TL;DR: This column provides examples and guidelines for properly specifying essential (i.e., requirements-level) security use cases for engineering security requirements.
Abstract: Although use cases are a popular modeling approach for engineering functional requirements, they are often misused when it comes to engineering security requirements because requirements engineers unnecessarily specify security architectural mechanisms instead of security requirements. After discussing the relationships between misuse cases, security use cases, and security mechanisms, this column provides examples and guidelines for properly specifying essential (i.e., requirements-level) security use cases.
TL;DR: This paper uses the Unified Modeling Language (UML) and commercial modeling environment Rational Rose Real Time (RoseRT) to obtain UML model statistics and presents a risk assessment methodology which can be used in the early phases of the software life cycle.
Abstract: Risk assessment is an essential part in managing software development. Performing risk assessment during the early development phases enhances resource allocation decisions. In order to improve the software development process and the quality of software products, we need to be able to build risk analysis models based on data that can be collected early in the development process. These models will help identify the high-risk components and connectors of the product architecture, so that remedial actions may be taken in order to control and optimize the development process and improve the quality of the product. In this paper, we present a risk assessment methodology which can be used in the early phases of the software life cycle. We use the Unified Modeling Language (UML) and commercial modeling environment Rational Rose Real Time (RoseRT) to obtain UML model statistics. First, for each component and connector in software architecture, a dynamic heuristic risk factor is obtained and severity is assessed based on hazard analysis. Then, a Markov model is constructed to obtain scenarios risk factors. The risk factors of use cases and the overall system risk factor are estimated using the scenarios risk factors. Within our methodology, we also identify critical components and connectors that would require careful analysis, design, implementation, and more testing effort. The risk assessment methodology is applied on a pacemaker case study.
TL;DR: Aspect oriented programming (AOP) is “the missing link” to allow you slice a system, use case by use case, over “all” lifecycle models and it is here to be harvested—now.
Abstract: Aspect oriented programming (AOP) is “the missing link” to allow you slice a system, use case by use case, over “all” lifecycle models. This will dramatically change the way complex systems are understood, how new features are added to systems, and how systems are implemented and tested. AOP will also add a new dimension of reuse to software development. And it is here to be harvested—now.
TL;DR: A Top-Down Petri Net-Based Approach for Dynamic Workflow Modeling and a Case-Based Framework for Workflow model Management are presented.
Abstract: Business Process Management: A Survey.- Full Papers.- Workflow: A Language for Composing Web Services.- Mining Most Specific Workflow Models from Event-Based Data.- Evaluation of Correctness Criteria for Dynamic Workflow Changes.- Integrated Business Process Management: Using State-Based Business Rules to Communicate between Disparate Stakeholders.- Structuring Business Objectives: A Business Process Modeling Perspective.- Use Cases as Workflows.- A Model to Support Collaborative Work in Virtual Enterprises.- Towards a Library for Process Programming.- Generating a Process Model from a Process Audit Log.- Contracting Workflows and Protocol Patterns.- Security in Business Process Engineering.- Query Nets: Interacting Workflow Modules That Ensure Global Termination.- Generic Recurrent Patterns in Business Processes.- Personal Schedules for Workflow Systems.- A Process-Oriented Model for Authentication on the Basis of a Coloured Petri Net.- Pattern Based Workflow Design Using Reference Nets.- A Model for Process Service Interaction.- Exception Handling in the BPEL4WS Language.- Ratios to Support the Exploration of Business Process Models.- Integrating Business Process Reengineering with Information Systems Development: Issues & Implications.- Undo in Workflow Management Systems.- A Top-Down Petri Net-Based Approach for Dynamic Workflow Modeling.- A Case-Based Framework for Workflow Model Management.- Tool Papers.- ADEPT Workflow Management System.- Modelling and Validation with VipTool.
TL;DR: This paper defines evaluation criteria and then reviews fifteen scenario notations, and twenty-six approaches for the construction of design models from scenarios are briefly compared.
