Search

We implemented and evaluated an automated cyber defense agent. The agent takes security alerts as input and uses reinforcement learning to learn a policy for executing predefined defensive measures. The defender policies were trained in an environment intended to simulate a cyber attack. In the simulation, an attacking agent attempts to capture targets in the environment, while the defender attempts to protect them by enabling defenses. The environment was modeled using attack graphs based on the Meta Attack Language language. We assumed that defensive measures have downtime costs, meaning that the defender agent was penalized for using them. We also assumed that the environment was equipped with an imperfect intrusion detection system that occasionally produces erroneous alerts based on the environment state. To evaluate the setup, we trained the defensive agent with different volumes of intrusion detection system noise. We also trained agents with different attacker strategies and graph sizes. In experiments, the defensive agent using policies trained with reinforcement learning outperformed agents using heuristic policies. Experiments also demonstrated that the policies could generalize across different attacker strategies. However, the performance of the learned policies decreased as the attack graphs increased in size., Comment: Presented at the Workshop on SOC Operations and Construction (WOSOC) 2023, colocated with NDSS 2023

The universal Turing machine is generally considered to be the simplest, most abstract model of a computer. This paper reports on the discovery of an accidental arbitrary code execution vulnerability in Marvin Minsky's 1967 implementation of the universal Turing machine. By submitting crafted data, the machine may be coerced into executing user-provided code. The article presents the discovered vulnerability in detail and discusses its potential implications. To the best of our knowledge, an arbitrary code execution vulnerability has not previously been reported for such a simple system.

Plagiarism in hands-on ethical hacking education is challeng-ing due to student work being delivered almost exclusively virtually viaactions on a cyber range. We are developing the Cheat Detection Sys-tem, a solution that uses system administration and two approaches oflog analysis to infer about the cheating behavior of students; one basedon canary detection and another based on traces of student actions whichwe have termed the intrusion deficit approach. QC 20201124

Background: Philosophers of science including Collins, Feyerabend, Kuhn and Latour have all emphasized the importance of consensus within scientific communities of practice. Consensus is important for maintaining legitimacy with outsiders, orchestrating future research, developing educational curricula and agreeing industry standards. Low consensus contrastingly undermines a field's reputation and hinders peer review. Aim: This paper aims to investigate the degree of consensus within the software engineering academic community concerning members' implicit theories of software engineering. Method: A convenience sample of 60 software engineering researchers produced diagrams describing their personal understanding of causal relationships between core software engineering constructs. The diagrams were then analyzed for patterns and clusters. Results: At least three schools of thought may be forming; however, their interpretation is unclear since they do not correspond to known divisions within the community (e.g. Agile vs. Plan-Driven methods). Furthermore, over one third of participants do not belong to any cluster. Conclusion: Although low consensus is common in social sciences, the rapid pace of innovation observed in software engineering suggests that high consensus is achievable given renewed commitment to empiricism and evidence-based practice., Comment: 10 pages, 6 Figures, 6 Tables

QC 20150618

Today’s global markets drive enterprises towards closer collaboration with customers, suppliers and partners. Interoperability problems constitute fundamental barriers to such collaboration. A characteristic of modern economic life is the requirement on continuous and rapid change and innovation. The success of an enterprise more and more depends on its ability to seamlessly interoperate with other agile enterprises, and to be able to adapt to actual or imminent changes. Flexible and adaptive interoperability of enterprises, with aligned business processes and information technology, thus emerges as a key business feature. This new enterprise reality calls for advanced technological support, preferably in harmony with technology developments of the Internet, which is our dominant universal communication and information infrastructure. The current special issue aims at contributing to a consolidation of the theoretical and empirical knowledge on enterprise interoperability, and at promoting novel ideas and early experience regarding the use and realization of the Future Internet vision to advance Enterprise Interoperability.

In existing business model frameworks little attention is paid to a thorough understanding of the perceived customer value of a business’ offering as compared to competing offers. In this paper, we propose to use utility theory in combination with e3value models to address this issue. An actor's joint utility function specifies how much value the actor attaches to a given product or service's different qualities. Competing value offerings map to different points on the customer utility function, since they provide certain quantities of each quality. Since the customer can be expected to exhibit a utility maximizing behavior, his/her choices between offerings can be predicted. Thus, given the proposed utility extension, it becomes possible to quantitatively reason about the relative customer value of an offering compared to those of the competition. This, in turn, allows the optimization of price, the key ingredient in any business model.

