The 2nd International Workshop on Software Engineering Challenges for the Smart Grid focuses on understanding and identifying the unique challenges and opportunities for SE to contribute to and enhance the design and development of the smart grid. In smart grids, the geographical scale, requirements on real-time performance and reliability, and diversity of application functionality all combine to produce a unique, highly demanding problem domain for SE to address. The objective of this workshop is to bring together members of the SE community and the power engineering community to understand these requirements and determine the most appropriate SE tools, methods and techniques.

Applications that continuously gather and disclose personal information about users are increasingly common. While disclosing this information may be essential for these applications to function, it may also raise privacy concerns. Partly, this is due to frequently changing context that introduces new privacy threats, and makes it difficult to continuously satisfy privacy requirements. To address this problem, applications may need to adapt in order to manage changing privacy concerns. Thus, we propose a framework that exploits the notion of privacy awareness requirements to identify runtime privacy properties to satisfy. These properties are used to support disclosure decision making by applications. Our evaluations suggest that applications that fail to satisfy privacy awareness requirements cannot regulate users' information disclosure. We also observe that the satisfaction of privacy awareness requirements is useful to users aiming to minimise exposure to privacy threats, and to users aiming to maximise functional benefits amidst increasing threat severity.

We propose the use of forensic requirements to drive the automation of a digital forensics process. We augment traditional reactive digital forensics processes with proactive evidence collection and analysis activities, and provide immediate investigative suggestions before an investigation starts. These activities adapt depending on suspicious events, which in turn might require the collection and analysis of additional evidence. The reactive activities of a traditional digital forensics process are also adapted depending on the investigation findings.

In a dynamic environment where context changes frequently, users’ privacy requirements can also change. To satisfy such changing requirements, there is a need for continuous analysis to discover new threats and possible mitigation actions. A frequently changing context can also blur the boundary between public and personal space, making it difficult for users to discover and mitigate emerging privacy threats. This challenge necessitates some degree of self-adaptive privacy management in software applications.

Security is primarily concerned with protecting assets from harm. Identifying and evaluating assets are therefore key activities in any security engineering process - from modeling threats and attacks, discovering existing vulnerabilities, to selecting appropriate countermeasures. However, despite their crucial role, assets are often neglected during the development of secure software systems. Indeed, many systems are designed with fixed security boundaries and assumptions, without the possibility to adapt when assets change unexpectedly, new threats arise, or undiscovered vulnerabilities are revealed. To handle such changes, systems must be capable of dynamically enabling different security countermeasures. This paper promotes assets as first-class entities in engineering secure software systems. An asset model is related to requirements, expressed through a goal model, and the objectives of an attacker, expressed through a threat model. These models are then used as input to build a causal network to analyze system security in different situations, and to enable, when necessary, a set of countermeasures to mitigate security threats. The causal network is conceived as a runtime entity that tracks relevant changes that may arise at runtime, and enables a new set of countermeasures. We illustrate and evaluate our proposed approach by applying it to a substantive example concerned with security of mobile phones.

This paper presents SecuriTAS, a tool to engineer adaptive security. It allows software designers to model security concerns together with the requirements of a system. This model is then used at runtime to analyze changes in security concerns and select the best set of security controls necessary to protect the system.

Access control systems are deployed in organizations to protect critical cyber-physical assets. These systems need to be adjustable to cope with different contextual factors like changes in resources or requirements. Still, adaptation is often performed manually. In addition, different product variants of access control systems need to developed together systematically. These characteristics demand a product line engineering approach for enhanced reuse. Moreover, to cope with uncertainty at runtime, adaptivity, i.e., switching between variations in a cyber-physical domain (reconfiguration) and adjusting access policies (behavior adaptation), needs to be supported.

SUMMARY Self‐adaptive software is a closed‐loop system, since it continuously monitors its context (i.e. environment) and/or self (i.e. software entities) in order to adapt itself properly to changes. We believe that representing adaptation goals explicitly and tracing them at run‐time are helpful in decision making for adaptation. While goal‐driven models are used in requirements engineering, they have not been utilized systematically yet for run‐time adaptation. To address this research gap, this article focuses on the deciding process in self‐adaptive software, and proposes the Goal‐Action‐Attribute Model (GAAM). An action selection mechanism, based on cooperative decision making, is also proposed that uses GAAM to select the appropriate adaptation action(s). The emphasis is on building a light‐weight and scalable run‐time model which needs less design and tuning effort comparing with a typical rule‐based approach. The GAAM and action selection mechanism are evaluated using a set of experiments on a simulated multi‐tier enterprise application, and two sample ordinal and cardinal action preference lists. The evaluation is accomplished based on a systematic design of experiment and a detailed statistical analysis in order to investigate several research questions. The findings are promising, considering the obtained results, and other impacts of the approach on engineering self‐adaptive software. Although, one case study is not enough to generalize the findings, and the proposed mechanism does not always outperform a typical rule‐based approach, less effort, scalability, and flexibility of GAAM are remarkable. Copyright © 2011 John Wiley & Sons, Ltd.

