Cybersecurity risk assessment has become a critical task in systems development and the operation of complex networked systems. However, current state-of-the-art approaches for detecting vulnerabilities, such as automated security testing or penetration testing, often result in late detection. Thus, there is a growing need for security by design, which involves conducting security-related analyses as early as possible in the system development life cycle. This paper proposes an integrated approach that combines static and dynamic hierarchical model-based security risk assessment. The approach enables early identification of security risks during system design, utilizing various models based on the Unified Modeling Language (UML), with lightweight extensions using profiles and stereotypes to capture security attributes like vulnerabilities and asset values. These security attributes are then used to compute relevant properties, including threat space, possible attack paths, and selected network-based security metrics. To facilitate dynamic security analysis, the UML model is subsequently translated into a deterministic and stochastic Petri net (DSPN). This translation allows for the dynamic analysis and simulation of the system’s state and behavior during an attack, capturing temporal aspects and probabilistic transitions. By representing system components and their interactions as modular Petri nets, the DSPN framework facilitates comprehensive simulation and analysis of possible attack scenarios. This also allows us to estimate time-based security metrics such as the duration required for an attacker to compromise system components. Consequently, this combined approach effectively addresses both static security analysis and dynamic state behavior, providing an integrated understanding of the system’s resilience against cyber threats. A real-world industrial case study illustrates the effectiveness of this approach. The underlying data originates from security assessments performed by Keen Security Labs, which were independently verified by BMW (Cai et al., 2019). Specifically, we present an infotainment system network model as implemented in multiple car models along with corresponding attack and defense models. We then demonstrate how the approach assesses the cybersecurity risk of such in-vehicle networks.

Polymorphism is a foundational concept within the object-oriented paradigm and is a feature of any mainstream object-oriented language that supports reusability and abstraction in software designs. With fUML being a standard specification of execution semantics of UML activity diagrams, it defines functionalities to simulate polymorphic behavior within such model executions. fUML only provides a simple standard implementation for simulating dynamic polymorphism at runtime. This default implementation does not meet the criteria of polymorphism as it is well-known and established by most mainstream object-oriented programming languages over the last decades, nor does it comply with the constraints for method overriding imposed by the original UML specification. However, fUML offers extension capabilities to add user-defined behavior for semantic variation points like polymorphism handling. This paper presents an extension of fUML execution semantics, enabling refined and more sophisticated simulation of polymorphism for executable UML models to comply with UML and the general understanding and functioning principles of polymorphic behavior within the object-oriented paradigm.

OMG's PSCS specification extends the execution model of fUML by precise runtime semantics for UML composite structures. With composite structures being a concept for describing structural properties of a model, the majority of execution semantics specified by PSCS concern analysis and processing of static information about the model's fine-grained structure at runtime. Using Model-To-Text-Transformation to generate source code, which serves as an input for PSCS's actual execution environment, the runtime level of model execution can be relieved by outsourcing analysis and processing of static information to the level of code generation. By inserting this step of preprocessing, the performance of the actual model execution at runtime can be improved. This paper introduces an implementation of the PSCS specification for C++ based on code generation using Model-to-Text-Transformation. Moreover, it presents a set of test models validating the correct functionality of the implementation a s well as a performance benchmark. The PSCS implementation presented by this paper was developed as a part of the MDE4CPP* project.

Availability of a common, shared benchmark to provide repeatable, quantifiable, and comparable results is an added value for any scientific community. International consortia provide benchmarks in a wide range of domains, being normally used by industry, vendors, and researchers for evaluating their software products. In this regard, a benchmark of untimed Petri net models was developed to be used in a yearly software competition driven by the Petri net community. However, to the best of our knowledge there is not a similar benchmark to evaluate solution techniques for Petri nets with timing extensions. In this paper, we propose an evaluation framework for the comparative analysis of generalized stochastic Petri nets (GSPNs) simulation techniques. Although we focus on simulation techniques, our framework provides a baseline for a comparative analysis of different GSPN solvers (e.g., simulators, numerical solvers, or other techniques). The evaluation framework encompasses a set of 50 GSPN models including test cases and case studies from the literature, and a set of evaluation guidelines for the comparative analysis. In order to show the applicability of the proposed framework, we carry out a comparative analysis of steady-state simulators implemented in three academic software tools, namely, GreatSPN, PeabraiN, and TimeNET. The results allow us to validate the trustfulness of these academic software tools, as well as to point out potential problems and algorithmic optimization opportunities.