This is the report on the ‘Workshop on Selected applications and methods for Enterprise Interoperability, which has been organized in conjunction with the IWEI Conference 2013 (Enschede, the Netherlands). This workshop has taken place on 26 March 2013 and was attended by around 15 people.

The business of contemporary organizations is heavily dependent on information systems. Business processes and IT are interwoven and numerous technologies are in use. How the involved systems affect each other or impact the organizations' business domain is often uncertain, thus decision-making regarding information technology is challenging. Enterprise architecture (EA) is a holistic, model-based management approach. Many of the available EA software tools focus on documenting and have limited analysis capabilities. In this article, a tool for EA analysis is presented, supporting the analysis of properties such as business fit, security, and interoperability. The tool is implemented to support the Predictive, Probabilistic Architecture Modeling Framework to specify and apply assessment frameworks for performing property analysis on EA models. QC 20131101

QC 20220909

In the design phase of business collaboration, it is desirable to be able to predict the profitability of the business-to-be. Therefore, techniques to assess qualities such as costs, revenues, risks, and profitability have been previously proposed. However, they do not allow the modeler to properly manage uncertainty with respect to the design of the considered business collaboration. In many real collaboration projects today, uncertainty regarding the business’ present or future characteristics is so significant that ignoring it becomes problematic. In this paper, we propose an approach based on the Predictive, Probabilistic Architecture Modeling Framework (P2AMF), capable of advanced and probabilistically sound reasoning about profitability risks. The P2AMF-based approach for profitability risk prediction is also based on the e3-value modeling language and on the Object Constraint Language (OCL). The paper introduces the prediction and modeling approach, and a supporting software tool. The use of the approach is illustrated by means of a case.

This year’s IWEI – IWEI 2012 – was held during September 6–7, 2012, in Harbin, China, following previous events in Stockholm, Sweden (2011), Valencia, Spain (2009), and Munich, Germany (2008). The theme of IWEI 2012 was “Collaboration, Interoperability and Services for Networked Enterprises,‿ thus especially soliciting submissions and discussions related to the three previously mentioned interrelated areas for enterprise interoperability. IWEI 2012 was organized by the IFIP Working Group 5.8 on Enterprise Interoperability in co-operation with InterOP-VLab. The objective of IFIP WG5.8 is to advance and disseminate research and development results in the area of enterprise interoperability. IWEI provides an excellent platform to discuss the ideas that have emerged from IFIP WG5.8 meetings, or, reversely, to transfer issues identified at the workshop to the IFIP community for further contemplation and investigation. The proceedings of IWEI 2012 are contained in this volume. In total 14 full papers and three short papers were selected for oral presentation and publication. The selection was based on a thorough review process, in which each paper was reviewed by at least three experts in the field. The papers are representative of the current research activities in the area of enterprise interoperability. The papers cover a wide spectrum of enterprise interoperability issues, ranging from foundational theories, frameworks, architectures, methods and guidelines to applications and case studies. The proceedings also include the abstracts of the invited talks of our two renowned keynote speakers: Sergio Gusmeroli (Director of TXT Labs Corporate Research Unit) and Lei Qin (Executive of Cloud Labs and Smarter Commerce Service Delivery, IBM China Development Laboratory).

One of the key aspects of the Future Internet is the Internet of Services, where companies are envisioned to sell and purchase services online in a dynamic fashion. A typical future scenario would be that companies form so-called ad-hoc business networks on the Future Internet to be able to collaborate together with a common goal of gaining value as a group. However, in order for these ad-hoc business networks to communicate and exchange services with each other they must be interoperable. This paper proposes architecture modeling and interoperability analysis as support functions in the ad-hoc business networks service life cycle.

This book contains the short papers of the Third International IFIP Working Conference on Enterprise Interoperability, IWEI 2011, held March 22-23, 2011, in Stockholm, Sweden, and the papers of the co-located IWEI Workshops, held on March 21, 2011. The IWEI Working Conference highlighted developments in the following areas: scientific foundations for specifying, analyzing and validating interoperability solutions; architectural frameworks for addressing interoperability challenges from different viewpoints and at different levels of abstraction; maturity models to evaluate and rank interoperability solutions with respect to distinguished quality criteria; and working sets of practical solutions and tools that can be applied to interoperability problems to date. The IWEI Workshops complemented the topics of the IWEI Working Conference and explored new issues and solutions in enterprise interoperability. This was done in four separate workshops: (1) Enterprise 2.0 – Using Internet 2.0 Technologies in Enterprise Management; (2) Semantic Interoperability in the Scope of Future Energy Smart Grids; (3) Advanced Results in MDI/SOA Innovation; and (4) Standards Ensuring Enterprise Interoperability and Collaboration – State of the Art and Perspectives. More than the Working Conference, the Workshops offered opportunities to discuss issues raised during the paper presentations and to brainstorm about possible solution directions.