Abstract: The elicitation, modeling and analysis of requirements have consistently been one of the main challenges during the development of complex systems. Telecommunication systems belong to this category of systems due to the worldwide distribution and the heterogeneity of today's telecommunication networks. Scenarios and use cases have become popular for capturing and analyzing requirements. However, little research has been done that compares different approaches and assesses their suitability for the telecommunications domain. This paper defines evaluation criteria and then reviews fifteen scenario notations. In addition, twenty-six approaches for the construction of design models from scenarios are briefly compared.
TL;DR: In this paper, an approach for generating system-level test cases based on use case models and refined by state diagrams is presented. The method is intended for integration into an iterative software development process model and is supported by an XML-based tool for model transformation.
Abstract: For incremental iterative software development processes, automated testing is necessary to enable evolution not only in terms of functionality, but in terms of software quality as well. Automation requires models to provide the necessary information. Scenarios and use cases do not only feed requirements engineering, they may also be the basis for testing. They have to be enriched by detailed behavioral information in order to be used for statistical test case generation. This paper introduces an approach for generating system-level test cases based on use case models and refined by state diagrams. These models are transformed into usage models to describe both system behavior and usage. The method is intended for integration into an iterative software development process model. The resulting test cases are suited to be carried out in conventional ways, i.e., either manually or using test tools. The method is supported by an XML-based tool for model transformation.
TL;DR: This paper presents PLUTO, a simple and intuitive methodology to manage the testing process of product lines, described as Product Lines Use Cases (PLUCs), based on the Category Partition method.
Abstract: This paper presents PLUTO, a simple and intuitive methodology to manage the testing process of product lines, described as Product Lines Use Cases (PLUCs). PLUCs are an extension of the well-known Cockburn's Use Cases, a notation based on natural language descriptions of requirements. The proposed test methodology is based on the Category Partition method, and can be used to derive a generic Test Specification for the product line, and a set of relevant test scenarios for a customer specific application.
TL;DR: Links that may be made between process models and Unified Modelling Language (UML) software specification techniques are discussed, working from an argument that the whole complexity of organisational activity cannot be captured by UML alone.
Abstract: This paper discusses links that may be made between process models and Unified Modelling Language (UML) software specification techniques, working from an argument that the whole complexity of organisational activity cannot be captured by UML alone. The approach taken is to develop a set of use cases, which would be capable of providing information support to a pre-defined organisational process. The nature of the thinking, which is necessary to derive the use cases, is outlined using the pre-defined process as a case study. The grouping of transactions and state changes into Use Cases is shown to require design choices, which may vary between particular organisational contexts. Conclusions are drawn about the direction of further investigation of links between process modelling and UML.
TL;DR: The tasks and support approach uses task descriptions that specify what the user and computer shall accomplish together without being explicit about who performs which parts of a task.
Abstract: The tasks and support approach uses task descriptions that specify what the user and computer shall accomplish together without being explicit about who performs which parts of a task. The requirement is simply to support the identified tasks. Stakeholders can easily validate and later verify such requirements. This approach is just as successful for product development and large-scale work restructuring as it is for buying commercial off-the-shelf products. Although the resulting requirements are of higher quality than traditional requirements, they are much faster to produce.
TL;DR: This work presents an approach with a set of artifacts and methodologies, and to automate the transition from requirement to detail design, to identify objects from the requirements and to model the problem in classes in object-oriented analysis and design (OOAD).
Abstract: To identify objects from the requirements and to model the problem in classes are critical in object-oriented analysis and design (OOAD). Unfortunately, this is recognized as a hard task for most software engineers, because both domain experience and expertise are needed, since there is no crisp guideline. We present an approach with a set of artifacts and methodologies, and to automate the transition from requirement to detail design. Use cases are applied as the method to capture and record requirements. All the use cases are formalized by a use case template. A glossary that contains the domain vocabulary is used throughout the OOAD process to reduce the vagueness of natural language. Some language patterns are introduced to make the automatic processing of use cases possible. We apply robustness analysis to bridge the gap between a use case and its realization, i. e. between a use case and the corresponding collaboration diagram in UML. Some rules are summarized and adopted to automate the object/class identification and behavior distribution among the classes. The implementation of the tool is described.
