@article{MTMT:33359588, title = {Safety and security of cyber-physical systems}, url = {https://m2.mtmt.hu/api/publication/33359588}, author = {Biro, Miklos and Mashkoor, Atif and Sametinger, Johannes}, doi = {10.1002/smr.2522}, journal-iso = {J SOFTW-EVOL PROC}, journal = {JOURNAL OF SOFTWARE-EVOLUTION AND PROCESS}, unique-id = {33359588}, issn = {2047-7473}, year = {2022}, eissn = {2047-7481} } @article{MTMT:33359589, title = {Intrusion detection framework based on causal reasoning for DDoS}, url = {https://m2.mtmt.hu/api/publication/33359589}, author = {Zeng, ZengRi and Peng, Wei and Zeng, Detian and Zeng, Chong and Chen, YiFan}, doi = {10.1016/j.jisa.2022.103124}, journal-iso = {J INF SECUR APPL}, journal = {JOURNAL OF INFORMATION SECURITY AND APPLICATIONS}, volume = {65}, unique-id = {33359589}, issn = {2214-2126}, abstract = {Among network security issues, distributed denial of service (DDoS) attacks are particularly harmful to a network. Several previous machine learning (ML)-based network intrusion detection approaches have been developed to protect against DDoS attacks. However, existing ML detection approaches diagnose the causality between attacks and traffic features based mainly on purely associative features. Causal reasoning shows that this inability to disentangle correlation from causation can result in diagnostic errors. To solve this problem, this paper proposes a framework of DDoS detection based on causal reasoning to solve the problem of false associations. This framework consists of two main parts: feature selection based on "do-operations" and attack detection by counterfactual diagnosis. First, the noise features that are falsely associated with DDoS attacks are deleted during the "do-operations". Then, the expected number of anomaly features under different DDoS attack types is calculated in the counterfactual situations. The larger the expected value that is calculated for a certain attack, the more likely it is that the anomaly features of the testing data are caused by this attack. The experiments show that the causality between DDoS attacks and the anomaly features can be fully described by our method, which, compared to other classic ML associative methods, increases the detection accuracy by approximately 5% on average.}, keywords = {accuracy; Detecting DDoS; False association; Do-operations; Counterfactual diagnosis}, year = {2022}, eissn = {2214-2134} } @inproceedings{MTMT:33359590, title = {A Conceptual Model for Mitigation of Root Causes of Uncertainty in Cyber-Physical Systems}, url = {https://m2.mtmt.hu/api/publication/33359590}, author = {Asmat, Mah Noor and Khan, Saif Ur Rehman and Mashkoor, Atif}, booktitle = {Database and Expert Systems Applications - DEXA 2021 Workshops}, doi = {10.1007/978-3-030-87101-7_2}, unique-id = {33359590}, abstract = {Cyber-Physical Systems (CPS) are widely used in different domains. The major application domains of CPS are healthcare, transportation, manufacturing, industrial control systems, automatic pilot avionics, robotics systems, and so on. Uncertainty is one of the major issues that challenge the reliability of a CPS. In the literature, various approaches have been proposed to deal with uncertainty. However, fewer studies have focused on handling the root cause analysis of uncertainty and also suggesting the corresponding mitigation strategies. Inspired by this, we propose a conceptual model effective in mitigating the root causes of uncertainty in CPS. Moreover, some potential future research dimensions are outlined.}, keywords = {UNCERTAINTY; CHALLENGES; cyber physical systems; Root causes}, year = {2021}, pages = {9-17}, orcid-numbers = {Asmat, Mah Noor/0000-0003-1802-1267; Mashkoor, Atif/0000-0003-1210-5953} } @article{MTMT:32293890, title = {Safe and secure cyber-physical systems}, url = {https://m2.mtmt.hu/api/publication/32293890}, author = {Bíró, Miklós and Mashkoor, Atif and Sametinger, Johannes}, doi = {10.1002/smr.2340}, journal-iso = {J SOFTW-EVOL PROC}, journal = {JOURNAL OF SOFTWARE-EVOLUTION AND PROCESS}, volume = {33}, unique-id = {32293890}, issn = {2047-7473}, abstract = {Cyber-Physical Systems (CPSs) differ from traditional Information Technology (IT) systems in such a way that they interact with the physical environment, i.e., they can monitor and manipulate real objects and processes. For this special issue, the authors of the best papers of IWCFS 2019 were invited to submit extended versions of their workshop papers. Additionally, we received eight submissions from around the globe as a result of an open call. After thorough and stringent reviews, we selected six articles that provide relevant contributions to the field of safety and security for CPSs.