Search

A preprint version of this article is available at arXiv: https://doi.org/10.48550/arXiv.2401.14682, The rise of self-driving cars (SDCs) presents important safety challenges to address in dynamic environments. While field testing is essential, current methods lack diversity in assessing critical SDC scenarios. Prior research introduced simulation based testing for SDCs, with Frenetic, a test generation approach based on Frenet space encoding, achieving a relatively high percentage of valid tests (approximately 50%) characterized by naturally smooth curves. The “minimal out-of-bound distance” is often taken as a fitness function, which we argue to be a sub-optimal metric. Instead, we show that the likelihood of leading to an out-of-bound condition can be learned by the deep-learning vanilla transformer model. We combine this “inherently learned metric” with a genetic algorithm, which has been shown to produce a high diversity of tests. To validate our approach, we conducted a large-scale empirical evaluation on a dataset comprising over 1,174 simulated test cases created to challenge the SDCs behavior. Our investigation revealed that our approach demonstrates a substantial reduction in generating non-valid test cases, increased diversity, and high accuracy in identifying safety violations during SDC test execution.

While simulation-based testing is critical for ensuring the safety of autonomous Unmanned Aerial Vehicles (UAVs), it has not been adequately researched yet. The UAV Testing Competition organized by the Search-Based and Fuzz Testing (SBFT) workshop is an initiative designed to inspire and encourage the software testing Community to direct their attention toward UAVs as a rapidly emerging and crucial domain. It provides a simple software platform and case study to facilitate their onboarding in the UAV domain and help them develop their first test generation tools for UAVs. In this first edition of the competition, 7 tools were submitted, evaluated, and compared extensively against each other and the baseline approach. We evaluated their test generation performance for 6 different case studies using our novel benchmarking infrastructure. The generated test suites were scored and ranked based on the number and severity of the revealed faults, and the complexity, diversity, and execution time of the test cases. This paper describes the competition context, its platform, the competing tools, and the evaluation process and results.

Natural Language to SQL systems (NL-to-SQL) have recently shown improved accuracy (exceeding 80%) for natural language to SQL query translation due to the emergence of transformer-based language models, and the popularity of the Spider benchmark. However, Spider mainly contains simple databases with few tables, columns, and entries, which do not reflect a realistic setting. Moreover, complex real-world databases with domain-specific content have little to no training data available in the form of NL/SQL-pairs leading to poor performance of existing NL-to-SQL systems. In this paper, we introduce ScienceBenchmark, a new complex NL-to-SQL benchmark for three real-world, highly domain-specific databases. For this new benchmark, SQL experts and domain experts created high-quality NL/SQL-pairs for each domain. To garner more data, we extended the small amount of human-generated data with synthetic data generated using GPT-3. We show that our benchmark is highly challenging, as the top performing systems on Spider achieve a very low performance on our benchmark. Thus, the challenge is many-fold: creating NL-to-SQL systems for highly complex domains with a small amount of hand-made training data augmented with synthetic data. To our knowledge, ScienceBenchmark is the first NL-to-SQL benchmark designed with complex real-world scientific databases, containing challenging training and test data carefully validated by domain experts.

A preprint version of this paper is available at arXiv: https://doi.org/10.48550/arXiv.2401.14736, Software metrics such as coverage or mutation scores have been investigated for the automated quality assessment of test suites. While traditional tools rely on software metrics, the field of self-driving cars (SDCs) has primarily focused on simulation-based test case generation using quality metrics such as the out-of-bound (OOB) parameter to determine if a test case fails or passes.However, it remains unclear to what extent this quality metric aligns with the human perception of the safety and realism of SDCs. To address this (reality) gap, we conducted an empirical study involving 50 participants to investigate the factors that determine how humans perceive SDC test cases as safe, unsafe, realistic, or unrealistic. To this aim, we developed a framework leveraging virtual reality (VR) technologies, called SDC-Alabaster, to immerse the study participants into the virtual environment of SDC simulators. Our findings indicate that the human assessment of safety and realism of failing/passing test cases can vary based on different factors, such as the test’s complexity and the possibility of interacting with the SDC. Especially for the assessment of realism, the participants’ age leads to a different perception. This study highlights the need for more research on simulation testing quality metrics and the importance of human perception in evaluating SDCs.

Das Abstract zum Poster ist publiziert in: Abstractband zum 61. Wissenschaftlichen Kongress der Deutschen Gesellschaft für Ernährung (Volume 30), DGE, S. 86

Developing tools and researching in the context of self-driving cars (SDCs) is time-consuming and costly since researchers and practitioners rely on expensive computing hardware and simulation software. We propose SensoDat, a dataset of 32,580 executed simulation-based SDC test cases generated with state-of-the-art test generators for SDCs. The dataset consists of trajectory logs and a variety of sensor data from the SDCs (e.g., rpm, wheel speed, brake thermals, transmission, etc.) represented as a time series. In total, SensoDat provides data from 81 different simulated sensors. Future research in the domain of SDCs does not necessarily depend on executing expensive test cases when using SensoDat. Furthermore, with the high amount and variety of sensor data, we think SensoDat can contribute to research, particularly for AI development, regression testing techniques for simulation-based SDC testing, flakiness in simulation, etc. Link to the dataset: https://doi.org/10.5281/zenodo.10307479

Test case generation (TCG) for Python poses distinctive challenges due to the language’s dynamic nature and the absence of strict type information. Previous research has successfully explored automated unit TCG for Python, with solutions outperforming random test generation methods. Nevertheless, fundamental issues persist, hindering the practical adoption of existing test case generators. To address these challenges, we report on the organization, challenges, and results of the first edition of the Python Testing Competition. Four tools, namely UTBotPython, Klara, Hypothesis Ghostwriter, and Pynguin were executed on a benchmark set consisting of 35 Python source files sampled from 7 open-source Python projects for a time budget of 400 seconds. We considered one configuration of each tool for each test subject and evaluated the tools’ effectiveness in terms of code and mutation coverage. This paper describes our methodology, the analysis of the results together with the competing tools, and the challenges faced while running the competition experiments.

This study investigates how value stream management enables operational alignment between business and software development. The present paper employs a single-case study design within a Swiss-based bank and its IT subsidiary. Qualitative data were collected, analyzed, and synthesized, offering comprehensive insights into an organization operating under the value stream paradigm. Expanding on operational alignment theory, this research introduces a revised model for the operational alignment of software value streams. The derived model includes three aggregated dimensions: Seek Value, Foster Transparency, and Enable Proximity. The findings suggest that software value streams require product-centric teams, featuring designated roles at the interface between business and development. Moreover, value streams and the product team strive for transparency to disclose the actions and decisions of driving companies’ value. This study provides insights into the complex landscape of software development to align the operational dynamics between business and IT to pave the way for success.