One of the goals of the Foundational UML Subset (fUML) is a consistent and well-defined execution of UML activity diagrams. However, the specification is not done in a formal mathematical model and leaves room for implementation-specific tool details. This paper shows how this may lead to problems for concurrent program semantics. To this end, the paper introduces a transformation and basic analysis methods for activity diagrams under the current fUML sequential execution semantics. The analysis is conducted using Petri nets, which are mathematical models with a graphical representation to describe distributed systems. There are numerous well-established analysis methods to validate specific desirable properties of a concurrent program including liveliness, the absence of deadlocks, fairness, mutual exclusion, and detection of unreachable states. In this paper, we show that the intuitive translation to Petri nets does not fit the current fUML execution implementation; therefore, we i ntroduce a new model-to-model transformation realized with QVTo, that translates a set of the most used fUML elements to Petri nets. Moreover, we propose methods to analyze the models with the tool TimeNET.

This paper shows and discusses the realization of advanced data structures used in the UML specification (namely subsets, unions, and subset-unions) for a C++ execution engine. Those data structures have been realized thanks to the use of variadic templates, which were first introduced in C++11. Thanks to those templates which allow to take as parameters a non-fixed number of elements in an elegant manner, it has been possible to automatically generate from the Ecore and UML ecore models type-safe data structures which avoid elements being duplicated or the generation of additional lists during run-time. A performance analysis is presented to show how our implementation behaves compared to the other possible approaches.

This paper introduces an execution engine that is able to run fUML models, described by a subset of UML's class and activity diagrams' elements. The execution engine is realized in C++, which leads, in certain conditions, to better memory efficiency and performance of the generated code, compared for example to the fUML standard implementation in Java. As it does not use any platform specific code, it is possible to compile it on any C++ compliant platform. The paper then shows how the engine has been applied to a simulated annealing optimization heuristic as a validation example and finally a performance evaluation regarding occupied memory, storage requirements, and execution time is carried out.

The optimization of complex systems as well as other design methods require a description of the system parameters, or the design space. Explicit encoding of all possible variants is practically impossible, thus an implicit method is needed. While this is easy for purely numerical parameters and a fixed number of them as usually assumed in direct or indirect optimization, it is quite hard for systems in which the architecture and thus the structure of the parameters themselves can be varied. This paper introduces an approach to specify system architecture variants in a concise way and proposes a UML profile for this task. Standard UML meta model elements are used for the description of variant-specific stereotypes. An example of a variant specification for a communication network model is presented.

This short paper presents ongoing work towards the model-based evaluation of AFDX avionic networks. The required reliability of this type of network depends on timely packet delivery, which must be analyzed during design. We extend previous work by colored stochastic Petri net models of AFDX modules, which reduces several restrictions of the earlier Petri net models. Rare-event simulation for such models allows to efficiently compute small probabilities of long (potentially safetycritical) transmission delays. This has been implemented in the software tool TimeNET previously, and the simulation results validate the proposed model.

Model-driven architecture is a well-known approach for the development of complex software systems. The most famous tool chain is provided by Eclipse with the tools of the Eclipse modeling project. Like Eclipse itself, these tools are based on Java. However, there are numerous legacy software packages written in C++, which often use only an implicit meta-model. A real C++ implementation of this meta-model would be necessary instead to be used at run time. This paper presents a generator for C++ to create the classes, meta-model packages, and factories to realize modeling, transformation, validation, and comparison of UML models. It gives an overview of its workflow and major challenges. Moreover, a comparison between Java and C++ implementations is given, considering different benchmarks.

Analysis and validation using simulation is a helpful tool in systems engineering, but requires in-depth knowledge of various aspects of the system itself, used model classes, and an appropriate software tool. Usually, this expertise is spread over a number of team members, thus making it a non-trivial task. A domain-specific simulation-based system design tool (termed here simulation-based application, SBA) could fill this gap. It hides the complexity of the model from the system designer and allows to configure parameters and analyze results in one single application. The necessary extra effort in software development compared to a bare modeling tool can be reduced with techniques for model-driven development. This paper presents an approach to use such methods to improve the development of SBA as a case of domain-specific software product lines. The workflow is described as well as the existing meta-model and applied techniques from model-driven development. The paper also shows the necessary elements of a meta model to describe SBAs. An example shows the complete workflow using an example of a wireless sensor networks for avionic applications.

Clock synchronization is a necessary feature in in-vehicle time- and safety-critical networks. The reason is that exact timing information has to be maintained in nodes, for instance for time stamps of messages that are important for safety-critical functions. A common time base has to be established at start-up time before time-sensitive data handling can begin. In vehicular applications, this clock initialization phase is only one part of tasks that have to be finished before the vehicle is fully functional. To avoid lengthy delays after vehicle ignition, this start-up phase has to be very short depending on the requirements of functions. Advanced driver assistance systems require high-bandwidth communication such as Ethernet Audio Video Bridging (AVB). Its corresponding IEEE 802.1 AS time synchronization protocol is, however, not able to guarantee fast synchronization start-up in conformance with automotive applications. This paper thus proposes and analyzes several variants of the time synchronization protocol to achieve a shorter start-up time. Simulation-based performance analysis shows that start-up times can be reduced by a factor of 40 compared to the standard IEEE 802.1 AS with the proposal, without considerably affecting synchronization error.