TL;DR: This work shows a methodical approach for the development of security-critical systems and the modeling of security aspects in the application core with an extension of the Unified Modeling Language for secure systems development, UMLsec.
Abstract: Due to increasing interconnection, IT systems are confronted with more and more attacks. To address this problem, we have to consider security requirements from the beginning of the system development. In early phases of system development, it is common to use a hybrid system view which is based on an object oriented modeling of the application core and the specification of use cases. We present an extension of this process for security-critical systems. We show a methodical approach for the development of security-critical systems and the modeling of security aspects in the application core with an extension of the Unified Modeling Language for secure systems development, UMLsec. Furthermore, we introduce security use cases for the development of security aspects in conjunction with behavioral modeling.
TL;DR: A contract language for PF functional requirements expressed as parameterized use cases is proposed; this language supports the specification of variant parts in the requirements and studies the efficiency of the generated test cases on a case study.
Abstract: Use-cases have been identified as good inputs to generate test cases and oracles at requirement level. To have an automated generation, information is missing from use cases, such as the exact inputs of the system, and the sequential constraints between the use cases. The contribution of this paper is then two-fold. First we propose a contract language for PF functional requirements expressed as parameterized use cases; this language supports the specification of variant parts in the requirements. Then we provide a method, a formal model and a prototype tool to automatically generate both functional and robustness test cases specific to a product from the PF requirements. We study the efficiency of the generated test cases on a case study.
TL;DR: This paper represents a new approach that identifies classes based on goals of use cases without descriptions, and produces use case-entity diagrams as a vehicle for deriving classes from use cases and to show the involvement of classes in use cases of a system.
Abstract: In a use case-driven process, classes in the class diagram need to be identified from use cases in the use case diagram. Current object modelling approaches identify classes either from use case descriptions, or using classic categories. Both ways are inefficient when use cases can be described with many scenarios in different words. This paper represents a new approach that identifies classes based on goals of use cases without descriptions. The approach produces use case-entity diagrams as a vehicle for deriving classes from use cases and to show the involvement of classes in use cases of a system.
TL;DR: The focus of this paper is the development of a semantic model to consistently combine a use-case model and a conceptual class diagram to form a system specification.
Abstract: This paper is towards the development of a methodology for object-oriented software development. The intention is to support effective use of a formal model for specifying and reasoning during the requirements analysis and design of a software development process. The overall purpose is to enhance the application of the Unified Modelling Language (UML) with a formal semantics in the Rational Unified Software Development Process (RUP). The semantic framework defines the meaning of some UML submodels. It identifies both the static and dynamic relationships among these submodels. Thus, the focus of this paper is the development of a semantic model to consistently combine a use-case model and a conceptual class diagram to form a system specification.
TL;DR: In this paper, a method for extracting requirements of an architectural software model comprises providing a use case model as a directed graph of the architecture model comprising nodes corresponding to use cases and relations between nodes.
Abstract: A method for extracting requirements of an architectural software model comprises providing a use case model as a directed graph of the architectural software model comprising nodes corresponding to use cases and relations between nodes (1001), and creating, automatically, a tree comprising a root node corresponding to an abstract use case and at least one leaf node corresponding to one of an abstract use case and a concrete use case (1004).
TL;DR: The Object-Oriented Systems Development Environment and Selecting the Best Alternative Design Strategy are presented, followed by a discussion of project management and planning and systems design.
Abstract: I. FOUNDATIONS FOR OBJECT-ORIENTED SYSTEMS DEVELOPMENT. 1. The Object-Oriented Systems Development Environment. 2. Introduction to Object-Orientation. II. PROJECT MANAGEMENT AND PLANNING. 3. Managing the Object-Oriented Information Systems Project. 4. Project Management and Planning. III. SYSTEMS ANALYSIS. 5. Determining Object-Oriented Systems Requirements. 6. Structuring System Requirements: Use Case Description and Diagrams. 7. Conceptual Data Modeling. 8. Object-Relational Modeling. 9. Analysis Classes. 10. Selecting the Best Alternative Design Strategy. IV. SYSTEMS DESIGN. 11. Physical Database Design. 12. Design Elements. 13. Designing the Human Interface. V. SYSTEMS IMPLEMENTATION AND OPERATION. 14. OOSAD Implementation and Operation. Glossary of Acronyms. Glossary of Terms. Index.