Part of Track 5: Data Science & Business Analytics, For organizations, the use of Big Data and data analytics provides the opportunity to gain competitive advantages and foster innovation. In most of these data analytics initiatives, it is possible that data from external stakeholders could enrich the internal data assets and lead to enhanced outcomes. Currently, no framework is available that systematically guides practitioners in identifying and evaluating suitable inter-organizational data collaborations at an early stage. This paper closes the gap by following an action design research approach to develop the Data Collaboration Canvas (DCC). The DCC was rigorously evaluated by practitioners from Swiss organizations in six different industries, instantiated in four workshops, and used to guide innovative data collaboration projects. This artifact gives practitioners a guideline for identifying data collaboration opportunities and an insight into the main factors that must be addressed before further pursuing a collaborative partnership.

Microservices are an emerging architectural style advocating for small loosely-coupled services in order to maximize scalability and adaptability. In order to help IT personnel, adaptability can be put (completely or partially) under the responsibility of the system using autonomic techniques, e.g., underpinned by a MAPE-K control loop. This paper discusses possible trade-offs, challenges, support techniques for software architects and research directions involved in building autonomic microservice-based systems.

Simplicity in elastically scalable application development is a key concern addressed by the serverless computing paradigm, in particular the code-level Function-as-a-Service (FaaS). Various FaaSification frameworks demonstrated that marking code methods to streamline their offloading as cloud functions offers a simple bridge to software engineering habits. As application complexity increases, more complex runtime patterns with background activities, such as keeping containerised cloud functions warm to ensure the absence of cold starts, usually require giving up on simplicity and instead investing efforts into orchestrating infrastructure. By bringing infrastructure-as-code concepts into the function source via powerful code annotations, typical orchestration patterns can be simplified again. We evaluate this idea and demonstrate its practical feasibility with FaaS Fusion, an annotations library and transpiler framework for JavaScript.

The high-tech equipment industry is adopting approaches like Model-Based Systems Engineering (MBSE) and Scaled Agile Framework (SAFe) to improve their practices. Instantiations of these approaches do not necessarily align across disciplines. Given the importance of software aspects in systems, the interplay between software and other engineering disciplines should be carefully addressed. Decision makers are interested in mitigating any risks in the collaboration of specialists in different disciplines. This short positioning paper proposes an applied research approach to identify such risks for later mitigation. The approach is inspired by grounded theory (we constructed concepts from interviews) and systems thinking. Work still to do is to cross-check identified concepts with literature. This research is in progress and we welcome discussions and critical opinions.

This research presents Computational Fluid Dynamics (CFD) simulations in ANSYS® illustrating emissions of to the air. The CFD simulations is employed to study plume transport in urban environment, i.e., Breivika port in the city of Tromsø. The case study presents a two-phase model considering specific wind strength and direction in the city of Tromsø. Geographical coordinates, temperature, and wind data were obtained from the open sources, such as Google Maps, and Norwegian Meteorological Institute. The results from the simulations indicates a potential outcome with respect to various weather conditions. It was revealed for vessels less than 30 meter chimney height, the higher the wind strength, the lower the plume dispersion, causing the plume to stay closer to the terrain. This brings in a concentrated amount of pollutants closer to the public areas. The terrain in the model is recognizable for the Tromsø port’s location. From the CFD results, it is illustrated that onshore wind with high wind strength could affect the environment. The results simulated in OpenFOAM are qualitatively showing the same as visible in ANSYS®.

In recent years, there has been a paradigm shift in the realm of software development, primarily induced by the advent of low code / no code platforms. These platforms have introduced an intuitive, user-friendly medium for both developers and non-technical users to build applications, eliminating the need to write code from scratch. Despite the advantages presented by this approach, the current state of low code / no code platforms exhibits certain constraints. These limitations include vendor-lock in, limited maintainability, reusability, extendability, performance and scalability. The objective of this research is to probe this void, through a comparative analysis of current low code / no code platforms, emphasizing their respective strengths and weaknesses and subsequently proposing a new tool. This proposed tool seeks to circumvent some of the prevalent limitations while capitalizing on their strengths. The goal is to develop a developer experience (DX)-friendly tool that generates code while allowing full access to the codebase. This simplifies application customization without the need to write code from scratch. In order to achieve this, an in-depth examination of existing low code platforms and code generators, such as OutSystems, Mendix and JHipster, will be conducted to discern their strengths and weaknesses. This analysis will serve as a foundation for the development of our tool, targeting a more flexible and customizable development environment specifically catered towards DX-friendly low code projects. The concluding portion of this research will delve into the implementation of our proposed tool, including a detailed description of its architecture, features and usability. Furthermore, the potential applications of this tool and its utility in creating DX-friendly low code projects that meet the modern software development requisites will also be discussed. In summary, this research aims to augment the ongoing evolution of low code by introducing a ne

Information systems (IS) literature has predominantly studied IS project control with a focus on software development projects. However, by virtue of digital transformation, an increasing number of organizations are implementing cross-functional teams, combining software development with software operations tasks. The goal is to react quickly to the ever-changing market requirements. The DevOps concept aims to effectively orchestrate development and operations activities and smoothly manage tensions within teams, resulting from the heterogeneous composition of skills, responsibilities, and working styles. In contrast to the predominant project management view of control of prior research, which focuses on software development, this study investigates a different perspective: focusing on exerting control in DevOps teams and simultaneously navigating tensions between software development and operations. Utilizing an inductive theory-building approach, we first identify the four tensions discussed in prior literature—namely, goal conflict, method discomfort, decision rights, and time rhythm—and then empirically derive corresponding resolutions. Integrating our findings, we present an empirically derived model that can serve as a DevOps control approach for navigating the tensions between development and operations teams. This model extends our theoretical knowledge about control in DevOps teams and serves to inform IT practitioners, helping them successfully implement and manage DevOps teams.