Adaptation requires a system to monitor its operational context to ensure that when changes occur, a suitable adaptation action is planned and taken at runtime. The ultimate goal of adaptation is that users get their dynamic requirements met efficiently and correctly. Context changes and users' judgment of the role of the system in meeting their requirements are drivers for adaptation. In many cases, these drivers are hard to identify by designers at design time and hard to monitor by the use of exclusively technological means by the system at runtime. In this paper, we propose Social Sensing as the activity performed by users who act as monitors and provide information needed for adaptation at runtime. Such information helps the system cope with technology limitations and designers' uncertainty. We discuss the motivation and foundations of Social Sensing and outline a set of research challenges to address in future work.

Predicting changes in software entities (e.g. source files) that are more likely to change can help in the efficient allocation of the project resources. A powerful change prediction tool can improve maintenance and evolution tasks in software projects in terms of cost and time factors. The vast majority of research works have focused on determining "where" the most change-prone entities are, and "how" the change will be propagated through a system. This article suggests that knowing "when" changes are likely to happen can also provide another consideration for managers and developers to plan their maintenance activities more efficiently. To address this issue, a Neural Network-based Temporal Change Prediction (NNTCP) framework is proposed. This novel framework indicates "where" the changes are likely to happen (i.e. hot spots), and then adds the time dimension to predict "when" it may occur. In proving this concept, the NNTCP framework is applied in two large-scale open source software projects, Mozilla and Eclipse. The results obtained indicate NNTCP can predict the occurrence of several future revisions with reasonable performance.

Software systems dealing with distributed applications in changing environments normally require human supervision to continue operation in all conditions. These (re-)configuring, troubleshooting, and in general maintenance tasks lead to costly and time-consuming procedures during the operating phase. These problems are primarily due to the open-loop structure often followed in software development. Therefore, there is a high demand for management complexity reduction, management automation, robustness, and achieving all of the desired quality requirements within a reasonable cost and time range during operation. Self-adaptive software is a response to these demands; it is a closed-loop system with a feedback loop aiming to adjust itself to changes during its operation. These changes may stem from the software system'sself(internal causes, e.g., failure) orcontext(external events, e.g., increasing requests from users). Such a system is required tomonitoritself and its context,detectsignificant changes,decidehow to react, andactto execute such decisions. These processes depend on adaptation properties (called self-* properties), domain characteristics (context information or models), and preferences of stakeholders. Noting these requirements, it is widely believed that new models and frameworks are needed to design self-adaptive software. This survey article presents a taxonomy, based on concerns of adaptation, that is,how,what,whenandwhere, towards providing a unified view of this emerging area. Moreover, as adaptive systems are encountered in many disciplines, it is imperative to learn from the theories and models developed in these other areas. This survey article presents a landscape of research in self-adaptive software by highlighting relevant disciplines and some prominent research projects. This landscape helps to identify the underlying research gaps and elaborates on the corresponding challenges.

One of the important activities in re-engineering process is detecting design flaws. Such design flaws prevent an efficient maintenance, and further development of a system. This research proposes a novel metric-based heuristic framework to detect and locate object-oriented design flaws from the source code. It is accomplished by evaluating design quality of an object-oriented system through quantifying deviations from good design heuristics and principles. While design flaws can occur at any level, the proposed approach assesses the design quality of internal and external structure of a system at the class level which is the most fundamental level of a system. In a nutshell, design flaws are detected and located systematically in two phases using a generic OO design knowledge-base. In the first phase, hotspots are detected by primitive classifiers via measuring metrics indicating a design feature (e.g. complexity). In the second phase, individual design flaws will be detected by composite classifiers using a proper set of metrics. We have chosen JBoss Application Server as the case study, due to its pure OO large size structure, and its success as an open source J2EE platform among developers.