Cybersecurity attacks are on the rise, and the current response is not effective enough. The need for a competent workforce, able to face attackers, is increasing. At the moment, the gap between academia and real-world skills is huge and academia cannot provide students with skills that match those of an attacker. To pass on these skills, teachers have to train students in scenarios as close as possible to real-world ones. Capture the Flag (CTF) competitions are a great tool to achieve this goal, since they encourage students to think as an attacker does, thus creating more awareness on the modalities and consequences of an attack. We describe our experience in running an educational activity on ethical hacking, which we proposed to computer science and computer engineering students. We organized seminars, outside formal classes, and provided online support on the hands-on part of the training. We delivered different types of exercises and held a final CTF competition. These activities resulted in growing a community of students and researchers interested in cybersecurity, and some of them have formed ZenHack, an official CTF team.

Assuring the quality of Internet of Things (IoT) systems is of paramount importance, and guaranteeing their reliability and compliance with the requirements is mandatory, but few attempts have been made so far. In previous works, we proposed two approaches for acceptance testing and runtime verification of IoT systems. Both works rely on a UML state machine to specify the system expected behaviour. In the acceptance testing approach, the interesting paths to exercise are identified and translated into executable test scripts. In the runtime verification approach, the relevant events during the system execution are monitored and compared against a formal specification derived from the UML state machine. In this paper, we compare the effectiveness of our two approaches, by applying them to a mobile health IoT system for the management of diabetic patients, employing over 100 mutated versions of the original system and analysing more than 1000 different executions. Results show that both approaches are effective in different ways in detecting bugs. While the acceptance testing approach is more effective to detect the bugs affecting the user interface, the runtime verification approach tracks better the subtle deviations from the system expected behaviour, in particular those concerning network issues.

This short paper describes :DRHOP , a project proposal based on the idea of an “open interface” that aims to aggregate different types of “services” and to build around them a community of users who, without changing their usual online (and offline) habits, collect a wallet of drops, a sort of virtual currency that can be donated for charity purposes. The architecture of the system is introduced together with the present version of a proof of concept, currently implemented in the context of online advertising. :DRHOP is still in its initial design phase and important issues like trust, security, and privacy - that are fundamental for the success of a proposal like this - are only partially sketched. Nevertheless, we think the idea is worth to carry on as witnessed by some similar projects, which are also briefly introduced in the paper, showing the interest of the Internet community for online charity experiences.

Internet of things (IoT) systems are becoming ubiquitous and assuring their quality is fundamental. Unfortunately, a few proposals for testing these complex, and often safety‐critical, systems are present in the literature. The authors propose an approach for acceptance testing of IoT systems adopting graphical user interfaces as a principal way of interaction. Acceptance testing is a type of black box testing based on test scenarios, i.e. sequences of steps/actions performed by the user or the system. In their approach, test scenarios are derived from a state machine that expresses the behaviour of the system under test, and test cases are derived from them by specifying the actual data and assertions and made executable by implementing the corresponding test scripts. As a case study, they selected a mobile health IoT system for diabetes management composed of local sensors/actuators, smartphones, and a remote cloud‐based system. The effectiveness of the approach has been evaluated by measuring the capability of two test suites implemented using different localisation strategies (visual and structure‐based) in detecting mutants of the original m‐health system. Results show the effectiveness of the test suites implemented by following the proposed approach since 93% of the generated mutants have been detected.

We conducted a personal opinion survey in two rounds - years 2008 and 2011 - with the aim of investigating the level of knowledge and adoption of SOA in the Italian industry. We are also interested in understanding what is the trend of SOA (positive or negative?) and what are the methods, technologies and tools really used in the industry. The main findings of this survey are the following: (1) SOA is a relevant phenomenon in Italy, (2) Web services and RESTFul services are well-known/used and (3) orchestration languages and UDDI are little known and used. These results suggest that in Italy SOA is interpreted in a more simplistic way with respect to the current/real definition (i.e., without the concepts of orchestration/choreography and registry). Currently, the adoption of SOA is medium/low with a stable/positive trend of pervasiveness.

We define a DHT system whose aim is to combine the routing efficiency typical of randomized networks, i.e. average path length O(logn/ log log n), with the ease of coding and the start-up efficiency of an optimized uniform system. Our proposed system is non-uniform, even though it is not explicitly randomized. In particular, the difference in terms of finger tables between two adjacent peers in a large system is very moderate, and predictable based on an approximation of the peers' keys. These characteristics allow us to adopt a (multi-hop) Neighbor of Neighbor routing algorithm, which asymptotically achieves O(logn/ log logn) average path length, and that in practice may even slightly outperform randomized networks containing more than 100,000 peers.

Performance Evaluation Process Algebra (PEPA) is a formal language for performance modeling based on process algebra. It has previously been shown that, by using the process algebra apparatus, compact performance models can be derived which retain the essential behavioral characteristics of the modeled system. However, no efficient algorithm for this derivation was given. We present an efficient algorithm which recognizes and takes advantage of symmetries within the model and avoids unnecessary computation. The algorithm is illustrated by a multiprocessor example.

Stochastic Petri Nets and Stochastic Process Algebras can both be used for the qualitative and quantitative analysis of parallel and distributed systems. However, sometimes and complexity of the system can make such analysis infeasible, due to the large size of the state space underlying the model. To overcome this problem different aggregation techniques have been proposed in both formalisms. Two of them are compared in this paper.