In this paper, an innovative data compression methodology based on Tucker tensor decomposition is presented. The proposed approach exploits the benefits of organizing time series in multidimensional arrays (tensors) in order to achieve higher compression ratios of the original data while preserving most of their properties and, in this form, achieving a low reconstruction error. This reorganization of the data into the tensor allows the creation of correlation for heterogeneous data. Furthermore, it reduces the direct relationship between the number of columns and rows with the final size of the compressed file when the data is compressed using algorithms based on matrix-based dimensional reduction techniques, such as the Singular Value Decomposition (SVD). At the same time, the problem of missing data can be overcome since the problem is formulated as an iterative process. To demonstrate the effectiveness of the innovative algorithm proposed, two study cases from electrical networks are presented. First, the compression of real synchrophasor data acquired from one commercial Phasor Measurement Unit (PMU) measuring 3-phase voltages and frequency measurements from the electrical system of Continental Europe is presented, where a significant CR is achieved for apparently no correlated data. Then, an application to real Smart Meter measurements from the electrical utility ERCOT in the USA is also provided. Here the clustering of the data is obtained as an additional outcome of the proposed algorithm. To underline the benefits of the innovative proposed methodology in contrast to other more common decompositions such as SVD, the compression ratios and reconstruction error achieved using these two different techniques are compared. The results indicate that using Tucker decomposition, not only higher compression can be achieved, but also it is demonstrated that for SM data, additional attributes can be obtained, such as clustering.

In today's fast-changing environment, many organizations are applying the DevOps (Development and Operations) concept to transform their IT functions and establish cross-functional IT teams to deliver software services quickly, reliably, and safely with end-to-end responsibility. The results of an empirical study on which this chapter is based presents platform-oriented, application-oriented, and mobile-oriented DevOps setups, outlining areas of potential collaboration between these DevOps setups and the importance of aligning the aims of development (process agility) and operations (process rigor). Based on the study, six indicators of successful DevOps integration formulated as recommendations for successful IT function transformation were identified.

Implementing access control policies is an error-prone task that can have severe consequences for the security of software applications. Model-driven approaches have been proposed in the literature and associated tools have been developed with the goal of reducing the complexity of this task and helping developers to produce secure software efficiently. Nevertheless, there is a lack of empirical data supporting the advantages of model-driven security approaches over code-centric approaches, which are the de-facto industry standard for software development. In this work, we compare the result of implementing the same functional and security requirements by multiple developer groups in the context of a security engineering graduate course. We thereby obtain evidence on the security and efficiency of a tool-based model-driven approach to security from the literature compared to a direct implementation in a well-known, modern web-development framework. For example, the projects using model-driven development pass up to 50% more security tests on average with less development effort. Also, we observe that models are twice as concise as manual implementations, which improves system maintainability.

Dozens of municipalities across Switzerland have introduced new digital interfaces for interacting with citizens. Among the widely used ones are interactive applications to report damage or needs, collectively called civic engagement services for issue tracking. We argue that while they are popular and effectively encourage crowdsourcing with residents, from a computer science perspective many current systems have issues, including in data privacy and operation efficiency. To overcome them, we propose specific improvements and outline a vision for smart digital spaces in which various stakeholders around smart cities and regions can participate.

Symbolic execution is a powerful technique for automatic analysis of and reasoning about program behaviour, particularly in binary analysis. However, popular reverse engineering tools such as Ghidra lack native support for symbolic execution. Existing extensions advertising symbolic execution are limited in functionality, do not scale well enough to be employed on practical binaries and provide limited documentation. The Cyber-Defence Campus of armasuisse, as part of its vulnerability research program, has developed a proof-of-concept tool called Morion, that enables symbolic execution-based analysis of various vulnerability types on practical binaries. Previously, it had to be configured by manually writing configuration files. This thesis proposes Ghidrion, an open-source Ghidra plugin that leverages information gathered from Ghidra’s analysis tools to enhance analysts’ usage of Morion. Ghidrion suggests calls to external functions that can be hooked and simplifies configuring the setup necessary to run Morion. It further supports the analysis of Morion’s results by visually highlighting executed instructions and providing a side-by-side comparison of memory and register values at the beginning and end of the execution. Alongside the code, previously missing documentation on developing Ghidra plugins is provided. This thesis further proposes future research directions, such as improvements to Ghidra’s loader to match external functions to their libraries and added support for interactive Python shells to run Morion’s analysis modules from within Ghidra.

IoT systems rely on collected data to operate autonomously and generate insights. Such systems commonly produce redundant measurements, which can be insufficient to mitigate complex data disagreements. We believe a well-defined process to achieve internal ground truth through fusion is needed. Leveraging two case studies, we show how sensor data fusion with variants of history-aware voting can help to reconcile observations. We contribute a specification scheme with unified format to define the parameters and characteristics of a particular voting scenario, supporting reliable decision-making. Finally, we deploy and evaluate a novel method of bootstrapping historical records of sensor modules using a clustering algorithm. This method boosts the convergence of the measurements by 4x.

Die wachsende Weltbevölkerung, sowie die damit verbundene steigende Nachfrage nach Proteinen, v.a. in Form tierischer Lebensmittel, stellt uns vor grosse Herausforderungen. Denn gerade die Produktion und der Verzehr von Fleisch sowie anderen Produkten tierischen Ursprungs führt zu negativen Umwelteffekten und hat Auswirkungen auf Tier und Mensch. Wenn sich die heutigen Ernährungsgewohnheiten weltweit nicht ändern, können die «Sustainable Development Goals» (SDGs) nicht erreicht werden. Alternative Proteinquellen wie Algen, Insekten oder Hülsenfrüchte können helfen, den weltweiten Proteinbedarf nachhaltiger zu decken. Doch wie gut sind diese Alternativen hinsichtlich der Umweltbelastung, wirtschaftlicher, sozialer und ernährungs-physiologischer Faktoren wirklich? Hierzu gibt es viele Studien und Daten, aber kein komprimiertes "Nachschlagewerk". An der ZHAW wurde deshalb eine Datenbank entwickelt, welche es Studierenden wie auch WissenschaftlerInnen ermöglichen soll, proteinhaltige Lebensmittel hinsichtlich verschiedener Nachhaltigkeitsaspekte zu vergleichen. Dadurch kann deutlich gemacht werden, welche Produkte in welchem Umfang zu einer nachhaltigeren Proteinversorgung der Bevölkerung beitragen können.

Application needs for big data processing are shifting from planned batch processing to emergent scenarios involving high elasticity. Consequently, for many organisations managing private or public cloud resources it is no longer wise to pre-provision big data frameworks over large fixed-size clusters. Instead, they are looking forward to on-demand provisioning of those frameworks in the same way that the underlying compute resources such as virtual machines or containers can already be instantiated on demand today. Yet many big data frameworks, including the widely used Apache Spark, do not sandwich well in between underlying resource managers and user requests. With SLASH, we introduce a light-weight serverless provisioning model for worker nodes in standalone Spark clusters that help organisations slashing operating costs while providing greater flexibility and comfort to their users and more sustainable operations based on a unique triple scaling method.

