Search

En los últimos años, los proyectos de software de código abierto (OSS) se han vuelto cada vez más importantes para muchas organizaciones. A medida que estos proyectos crecen en tamaño y complejidad, aumenta la necesidad de un desarrollo de software de alta calidad. Al mismo tiempo se ha comprobado que el uso de prácticas de DevOps mejora la calidad y el rendimiento organizacional. Sin embargo, es difícil medir el impacto real que supone aplicar estas prácticas porque los métodos de evaluación existentes, como los informes de DORA, se centran principalmente en la implementación continua y la entrega en producción. Esto se diferencia de las prioridades de los proyectos OSS, que enfatizan la liberación continua de código y su impacto en los usuarios en lugar de en sus implementaciones o entregas en producción. Para abordar esta situación se emplea un sistema colaborativo de evaluación, Performance-Tracker (PT), diseñado para evaluar y comparar el rendimiento de proyectos OSS usando varios factores. PT extrae información pública de proyectos OSS y ha permitido generar una base de conocimientos compartida que supone la primera base de conocimiento del marco de referencia. Esto se ha logrado evaluando el rendimiento de 50 proyectos OSS en su primera versión. Este enfoque permite que puedan evaluarse más proyectos y que comparen su rendimiento en base a los puntos de referencia de la base de conocimiento colaborativa. Usando PT y con las métricas propuestas, los proyectos OSS pueden analizar y comparar su rendimiento con respecto al resto de proyectos participantes. Esto, a su vez, permite que sus resultados alimenten la base de conocimiento y enriquezcan el marco de referencia. PT, junto a su base de conocimiento inicial, es una propuesta integral para la evaluación de proyectos OSS, abordando los desafíos propios de este tipo de proyectos. Además, el entorno de aprendizaje colaborativo persigue fomentar un proceso de desarrollo más eficiente en los proyectos OSS. Al perm

La creciente popularidad y dependencia de las organizaciones en proyectos de software de código abierto (OSS) hace esencial asegurar su rendimiento óptimo. Sin embargo, las herramientas de evaluación del rendimiento actuales no cuentan con funcionalidades de colaboración adecuadas, lo que dificulta la evaluación y comparación objetiva del rendimiento mediante métricas estandarizadas, presentando desafíos tanto para desarrolladores como organizaciones en el mercado tecnológico. En este artículo se presenta Performance-Tracker, una herramienta de evaluación comparativa que ha sido diseñada para evaluar y comparar el rendimiento de proyectos OSS mediante métricas que consideran las características propias de los proyectos OSS. Performance-Tracker utiliza una base de conocimientos inicial de 50 proyectos y define un modelo de contribución colaborativa en proyectos OSS, lo que permite a las comunidades evaluar su rendimiento de forma objetiva. La herramienta proporciona perspectivas valiosas de mejora y asienta un marco de trabajo inicial para fomentar un desarrollo más eficiente basado en el aspecto colaborativo.

Context: System of Systems (SoS) is an emerging paradigm by which independent systems collaborate by sharing resources and processes to achieve objectives that they could not achieve on their own. In this context, a number of emergent behaviors may arise that can undermine the security of the constituent systems. Objective: We apply the Delphi method with the aims to improve our understanding of SoS security and related problems, and to investigate their possible causes and remedies. Method: Experts on SoS expressed their opinions and reached consensus in a series of rounds by following a structured questionnaire. Results: The results show that the experts found more consensus in disagreement than in agreement about some SoS characteristics, and on how SoS vulnerabilities could be identified and prevented. Conclusions: From this study we learn that more work is needed to reach a shared understanding of SoS vul nerabilities, and we leverage expert feedback to outline some future research directions.

