Abstract Infrastructure as Code (IaC) uses versionable software code to define, deploy, and configure physical computational resources, software execution platforms, and applications. As a result, IaC enables the scalable management of complex computing environments while preventing environment drift. IaC frameworks typically offer specific languages such as the industrial Terraform, Ansible, Chef, or TOSCA—standing for Topology and Orchestration Specification for Cloud Applications—the OASIS (Organization for the Advancement of Structured Information Standards) open standard approach to IaC. Developing high-quality IaC for deploying and managing applications demands expertise and knowledge in specific IaC languages, infrastructure resources, resource providers, quality issues in IaC scripts, and so on. While several model-driven engineering (MDE) approaches have been proposed to simplify IaC development, they cannot capture and use expert knowledge to assist with modeling tasks and MDE processes by providing interactive recommendations. This paper presents a knowledge-based framework for guiding the model-driven development of IaC. We use TOSCA as the target IaC language as it is an open standard. We enable IaC and resource experts to share their IaC and resource-related knowledge with application operational experts to help simplify the development of application deployment models. We use an ontology to record the relevant deployment knowledge and ontology reasoning to implement modeling guidance capabilities such as TOSCA model auto-completion, code smell and error detection, and model element matchmaking. We show the flexibility of our methodology by applying it to three industrial applications, covering cloud, edge, and HPC (High-Performance Computing) domains. Moreover, we also assess the use acceptance of our approach and framework by conducting controlled experiments with expert and non-expert IaC users. The results indicate that our method can simplify IaC development by providing appropriate recommendations.

Cryptographic ransomware remains one of the most damaging cyber threats. While research on ransomware has advanced, detailed knowledge of encryption tactics and their implications for digital forensics remains fragmented. As a result, the practical applicability of existing methods is limited. This work addresses these gaps through an empirical investigation of prevalent ransomware encryption techniques and their impact on forensic evidence availability. The investigation of prevalent ransomware encryption was performed using a systematic literature review, mapping ransomware encryption configurations and anti-forensic strategies. Realistic experimental scenarios were subsequently created by simulating Operating System (OS)- and hypervisor-level disk encryption. This was followed by artifact carving and parsing to evaluate evidence availability. The results of the literature review provide an overview of contemporary ransomware encryption practices. The overview reveals clear distinctions between OS and hypervisor encryption in terms of complexity, configurations, and forensic impact. Empirical testing also shows that OS encryption typically leaves most artifacts intact except where targeted anti-forensics are applied. Hypervisor encryption, conversely, significantly reduces access to critical sources such as Windows event logs. The findings of this research enhance the field of digital forensics by providing an overview of ransomware encryption practices and revealing their differing impacts on forensic evidence availability.

A data catalog enables an organization to maintain an inventory of its data assets by collecting and managing the relevant metadata. We conducted a systematic multi-vocal literature review on data catalogs to understand their features and usage. We systematically selected and analyzed 86 literature sources and 39 catalog tools. We first utilized the findings from the literature to develop a classification framework comprising 24 fine-grained and five high-level features, along with three maturity levels. Next, we analyzed 39 tools based on the classification framework. Organizations typically include a data catalog as a component in their big data platforms and use it to support the various phases of the metadata management lifecycle. Hence, we also mapped the catalog features to the requirements of metadata-driven big data architectures, namely data mesh, data lake, and data lakehouse. Moreover, the mappings of the features to the phases in a metadata management lifecycle were developed. Our findings shall aid organizations in making informed decisions when choosing data catalog tools and help researchers identify the critical research issues in data cataloging and metadata management. Editor’s note: Open Science material was validated by the Journal of Systems and Software Open Science Board .

Data quality is critical to make data-driven business decisions reliable, accurate, and complete. As a result, data quality assessment has become a prevalent topic among researchers and practitioners. Previous studies have surveyed data quality tools and used them in industrial projects. However, the practitioners’ adoption of data quality tools is mainly unexplored. In this study, we systematically selected the five widely used tools and analyzed 498 GitHub repositories that use those tools. Our findings show that practitioners increasingly use data quality tools to assess and improve the quality of their data. The most common use case is software development (49.2%), followed by learning (25.5%), teaching (9.2%), and research (0.4%). However, most repositories (69%) showed less activities and collaboration. The development projects, especially with industry-based owners, were the most active. The predominant use of the data quality tools was to assess the completeness of the data, followed by uniqueness, validity, and referential integrity.