Simulation-based testing is crucial for ensuring the safety and reliability of unmanned aerial vehicles (UAVs), especially as they become more autonomous and get increasingly used in commercial scenarios. The complexity and automated nature of UAVs requires sophisticated simulation environments for effectively testing their safety requirements. The primary challenges in setting up these environments pose significant barriers to the practical, widespread adoption of UAVs. We address this issue by introducing Aerialist (unmanned AERIAL vehIcle teST bench), a novel UAV test bench, built on top of PX4 firmware, that facilitates or automates all the necessary steps of definition, generation, execution, and analysis of system-level UAV test cases in simulation environments. Moreover, it also supports parallel and scalable execution and analysis of test cases on Kubernetes clusters. This makes Aerialist a unique platform for research and development of test generation approaches for UAVs. To evaluate Aerialist’s support for UAV developers in defining, generating, and executing UAV test cases, we implemented a search-based approach for generating realistic simulation-based test cases using real-world UAV flight logs. We confirmed its effectiveness in improving the realism and representativeness of simulation-based UAV tests.

Continuum computing promises the abstraction of physical node location and node platform stack in order to create a seamless application deployment and execution across edges and cloud data centres. For industrial IoT applications, the demand to generate data insights in conjunction with an installed base of increasingly capable edge devices is calling for appropriate continuum computing interfaces. Derived from a case study in industrial water flow monitoring and based on the industry's de-facto standard Kubernetes to deploy complex containerised workloads, we present an appropriate continuum deployment mechanism based on custom Kubernetes controllers and CI/CD, called Kontinuum Controller. Through synthetic experiments and a holistic cross-provider deployment, we investigate its scalability with emphasis on reconciling adjusted configuration per application and per node, a critical requirement by industrial customers. Our findings convey that Kubernetes by default would enter undesirable oscillation already for modestly sized deployments. Thus, we also discuss possible solutions.

Paper documents, where digital signatures are not directly applicable, are still widely utilized due to usability and legal reasons. We propose a novel approach to authenticating paper documents by taking short videos of them with smartphones. Our solution combines cryptographic and image comparison techniques to detect and highlight semantic-changing attacks on rich documents, containing text and graphics. We provide geometrical arguments for the security of our novel comparison algorithm, and prove that its combination with a cryptographic protocol is secure against strong adversaries capable of compromising different system components. We also measure its accuracy on a set of 128 videos of paper documents and a set of 960 synthetically generated warped documents, half containing subtle forgeries. Our algorithm finds all forgeries accurately with no false positives. The highlighted regions are large enough to be visible to users, but small enough to precisely locate forgeries.

Die Arbeit widmet sich der Digitalisierung analoger Anzeigen für Home-Automatisierungssysteme. Das Ziel besteht darin, Daten von analogen Anzeigen zu erfassen und sie in digitaler Form für Home-Automatisierungssysteme verfügbar zu machen. Die Arbeit beginnt mit einem Erklärungsabschnitt, die die wichtigsten Aspekte wie Homeautomatisierung, Machine Learning, Computer Vision, bestehende Losungen, den entwickelten Ansatz und den Vergleich behandeln. Im Abschnitt zur Homeautomatisierung werden grundlegende Konzepte und Technologien erläutert. Der Abschnitt zum Machine Learning erläutert, wie maschinelles Lernen zur Automatisierung und Analyse von Bildern eingesetzt wird. Insbesondere wird hier auf das Training eines Convolutional Neural Networks (CNN) mit einem Datensatz von Bildern eingegangen, um Rundinstrumente zu erkennen. Da der Datensatz begrenzt ist, werden Techniken zur Datenvermehrung angewendet. Der Computer Vision-Abschnitt beschäftigt sich mit der Verarbeitung von Bildern und der Objekterkennung. Hier werden Techniken wie Histogramm-Gleichung und Circle Hough-Transformation verwendet, um den Kontrast des Bildes anzupassen und das Zentrum des Zifferblatts zu lokalisieren. Die Zeigererkennung erfolgt durch die Umwandlung des Bildes in Graustufen- und Schwarz-Weiss-Bilder, um die Informationen zu reduzieren und eine präzise Messwertextraktion und -analyse zu ermöglichen. Im Abschnitt zu den bestehenden Losungen werden zwei Ansätze betrachtet. Der erste Ansatz verwendet einen Mikrocontroller mit Kameramodul, um Werte auf analogen Wasserzahlern zu erkennen und zu digitalisieren. Der zweite Ansatz schlägt vor, bestehende analoge Anzeigen durch neue Digitalanzeigen zu ersetzen, was den Einsatz verschiedener Sensoren und Steuerungsmodule erfordert. Beide Losungen haben Vor- und Nachteile, und die Wahl hangt von den spezifischen Anforderungen und dem Anwendungskontext ab. Die Realisierung des entwickelten Ansatzes beinhaltet die Verwendung des ausgewählten CNN-Modell

Die ZHAW besitzt eine eigene CTFd Plattform, auf welcher CTF Challenges zur Verfügung gestellt werden. In dieser Arbeit wurden drei CTF Challenges zum Thema Web Cache Poisoning entwickelt, welche nun auf dieser Plattform verfügbar sind. Für die Informationsbeschaffung und Planung der Challenges wurde eine Marktanalyse durchgeführt. Diese untersuchte, wie andere Hochschulen CTF Challenges verwenden, wie diese aufgebaut werden und ob sie auch bereits welche zum Thema Web Cache Poisoning anbieten. Die aus der Umsetzung resultierenden Challenges besitzen alle eine eigene Schwierigkeitsstufe. Es gibt ein Tutorial als Einführung in das Thema. Dort werden die Grundlagen des Web Cache Poisoning an die Spielenden vermittelt. Bei der Medium Challenge können die Spielenden ihre Fertigkeiten schärfen, in dem sie das Gelernte aus dem Tutorial ohne weitere Hilfestellung anwenden. Die letzte und schwierigste Challenge bezieht sich auf eine in der Praxis gefundene Sicherheitslücke. Dabei können die Spielenden ihr Können unter Beweis stellen. Die ersten beiden Challenges konnten auch bereits im kleinen Rahmen an einem Event getestet werden. Das daraus resultierende Feedback floss in die Entwicklung mit ein und half bei der Verbesserung der Challenges., The ZHAW has its own CTFd platform where CTF challenges are made available. In this project, three CTF challenges on the topic of Web Cache Poisoning were developed and are now accessible on this platform. For gathering information and planning the challenges, a market analysis was conducted. This analysis examined how other universities use CTF challenges, how they are structured, and whether they already offer challenges related to Web Cache Poisoning. The challenges resulting from the implementation have different difficulty levels. There is a tutorial that serves as an introduction to the topic, providing players with the basics of Web Cache Poisoning. In the medium challenge, players can sharpen their skills by applying what they learned in the tutorial without further assistance. The final and most difficult challenge is based on a real-world security vulnerability. Players can demonstrate their abilities in this challenge. The first two challenges were also tested in a small-scale event. The feedback received from the testing was incorporated into the development process and helped improve the challenges.