TL;DR: The usage-based reading technique combines traditional inspection principles, use cases, and operational profile testing to create an efficient user-oriented software inspection reading technique.
Abstract: The usage-based reading technique combines traditional inspection principles, use cases, and operational profile testing to create an efficient user-oriented software inspection reading technique. UBR can find faults more effectively and efficiently than the traditional checklist-based method.
TL;DR: This paper focuses on two submodels of the model for context aware service interactions, namely Context Bindings and Context Obligations, and demonstrates how to integrate them into existing service architectures.
Abstract: In this paper we analyse the applicability of our Context Ontology Language (CoOL), considering a range of use cases. After wrapping up the model in use within this language, we introduce some interesting applications of the language, based on a scenario showing the challenges in context aware service interactions.
We focus on two submodels of our model for context aware service interactions, namely Context Bindings and Context Obligations, and demonstrate how to integrate them into existing service architectures.
TL;DR: AuthUML as mentioned in this paper is a framework based on logic programming that analyzes access control requirements in the requirements phase of the life cycle to ensure that they are consistent, complete and conflict-free.
Abstract: Security requirements of a software product need to receive attention throughout its development life cycle. authUML is a framework based on logic programming that analyzes access control requirements in the requirements phase of the life cycle to ensure that they are consistent, complete and conflict-free. The framework is a customized version of Flexible Authorization Framework (FAF) of Jajodia et al. [9] suitable for Unified Modeling Language (UML) based requirement engineering. Our approach analyzes requirements on two levels: Use Cases and the conceptual operations [19]. authUML specifies policies to prevent inconsistent, incomplete and conflicting requirements before the developers proceed to the following phases of the development life cycle.
TL;DR: This work will explore the idea of crosscutting use cases and, therefore, functional concerns, by extending the use case model to integrate non-functional requirements and identifying those use cases that are crosscutting.
Abstract: Existing approaches to software development do not handle properly the crosscutting nature of some requirements, be functional or non-functional. Aspect-oriented approaches aim at handling effectively separation of crosscutting requirements. We have been investigating how to achieve separation of concerns, not only through functional and non-functional requirements, but also by providing mechanisms to identify, modularize, specify and compose crosscutting requirements. In this paper we envisage an aspectual use-case driven approach by extending the use case model to integrate non-functional requirements and identifying those use cases that are crosscutting. The examples of crosscutting concerns usually found in the literature are always non-functional. In this work we will explore the idea of crosscutting use cases and, therefore, functional concerns.
TL;DR: This tutorial introduces the models and methods of usage-centered design and explores the integration of use-centered approaches into software engineering practice, with the focus on use cases.
Abstract: Usage-centered design is a systematic, model-driven approach to visual and interaction design with an established record of effectiveness in a wide variety of settings and areas of application. The tutorial introduces the models and methods of usage-centered design and explores the integration of usage-centered approaches into software engineering practice. Agile approaches to modeling will be emphasized, with the focus on use cases, which are central to usage-centered design and serve as a common thread throughout an integrated usage-centered software engineering process.
TL;DR: RECOCASE is a comprehensive methodology that includes use case description guidelines, a controlled language to support natural language translation, a requirements engineering process model and a tool to assist the specification and reconciliation of requirements.
Abstract: While it is acknowledged that system requirements will never be complete, incompleteness is often due to an inadequate process and methods for acquiring and tracking a representative set of requirements. Viewpoint development has been proposed to address these problems. We offer a viewpoint development approach that fits easily into the current practice of capturing requirements as use case descriptions. However, current practice does not support visualization of use case descriptions, the capture of multiple use case descriptions, the modeling of conflicts and the reconciliation of viewpoints. In our approach we apply techniques from natural language processing, term subsumption and set-theory to automatically convert the use case descriptions into a line diagram. The visualisation of use case descriptions is a natural addition to the object-oriented design of systems using the Unified Modelling Language where diagrams act as communication and validation devices. RECOCASE is a comprehensive methodology that includes use case description guidelines, a controlled language to support natural language translation, a requirements engineering process model and a tool to assist the specification and reconciliation of requirements. Our approach combines group and individual processes to minimise contradictions and missing information and maximise ownership of the requirements models. In this paper we describe each of the parts of our methodology following an example through each section.