Data mesh is an emerging decentralized approach to managing and generating value from analytical enterprise data at scale. It shifts the ownership of the data to the business domains closest to the data, promotes sharing and managing data as autonomous products, and uses a federated and automated data governance model. The data mesh relies on a managed data platform that offers services to domain and governance teams to build, share, and manage data products efficiently. However, designing and implementing a self-serve data platform is challenging, and the platform engineers and architects must understand and choose the appropriate design options to ensure the platform will enhance the experience of domain and governance teams. For these reasons, this paper proposes a catalog of architectural design decisions and their corresponding decision options by systematically reviewing 43 industrial gray literature articles on self-serve data platforms in data mesh. Moreover, we used semi-structured interviews with six data engineering experts with data mesh experience to validate, refine, and extend the findings from the literature. Such a catalog of design decisions and options drawn from the state of practice shall aid practitioners in building data meshes while providing a baseline for further research on data mesh architectures.

The increasing heterogeneity of the VM offerings on public IaaS clouds gives rise to a very large number ofdeployment optionsfor constructing distributed, multi-component cloud applications. However, selecting an appropriatedeployment variant, i.e., a valid combination of deployment options, to meet required performance levels is non-trivial. The combinatorial explosion of thedeployment spacemakes it infeasible to measure the performance of all deployment variants to build a comprehensive empirical performance model. To address this problem, we proposeFeature-Oriented Cloud(FOCloud), a performance engineering approach for deployment configurable cloud applications. FOCloud (i) uses feature modeling to structure and constrain the valid deployment space by modeling the commonalities and variations in the different deployment options and their inter-dependencies, (ii) uses sampling and machine learning to incrementally and cost-effectively build a performance prediction model whose input variables are the deployment options, and the output variable is the performance of the resulting deployment variant, and (iii) uses Explainable AI techniques to provide explanations for the prediction outcomes of valid deployment variants in terms of the deployment options. We demonstrate the practicality and feasibility of FOCloud by applying it to an extension of the RuBiS benchmark application deployed on Google Cloud.

J1C2 Presentation Abstract at IEEE SERVICES 2022 for IEEE Transactions on Services Computing DOI 10.1109/TSC.2022.3142853

Linguistic anti-patterns are recurring poor practices concerning inconsistencies in the naming, documentation, and implementation of an entity. They impede the readability, understandability, and maintainability of source code. This paper attempts to detect linguistic anti-patterns in Infrastructure-as-Code (IaC) scripts used to provision and manage computing environments. In particular, we consider inconsistencies between the logic/body of IaC code units and their short text names. To this end, we propose FindICI a novel automated approach that employs word embedding and classification algorithms. We build and use the abstract syntax tree of IaC code units to create code embeddings used by machine learning techniques to detect inconsistent IaC code units. We evaluated our approach with two experiments on Ansible tasks systematically extracted from open source repositories for various word embedding models and classification algorithms. Classical machine learning models and novel deep learning models with different word embedding methods showed comparable and satisfactory results in detecting inconsistent Ansible tasks related to the top-10 used Ansible modules.

We propose enabling continuous performance optimisation of distributed hybrid applications in heterogeneous cloud, Edge, and HPC environments by employing an intelligent re-deployment feedback loop.

Abstract IoT-based applications need to be dynamically orchestrated on cloud-edge infrastructures for reasons such as performance, regulations, or cost. In this context, a crucial problem is facilitating the work of DevOps teams in deploying, monitoring, and managing such applications by providing necessary tools and platforms. The SODALITE@RT open-source framework aims at addressing this scenario. In this paper, we present the main features of the SODALITE@RT: modeling of cloud-edge resources and applications using open standards and infrastructural code, and automated deployment, monitoring, and management of the applications in the target infrastructures based on such models. The capabilities of the SODALITE@RT are demonstrated through a relevant case study.