It is our duty as software engineers to understand our contribution towards sustainability and ultimately assess and improve the sustainability of the software engineering (SE) processes we apply. However, commonly established criteria for such an assessment are currently lacking. In this experience report, we share insights from our investigation into the sustainability of software engineering processes, focusing on a collaborative project with an industry partner. Our research delves into lessons learned while exploring this critical issue. Our contribution lies in the introduction of an initial framework, which includes assessment criteria as the core element, and on the results of using this framework to assess the software engineering process of our industry partner. By sharing our experiences and findings, we aim to contribute to the understanding of sustainable software engineering practices and stimulate dialogue on how software engineering can address societal and environmental challenges. Our work underscores the significance of adopting sustainable practices and encourages the software engineering community—in both academia and industry—to embrace a proactive role in advancing sustainability for society.

Die BORM-INFORMATIK AG entwickelt und vertreibt eine Betriebsführungslösung mit Hauptfokus auf die Abläufe von produzierenden und projektorientierten Betrieben im holzverarbeitenden Sektor. Im Zuge der Umlagerung der Business-Logik auf den BormServer ergab sich die Notwendigkeit einer Lösung zur Verwaltung von zeitlich gesteuerten oder von Usern ausgelösten Hintergrundprozessen. Bestehende Lösungen wurden bei Bedarf individuell implementiert. Ziel dieser Arbeit war die Erarbeitung eines Konzepts für eine einheitliche, zweckbestimmte Verwaltung solcher Prozesse (Tasks) sowie die Implementation eines entsprechenden Prototyps. Dazu wurden zunächst verschiedene Taskverwaltungs-Frameworks evaluiert und für die Anwendung auf dem BormServer getestet. Diese Recherchen führten zur Auswahl des .NET-Frameworks Hangfire. Im Hinblick auf die Integration in den BormServer wurden die benötigten Systemoperationen definiert sowie eine Architektur- und eine Verteilungsübersicht entworfen. Basierend auf diesem Konzept wurde anschliessend der Prototyp implementiert. Für die Verifikation der Funktionalität wurden Unit-Tests geschrieben und Systemtests durchgeführt. Die Tasks selber werden als Python-Skripts implementiert. Task-Metadaten werden in der BORM-Datenbank gespeichert. Anhand eines einfachen Beispiels wurde die Möglichkeit der Integration von BORM-internen Python-Bibliotheken demonstriert. Mit der bestehenden Implementation ist es nun möglich, Tasks zu starten, für die zeitliche Steuerung aktiv oder inaktiv zu setzen, sowie den Status eines Tasks abzufragen. Tasks können zudem erstellt, geändert und gelöscht werden. Die Interaktion mit der Taskverwaltung erfolgt über die API-Endpoints des BormServers. Weitere Funktionalitäten, wie die Verarbeitung von Task-Resultaten sowie das Abbrechen von laufenden Tasks, wurden im Rahmen des Prototyps konzeptionell aufgezeigt. Das weitere Vorgehen beinhaltet die Umsetzung dieser Funktionalitäten sowie die Integration des Hangfire-Datenspeich, BORM-INFORMATIK AG develops and distributes a business management solution with the focus on the processes of manufacturing and project-oriented companies in the woodworking sector. In the course of moving the business logic to the BormServer, the need arose for a solution to manage time-controlled or user-triggered background processes. Existing solutions were implemented individually as needed. The aim of this thesis was to develop a concept for a uniform, purpose-specific control of such processes (tasks) and to implement a corresponding prototype. To this end, various task management frameworks were evaluated and tested for use on the BormServer. This research led to the selection of the .NET framework Hangfire. For the integration into the BormServer, the required system operations were defined and an architecture and a distribution overview were designed. Based on this concept, the prototype was then implemented. For the verification of the functionality, unit tests were written and system tests were performed. The tasks themselves are implemented as Python scripts. Task metadata is stored in the BORM database. A simple example was used to demonstrate the possibility of integrating BORM-internal Python libraries. With the existing implementation, it is now possible to start tasks, set them active or inactive for time control, and query the status of a task. Tasks can also be created, changed and deleted. Interaction with the task management takes place via the API endpoints of the BormServer. Further functionalities, such as the processing of task results and the cancellation of running tasks, were conceptually demonstrated within the scope of the prototype. The next steps include the implementation of these functionalities and the integration of the Hangfire data storage into the BORM database.

Open Science is transforming the way researchers collect, process, analyze, and store empirical research data, particularly in the social sciences and humanities, where language data is crucial. This transformation processespecially concerns developers and providers oflarge language corporaand manifests itself in at least three challengeswhen providing these corpora as Open Research Data (ORD). Challenges concernheterogeneous practices that researchers apply when working with language data, research data lifecycle, and legal and ethical aspect. In this paper, we present Swiss-AL, a language data platform developed in Switzerland that is being transformed into an Open Research Data Resource for Applied Sciences within the Swiss Open Science Strategy. The paper gives an overview over the data contained in Swiss-AL and the infrastructure that is used to process and analyze the data. Furthermore, it presents approaches to the three abovementioned challenges to language ORD.

Domain-specific Microservice Reference Architectures (MSRA) have become relevant study objects in software technology. They facilitate the technical evaluation of service designs, compositions patterns and deployment configurations in realistic operational practice. Current knowledge about MSRA is predominantly confined to business domains with modest numbers of users per application. Due to the ongoing massive digital transformation of society, people-related online services in e-government, e-health and similar domains must be designed to be highly scalable at entire nation level at affordable infrastructure cost. With ZVAX, we present such a service in the e-health domain. Specifically, the ZVAX implementation adheres to an MSRA for pandemic-related processes such as vaccination registration and passenger locator form submission, with emphasis on selectable levels of privacy. We argue that ZVAX is valuable as study object for the training of software engineers and for the debate on arbitrary government-to-people services at scale.

Consumers in brick-and-mortar stores are increasingly expecting a personalised shopping experience and digital assistance in finding the right products. The retail industry has already undergone a shift towards more ubiquitous in-store technology but smart shopping assistance for consumers is notably absent. Whether physical product search, localisation and navigation could work with contemporary technology is an open question. In an applied research setting conducted on behalf of a retail technology provider, we have analysed the feasibility of introducing a smart shopping workflow based on product search and indoor navigation. In this paper we provide our findings with key contributions in workflow design, mobile application design, and technology fitting concerning localisation and notification of customers.