La ciberseguridad es un conjunto de procedimientos y herramientas que permite proteger los recursos tanto de la empresa como de sus usuarios. Ade más, en un contexto industrial los sistemas contienen información sensible sobre su contexto. Con el auge del teletrabajo los ciberdelincuentes tienen nuevas opor tunidades de ataque ya que toda la comunicación laboral es digital. Esto supone que los ataques de ingeniería social sean una herramienta clave para que el ata cante gane acceso a recursos delicados de la empresa. Para evaluar la seguridad del factor humano se han diseñado 4 ataques con el objetivo de conseguir infor mación que podría comprometer la seguridad de los sistemas de una clínica de salud. Los ataques incluyen suplantación de identidad y engaño para desafiar la ingenuidad del equipo de desarrollo. Los resultados han descubierto las debilida des que presenta el equipo humano y permite crear un plan de formación como mecanismo de seguridad preventivo para proteger de ataques de ingeniería social de un atacante malicioso.

En los últimos años, los avances en las Tecnologías de la Información y la Comunicación (TIC) las han hecho imprescindibles en nuestra sociedad, especialmente en el funcionamiento de muchas organizaciones. Un ejemplo sería el impacto que han tenido y tienen en la medicina. Son fundamentales para mejorar la calidad, eficacia y eficiencia de los servicios sanitarios, siendo necesario apostar por la interoperabilidad de estos sistemas tecnológicos.

Teaching in Software Engineering involves learning strategies to address so ft- ware discovery, development and operations. However, in the literature we can find strategies that are defined based on constructs that can even vary between similar strategies, which makes it difficult to learn these strategies. Here it is proposed a technique consisting of a canvas that organizes knowledge into a set of basic constructs that allow it to be applied to any soft- ware strategy to describe it. Post-its can be included on the canvas in an agile way to conceptually define any software strategy taught in class. It is intended to improve the experience ofstudents during learning, so that they are active participants instead ofpassive observers, thus facilitatingmeaningful learning that endows the student with the ability to acquire concepts and establish re- lationships on the knowledge acquired. To validate the proposal, an evaluation of the student's experience during learning with the UEQ (User Experience Questionnaire) technique has been carried out. The results show that the tech- nique is perceived by students as a novel, stimulating and attractive learning technique., La enseñanza en Ingeniería del Software implica el aprendizaje de estrategias que permitan abordar el descubrimiento, desarrollo y operaciones software. Sin embargo, en la literatura podemos encontrar estrategias que son definidas en base a constructos que pueden incluso variar entre estrategias similares, lo que dificulta el aprendizaje de dichas estrategias. El presente trabajo propone una técnica consistente en un lienzo que organiza el conocimiento en un conjunto de constructos básicos y que permiten ser aplicados a cualquier estrategia software para describirla. En el lienzo pueden incluirse post-its de forma ágil para definir conceptualmente cualquier estrategia software que se enseñe en clase. Se pretende mejorar la experiencia de los alumnos durante el aprendizaje, para que sean participantes activos en lugar de observadores pasivos, facilitando así un aprendizaje significativo que dote al alumno de la capacidad de adquirir conceptos y establecer relaciones sobre el conocimiento adquirido. Para validar la propuesta, se ha realizado una evaluación de la experiencia del alumno durante el aprendizaje con la técnica UEQ (User Experience Questionnaire). Los resultados muestran que la técnica es percibida por los alumnos como una técnica de aprendizaje novedosa, estimulante y atractiva.

Healthcare institutions is an ever-innovative field, in which modernization is moving forward taking giant steps. This modernization, so called “digitization”, brings up some concerns that should be carefully consid ered. Currently, the most sensible concerning in this field is the management of Electronic Health Record and patients’ data privacy. Health-related data in healthcare systems are under strict regulations, such as the EU’s General Data Protection Regulation (GDPR), whose non-compliance imposes huge penalties and fines. Cy bersecurity in healthcare plays an important role at protecting these sensitive data, which are highly valuable for criminals. Security experts follow already existing security frameworks to orchestrate the security assess ment process, so that the auditing process is as complete and as organized as possible. This study extends the lifecycle of a security assessment framework and conducts an exploitation and vulnerabilities’ analysis on an actual industrial scenario. The results of this security audit shows that even if the system is heavily fortified, there can be still some vulnerabilities.