Abstract: Stochastic colored Petri nets are an established model for the specification and quantitative evaluation of com-plex systems. Automated design-space optimization for such models can help in the design phase to find good variants and parameter settings. However, since only indirect heuristic optimization based on simulation is usually possible, and the design space may be huge, the computational effort of such an algorithm is often prohibitively high. This paper extends earlier work on accuracy-adaptive simulation to speed up the overall optimization task. A local optimization heuristic in a “divide-and-conquer ” approach is combined with vary-ing simulation accuracy to save CPU time when the response surface contains local optima. An application example is analyzed with our recently implemented software tool to validate the advantages of the approach. 1

Managing a cloud computing provider is a difficult task, which involves the control and maintenance of several components, such as computers, network infrastructures and software components. In these environments, availability, security and low costs are important requirements to achieve high quality of service. Therefore, the evaluation of these systems is important to find a configuration that meets the constraints of users and provider. A widely adopted strategy to evaluate cloud computing systems consists by the utilization of stochastic models (e.g., stochastic Petri nets - SPN) to assess the concern metrics. In this context, Eucalyptus is an open source private cloud software for building private and hybrid clouds. This work presents dependability models for evaluation on Eucalyptus clouds. These models focus on the user point of view metrics (e.g., number of running virtual machines) to assess the dependability metrics. In order to demonstrate the feasibility of the proposed models, we evaluate a real world environment and validate the presented models by using Eucabomber tool version 2.0.

Over the last years, many companies have been moving their computational services to cloud computing providers. In these environments, high availability is a key metric since system outages can lead penalties defined in service level agreements (SLAs). Eucalyptus is a prominent tool for providing virtual machines (VMs) as a cloud service. Considering the user perspective, the service is available if the requested VMs are operational no matter which part of the infrastructure is failed or not. Therefore, providers need to evaluate the dependability level of their environment, considering the user point of view. An important technique to perform dependabiliy evaluation in general systems corresponds to fault injection approach, which observes the systems behavior during the occurrence of fault events. This paper presents an extension of previous work (i.e., Eucabomber) that provides a fault injection tool for dependability evaluation in Eucalyptus cloud computing platform. The current version extends the previous one by providing new user-oriented metrics considering the VM life-cycle operations and also takes into account failure dependencies between Eucalyptus components. Additionally, a case study comparing dependability model results and measured metrics is provided to demonstrate the feasibility of the proposed environment.

Hundreds of natural disasters occur in many parts of the world every year, causing billions of dollars in damages. This fact contrasts with the high availability requirement of cloud computing systems, and, to protect such systems from unforeseen catastrophe, a recovery plan requires the utilization of different data centers located far enough apart. However, the time to migrate a VM from a data center to another increases due to distance. This work presents dependability models for evaluating distributed cloud computing systems deployed into multiple data centers considering disaster occurrence. Additionally, we present a case study which evaluates several scenarios with different VM migration times and distances between data centers.

Designing complex embedded systems is a challenge, which benefits from using models for various tasks. Among them, an important one is finding a good (or the best) system design alternative for a given set of changeable parameters. Such decisions are usually based on non-functional properties which can be quantitatively expressed and evaluated using a model. Automatic optimization would be advantageous, but one of its problems is the enormous computational effort to evaluate the model for a large number of parameter sets. In this paper a new idea to speed up indirect optimization is proposed, which makes use of an integration of optimization control and underlying performance evaluation technique. Moreover, we propose to adaptively use refinements or abstractions of complex hierarchical models to control the tradeoff between model complexity and result accuracy of a performance evaluation, and demonstrate this dependency with an example.

Automotive software design is a challenging task because of increasing system complexity. This paper proposes a model-based software development process for complex embedded systems in automotive applications. The gap between early requirement specifications and the development of electronic control units for specific features is bridged with an approach using executable specifications. Behavioral and non-functional properties of the system to be designed can thus be evaluated early during the design process, which improves the confidence of strategic design decisions. Moreover, the executable system model serves as an interface description for module designers, which eases the problem of system integration. The problem of increasing resources for system simulation and optimization is treated by an approach of accuracy adaptive system simulation. The paper presents work in progress towards a complete methodology and tool chain using a CAN bus example.