This book contains the short papers of the Third International IFIP Working Conference on Enterprise Interoperability, IWEI 2011, held March 22-23, 2011, in Stockholm, Sweden, and the papers of the co-located IWEI Workshops, held on March 21, 2011. The IWEI Working Conference highlighted developments in the following areas: scientific foundations for specifying, analyzing and validating interoperability solutions; architectural frameworks for addressing interoperability challenges from different viewpoints and at different levels of abstraction; maturity models to evaluate and rank interoperability solutions with respect to distinguished quality criteria; and working sets of practical solutions and tools that can be applied to interoperability problems to date. The IWEI Workshops complemented the topics of the IWEI Working Conference and explored new issues and solutions in enterprise interoperability. This was done in four separate workshops: (1) Enterprise 2.0 – Using Internet 2.0 Technologies in Enterprise Management; (2) Semantic Interoperability in the Scope of Future Energy Smart Grids; (3) Advanced Results in MDI/SOA Innovation; and (4) Standards Ensuring Enterprise Interoperability and Collaboration – State of the Art and Perspectives. More than the Working Conference, the Workshops offered opportunities to discuss issues raised during the paper presentations and to brainstorm about possible solution directions.

This volume contains the proceedings of the Third International IFIP Working Conference on Enterprise Interoperability, IWEI 2011. Out of 47 submitted full papers, 15 papers were selected for oral presentation and publication (31.91% acceptance rate). In addition, five short papers were selected for oral presentation and publication in a companion book. The selection was based on a thorough reviewing process, in which each paper was scrutinized by at least three experts in the field. The papers are representative of the current research activities in the area of enterprise interoperability. The papers cover a wide spectrum of enterprise interoperability issues, ranging from foundational theories, frameworks, architectures, methods and guidelines to applications and case studies. The proceedings also include the abstracts of the invited talks at IWEI 2011, given by two renowned keynote speakers: Andreas Friesen (Research Program Manager of Service Science, SAP) and Gérald Santucci (Head of the Unit on Networked Enterprise & Radio Frequency Identification, INFSO DG, EC).

Pragmatic interoperability (PI) is the compatibility between the intended versus the actual effect of message exchange. This paper advances PI as a new research agenda within the gamut of enterprise interoperability research. PI is timely in today's new enterprises as it is increasingly important that organizations are able to collectively add value to their products and services through effective collaboration. When enterprise systems exchange information, PI goes beyond the compatibility between the structure and the meaning of shared information. It also considers the use of information in a given context as an equally important aspect. As PI is a relatively new domain, this paper attempts to elucidate its notion by identifying and relating its key concepts from proposed definitions, and by reviewing extant approaches to identify critical knowledge gaps in PI research.

Service-Oriented Architecture (SOA) has emerged as an architectural style to foster enterprise interoperability, as it claims to facilitate the flexible composition of loosely coupled enterprise applications and thus alleviates the heterogeneity problem among enterprises. Meanwhile, Model-Driven Architecture (MDA) aims at facilitating the development of distributed application functionality, independent from its implementation using a specific technology platform and thus contributes to deployment in different platforms. In this paper we propose an MDA-based transformation technique for service composition. The contribution of the paper is two-fold. First, our approach shows how enterprise interoperability is supported by service composition at two different technical levels, namely at choreography and orchestration level. Second, the approach contributes to the management of changes that affect enterprise interoperability, by defning a (semi-)automated transformation from choreography to orchestrations in which the interoperability constraints specified at the choreography level are preserved.

Compliance audits and IT process evaluations are time-demanding to conduct and methods to simplify and support such evaluations are valuable. This article proposes a set of indicators that can be used to predict similarities in IT process maturity and thereby be used to optimize resource allocations when conducting process maturity evaluations and compliance audits. The indicators have been identified from the COBIT framework and tested against process maturity data from 35 European organizations. Four out of six proposed indicators were supported in the statistical analysis. These indicators can be used as an instrument in COBIT-based maturity evaluations and compliance audits to make the assessment process more resource-efficient. QC 20120321