The “Systems of Systems” (SoS) emerged as a new horizon with the predominant use of information systems. In this meaning, at the end of 20th century the Systems of Systems have been adopted to define a set of systems retaining operative and managerial independence. These systems temporary collaborate to reach a common goal in an organized way. SoS are complex systems that are not managed by a single accountant, and its outcomes have not a single author or owner. Some shared resources, as functionalities and data are a compositional feature. It means, SoS functionalities and data is a sum of shared resources among the constituent systems. SoS offer new challenges when defining general guidelines on its management, development or operative. Its dynamic composition involves additional complexity: constituent systems may join and disengage, affecting the SoS normal behavior. Diverse alternatives have been proposed with the aim of managing the SoS, analyze its functionalities or performance among others. The security of each constituent system does not compose the SoS security. Despite each constituent system is secure by itself, it is only securing a SoS component, but not the SoS as a whole. An unexpected or mal-intentioned combination of functionalities may produce harmful results on the SoS. SoS security is a complex feature to analyze, given the SoS evolutionary behavior and the no compositionality of security. Since more than 20 years ago software engineering have been designing guidelines to unify routines and create standards as in the case of information system development in computer engineering. These routines include values, strategies, guidelines and methodologies that assist in the development and maintenance of software systems. The use of guides, methodologies and frameworks have evolved with the systems. Technological advances in communication promoted the use of this kind of strategies, easing product and services control and management. However, these

The advance in the digital world has caused a growth of complexity in innovation. Traditional approaches to innovation, based on reductionism, face greater difficulties. That is why we have witnessed the growth of those known as System of Systems (SoS). There is a wide variety of methodologies and domains of application in the literature to form framed solutions in the context of SoS, but there is no unified c onsensus f or i ts u se a nd e ven l ess when it comes to agile environments of continuous integration and deployment in which traceability requirements are critical. In recent years, the need to have traceability software that continuously records and monitors the trace of the entities that interact with it has become an essential feature. In addition, over the years there has been evidence of errors caused by poor traceability control. Therefore, this document presents an agile framework that aims to guarantee the traceability of a SoS from the early stages. This framework unifies the discovery, development and operations, providing full coverage in the conformation of the solution. Finally, we present a case study as future work, which is based on the application of our framework on smart laboratories for assisted reproduction.

Background and goal: Health information systems are increasingly sophisticated and developing them is a challenge for software developers. Software engineers usually make use of UML as a standard model language that allows defining health information system entities and their relations. However, working with health system requires learning HL7 standards, that defines and manages standards related to health information systems. HL7 standards are varied, however this work focusses on v2 and v3 since these are the most used one on the area that this work is being conducted. This works aims to allow modeling HL7 standard by using UML. Methods: Several techniques based on the MDE (Model-Driven Engineering) paradigm have been used to cope with it. Results: A useful reference framework, reducing final users learning curve and allowing modeling maintainable and easy-going health information systems. Conclusions: By using this approach, a software engineer without any previous knowledge about HL7 would be able to solve the problem of modeling HL7-based health information systems. Reducing the learning curve when working in projects that need HL7 standards.

We propose a factory of educational System of Systems (SoS) case studies that can be used for evaluating SoS research results, in particular in SoS testing. The factory includes a first set of constituent systems that can collaborate within different SoS architectures to accomplish different missions. In the paper, we introduce three possible SoSs and outline their missions. For more detailed descriptions, diagrams and the source code, we refer to the online repository of EDUFYSoS. The factory is meant to provide an extensible playground, which we aim to grow to include more systems and other missions with the support of the community.

