The Object Management Group's (OMG) Model Driven Architecture (MDA) strategy envisages a world where models play a more direct role in software production, being amenable to manipulation and transformation by machine. Model Driven Engineering (MDE) is wider in scope than MDA. MDE combines process and analysis with architecture. This article sets out a framework for model driven engineering, which can be used as a point of reference for activity in this area. It proposes an organisation of the modelling 'space' and how to locate models in that space. It discusses different kinds of mappings between models. It explains why process and architecture are tightly connected. It discusses the importance and nature of tools. It identifies the need for defining families of languages and transformations, and for developing techniques for generating/configuring tools from such definitions. It concludes with a call to align metamodelling with formal language engineering techniques.

Model Driven Engineering

An attack graph is a succinct representation of all paths through a system that end in a state where an intruder has successfully achieved his goal. Today Red Teams determine the vulnerability of networked systems by drawing gigantic attack graphs by hand. Constructing attack graphs by hand is tedious, error-prone, and impractical for large systems. By viewing an attack as a violation of a safety property, we can use off-the-shelf model checking technology to produce attack graphs automatically: a successful path from the intruder's viewpoint is a counterexample produced by the model checker In this paper we present an algorithm for generating attack graphs using model checking as a subroutine. Security analysts use attack graphs for detection, defense and forensics. In this paper we present a minimization analysis technique that allows analysts to decide which minimal set of security measures would guarantee the safety of the system. We provide a formal characterization of this problem: we prove that it is polynomially equivalent to the minimum hitting set problem and we present a greedy algorithm with provable bounds. We also present a reliability analysis technique that allows analysts to perform a simple cost-benefit trade-off depending on the likelihoods of attacks. By interpreting attack graphs as Markov Decision Processes we can use the value iteration algorithm to compute the probabilities of intruder success for each attack the graph.

Two Formal Analyses of Attack Graphs

We apply a model checker to the problem of test generation using a new application of mutation analysis. We define syntactic operators, each of which produces a slight variation on a given model. The operators define a form of mutation analysis at the level of the model checker specification. A model checker generates countersamples which distinguish the variations from the original specification. The countersamples can easily be turned into complete test cases, that is, with inputs and expected results. We define two classes of operators: those that produce test cases from which a correct implementation must differ, and those that produce test cases with which it must agree. There are substantial advantages to combining a model checker with mutation analysis. First, test case generation is automatic; each countersample is a complete test case. Second, in sharp contrast to program-based mutation analysis, equivalent mutant identification is also automatic. We apply our method to an example specification and evaluate the resulting test sets with coverage metrics on a Java implementation.

Using Model Checking to Generate Tests from Specifications | NIST

Manufacturers are faced with many challenges, such as globalization, disparate enterprise systems and a lack of platform maturity. These will only multiply as technology advances, offshore manufacturing increases and new ways of working emerge. To overcome these challenges, many manufacturers have embraced product lifecycle management (PLM) or have expanded the use of PLM processes and tools to manage product data effi ciently, with increased visibility and control over the life cycle of the product.

/pdf/product-lifecycle-management-4mlr7de931.pdf

Product lifecycle management

A survey of approaches combining safety and security for industrial control systems

Dynamic State Machines (DSTM) is an extension of Hierarchical State Machines recently introduced to answer some concerns raised by model-based validation of railway control systems. However, DSTM can be used to model a wide class of systems for design, verification and validation purposes. Its main characteristics are the dynamic instantiation of parametric machines and the definition of complex data types. In addition, DSTM allows for recursion and preemptive termination. In this paper we present a translation of DSTM models in Promela that can enable automatic test case generation via model checking and, at least in principle, system verification. We illustrate the main steps of the translation process and the obtained Promela encoding.

From Dynamic State Machines to Promela

Recent research advances have brought to a growing interest from both academic and industrial communities in the improvement of existing engineering processes by means of model-driven techniques. This method is starting to demonstrate its effectiveness by raising the level of abstraction and by improving the level of automation of traditional processes. One of these applications is related to V&V processes and in particular to the generation of system level test cases for critical systems. This chapter investigates the possibility to further improve such process by exploiting synergies between model-driven techniques and knowledge engineering ones. This work is developed in the context of Crystal, an EU Artemis funded research project, and focuses on a specific part of its framework. The proposed approaches are demonstrated by means of a case study in the field of railway signalling system.

Improving Automatic Test Case Generation Process with Knowledge Engineering in the Crystal Project

Computer-aided security assessment of water networks monitoring platforms

E-Health organisations have seen in these years a rapid growth in the complexity and criticality of the processes they manage. This paper defines an approach for modelling clinical workflows based on Model-Driven principles; in particular the modelling activity is supported by the Dynamic State Machine (DSTM) formalism, that is a well-formed graphical language able to represent state based systems. The main advantage of using such a language resides in obtaining formal models of clinical workflows (whose semantics is strong and precise), with an high level of usability. While the focus of the paper is clearly on modelling, the application of Model-Driven principles allows a tight integration between the control flow of the clinical processes and the information that can be extracted from informal documentation. The approach is shown by applying it to the case study of a real world treatment process of bipolar and mood disorders.

Roberto Nardone

Papers

From Dynamic State Machines to Promela

Improving Automatic Test Case Generation Process with Knowledge Engineering in the Crystal Project

Computer-aided security assessment of water networks monitoring platforms

Towards Model-Driven Assessment of Clinical Processes

Intelligent detection of warning bells at level crossings through deep transfer learning for smarter railway maintenance