One of the trends in the global market is the increasing collaboration among enterprises. Constant changes in inter- and intra-organizational environment will persist in the future. Organizations have to flexibly and continuously react to (imminent) changes in markets and trading partners. Large companies but also SMEs have to cope with internal changes from both a technical (e.g. new information, communication, software and hardware technologies) and an organizational point of view (e.g. merging, re-organization, virtual organizations, etc.). In this context, the competitiveness of an enterprise depends not only on its internal performance to produce products and services but also on its ability to seamlessly interoperate with other enterprises. External and internal collaborative work needs more interoperable solutions. The International Workshop on Enterprise Interoperability, IWEI, aims at identifying and discussing challenges and solutions with respect to enterprise interoperability, both at the business and the technical level. The workshop promotes the development of a scientific foundation for specifying, analyzing and validating interoperability solutions; an architectural framework for addressing interoperability problems from different viewpoints and at different levels of abstraction; a maturity model to evaluate and rank interoperability solutions with respect to distinguished quality criteria; and a working set of practical solutions and tools that can be applied to interoperability problems to date. IWEI organized by the IFIP Working Group 5.2 on Enterprise Interoperability. The aim of IFIP WG5.2 is to progress and disseminate research and development results in the area of enterprise interoperability. The IWEI workshop is therefore also a platform where ideas emerged from IFIP WG5.2 meetings can be discussed, or reversely, where issues raised at the workshop can be taken to the IFIP community for further contemplation and investigation. This volume contains the proceedings of the first edition of the workshop, IWEI 2008, held on September 18, 2008, in Munich, Germany, in conjunction with the 12th IEEE International EDOC Conference – The Enterprise Computing Conference (EDOC 2008). Nine papers were selected for oral presentation and publication, based on a thorough review process, in which each paper was reviewed by several experts in the field. The papers are representative for the current research activities in the area of enterprise interoperability. For convenience, the papers were grouped in 4 sessions, reflecting some of the major topics related to enterprise interoperability, namely Session 1 - Ontologies and the semantic web; Session 2 - Service-orientation; Session 3 - Inter-organizational interoperability; and Session 4 - Maturity models.

Making major changes in enterprise information systems, such as large IT-investments, often have a significant impact on business operations. Moreover, when deliberating which IT-changes to make, the consequences of choosing a certain scenario may be difficult to grasp. One way to ascertain the quality of IT-investment decisions is through the use of methods from decision theory. This paper proposes the use of one such method to facilitate IT-investment decision making, viz. extended influence diagrams. An extended influence diagram is a tool able to completely desccribe and analyse a decision situation. The applicability of extended influence diagrams is demonstrated at the end of the paper by using an extended influence diagram in combination with the ISO/IEC 9126 software quality metrics as means to assist a decision maker in a decision regarding an IT-investment. QC 20120613

One important aspect of the quality of programming languages is the effort required by a programmer to understand code written in the language. A historical case where this issue was at the forefront was in the debate between the proponents of high-level languages (HLL) and Assembly languages, where the main argument for HLLs were that they were easier for people to understand. Being one out of a series of articles arguing for a unified theory for software engineering, this article proposes the use of a specific theoretical model from the discipline of cognitive psychology as a tool for predicting language comprehension effort. Describing human problem solving faculties, the ACT-R model [Anderson and Lebiere 1998] predicts that the effort of understanding a program written in C is only 36,5% of the effort of understanding a comparable program written in Assembly. In order to validate the theory, an experiment was performed where a number of engineering students were exposed to tasks of program comprehension. This empirical assessment demonstrated that the effort of understanding a program written in C is 32,5% of the effort of understanding a comparable program written in Assembly. Comparing the results of the theoretical predictions and the empirical assessments of program comprehension effort, we find that the theoretical model performs surprisingly well. The prediction error for the execution of an Assembly program was 5,1% while the error for C was 6,8%. The prediction error for the ratio between the two program languages amounted to 12,6%. QC 20130618

A company?s Chief Information Officer (CIO) is responsible for the management and evolution of the enterprise information system. An approach suggested as an aid for the CIO?s decision-making process is Enterprise Architecture, based on architectural models of both the enterprise information system and its context. For architectural models to function as decision-making support, this paper argues that they must be amenable to architectural analysis. The purpose of this paper is to demonstrate the importance of architectural theory in the analysis of architectural models of the enterprise information system. Architectural theory diagrams are proposed as means for presenting and comparing architectural theories as well as for assessing the analytical value of architectural models. QC 20120327