Web augmentation is a set of techniques allowing users to define and execute software which is dependent on the presentation layer of a concrete Web page. Through the use of specialized Web augmentation artifacts, the end users may satisfy several kinds of requirements that were not considered by the analysts, developers and stakeholders that built the application. Although some augmentation approaches are contemplating a server-side counterpart (to support aspects such as collaboration or cross-browser session management), the augmentation artifacts are usually purely client-side. The server-side support increases the capabilities of the augmentations, since it may allow sharing information among users and devices. So far, this support is often defined and developed in an ad hoc way. Although it is clear that server-side support brings new possibilities, it is also true that developing and deploying server-side Web applications is a challenging task that end users hardly may handle. This work presents a novel approach for designing Web augmentation applications based on client-side and server-side components. We propose a model-driven approach that raises the abstraction level of both, clientand server-side developments. We provide a set of tools for designing the composition of the core application with new features on the back-end and the augmentation of pages in the front-end. The usability and the value of the produced augmentations have been evaluated through two experiments involving 30 people in total.

The increasing use of the Internet for social purposes enriches the data available online about all of us and promotes the concept of the Digital Persona. Actually, most of us are represented online by more than one identity, what we define here as a Pluridentity . This trend brings increased risks: it is well known that the security of a Digital Persona can be exploited if its data and security are not effectively managed. In this paper, we focus specifically on a new type of digital attack that can be perpetrated by combining pieces of data belonging to one same Pluridentity in order to profile their target. Some victims can be so accurately depicted when looking at their Pluridentity that by using the gathered information attackers can execute very personalized social engineering attacks, or even bypass otherwise safe security mecha- nisms. We characterize these Pluridentity attacks as a security issue of a virtual System of Systems, whose constituent systems are the individual identities and the humans themselves. We present a strategy to identify vulnerabilities caused by overexposure due to the combination of data from the constituent iden- tities of a Pluridentity. To this end we introduce the Digital Persona Portrayal Metamodel, and the related Digital Pluridentity Persona Portrayal Analysis process that supports the architecting of data from differ- ent identities: such model and process can be used to identify the vulnerabilities of a Pluridentity due to its exploitation as a System of Systems. The approach has been validated on the Pluridentities of seven- teen candidates selected from a data leak, by retrieving the data of their Digital Personae, and matching them against the security mechanisms of their Pluridentities. After analyzing the results for some of the analyzed subjects we could detect several vulnerabilities.

Artificial intelligence (AI) is a broad field whose prevalence in the health sector has increased during recent years. Clinical data are the basic staple that feeds intelligent healthcare applications, but due to its sensitive character, its sharing and usage by third parties require compliance with both confidentiality agreements and security measures. Data Anonymization emerges as a solution to both increasing the data privacy and reducing the risk against unintentional disclosure of sensitive information through data modifications. Although the anonymization improves privacy, the diverse modifications also harm the data functional suitability. These data modifications can affect applications that employ the anonymized data, especially those that are data-centric such as the AI tools. To obtain a trade-off between both qualities (privacy and functional suitability), we use the Test-Driven Anonymization (TDA) approach, which anonymizes incrementally the data to train the AI tools and validates with the real data until maximizing its quality. The approach is evaluated on a real-world dataset from the Spanish Institute for the Study of the Biology of Human Reproduction (INEBIR). The anonymized datasets are used to train AI tools and select the dataset that gets the best trade-off between privacy and functional quality requirements. The results show that TDA can be successfully applied to anonymize the clinical data of the INEBIR, allowing third parties to transfer without transgressing user privacy and develop useful AI Tools with the anonymized data.