TL;DR: A protocol and framework are presented that utilise the Unified Modelling Language and adopts best practice from IT and social science methods that produces a clear linkage between stakeholder goals and expectations, and IT functionality expressed as UML use cases.
Abstract: This paper relates experiences of using a business-process approach to the determination of requirements for social care systems A method has been developed and used successfully with a number of major research projects, most specifically PLANEC A protocol and framework are presented that utilise the Unified Modelling Language and adopts best practice from IT and social science methods It utilises a loose-coupled hierarchical grouping of processes as a strategic view, and more tightly coupled models such as workflows The method, as it has evolved, has produced a clear linkage between stakeholder goals and expectations, and IT functionality expressed as UML use cases
TL;DR: The central idea of the approach is to use the branch-reserving call graph (BRCG) as the intermediate representation of a software program to avoid intensive human involvement in determining the final set of use cases.
Abstract: Understanding the behavior of a software system is an important problem in program comprehension. Use cases have been accepted as an effective means for describing behavioral requirements for a software system. We propose a novel approach for obtaining use cases from source code. The central idea of our approach is to use the branch-reserving call graph (BRCG) as the intermediate representation of a software program. We also provide strategies for pruning the BRCG to avoid generating too many fine-grained use cases. Use cases, which may just undergo some minor modifications from human experts, can be generated through traversing the pruned BRCG. The contributions of our approach are three-fold, i) This method represents a compromised approach, which differs from both the static and dynamic approaches for use case discovery, ii) This method takes into consideration the fact that it is the branch statements that separate one use case from another in source code. iii) This method can avoid intensive human involvement in determining the final set of use cases. We have also performed a case study for this method on a GNU system.
TL;DR: The authors show how analysts and developers can effectively identify requirements by applying a variety of techniques, centered on the power of use cases, and illustrates proven techniques for determining, implementing, and validating requirements.
Abstract: From the Publisher:
"Despite the wealth of development knowledge, experience, and tools available today, a substantial percentage of software projects fail, often because requirements are not correctly determined and defined at the outset, or are not managed correctly as the project unfolds. This second edition of the popular text Managing Software Requirements focuses on this critical cause of failure and offers a practical, proven approach to building systems that meet customers' needs on time and within budget." Using an accessible style, their own war stories, and a comprehensive case study, the authors show how analysts and developers can effectively identify requirements by applying a variety of techniques, centered on the power of use cases. The book illustrates proven techniques for determining, implementing, and validating requirements. It describes six vital Team Skills for managing requirements throughout the lifecycle of a project: Analyzing the Problem, Understanding User Needs, Defining the System, Managing Scope, Refining the System Definition, and Building the Right System. Managing Software Requirements, Second Edition, specifically addresses the ongoing challenge of managing change and describes a process for assuring that project scope is successfully defined and agreed upon by all stakeholders.
TL;DR: This paper provides definitions for types of alternative interaction courses as well as clarifying conceptual differences between, and providing illustrative real-world examples of, each, related to Cockburn's relevant practical approach of use case goals and use case business results in the context of goal-driven requirements engineering.
Abstract: Use cases are a powerful and widely recognised tool for the elicitation and specification of functional software requirements. However, major problems and gaps still exist; practitioners frequently encounter these. One of these is the specification of alternative use case interaction courses. Experience shows that practitioners do not only need to specify alternative interaction courses that are inserted subject to a business condition; they also need to express partially or fully parallel interaction courses, exceptional use case behaviour, and cyclic interaction paths. Based on an extensive literature review and practical observations, this paper provides definitions for types of alternative interaction courses, as well as clarifying conceptual differences between, and providing illustrative real-world examples of, each. Moreover, these definitions are related to Cockburn’s relevant practical approach of use case goals and use case business results in the context of goal-driven requirements engineering. Finally, the provided definitions will contribute to an understanding of use case interaction specification and goal-driven requirements engineering in practice; they also present clear advice on how to perform use case model refactoring through the application of UML’s repeatedly discussed extend-relationship.