QC 20100621

Information technology (IT) pervades organizations more and more and becomes increasingly important for their business models. It has evolved from a purely supportive role to an important strategic pillar in many organizations. Even more, it is important that IT is aligned to the needs of the organization. Approaches that realize this are often subsumed under the term ``business-IT-alignment''. One instrument for achieving business-IT-alignment is Enterprise Architecture (EA). EAs provide a holistic perspective on the structure of the organization and provide a set of techniques to guide and steer the evolution of the organization to a desired goal state. A key artifact of EA is the EA model. It abstracts the elements and their relationships to an understandable and manageable measure. Usually enterprise architects model business processes, applications, hardware components, data models and customer relationships. Based on the information stored in the EA model, the organization's management makes important decisions regarding future focus. Contrary, also on the operational level, the model can provide important information, for example which application is used in which business environment and exchanges data with other applications. In order to be able to derive meaningful decisions from the EA model, their quality is of crucial importance. Therefore, this work is elaborates on developing different processes and techniques that ensure the quality of the EA model. First, we present a process to ensure the quality of the EA model, where model maintenance is understood as a continuous evolution. For this purpose, we define different steps, which have to be considered in such a process. This process will serve as foundation for a continuous delivery pipeline that will help automate as many of these steps as possible. Next, we present an approach that allows storing contrary information in EA models. In addition to the aforementioned processes, we developed also several techniques to improve the quality of EA models. However, for improvement, we need a method to evaluate the quality, which we also introduce within this work. Subsequently, we facilitate machine-learning techniques to support the modeler reuse existing elements of the model. In addition, we compare the performance of different algorithms to determine the best on in a certain situation. Additionally, we present a method to identify unnecessary elements in the model.

This thesis presents a development method that supports enterprise architects in systematically designing an organization-specific enterprise architecture (EA) management function. The development method builds on a method base, consisting of interrelated method building blocks (MBB) extracted from practice-proven approaches. The development method guides an organization in incrementally designing an EA management function by completing the activities with algorithmically identified MBBs suitable for the given organizational context and the specific problem. The development method employs a catalog of organizational context descriptions relevant for the design of the EA management function, supplies techniques to ensure operational implementability, and provides guidelines for adapting existing EA management functions in response to changing organizational contexts and problems. Im Rahmen dieser Arbeit wird eine Entwurfsmethode vorgestellt, welche Unternehmensarchitekten bei der systematischen Entwicklung einer problemadäquaten und organisationsspezifischen Enterprise Architecture Management (EAM) Funktion unterstützt. Die inkrementelle Ausgestaltung der EAM Funktion erfolgt dabei anhand eines Aktivitätsmodells und unter Verwendung einer Methodenbibliothek. Die Methodenbibliothek führt praxiserprobte Lösungen in Form von Methodenbausteinen in einem Theorieverbund zusammen. Durch eine geeignete Organisation der Methodenbausteine in der Methodenbibliothek wird im Rahmen der Entwurfsmethode die Auswahl der passenden Methodenbausteine für ein Unternehmen identifiziert. Hierzu stellt die Entwurfsmethode einen Katalog von Kontextbeschreibungen zur Klassifikation des Unternehmens sowie Techniken zur Konfiguration, Adaption und Integration der Methodenbausteine zu einer umsetzbaren EAM Funktion bereit.

The value returned by Enterprise Architecture (EA) is being viewed with increasing consideration by researchers and practitioners. They struggle to justify the EA investments made. Quantifying the Enterprise Architecture benefits has always been a challenge because measurements and real value delivered can not often be expressed in simple technical oriented metrics only.In this paper we suggest a multi-perspective framework, based on the concept of Balanced Scorecard (BSC), for providing guidance about where to identify and quantify the value of EA from the perspective of management. A derived methodology is used to localize a few selected Key Performance Indicators (KPI's) for measuring the benefits of Enterprise Architecture that help practitioners to design and implement the suggested framework.

Enterprise Architecture (EA) in the context of enterprise engineering addresses aspects of developing, improving and integrating organizations. The paper introduces an approach to EA proposing Integration Concepts (IC) to reconcile changing business process requirements and information systems. Being process-driven and supporting integration issues the chosen IC is a Service Oriented Architecture (SOA). Therefore the contribution aims at developing a methodology to support service engineering by defining architectural domains in an EA. The paper shows the need for methods in the field of domain engineering supporting the design of a SOA. The main contribution of the paper is an algorithm based modelling approach and a methodology to support service domain clustering. The clustering algorithms are using a model considering business processes, information systems and information system interfaces. The algorithm adopts network-centric approaches used in the field of social network analysis to define and/or identify service domain clusters in complex scenarios. The paper summarizes a case study in a globally operating company and closes with a conclusion. The paper is organized by chapters addressing context, objective, approach, case, results and lessons learned.