}, keywords = {SAFETY; Security; cyber–; physical system}, year = {2021}, eissn = {2047-7481}, orcid-numbers = {Bíró, Miklós/0000-0001-8627-1159; Mashkoor, Atif/0000-0003-1210-5953} } @CONFERENCE{MTMT:32293891, title = {Evaluating the alignment of sequence diagrams with system behavior}, url = {https://m2.mtmt.hu/api/publication/32293891}, author = {Mashkoor, Atif and Egyed, Alexander}, booktitle = {Proceedings of the 2nd International Conference on Industry 4.0 and Smart Manufacturing (ISM 2020)}, doi = {10.1016/j.procs.2021.01.267}, unique-id = {32293891}, abstract = {In model-driven engineering, sequence diagrams are commonly used to describe a system's expected behavior in different scenarios. Indeed, the information flow described in sequence diagrams should actually take place during a real execution of the system in order to ensure its safety, security and correctness. If it does not, this may lead to serious consequences. In this short paper, we present a novel generic approach for addressing this issue by observing the live execution of a system and checking whether the exhibited information flow correctly follows what has been specified in sequence diagrams. (C) 2021 The Authors. Published by Elsevier B.V.}, keywords = {Correctness; Sequence diagrams; run-time behavior}, year = {2021}, pages = {502-506} } @article{MTMT:32293889, title = {A goal-driven approach for the joint deployment of safety and security standards for operators of essential services}, url = {https://m2.mtmt.hu/api/publication/32293889}, author = {Ponsard, Christophe and Grandclaudon, Jeremy and Massonet, Philippe}, doi = {10.1002/smr.2338}, journal-iso = {J SOFTW-EVOL PROC}, journal = {JOURNAL OF SOFTWARE-EVOLUTION AND PROCESS}, volume = {33}, unique-id = {32293889}, issn = {2047-7473}, abstract = {Designing safety-critical software in domains ensuring essential services like transportation, energy, or health requires high assurance techniques and compliance with domain specific standards. As a result of the global interconnectivity and the evolution toward cyber-physical systems, the increasing exposure to cyber threats calls for the adoption of cyber security standards and frameworks. Although safety and security have different cultures, both fields share similar concepts and tools and are worth being investigated together. This paper provides the background to understand emerging co-engineering approaches. It advocates for the use of a model-based approach to provide a sound risk-oriented process and to capture rationales interconnecting top-level standards/directives to concrete safety/security measures. We show the benefits of adopting goal-oriented analysis that can be transposed later to domain-specific frameworks. Both qualitative and quantitative reasoning aspects are analyzed and discussed, especially to support trade-off analysis. Our work is driven by a representative case study in drinking water utility in the scope of the NIS regulation for operator of essential services.}, keywords = {risk management; Engineering; Standards; Cyber security; Safety analysis; NIS directive; co‐}, year = {2021}, eissn = {2047-7481}, orcid-numbers = {Ponsard, Christophe/0000-0002-5027-2114; Massonet, Philippe/0000-0003-1883-4188} } @article{MTMT:32293892, title = {A formal approach to rigorous development of critical systems}, url = {https://m2.mtmt.hu/api/publication/32293892}, author = {Singh, Neeraj Kumar and Lawford, Mark and Maibaum, Thomas S. E. and Wassyng, Alan}, doi = {10.1002/smr.2334}, journal-iso = {J SOFTW-EVOL PROC}, journal = {JOURNAL OF SOFTWARE-EVOLUTION AND PROCESS}, volume = {33}, unique-id = {32293892}, issn = {2047-7473}, abstract = {Safety critical systems, such as medical, automotive, and avionics systems, play an important role in our daily lives. Increasing demand for new technologies in these safety critical systems requires rapid adoption of commercial hardware and software. However, the adoption of new hardware and software increases life-threatening vulnerabilities. To aid in the reduction of these vulnerabilities and system failures, this paper proposes a framework based on formal