Keeping a vehicle secure implies provide of a long-term support, where over-the-air updates (OTA) play an essential role. Clear understanding of OTA threats is essential to counter them efficiently. Existing research on OTA threats often exclude human actors, such as drivers and maintenance personnel, as well as leave aside privacy threats. This paper addresses the gap by investigates security and privacy OTA threats relevant for vehicle manufacturers for the whole product lifecycle. We report on a practical scenario "long term support", its data flow elements, and outcomes of threat analyses. We apply state of the art approaches, such as STRIDE (extended with an automotive template) and LINDDUN, to an automotive case and consider an automotivespecific UNECE OTA threat catalogue. Outcomes indicate complementarity of these methods and provide inputs to studies how well they address practical automotive cases.

With the advent of embedded and mobile computing techniques, software systems are increasingly operated in open and dynamic environments. Such systems desire self-adaptive capabilities. This paper proposes an agent-oriented approach to the modeling and simulation of distributed adaptive systems. The approach enables to construct structural and behavioral models at a high abstraction level, and to validate the models at design stage through model simulation. The modeling language facilitates devising decentralized adaption logic at both component and system levels. Simulation demonstrates how a system dynamically re-organizes in response to the changes in the operating context. Case studies show that our approach can support various self-adaptation mechanisms with which a multi-agent system adjusts to internal failures, unexpected environment, or user's changing requirements.

A modelling language can be defined by a metamodel in UML class diagram. This paper defines the semantics of such metamodels through two mappings: a signature mapping from metamodels to signatures of first order languages and an axiom mapping from metamodels to sets of axioms over the signature. Valid models, i.e. instances of the metamodel, are therefore mathematical structures in the signature that satisfies the axioms. This semantics definition enables us to analyse the logical consistency and completeness of metamodels. A software tool called LAMBDES is implemented to translate metamodels into first order logic systems and analyse them by employing the theorem prover SPASS. Case studies with the tool detected inconsistency and incompleteness in the metamodel of UML 2.0 and an AspectJ profile.

Generation of adequate test cases is difficult and expensive, especially for testing software systems whose input is structurally complex. This paper presents an approach called data mutation to generating a large number of test data from a few seed test cases. It is inspired by mutation testing methods, but differs from them in the aim and the way that mutation operators are defined and used. While mutation testing is a method for measuring test adequacy, data mutation is a method of test case generation. In traditional mutation testing, mutation operators are used to transform the program under test. In contrast, mutation operators in our approach are applied on input data to generate test cases, hence called data mutation operators. The paper reports a case study with the method on testing an automated modelling tool to illustrate the applicability of the proposed method. Experiment data clearly demonstrate that the method is adequate and cost effective, and able to detect a large proportion of faults. 1

In model-driven software development, inconsistency of a model must be detected and eliminated to ensure the quality of the model. This paper investigates the consistency check in the modelling of multi-agent systems (AMS). Consistency constraints are formally defined for the CAMLE language, which was proposed in our previous work for modelling MAS. Uses of the consistency constraints in the implementation of a modelling environment for automatic consistency check and model transformation are discussed.