Infrastructure-as-code (IaC) is the DevOps tactic of managing and provisioning software infrastructures through machine-readable definition files, rather than manual hardware configuration or interactive configuration tools. From a maintenance and evolution perspective, the topic has picked the interest of practitioners and academics alike, given the relative scarcity of supporting patterns and practices in the academic literature. At the same time, a considerable amount of gray literature exists on IaC. Thus we aim to characterize IaC and compile a catalog of best and bad practices for widely used IaC languages, all using gray literature materials. In this paper, we systematically analyze the industrial gray literature on IaC, such as blog posts, tutorials, white papers using qualitative analysis techniques. We proposed a definition for IaC and distilled a broad catalog summarized in a taxonomy consisting of 10 and 4 primary categories for best practices and bad practices, respectively, both language-agnostic and language-specific ones, for three IaC languages, namely Ansible, Puppet, and Chef. The practices reflect implementation issues, design issues, and the violation of/adherence to the essential principles of IaC. Our findings reveal critical insights concerning the top languages as well as the best practices adopted by practitioners to address (some of) those challenges. We evidence that the field of development and maintenance IaC is in its infancy and deserves further attention.

Summary With the single‐instance multitenancy (SIMT) model for composite Software‐as‐a‐Service (SaaS) applications, a single composite application instance can host multiple tenants, yielding the benefits of better service and resource utilization and reduced operational cost for the SaaS provider. An SIMT application needs to share services and their aggregation (the application) among its tenants while supporting variations in the functional and performance requirements of the tenants. The SaaS provider requires a middleware environment that can deploy, enact, and manage a designed SIMT application, to achieve the varied requirements of the different tenants in a controlled manner. This paper presents the SDSN@RT (software‐defined service networks at runtime) middleware environment that can meet the aforementioned requirements. SDSN@RT represents an SIMT composite cloud application as a multitenant service network, where the same service network simultaneously hosts a set of virtual service networks, one for each tenant. A service network connects a set of services and coordinates the interactions between them. A virtual service network realizes the requirements for a specific tenant and can be deployed, configured, and logically isolated in the service network at runtime. SDSN@RT also supports the monitoring and runtime changes of the deployed multitenant service networks. We show the feasibility of SDSN@RT with a prototype implementation and demonstrate its capabilities to host SIMT applications and support their changes with a case study. The performance study of the prototype implementation shows that the runtime capabilities of our middleware incur little overhead.

A composite cloud application can achieve economies of scale by sharing partner services between tenants at runtime, following the Single-Instance Multi-Tenancy (SIMT) model. However, supporting runtime sharing with tenant-specific functional and performance variations in an SIMT application is challenging. We address this challenge by proposing the Software-Defined Service Networking (SDSN) approach. SDSN realizes an SIMT composite cloud application with a managed service network and a set of managed virtual service networks (VSNs) that share the service network. The service network is formed by connecting a set of partner services according to their capabilities and interoperability. To achieve the functional and performance requirements of a particular tenant, a VSN composes a subset of the services under a specific configuration design over the service network, and regulates the interactions between the services concerned according to a specific regulation design. We describe how a service network and its VSNs are designed and enacted to achieve the SIMT objectives. We show the feasibility of SDSN, demonstrate the utilization benefits it achieves, and quantify the runtime overhead it incurs.

Cloud computing, as a concept, promises cost savings to end-users by letting them outsource their non-critical business functions to a third party in pay-as-you-go style. However, to enable economic pay-as-you-go services, we need Cloud middleware that maximizes sharing and support near zero costs for unused applications. Multi-tenancy, which let multiple tenants (user) to share a single application instance securely, is a key enabler for building such a middleware. On the other hand, Business processes capture Business logic of organizations in an abstract and reusable manner, and hence play a key role in most organizations. This paper presents the design and architecture of a Multi-tenant Workflow engine while discussing in detail potential use cases of such architecture. Primary contributions of this paper are motivating workflow multi-tenancy, and the design and implementation of multi-tenant workflow engine that enables multiple tenants to run their workflows securely within the same workflow engine instance without modifications to the workflows.