Model-based design using executable models has the potential to increase system design efficiency and accuracy significantly. In the paper we present an industrial application which covers system design issues in the area of avionics and airline operation, especially taking into account maintenance and logistics operations and their impact on fleet availability. Such a complex system needs to be modeled on a very abstract level of detail in the early phases of design, and undergoes a stepwise refinement throughout the further development. Executability of a model ensures that the model is a behavioral specification, and allows simulation runs for a performance evaluation of design alternatives. Decisions can thus be made with more confidence. We use the software tool MLDesigner in the paper, which is capable of modeling an evaluating hierarchical multi-domain models of complex systems. Different models of computation for submodels can be mixed, and an extensive library of predefined modules is available. We present parts of an abstract airline model from an ongoing project, which is used to evaluate, among others, resource availabilities.

Vehicle testing and diagnosis requires huge amounts of data to be gathered and analyzed. Not all possibly interesting data can be stored because of the limited memory available in a tested vehicle. On-board preprocessing of data and decisions about which information has to be kept or omitted is thus vital for vehicle testing routines. This paper introduces a method for flexible on-board processing of sensor data of a vehicle. The approach is motivated by sensor network ideas and makes use of stream processing techniques. A processing graph model for automotive applications is proposed, which consists of operator nodes and connecting data streams. This model supplies both recording and processing functionality together. To account for dynamic changes of conditions within a vehicle-most of the time only a small portion of the vehicle states are interesting for diagnosis-both the model and actual software are built in such a way that the whole system can automatically be adapted at runtime whenever certain conditions are detected. The proposed stream processing model has been implemented in a proof-of-concept industrial application, that was deployed to an automotive on-board unit. Results show that this approach effectively trades a little more on-board processing power for a large data volume, that does not need to be saved and transmitted for off-board usage anymore.

This paper proposes a methodology for modeling and evaluating supply chains based ongeneralized stochastic Petri net(GSPN) components. The proposed modeling process is based on a bottom-up approach, which assures desirable model properties that start from a set of predefined modules for typical supply chain entities. A compositional algebra that formally defines GSPN compositions is presented. The proposed methodology is supported by an implementation of the methodology in thestochastic logistics optimizer tool(SLOT). An industrial case study has been conducted to show the benefits of the approach.

ZigBee is a network stack requiring only low power consumption, that is used in different application areas. The 2003 ZigBee implementation has flaws when the coordinator node fails, because it represents a single point of failure. This paper presents a new approach to overcome this pitfall. The solution is transparent for communicating end nodes, easy to use, and supports all ZigBee features. It uses a backup solution for coordinator nodes that is implemented at the application level. The approach has been implemented and tested in a real-life setup. In addition to that, the paper introduces a model of a more complex configuration and presents simulation results for the proposed approach.

Multistage interconnection networks (Banyan networks) are proposed as connections in multiprocessor systems and in high-bandwidth network switches. In order to achieve suitable solutions when designing such networks to fit a given task, performance evaluation plays a crucial part. This paper presents an approximative analytical modeling approach that offers a performance measure (in addition to mean throughputs and delay times) that is considered important in real-time communications scenarios: distribution of delay times, for which no analytically tractable exact method exists.

This work proposes the use of pre-defined generalized stochastic Petri net (GSPN) components to model and evaluate outbound logistics. The modeling process takes into account the automatic generation of these stochastic models from high-level end-user-oriented descriptions. The model resultant from this translation is guaranteed to have some expected Petri nets' properties. The Stochastic Logistics Optimizer Tool (SLOT) was implemented with the aim of supporting the modeling process based on a component library. Case studies were carried out and one of them is presented.

We present results of a collaboration project, during which parts of General Motors' north American vehicle supply chain have been modeled and evaluated. A variant of colored stochastic Petri nets has been developed for this task, and support for model creation and performance evaluation was implemented in our tool TimeNET. Variations of the model and their stepwise evaluation lead to suggestions about how the supply chain can be reorganized in order to improve the time between customer order and vehicle delivery (order-to-delivery time).

The design of real-time systems requires modeling and analysis techniques, to ensure their correct and timely operation. In many cases a realistic model should be able to cover both fixed and stochastic times. Stochastic Petri nets are a promising description technique in this field, but mixing deterministic and randomly distributed times in one model makes the analysis often impossible. This paper shows that Petri net models with an underlying discrete time can be advantageous for the modeling and analysis of real-time systems. For a demonstration a simple application example is modeled and its behavior computed using the software tool TimeNET.

There is a need for modeling and performance evaluation techniques and tools for a fast and reliable design of modern manufacturing systems. The paper introduces TimeNET/sub MS/, a software tool which integrates manufacturing system modeling and performance analysis with an easy-to-use graphical user interface. It is based on a concept of independent models for the manufacturing system structure and work plans, both using a dedicated class of colored stochastic Petri nets. TimeNET/sub MS/ is implemented as an extension of the more general Petri net modeling and analysis tool TimeNET. An industrial application example shows the use of the tool.