Societies and legislations are moving towards automated decision-making based on measured data in safety-critical environments. Over the next years, density and frequency of measurements will increase to generate more insights and get a more solid basis for decisions, including through redundant low-cost sensor deployments. The resulting data characteristics lead to large-scale system design in which small input data errors may lead to severe cascading problems including ultimately wrong decisions. To ensure internal data consistency to mitigate this risk in such IoT environments, fast-paced data fusion and consensus among redundant measurements need to be achieved. In this context, we introduce history-aware sensor fusion powered by accurate voting with clustering as a promising approach to achieve fast and informed consensus, which can converge to the output up to 4X faster than the state of the art history-based voting. Leveraging three case studies, we investigate different voting schemes and show how this approach can improve data accuracy by up to 30% and performance by up to 12% compared to state-of-the-art sensor fusion approaches. We furthermore contribute a specification format for easily deploying our methods in practice and use it to develop a pilot implementation.

Präsentationen sind aus vielen Bereichen des täglichen Lebens kaum mehr wegzudenken. Neben gängigen Programmen wie Microsoft PowerPoint, in denen die grafische Darstellung von Präsentationen direkt bearbeitet wird, existieren alternative Ansätze, bei denen die Präsentationen im Quelltext editiert werden. Dadurch ergeben sich diverse Vorteile, beispielsweise in der Teamarbeit, der Versionierung und einer besseren Trennung von Inhalt und Gestaltung. Bestehende Lösungen in diesem Bereich erfordern allerdings entweder fortgeschrittene technische Kenntnisse oder sie sind in ihrer Funktionalität sehr limitiert. In dieser Arbeit wird ein Konzept entwickelt, um Quelltext-basierte Präsentationen einer breiteren Zielgruppe zugänglich zu machen. Hierfür wird eine Anwendung konzipiert, mit der Präsentationen in der Auszeichnungssprache Markdown editiert werden können. Es soll eine einfache und intuitive Benutzung sichergestellt werden, ohne die Möglichkeiten zur individuellen Anpassung der Darstellung einzuschränken. Das ausgearbeitete Konzept wird als Desktop-Applikation umgesetzt. Die Software verarbeitet Markdown-Quelltext zu einer interaktiven Web-Präsentation, wobei das Framework Reveal.js verwendet wird. Mit Templates wird eine Abstraktion zwischen der Applikation und Reveal.js geschaffen, die eine maximale Anpassbarkeit der Darstellung ermöglicht. Neben einem Texteditor für den Quelltext der Präsentation bietet die Software mit einer anpassbaren Toolbar und einer Echtzeit-Vorschau praktische Lösungen an, welche eine intuitive Nutzung ermöglichen., Presentations have become indispensable in many areas of daily life. In addition to common programs such as Microsoft PowerPoint, in which the graphical representation of presentations is edited directly, alternative approaches exist in which the presentations are edited in the source code. This results in a variety of advantages, for example in teamwork, versioning, and a better separation of content and design. Existing solutions in this area, however, either require advanced technical knowledge or are very limited in their functionality. In this thesis, a concept is developed to make source codebased presentations accessible to a broader target group. For this purpose, an application is designed that can be used to edit presentations in the Markdown markup language. Simple and intuitive use shall be ensured without limiting the possibilities for customizing the presentation. The elaborated concept is implemented as a desktop application. The software processes Markdown source code into an interactive web presentation, using the framework Reveal.js. Templates are used to create an abstraction between the application and Reveal.js, allowing maximum customizability of the display. In addition to a text editor for the source code of the presentation, the software offers practical solutions with a customizable toolbar and a real-time preview, which allow intuitive use.

A report from working group 3 'Serverless Applications and Requirements' in Dagstuhl Seminar 21201, discussing why and when applications should be serverless, what the unique characteristics are, which trade-offs and scopes exist, and giving exemplary insights into serverless application domains, along with six take-aways for the wider research community.

AI convergence platforms such as Google's Unified AI Platform promise to fully interpret and understand any data submitted to them. The business needs of SMEs are however better addressed by tailored tools that smartly parse and interpret data without being locked into a particular vendor platform. With AutoTable, a new tool design for schema, pattern and relation inference as well as training data synthesis has recently become available. This paper explains why AutoTable is smart, unintrusive and yet powerful in working with tabular business data such as CSVs, flat JSON and spreadsheets.

Die zunehmende Nutzung des Internets in allen Lebensbereichen birgt auch eine zunehmende Gefahr von Internetkriminalität, wie beispielsweise den Missbrauch von persönlichen Daten. Dies zu verhindern ist sowohl Aufgabe des Staates, welcher mittels gesetzlicher Vorgaben festlegt wie Daten verarbeitet werden dürfen, als auch Aufgabe eines jeden Internetnutzenden. Dabei zeigt sich jedoch das als Datenschutzparadoxon bekannte Problem. Den Nutzenden von Dienstleistungen im Internet ist zwar einerseits der Schutz ihrer Daten wichtig, andererseits geben sie persönliche Informationen freizügig preis. Diese Studie untersucht, ob diese Diskrepanz zwischen Einstellung und Verhalten mittels der Bewusstmachung von persönlicher Betroffenheit aufgelöst werden kann. Im Rahmen eines Umfrageexperiments wird versucht bei den Teilnehmenden mittels eines Zeitungsartikels zu einem Datenmissbrauch-Skandal in ihrem Heimatland persönliche Betroffenheit auszulösen. Die Kontrollgruppe erhält einen äquivalenten Stimulus zu einem anderen Land. Anschliessend wird getestet, wie viele persönliche Informationen die Versuchsteilnehmenden preisgeben. Es zeigt sich, dass diejenigen, bei denen ein Zeitungsartikel zu Datenmissbräuchen eine höhere persönliche Betroffenheit auslöst, auch weniger persönliche Daten teilen. Allerdings zeigt sich auch, dass der verwendete Zeitungsartikel zum Heimatland kein systematischer Auslöser von persönlicher Betroffenheit darstellt. Die Studie verdeutlicht also die Relevanz von persönlicher Betroffenheit und regt dazu an, weitere Stimuli zu erforschen.