ERP systems are composed of different functional modules on which each one addresses a different business area. Developments on these modules are managed independently on each one, which allow to handle and address the management of many related information requirements. In this context the startup G7Innovation works for its product iMEDEA. In this study we have combined two methodologies, Design Sprint and NDT 4.0; and systematized the development of ERP system modules. This combination allows you to use Design Sprint to generate and validate prototyping, and NDT 4.0 to do the study, analysis, and design of the software to be developed. In addition, according to the specifications defined in NDT, the code generation of the ERP module can be automated. This proposal has been validated in a case study in collaboration with the startup G7Innovation, where we have applied both methodologies on Odoo, an open source ERP system based in Python language. Thanks to the use of these two methodologies we have produced a module related to the needs of the clinic by reducing costs, times and human failures.

Engineering Systems of Systems is one of the new chal-lenges of the last few years. This depends on the increasing number of systems that must interact one with another to achieve a goal. One peculiarity of Systems of Systems is that they are made of systems able to live on their own with well-established functionalities and requirements, and that are not necessarily aware of the joint mission or prepared to collaborate. In this emergent scenario, securi-ty is one crucial aspect that must be considered from the very beginning. In fact, the security of a System of Sys-tems is not automatically granted even if the security of each constituent system is guaranteed. The aim of this paper is to address the problem of assessing security properties in Systems of Systems. We discuss the specific security aspects of such emergent systems, and propose the TeSSoS approach, which includes modelling and testing security properties in Systems of Systems and introduces the Red and Blue Requirements Specification concepts.

Los sistemas ERP están compuestos por diferentes módulos funciona les en el que cada uno aborda un área de negocio distinta. Los desarrollos que se llevan a cabo sobre estos módulos se gestionan de manera independiente por cada uno, lo que permite abordar de forma controlada un gran número de requisitos de información relacionados. En este contexto trabaja la startup G7Innovation para su producto iMEDEA. En este estudio hemos combinado dos metodologías, De sign Sprint y NDT 4.0; consiguiendo sistematizar el desarrollo de módulos de sistemas ERP. Esta combinación permite usar Design Sprint para generar y vali dar el prototipado, y NDT 4.0 para hacer el estudio, análisis y diseño del software a desarrollar. Además, de acuerdo a las especificaciones definidas en NDT, se puede automatizar la generación de código del módulo ERP. Esta propuesta se ha validado en un caso de estudio en colaboración con la startup G7Innovation donde hemos aplicado ambas metodologías sobre Odoo, un sistema ERP de có digo abierto escrito en lenguaje Python. Gracias al uso de estas dos metodologías hemos producido un módulo afín a las necesidades de la clínica reduciendo cos tos, tiempos y fallos humanos.

Within growing pervasive information systems, Systems of Systems (SoS) emerge as a new research frontier. A SoS is formed by a set of constituent systems that live on their own with well-established functionalities and requirements, and, in certain circumstances, they must collaborate to achieve a common mission. In this scenario, security is one crucial property that needs to be considered since the early stages of SoS lifecycle. Unfortunately, SoS security cannot be guaranteed by addressing the security of each constituent system separately. The aim of this paper is to discuss the challenges faced in addressing the security of SoS and to propose some research ideas centered around the notion of a mission to be carried out by the SoS.

The Model-Driven Engineering (MDE) has been used in recent years to promote better results in the development of Web Applications, in the field that has been called Model-Driven Web Engineering (MDWE). One of the advantages of applying MDWE is that it offers a solution to reduce the cost of the tests without affecting their quality execution. This paper presents the application of a MDWE methodology (Navigational Development Techniques, NDT) that provides support for all the phases of the lifecycle of a software project development proposing transformations between these phases, to manage the test phase of a real-world case study named ADAGIO. This project, among other goals, proposes the development of a web application whose main objective is to offer researchers the possibility of integrating and consolidating heterogeneous data sources, showing a unified vision of them, allowing to simplify the search task in different repositories as well as the relationship between the sources found.

