• The SAFT-GT toolchain enables semi-automatic Attack-Fault Tree generation for enhanced safety and security assessment in self-adaptive systems. • The toolchain efficiently integrates into the feedback loop of self-adaptive systems, allowing for dynamic updates based on security assessments. • A user study with domain experts confirms the toolchain’s relevance and practical applicability in real-world scenarios. • Performance experiments demonstrate that the Attack-Fault Tree generation pipeline operates within feasible time constraints, supporting real-time applications. • The complete toolchain and resources are provided for download, fostering further research and collaboration in the field. In the rapidly evolving landscape of software engineering, the demand for robust and secure systems has become increasingly critical. This is especially true for self-adaptive systems due to their complexity and the dynamic environments in which they operate. To address this issue, we designed and developed the SAFT-GT toolchain that tackles the multifaceted challenges associated with ensuring both safety and security. This paper provides a comprehensive description of the toolchain’s architecture and functionalities, including the Attack-Fault Trees generation and model combination approaches. We emphasize the toolchain’s ability to integrate seamlessly with existing systems, allowing for enhanced safety and security analyses without requiring extensive modifications and domain knowledge. Our proposed approach can address evolving security threats, including both known vulnerabilities and emerging attack vectors that could compromise the system. As a use case for the toolchain, we integrate it into the feedback loop of self-adaptive systems. Finally, to validate the practical applicability of the toolchain, we conducted an extensive user study involving domain experts, whose insights and feedback underscore the toolchain’s relevance and usability in real-world scenarios. Our findings demonstrate the toolchain’s effectiveness in real-world applications while highlighting areas for future improvements. The toolchain and associated resources are available in an open-source repository to promote reproducibility and encourage further research in this field.

Several profilers for general-purpose languages like Java offer visualizations to support users in understanding the execution of a program and identifying the causes of a performance issue. Unfortunately, these performance visualizations are difficult to reuse in profilers for declarative model transformations since they cannot display transformation-specific information. For example, a profiler for a declarative model transformation language must provide information on the traversal of the input model since it impacts the performance but is hidden from the developer. Moreover, the respective visualization must scale for input models that consist of several thousand model elements. Hence, we developed performance visualizations for the declarative model transformation language Henshin that provide insights into the transformation execution. Subsequently, we performed a mixed methods study with 18 Henshin novices to evaluate the effectiveness of our visualizations. In our study, the participants tried to improve the execution performance of four transformations by performing a root cause analysis using our visualizations. The results of our study show that depending on the task, between 16 and 18 participants understood the execution of a transformation correctly based on our visualizations. Moreover, between 12 and 18 participants proposed effective optimizations using our visualizations.

Model transformation languages are domain-specific languages used to define transformations of models. These transformations consist of the translation from one modeling formalism into another or just the updating of a given model. Such transformations are often described declaratively and are often implemented based on very small models that cover the language of the input model. As a result, transformation developers are often unable to assess the time required to transform a larger model. Hence, we propose a prediction approach based on machine learning which uses a set of model characteristics as input and provides a prediction of the execution time of a transformation defined in the Atlas Transformation Language (ATL). In our previous work (Groner et al., 2023), we already showed that support vector regression in combination with a model characterization based on the number of model elements, the number of references, and the number of attributes is the best choice in terms of usability and prediction accuracy for the transformations considered in our experiments. Our previous approach cannot predict the performance of transformations correctly which transform attributes whose values have an arbitrary size, like string attributes. Therefore, we investigate in this work whether an extension of our feature sets that describes the average size of string attributes can help to overcome this weakness. Our results show that the random forest approach in combination with model characterizations based on the number of model elements, the number of references, the number of attributes, and the average size of string attributes filtered by the 85th percentile of their variance is the best choice in terms of the simple way to describe a model and the quality of the obtained prediction. With this combination, we obtained a mean absolute percentage error (MAPE) of 5.07% over all modules and a MAPE of 4.82% over all modules excluding the transformation for which our previous approach failed. Whereas, we obtained previously a MAPE of 38.48% over all modules and a MAPE of 4.45% over all modules excluding the transformation for which our previous approach failed.

