use cases such as error detection, optimization, and library replacement. Reasons for self-implementing algorithms included library inadequacies, performance needs and avoiding dependencies or licensing costs. Conclusion: This study shows that algorithm labels improve program comprehension, especially for developers with medium programming experience. Our qualitative analysis also sheds light on how participants benefit from the labels, further use cases for algorithm recognition and motivations behind self-implementing algorithms.

Context: Technically sophisticated systems are the result of the joint work of several domain experts. However, the more people collaborate, the more important it becomes to make the model evolution and its single edit operations accessible and comprehensible for involved stakeholders. Objective: We developed the textual and semantic aware query language EditQL. It enables domain experts to search for model versions, changes, and causing edit operations within a model's edit history. Based on an operation-based versioning system, the query language covers both edit operations and all model states. Method: We systematically elaborate the requirements of a query language for edit histories. Based on this, we present a DSL integrated into an existing modeling tool. We conducted a mixed-methods usability study with 15 participants in which they had to answer various questions about a model's evolution using EditQL. Results: All participants agreed on the usefulness of the query language, particularly the possibility of querying for semantic changes in the model. The measured System Usability Scale (SUS) scores range from OK to good. In addition, we identified a set of possible improvements. Conclusion: The study confirmed that EditQL and the underlying concepts are suitable tools to help domain experts understand the evolution of a model.

International audience

Cyber–physical systems (CPS) are increasingly self-adaptive, i.e. they have the ability to introspect and change their behavior. This self-adaptation process must be considered when modeling the safety and security aspects of the system. This study collects and compares security attacks and safety hazards on self-adaptive systems (SAS) described in the literature. In addition, mitigation and treatment strategies, as well as the modeling and analysis approaches, are investigated. We conducted a systematic literature review on 21 selected papers. The selection process included a database search on four scientific databases using a common search string (1430 papers), forward and backward snowballing (1402 papers), and filtering the results based on predefined inclusion and exclusion criteria. The coding scheme to analyze the content of the papers was obtained through research questions, existing domain-specific taxonomies, and open coding. Safety and security are not jointly modeled in the context of self-adaptive systems. The adaptation process is often not considered in the attack and hazard analysis due to naïve assumptions and modeling. The proposed approaches are mostly verified and validated through simulation often using simple use cases and scenarios. A thorough and joint modeling approach for safety and security in self-adaptive systems is still an open challenge that needs to be addressed. Further work is needed to address the gap between safety and security modeling in self-adaptive systems. Editor’s note: Open Science material was validated by the Journal of Systems and Software Open Science Board.

Self-adaptive systems offer several attack surfaces due to the communication via different channels and the different sensors required to observe the environment. Often, attacks cause safety to be compromised as well, making it necessary to consider these two aspects together. Furthermore, the approaches currently used for safety and security analysis do not sufficient take into account the intermediate steps of an adaptation. Current work in this area ignores the fact that a self-adaptive system also reveals possible vulnerabilities (even if only temporarily) during the adaptation. To address this issue, we propose a modeling approach that takes into account the different relevant aspects of a system, its adaptation process, as well as safety hazards and security attacks. We present several models that describe different aspects of a self-adaptive system and we outline our idea of how these models can then be combined into an Attack-Fault Tree. This allows modeling aspects of the system on different levels of abstraction and co-evolve the models using transformations according to the adaptation of the system. Finally, analyses can then be performed as usual on the resulting Attack-Fault Tree.