Anlässlich der akuten Bedrohungslage durch Cyberattacken weltweit wurde im ersten Quartal 2023 im Rahmen einer Masterarbeit untersucht, wie sich die aktuelle Situation bezüglich Cyberangriffe und IT-Sicherheitsmassnahmen in der Schweizer Speditions- und Logistikindustrie darstellt. Das Ergebnis wurde anschliessend mit der Situation in der Schweizer Tech-Industrie (Maschinen-, Elektro- und Metall-Industrie sowie verwandte Technologiebranchen) und mit der deutschen Logistik- und Tech-Industrie verglichen. Es zeigte sich, dass die Unternehmen der Schweizer Speditions- und Logistikindustrie ähnlich, wenn auch technisch und organisatorisch unterschiedlich ausgeprägt, auf Cyberangriffe vorbereitet sind wie die Unternehmen der Schweizer Tech-Industrie. Zudem haben die angegriffenen Unternehmen der Schweizer Speditions- und Logistikindustrie ihre IT-Sicherheitsmassnahmen nach den Angriffen nochmals deutlich verbessert. Abschliessend wird empfohlen, das Thema Cybersicherheit auf Geschäftsleitungsebene in einem zentralen Risikomanagement zu verankern und dem Faktor Mensch künftig noch mehr Beachtung zu schenken. Insbesondere auf künstlicher Intelligenz basierende Cyberangriffe sind immer schwieriger zu erkennen, weshalb in entsprechende Sensibilisierungsmassnahmen bei den Mitarbeitenden investiert werden sollte, um die Cybersicherheit der Unternehmen zu erhöhen.

Language data is used not only by linguists, but also in many other research disciplines. In the Swiss-AL project, we aim to develop practices for a diverse community interested in exploring the potential of language data while implementing FAIR data management principles and integrating them into the Swiss-AL workbench.

Context and motivation. Guaranteeing effective software requirement communication among stakeholders and software developers is crucial to ensure stakeholders’ satisfaction. Nevertheless, communicating software requirements is error-prone due to misunderstandings between stakeholders and software developers, producing misalignment between the expected solution and the final product. Problem. Some authors have proposed software requirements patterns to effectively specify requirements, relying on a reusable experience-based approach. However, industry studies show that using requirements patterns is not yet an established practice due to the lack of tools and scalability of existing solutions. Solution. This tool & demonstration paper presents the first version of the architecture of LEMON, a software requirements tool to assist requirements specification based on reusable and documented requirements patterns. In this paper, we exemplify LEMON’s components and present a tool prototype through a use case demonstration in the context of digital health software development. Results and conclusions. We conclude our paper by reflecting on the challenges, opportunities, and next research efforts towards maximising LEMON’s industrial adoption based on practitioners’ feedback gathered through an online survey.

The prevailing consensus in cybersecurity is that individuals’ insecure behavior due to inadequate decision-making is a primary source of cyber incidents. The conclusion of this assumption is to enforce desired behavior via extensive security policies and suppress individuals’ intuitions or rules of thumb (cognitive heuristics) when dealing with critical situations. This position paper aims to change the way we look at these cognitive heuristics in cybersecurity. We argue that heuristics can be particularly useful in uncertain environments such as cybersecurity. Based on successful examples from other domains, we propose that heuristic decision-making should also be used to combat cyber threats. Lastly, we give an outlook on where such heuristics could be beneficial in cybersecurity (e.g., phishing detection or incident response) and how they can be found or created.

Over the past decades, there has been a growing interest in long-term heart rate records, especially from free-living animals. Largely, this increase is because most of the metabolic activity of tissues is based on oxygen delivery by the heart. Therefore, heart rate has served as a proxy for energy expenditure in animals. However, heart rates or other physiological variables recorded in humans and animals using loggers often contain noise. False measurements are sometimes eliminated by hand or by filters that reject variables based on the shape or frequency of the signal. Occasionally, outliers are rejected because they occur a long distance from genuine data. We introduce an R package, boxfilter, which enables users to eliminate noise based on counting the number of close neighbours inside a gliding window. Depending on the cut-off value chosen, a focal point with a low proportion of neighbours will be rejected as noise. All three parameters, namely window width and height, as well as the cut-off value, can be computed automatically. The choice of the clip-off value beyond which data points are discarded is crucial. The package boxfilter cannot, of course, solve problems caused by completely erroneous measurements. Like the human eye, this filter prefers points that are part of a pattern, such as a dense band, and rejects isolated values. The boxfilter may also be applied to other measures than heart rate that do not change instantaneously, such as body temperature, blood pressure or sleep parameters.

Context and motivation. Traceability is an essential part of quality assurance tasks for software maintainability, validation, and verification. However, the effort required to create and maintain traces is still high compared to their benefits. Problem. Some authors have proposed traceability tools to address this challenge, yet some of those tools require historical traceability data to generate traces, representing an entry barrier to software development teams that do not do traceability. Another common requirement of existing traceability tools is the scope of artefacts to be traced, hindering the adaptability of traceability tools in practice. Principal ideas. Motivated by the mentioned challenges, in this paper we propose OntoTraceV2.0: a tool for supporting trace generation of arbitrary software artefacts without depending on historical traceability data. The architecture of OntoTraceV2.0 integrates ontology-based automatic reasoning to facilitate adaptability for tracing arbitrary artefacts and natural language processing for discovering traces based on text-based similarity between artefacts. We conducted a quasi-experiment with 36 subjects to validate OntoTraceV2.0 in terms of efficiency, effectiveness, and satisfaction. Contribution. We found that OntoTraceV2.0 positively affects the subjects’ efficiency and satisfaction during trace generation compared to a manual approach. Although the subjects’ average effectiveness is higher using OntoTraceV2.0, we observe no statistical difference with the manual trace generation approach. Even though such results are promising, further replications are needed to avoid certain threats to validity. We conclude the paper by analysing the experimental results and limitations we found, drawing on future challenges, and proposing the next research endeavours.