Within the development of software systems, the development of web applications may be one of the most widespread at present due to the great number of advantages they provide such as: multiplatform, speed of access or the not requiring extremely powerful hardware among others. The fact that so many web applications are being developed, makes enormous the volume of information that it is generated daily. In the management of all this information, the entity reconciliation (ER) problem occurs, which is to identify objects referring to the same real-world entity. This paper proposes to give a solution to this problem through a web perspective based on the Model-Driven Engineering paradigm. To this end, the Navigational Development Techniques (NDT) methodology, that provides a formal and complete set of processes that bring support to the software lifecycle management, has been taken as a reference and it has been extended adding new activities, artefacts and documents to cover the ER. All these elements are defined by a process named Model-Driven Entity ReconcilIAtion (MaRIA), that can be integrated in any software development methodology and allows one to define the ER problem from the early stages of the development. In addition, this proposal has been validated in a real-world case study helping companies to reduce costs when a software product that must give a solution to an ER problem has to be developed

El Trabajo Fin de Grado (TFG) juega un papel muy im portante en el proceso formativo de los grados en Inge niería Informática, ya que, a través de la ejecución sa tisfactoria de un proyecto, se pretende que el alumno/a tenga su primera experiencia profesional tutorada co mo ingeniero/a en proyectos de ingeniería y tecnología del Software. En este artículo se presenta una propues ta de metodología de trabajo seguida por nuestro grupo de investigación a la hora de tutorar, dirigir y ejecutar los TFG de las titulaciones de grado relacionadas con la Ingeniería Informática. Esta metodología, está com puesta por tres fases principales: la fase de diseño del producto (basada en metodología Design Sprint), la fa se de análisis de la solución (basada en la metodología NDT) y el diseño, implementación y pruebas de la so lución (basada en metodologías ágiles de desarrollo). Gracias a esta forma de trabajo, el alumno es capaz de ejecutar el TFG de una forma sistemática, ordenada y teniendo una visión clara del producto y solución que debe desarrollar., The final project plays a very important role in the for mative process of the degrees in Computer Enginee ring, because, the satisfactory execution of a project, intends that the student has his first professional tuto red experience as real engineer in projects of software engineering and technology. In this paper we present a proposal of work methodology followed by our re search group when it comes to tutoring, directing and executing the final project in the degree programs re lated to Computer Engineering. This methodology is composed of three main phases: the design phase of the product (based on Design Sprint methodology), the solution analysis phase (based on the NDT methodo logy) and the design, implementation and testing of the solution phase (based on in agile development metho dologies). Thanks to this kind of working, the student is able to execute the final project in a systematic and orderly way, having a clear vision of the product and solution to be developed.

Health information systems are increasingly complex, and their development is presented as a challenge for software development companies offering quality, maintainable and interoperable products. HL7 (Health level 7) International, an international non-profit organization, defines and maintains standards related to health information systems. However, the modelling languages proposed by HL7 are far removed from standard languages and widely known by software engineers. In these lines, NDT is a software development methodology that has a support tool called NDT-Suite and is based, on the one hand, on the paradigm of model-driven engineering and, on the other hand, in UML that is a widely recognized standard language. This paper proposes an extension of the NDT methodology called MoDHE (Model Driven Health Engineering) to offer software engineers a methodology capable of modelling health information systems conforming to HL7 using UML domain models.

Websites augmentations have been adopted as a mean for improving the User Experience of applications that often are not owned by the user. The augmentations alter the page in order to add, modify and even remove its content pursuing the satisfaction of a user’s need. However, these augmentations are limited to page modification or transcluding content from another site on Internet. Moreover, advance server-side based augmentations have been released only by developers because of the required technical skill for the task. In this work, we have presented a novel approach for designing Web Augmentation coping client-side and server side using a Model-Driven Web Engineering approach. The approach rises the abstraction level for server side developments allowing end-users to design, and even implement the new functionalities. Additionally, the approach uses advance separation of concern principles thus we provide a set of tools for designing the composition of the core application and the augmentation. We show as running example an augmentation that introduces a site community’s review support upon an agriculture e-commerce site.