TL;DR: This paper describes an input model, a general recognition model, and a series of important classes of recognition parsers with useful computational characteristics so that one can say with some certainty how efficient the recognizers will be, and the kind of patterns the recognizer will accept.
Abstract: Many intelligent interfaces must recognize patterns of user activity that cross a variety of different input channels These multimodal interfaces offer significant challenges to both the designer and the software engineer The designer needs a method of expressing interaction patterns that has the power to capture real use cases and a clear semantics The software engineer needs a processing model that can identify the described interaction patterns efficiently while maintaining meaningful intermediate state to aid in debugging and system maintenanceIn this paper, we describe an input model, a general recognition model, and a series of important classes of recognition parsers with useful computational characteristics; that is, we can say with some certainty how efficient the recognizers will be, and the kind of patterns the recognizers will accept Examples illustrate the ability of these recognizers to integrate information from multiple channels across varying time intervals
TL;DR: This paper obtains an explicit mapping from high-level actions performed by a user (similar to use case scenarios/specification fragments) to their low-level implementation and can be used for design recovery of interactive graphical applications.
Abstract: Nowadays, the majority of productivity applications are interactive and graphical in nature. In this paper, we explore the possibility of taking advantage of these two characteristics in a design recovery tool. Specifically, the fact that an application is interactive means that we can identify distinct execution bursts corresponding closely to "actions" performed by the user The fact that the application is graphical means that we can describe those actions visually from a fragment of the application display itself. Combining these two ideas, we obtain an explicit mapping from high-level actions performed by a user (similar to use case scenarios/specification fragments) to their low-level implementation. This mapping can be used for design recovery of interactive graphical applications. We demonstrate our approach using L/sub Y/X, a scientific word processor.
TL;DR: A simple formal model Generic UC View is introduced which identifies important abstractions and the relations upon them which target the goal and the concept of use case expression is the base for the desired reasoning on whether the behavior of an entity complies with the composed behavior of its sub-entities.
Abstract: Although widely used, traditional use case modeling does not provide explicit means which could be easily used for capturing and testing behavior compliance of the entities involved in a particular use case model. Specifically, a use case model (a set of use cases) related to a system under design provides neither an explicit abstraction to capture the "whole picture" of the behavior of the system, nor to cover the interactions of subsystems and internal actors with the parent system. With the aim to allow for reasoning on the behavior, the paper introduces a simple formal model Generic UC View which identifies important abstractions and the relations upon them which target the goal. Among them, the concept of use case expression is the base for the desired reasoning on whether the behavior of an entity (such as an agent, a subsystem or a software component) complies with the composed behavior of its sub-entities, and the behavior on the communication links of two neighboring entities is compliant. As a proof of the concept, an instance of use case expressions, pro-cases is introduced. Based on behavior protocols, pro-cases can be checked for compliance via an already existing verifier. As pro-cases' syntax is simple, resembling regular-expressions, there are simple guidelines for transforming a use case written in classical textual form (based on a template) into a pro-case.
TL;DR: This paper presents an approach that integrates the FB concept with the UML notation in order to simplify and strengthen the development process of distributed control applications.
Abstract: The function block (FB) concept, which is used in the field of control applications for years, is now enhanced by the evolving IEC 61499 standard to support the development of modular, re-usable, open, and vendor-independent distributed control applications. The Unified Modeling Language (UML) on the other hand is the industry standard for modeling software systems. This paper presents an approach that integrates the FB concept with the UML notation in order to simplify and strengthen the development process of distributed control applications. Use cases are used to capture the requirements of the specific control application. UML models are next used to capture the static and dynamics of the system. A set of transformation rules enhances the transition from UML diagrams to FB design diagrams. CORFU, an IEC-compliant engineering tool, supports the whole process.