Das Versicherungsgeschäft basiert wesentlich auf der Verfügbarkeit und Nutzung von Daten, um Risiken zu quantifizieren und Preise festzulegen. Obwohl die effektive Aggregation von Daten und deren Analyse seit jeher zu den Schlüsselkompetenzen der Branche gehören, ist die Bedeutung von Daten als wertgenerierendem Asset im Zuge technologischer Entwicklungen gestiegen. Der Fokus der Datenanalytik verschiebt sich von der reinen Auswertung hin zu Vorhersage (Prädiktion) sowie zu Handlungs- und Entscheidungsorientierung (Präskription). Die Bedeutung unstrukturierter Daten ist gestiegen. Insbesondere durch das Aufkommen generativer künstlicher Intelligenz (Generative AI) und grosser Sprachmodelle (Large Language Models) könnte den Unternehmen ein Umbruch in Bezug auf Kundeninteraktion, Prozesse und Arbeitsweisen bevorstehen. In 25 Gesprächen mit Expertinnen und Experten aus Versicherungsindustrie und Beratung, mittels einer Umfrage unter Mitarbeitenden im Versicherungssektor sowie durch die Analyse von Stelleninseraten sind wir der Frage nachgegangen, was die Entwicklungen in Datenanalytik und künstlicher Intelligenz für die Versicherungsunternehmen bedeuten. Unser Fokus lag dabei insbesondere auf der zunehmenden methodischen und technologischen Komplexität und deren Konsequenzen für Kompetenzen, Rollen, Zusammenarbeit und Arbeitsweisen. Es lässt sich feststellen, dass die Branche massiv in Methodik, Werkzeuge und Systeme investiert, wenngleich grundsätzlich eine gewisse Zurückhaltung gegenüber allzu schnellen und radikalen Neuerungen herrscht. Die Covid-19-Pandemie und die Fortschritte in der generativen künstlichen Intelligenz wie ChatGPT werden gleichwohl als Katalysatoren für eine stärkere Datenorientierung in allen geschäftlichen Funktionen angesehen. Diese Katalysatoren sind insbesondere deswegen effektiv, weil sie nicht nur auf strategischer Ebene («top-down») wirken, sondern unmittelbaren Einfluss auf die Arbeitsweisen der Mitarbeitenden haben («bottom-up»). Unsere

This data paper describes the collection process and processing steps of bibliographic metadata of articles published in the two professional journals “Krankenpflege” (ISSN: 0253-0465) and “GERONTOLOGIE CH. Praxis + Forschung” by members of Swiss higher education institutions (HEI). Metadata provided by the publisher itself (Gerontologie CH.) or the database CINAHL Ultimate (“Krankenpflege”) were obtained, enriched, partly checked, and corrected to create a list of articles in tabular form as Excel and CSV of all articles published by Swiss university members between 2020 and 2023. In addition, all full-texts of articles listed for the journal “GERONTOLOGIE CH. Praxis + Forschung” have been extracted from the issues and are available in PDF. The lists include all bibliographic metadata elements, facilitating comparison with existing records in Swiss repositories and identifying articles not yet indexed. Missing articles can be stored within a Swiss university repository if the author is affiliated with the respective institution.

Several authors have proposed novel model-driven development (MDD) tools for years, promising to increase software development productivity and decrease software time-to-market. Although their effort to achieve such a promise, MDD tools have not shown a significant difference in benefits compared to classical code-centric development. This issue has led some authors to identify challenges that model-driven engineers—i.e., who create MDD tools—should address to improve current MDD tools. Specifically, some of these challenges arise from the lack of well-designed assistance during modeling in MDD tools. Due to that, some authors have proposed modeling assistants to address such challenges. However, some modeling assistants lack modeling context-awareness, hindering user experience in MDD tools. On the other hand, some authors have proposed context-aware modeling assistants. Nevertheless, such authors use domain- and modeling-task-dependent methods for proposing such context-aware modeling assistants, lacking generality. Therefore—in this Ph.D. thesis—we propose MERLIN: a MEthod for cReating modeLIng assistaNts in the context of MDD tools. MERLIN allows model-driven engineers for implementing context-aware modeling assistants by using a domain- and modeling-task-independent method. We frame our research using the Design Science method, proposing a set of goals and research questions. We expect that modeling assistants implemented by using MERLIN will increase the technology acceptance of MDD tools. Finally, we discuss the progress achieved so far and the research plan.

The 4th International Workshop on Dynamic Scheduling Problems IWDSP 2023, Die Tagung "The 4th International Workshop on Dynamic Scheduling Problems" (IWDSP 2023) war ein voller Erfolg. Wissenschaftler aus der ganzen Welt kamen an der ZHAW zusammen um sich über ihre neuesten Forschungsergebnisse in dynamischer Ablaufplanung auszutauschen. Ganz besonders hervorzuheben ist die Plenarvorlesung zur Berechenbarkeit und Komplexität in der Ablaufplanung unter stochastischen Einflüssen mit Szenarien von Prof. Leen Stougie (Ehemaliger Gruppen-Leiter des Centrum Wiskunde & Informatica, dem nationalen niederländischen Forschungsinstitut für Mathematik und Informatik, und Professor für Informatik an der Freien Universität Amsterdam, Niederlande). Während die Tagung in Reminiszenz von Albert Einstein im historischen Physikgebäude stattfand, können wir nun unseren Tagungsband zu den Fachvorträgen digital veröffentlichen. Darüberhinaus sind wir erfreut darüber, dass das renommierte Journal of Scheduling eine Sonderausgabe zu unserer Tagung herausgeben wird. Der Workshop wurde in Winterthur organisiert von Dr. Helmut Sedding, Operations Research und Operations Management, Institut für Datenanalyse und Prozessdesign, ZHAW School of Engineering unter wissenschaftlicher Leitung von Prof. Stanisław Gawiejnowicz, Algorithmik, von der Fakultät für Mathematik und Informatik, Adam Mickiewicz Universität Posen in Polen und Prof. Gur Mosheiov, Operations Research und Operations Management, Charles I. Rosen Chair in Business Administration von der Hebräischen Universität von Jerusalem, Israel. Wir bedanken uns ausserdem für die Unterstützung durch die wissenschaftlichen und die lokalen Komitees und den Schweizerischen Nationalfonds mit dem SNF Scientific Exchanges Projekt Nr. 211197.

For software maintenance and evolution, insight into the codebase is crucial. One way to enhance insight is the application of static analysis to extract and visualize program-specific relations from the code itself, such as call graphs and inheritance trees. Yet, software often contains in-house libraries: unique, domain-specific libraries whose usage is typically scattered throughout the codebase. To provide sufficient insight into the usage of those libraries, the static analysis must be customized with domain-specific information. In this paper, we propose a method to enhance insight into the usage of in-house libraries by producing custom overviews. Furthermore, we describe three exploratory case studies targeting industrial C++ and Ada codebases, in which the method was developed, evolved, and validated. The method prescribes how to create custom overviews using static analysis iteratively, starting from a user-provided, initial specification of proper library usage using code patterns. As a safeguard, the method includes cross-checks to detect code fragments that deviate from proper library usage. Whenever such a deviating library usage is found, the code owners determine whether that deviating library usage should be added to the specification of proper library usage or the code fragment should be made compliant. The latter alternative makes both the codebase more regular and keeps the custom static analysis simpler. The method creates custom overviews that reveal opportunities to improve the usage of the in-house libraries, e.g., the removal of domain-specific redundant code which cannot be detected using generic tools, such as compilers and linters. We observed that industrial codebases are regular enough to create custom overviews using static analysis in the three exploratory case studies. Furthermore, we observed that the cross-checks, which detect deviating library usage, ensure the validity and completeness of the custom overviews. We conclude that pr