Large-scale Cyber-Physical Systems (CPSs) are information systems that involve a vast network of sensor nodes and other devices that stream observations in real-time and typically are deployed in uncontrolled, broad geographical terrains. Sensor node failures are inevitable and unpredictable events in large-scale CPSs, which compromise the integrity of the sensors measurements and potentially reduce the quality of CPSs services and raise serious concerns related to CPSs safety, reliability, performance, and security. While many studies were conducted to tackle the challenge of sensor nodes failure detection using domain-specific solutions, this paper proposes a novel sensor nodes failure detection approach and empirically evaluates its validity using a real-world case study. This paper investigates time-series clustering techniques as a feasible solution to identify sensor nodes malfunctions by detecting long-segmental outliers in their observations' time series. Three different time-series clustering techniques have been investigated using real-world observations collected from two various sensor node networks, one of which consists of 275 temperature sensors distributed around London. This study demonstrates that time-series clustering effectively detects sensor node's continuous (halting/repeating) and incipient faults. It also showed that the feature-based time series clustering technique is a more efficient long-segmental outliers detection mechanism compared to shape-based time-series clustering techniques such as DTW and K-Shape, mainly when applied to shorter time-series windows.

Cyber-physical systems (CPSs) are integrated systems engineered to combine computational control algorithms and physical components such as sensors and actuators, effectively using an embedded communication core. Smart cities can be viewed as large-scale, heterogeneous CPSs that utilise technologies like the Internet of Things (IoT), surveillance, social media, and others to make informed decisions and drive the innovations of automation in urban areas. Such systems incorporate multiple layers and complex structure of hardware, software, analytical algorithms, business knowledge and communication networks, and operate under noisy and dynamic conditions. Thus, large-scale CPSs are vulnerable to enormous technical and operational challenges that may compromise the quality of data of their applications and accordingly reduce the quality of their services. This paper presents a systematic literature review to investigate data quality challenges in smart-cities large-scale CPSs and to identify the most common techniques used to address these challenges. This systematic literature review showed that significant work had been conducted to address data quality management challenges in smart cities, large-scale CPS applications. However, still, more is required to provide a practical, comprehensive data quality management solution to detect errors in sensor nodes’ measurements associated with the main data quality dimensions of accuracy, timeliness, completeness, and consistency. No systematic or generic approach was demonstrated for detecting sensor nodes and sensor node networks failures in large-scale CPS applications. Moreover, further research is required to address the challenges of ensuring the quality of the spatial and temporal contextual attributes of sensor nodes’ observations.

Software protection aims at safeguarding assets embedded in software by preventing and delaying reverse engineering and tampering attacks. This article presents an architecture and supporting tool flow to renew parts of native applications dynamically. Renewed and diversified code and data belonging to either the original application or to linked-in protections are delivered from a secure server to a client on demand. This results in frequent changes to the software components when they are under attack, thus making attacks harder. By supporting various forms of diversification and renewability, novel protection combinations become available and existing combinations become stronger. The prototype implementation is evaluated on several industrial use cases.

Software Protection techniques aim to defend the confidentiality and integrity of software applications that are exposed to an adversary that shares the execution host and access privileges of the application. This scenario is often denoted as protection against MATE (Man-At-The-End) attacks. This is an area of growing importance for industry: in many cases the deployment of such techniques is crucial to ensure business continuity. Following the second SPRO workshop co-located with CCS-2016 in Vienna, Austria, this third edition aims to establish a tradition where academics and industrial experts in software protection can meet to confront the challenges in designing stronger protections and in developing better integration with industrial software development life cycle requirements.

Code protections aim at blocking (or at least delaying) reverse engineering and tampering attacks to critical assets within programs. Knowing the way hackers understand protected code and perform attacks is important to achieve a stronger protection of the software assets, based on realistic assumptions about the hackers' behaviour. However, building such knowledge is difficult because hackers can hardly be involved in controlled experiments and empirical studies. The FP7 European project Aspire has given the authors of this paper the unique opportunity to have access to the professional penetration testers employed by the three industrial partners. In particular, we have been able to perform a qualitative analysis of three reports of professional penetration test performed on protected industrial code. Our qualitative analysis of the reports consists of open coding, carried out by 7 annotators and resulting in 459 annotations, followed by concept extraction and model inference. We identified the main activities: understanding, building attack, choosing and customizing tools, and working around or defeating protections. We built a model of how such activities take place. We used such models to identify a set of research directions for the creation of stronger code protections.