methods for developing safety-critical systems from requirements analysis to code generation. This framework includes a development process for documenting system requirements using tabular expressions, automatic formal model generation from the documented requirements, verification and validation of the generated formal models using proof techniques and animations, interactive simulation for validating the required behavior of the developed models by enabling domain experts to observe the system states according to, and finally, code generation from the formal model into a desired language. A prototype toolchain is developed to automate this framework. An assessment of the proposed framework is undertaken through a case study: insulin infusion pump (IIP).}, keywords = {REFINEMENT; simulation; Certification; formal methods; verification and validation; Code generation; proof-based development; tabular expression}, year = {2021}, eissn = {2047-7481} } @article{MTMT:31767336, title = {Current perspectives on the software engineering process}, url = {https://m2.mtmt.hu/api/publication/31767336}, author = {Bíró, Miklós and Colomo-Palacios, Ricardo and Messnarz, Richard}, doi = {10.1002/smr.2313}, journal-iso = {J SOFTW-EVOL PROC}, journal = {JOURNAL OF SOFTWARE-EVOLUTION AND PROCESS}, volume = {32}, unique-id = {31767336}, issn = {2047-7473}, abstract = {This volume comprises a selected set of high-quality and extended articles of the 26th Systems, Software and Services Process Improvement (EuroSPI) Conference, held during September 18-20, 2019 in Edinburgh, UK. Conferences were held in Dublin (Ireland) in 1994, in Vienna (Austria) in 1995, in Brighton (UK) in 1996, in Budapest (Hungary) in 1997, in Gothenburg (Sweden) in 1998, in Pori (Finland) in 1999, in Copenhagen (Denmark) in 2000, in Limerick (Ireland) in 2001, in Nuremberg (Germany) in 2002, in Graz (Austria) in 2003, in Trondheim (Norway) in 2004, in Budapest (Hungary) in 2005, in Joensuu (Finland) in 2006, in Potsdam (Germany) in 2007, in Dublin (Ireland) in 2008, in Alcala (Spain) in 2009, in Grenoble (France) in 2010, in Roskilde (Denmark) in 2011, in Vienna (Austria) in 2012, in Dundalk (Ireland) in 2013, in Luxembourg in 2014, in Ankara (Turkey) in 2015, in Graz (Austria) in 2016, in Ostrava (Czech Republic) in 2017, in Bilbao (Spain) in 2018, and in Edinburgh (UK) in 2019.}, year = {2020}, eissn = {2047-7481}, orcid-numbers = {Bíró, Miklós/0000-0001-8627-1159} } @article{MTMT:31771700, title = {Ensuring safe and consistent coengineering of cyber-physical production systems: A case study}, url = {https://m2.mtmt.hu/api/publication/31771700}, author = {Troels, Michael and Mashkoor, Atif and Demuth, Andreas and Egyed, Alexander}, doi = {10.1002/smr.2308}, journal-iso = {J SOFTW-EVOL PROC}, journal = {JOURNAL OF SOFTWARE-EVOLUTION AND PROCESS}, unique-id = {31771700}, issn = {2047-7473}, abstract = {In today's engineering projects, companies continuously have to adapt their systems to changing customers or dynamic market requirements. This requires a flexible, iterative development process in which different parts of the system under construction are built and updated concurrently. However, concurrent engineering becomes quite challenging in domains where different engineering artifacts from different disciplines come into play, such as safety-critical cyber-physical systems, where the involved engineering artifacts are quite heterogeneous in nature. In such systems, it is of utmost importance that different artifacts remain consistent in order to guarantee a correctly functioning end product. In this article, we discuss our experiences (with a leading company working in the areas of production automation and product processing) in maintaining the consistency between electrical models and the corresponding software controller, when both are subject to continuous changes. The article discusses how we let engineers describe the relationships between electrical models and the corresponding software controller code in the form of links and consistency rules. Additionally, we demonstrate that how our approach, through a process of continuous consistency checking, notifies engineers about the erroneous impact of their changes in various engineering artifacts.}, keywords = {Traceability; Safety analysis; Model-Driven engineering; Software evolution; incremental consistency checking}, year = {2020}, eissn = {2047-7481} }