Model transformation languages are special-purpose languages, which are designed to define transformations as comfortably as possible, i.e., often in a declarative way. Typically, developers create their transformations based on small input models which systematically cover the language of the input models. This makes it difficult for the developers to estimate how the transformations would perform for a large and diverse set of input models.

Cyber–physical systems (CPS) are increasingly self-adaptive, i.e. they have the ability to introspect and change their behavior. This self-adaptation process must be considered when modeling the safety and security aspects of the system. This study collects and compares security attacks and safety hazards on self-adaptive systems (SAS) described in the literature. In addition, mitigation and treatment strategies, as well as the modeling and analysis approaches, are investigated. We conducted a systematic literature review on 21 selected papers. The selection process included a database search on four scientific databases using a common search string (1430 papers), forward and backward snowballing (1402 papers), and filtering the results based on predefined inclusion and exclusion criteria. The coding scheme to analyze the content of the papers was obtained through research questions, existing domain-specific taxonomies, and open coding. Safety and security are not jointly modeled in the context of self-adaptive systems. The adaptation process is often not considered in the attack and hazard analysis due to naïve assumptions and modeling. The proposed approaches are mostly verified and validated through simulation often using simple use cases and scenarios. A thorough and joint modeling approach for safety and security in self-adaptive systems is still an open challenge that needs to be addressed. Further work is needed to address the gap between safety and security modeling in self-adaptive systems. Editor’s note: Open Science material was validated by the Journal of Systems and Software Open Science Board.

Self-adaptive systems offer several attack surfaces due to the communication via different channels and the different sensors required to observe the environment. Often, attacks cause safety to be compromised as well, making it necessary to consider these two aspects together. Furthermore, the approaches currently used for safety and security analysis do not sufficient take into account the intermediate steps of an adaptation. Current work in this area ignores the fact that a self-adaptive system also reveals possible vulnerabilities (even if only temporarily) during the adaptation. To address this issue, we propose a modeling approach that takes into account the different relevant aspects of a system, its adaptation process, as well as safety hazards and security attacks. We present several models that describe different aspects of a self-adaptive system and we outline our idea of how these models can then be combined into an Attack-Fault Tree. This allows modeling aspects of the system on different levels of abstraction and co-evolve the models using transformations according to the adaptation of the system. Finally, analyses can then be performed as usual on the resulting Attack-Fault Tree.

Abstract There exists a plethora of claims about the advantages and disadvantages of model transformation languages compared to general-purpose programming languages. With this work, we aim to create an overview over these claims in the literature and systematize evidence thereof. For this purpose, we conducted a systematic literature review by following a systematic process for searching and selecting relevant publications and extracting data. We selected a total of 58 publications, categorized claims about model transformation languages into 14 separate groups and conceived a representation to track claims and evidence through the literature. From our results, we conclude that: (i) the current literature claims many advantages of model transformation languages but also points towards certain deficits and (ii) there is insufficient evidence for claimed advantages and disadvantages and (iii) there is a lack of research interest into the verification of claims.

Model-Driven Software Engineering (MDSE) is a widely used approach to deal with the increasing complexity of software. This increasing complexity also leads to the fact that the models used and the model transformations applied become larger and more complex as well. This means that the execution performance of model transformations is gaining in importance. While improving the performance of model transformation execution engines has been a focus of the MDSE-community in the past, there does not exist any empirical study on how developers of model transformation deal with performance issues. Consequently, we conducted an exploratory mixed method study consisting of a quantitative online survey and a qualitative interview study. We used a questionnaire to investigate whether the performance of a transformation is actually important for transformation developers and whether they have already tried to improve the performance of a model transformation. Subsequently, we conducted semi-structured interviews based on the answers to the questionnaire to investigate how transformation developers deal with performance issues, what causes and solutions they found and also what they think could help them to easier find causes. The results of the quantitative online survey show that 43 of 81 participants have already tried to improve the performance of a transformation and 34 of the 81 are sometimes or only rarely satisfied with the execution performance. Based on the answers from our 13 interviews, we identified different strategies to prevent or find performance issues in model transformations as well as different types of causes of performance issues and solutions. Finally, we compiled a collection of additional tool features perceived helpful by the interviewees to address performance issues.