This paper describes the ASPIRE reference architecture designed to tackle one major problem in this domain: the lack of a clear process and an open software architecture for the composition and deployment of multiple software protections on software applications.

There are many reasons to protect software: your banking app needs to be protected to prevent fraud; software operating on critical infrastructures needs to be protected against vulnerability discovery; software vendors and service companies need it to protect their business; etc. In the past decade, many techniques to protect software have been presented and broken. Beyond making individual techniques better, the challenge includes to be able to deploy them in practice and be able to evaluate them. This is the objective of SPRO, the first International Workshop on Software Protection: to bring together researchers and industrial practitioners both from software protection and the wider software engineering community to share experience and provide directions for future research, in order to stimulate the use of software engineering techniques in novel aspects of software protection. This first edition of the workshop is held at ICSE 2015 in Florence (Italy) with the aim of creating a community working in this new growing area of security, and to highlight its synergies with different research fields of software engineering, like: formal models, program analysis, reverse engineering, code transformations, empirical evaluation, and software metrics. This paper presents the research themes and challenges of the workshop, describes the workshop organization, and summarizes the research papers.

Follow the promising Web 2.0 paradigm, the telecommunications world also wants to implement the Telco 2.0 vision by inviting its users to actively participate in the creating and sharing of services accessible using handheld devices. The EU-IST research project OPUCE (Open Platform for User-Centric Service Creation and Execution) aims at providing end users with an innovative platform which allows an easy creation and delivery of personalized communication and information services. This paper introduces a novel visual semantic service browser built on top of the OPUCE service repository which enables intuitive visualized service exploring and discovery while requires no technical semantic Web knowledge from the user.

The key objective of OPUCE system is to enable the participation of end-users in the management of their own services, by providing them with innovative tools which allow an easy creation and delivery of personalized communication and information services. This paper describes the OPUCE service and component repository, which extends the OMA OSPE service model storage approach XDM. By integrating an ebXML registry using the native notification mechanisms of XDM, the search capability of the repository is dramatically improved. Moreover, this repository also exploits semantic Web technology to provide an intuitive visualized browser for convenient service exploring.

Source code obfuscation is a protection mechanism widely used to limit the possibility of malicious reverse engineering or attack activities on a software system. Although several code obfuscation techniques and tools are available, little knowledge is available about the capability of obfuscation to reduce attackers' efficiency, and the contexts in which such an efficiencymay vary.

Preserving integrity of applications being executed in remote machines is an open problem. Integrity requires that application code is not tampered with, prior to or during execution, by a rogue user or a malicious software agent. This paper presents a methodology to enforce runtime integrity of application code by means of an integrity- preserving software component that is combined with the application. The software component is a trusted logic that can be replaced continuously from a remote location during run-time. For added assurance, the software component produces continuous sequence of proofs of its proper operation that are verified remotely.

Mobile phones are being increasingly equipped with sensors that ease retrieval of context information about a user. Context data can be aggregated with information centrally available to mobile operators and service providers, to infer higher-level information such as user "situations", easier to integrate with services. We have been conducting an internal trial monitoring the context of different users in their business life and designing rules to infer high level situations: logical location, activity and social state. In this paper we present the infrastructure and the rule-based reasoning process used for this experiment.

Given a client/server application, how can the server entrust the integrity of the remote client, albeit the latter is running on an un-trusted machine? To address this research problem, we propose a novel approach based on the client-side generation of an execution signature, which is remotely checked by the server, wherein signature generation is locked to the entrusted software by means of code integrity checking. Our approach exploits the features of dynamic aspect-oriented programming (AOP) to extend the power of code integrity checkers in several ways. This paper both presents our approach and describes a prototype implementation for a messaging application.

Nowadays, the development of services that span over both the Internet and telephony networks is driving significant efforts towards the integration of services offered by IT providers with telecom operators ones. Web services have often been recommended for providing, composing and realizing telecom services but introducing them means facing up with several challenges. This work sharpens benefits and drawbacks of Web service applications within a telecom environment focusing in particular on JAIN SLEE architecture, which defines a standard environment targeted at communication-based applications

The aspect-oriented paradigm allows weaving aspects in different join points of a program. Aspects can modify object fields and method control flow, thus possibly introducing subtle and undesired interactions (conflicts) among aspects and objects, which are not easily detectable. In this paper we propose a fully automated approach to discover conflicts among classes and aspects directly from Java bytecode. The novelty of this work is the usage of a rule engine for identifying possible conflicts among advices, methods, and fields. The knowledge base is obtained through static analysis of classes and aspects bytecode. The possible conflicts are represented by means of rules that can be easily extended and customized