Software is continually increasing in size and complexity, and therefore, vulnerability discovery would benefit from techniques that identify potentially vulnerable regions within large code bases, as this allows for easing vulnerability detection by reducing the search space. Previous work has explored the use of conventional code-quality and complexity metrics in highlighting suspicious sections of (source) code. Recently, researchers also proposed to reduce the vulnerability search space by studying code properties with neural networks. However, previous work generally failed in leveraging the rich metadata that is available for long-running, large code repositories. In this paper, we present an approach, named Bran, to reduce the vulnerability search space by combining conventional code metrics with fine-grained repository metadata. Bran locates code sections that are more likely to contain vulnerabilities in large code bases, potentially improving the efficiency of both manual and automatic code audits. In our experiments on four large code bases, Bran successfully highlights potentially vulnerable functions, outperforming several baselines, including state-of-art vulnerability prediction tools. We also assess Bran's effectiveness in assisting automated testing tools. We use Bran to guide syzkaller, a known kernel fuzzer, in fuzzing a recent version of the Linux kernel. The guided fuzzer identifies 26 bugs (10 are zero-day flaws), including arbitrary writes and reads.

Cloud Computing is emerging as a major trend in ICT industry. However, as with any new technology, new major challenges lie ahead, one of them concerning the resource provisioning. Indeed, modern Cloud applications deal with a dynamic context that requires a continuous adaptation process in order to meet satisfactory Quality of Service (QoS) but even the most titled Cloud platform provide just simple rule-based tools; the rudimentary autoscaling mechanisms that can be carried out may be unsuitable in many situations as they do not prevent SLA violations, but only react to them. In addition, these approaches are inherently static and cannot catch the dynamic behavior of the application and are unsuitable to manage multi-Cloud/data center deployments required for mission critical services. This situation calls for advanced solutions designed to provide Cloud resources in a predictive and dynamic way. This work presents capacity allocation algorithms, whose goal is to minimize the total execution cost while satisfying some constraints on the average response time of multi-Cloud based applications. This paper proposes a joint load balancing and receding horizon capacity allocation techniques, which can be employed to handle multiple classes of requests. An extensive evaluation of the proposed solution against an Oracle with perfect knowledge of the future and well-known heuristics proposed in the literature is provided. The analysis shows that our solution outperforms the heuristics producing results very close to the optimal ones, and reducing the number of QoS violations (in the worst case QoS constraints violation rate is 4.26 percent versus up to 17.25 percent of other approaches and can easily reduced by roughly a factor of four by exploiting the receding horizon approach). Furthermore, a sensitivity analysis over two different time scales indicates that finer grained time scales are more appropriate for spiky workloads. Analytical results are validated through simulation, which also analyzes the impact of Cloud environment random perturbations. Finally, experiments on a prototype environment demonstrate the effectiveness of the proposed approach under real workloads.

Distributed streaming applications, i.e. applications that process massive and potentially infinite streams of data, are becoming increasingly popular in order to tame at the same time the velocity and the volume of Big Data. Designing and developing distributed streaming applications is currently difficult because it involves the employment of 1) complex programming paradigms to deal with the unboundedness of data streams together with 2) distributed streaming engines, each coming with its own APIs. To address the above shortcomings, in this tool demo paper we present StreamGen, a model-driven tool aiming at simplifying the development of distributed streaming applications. StreamGen provides (i) a UML profile to add streaming-specific concepts to standard UML Class Diagrams and (ii) a model-to-text transformation to automatically generate the application code starting from UML models.

Big Data or Data-Intensive applications (DIAs) seek to mine, manipulate, extract or otherwise exploit the potential intelligence hidden behind Big Data. However, several practitioner surveys remark that DIAs potential is still untapped because of very difficult and costly design, quality assessment and continuous refinement. To address the above shortcoming, we propose the use of a UML domain-specific modeling language or profile specifically tailored to support the design, assessment and continuous deployment of DIAs. This article illustrates our DIA-specific profile and outlines its usage in the context of DIA performance engineering and deployment. For DIA performance engineering, we rely on the Apache Hadoop technology, while for DIA deployment, we leverage the TOSCA language. We conclude that the proposed profile offers a powerful language for data-intensive software and systems modeling, quality evaluation and automated deployment of DIAs on private or public clouds.

Infrastructure-as-code (IaC) is the DevOps tactic of managing and provisioning infrastructure through machine-readable definition files, rather than physical hardware configuration or interactive configuration tools. From a maintenance and evolution perspective, the topic has picked the interest of practitioners and academics alike, given the relative scarcity of supporting patterns, best practices, tools, and software engineering techniques. Using the data coming from 44 semistructured interviews to senior developers of as many companies, in this paper we shed light on the state of the practice in the adoption of IaC and the key software engineering challenges in the field. Particularly, we investigate (i) how practitioners adopt and develop IaC, (ii) which support is currently available, i.e., the typically used tools and their advantages/disadvantages, and (iii) what are the practitioner's needs when dealing with IaC development, maintenance, and evolution. Our findings clearly highlight the need for more research in the field: the support provided by currently available tools is still limited, and developers feel the need of novel techniques for testing and maintaining IaC code.

The rise of Big Data is leading to an increasing demand for large-scale data-intensive applications (DIAs), which have to analyse massive amounts of personal data (e.g. customers' location, cars' speed, people heartbeat, etc.), some of which can be sensitive, meaning that its confidentiality has to be protected. In this context, DIA providers are responsible for enforcing privacy policies that account for the privacy preferences of data subjects as well as for general privacy regulations. This is the case, for instance, of data brokers, i.e. companies that continuously collect and analyse data in order to provide useful analytics to their clients. Unfortunately, the enforcement of privacy policies in modern DIAs tends to become cumbersome because (i) the number of policies can easily explode, depending on the number of data subjects, (ii) policy enforcement has to autonomously adapt to the application context, thus, requiring some non-trivial runtime reasoning, and (iii) designing and developing modern DIAs is complex per se. For the above reasons, we need specific design and runtime methods enabling so called privacy-by-design in a Big Data context. In this article we propose an approach for specifying, enforcing and checking privacy policies on DIAs designed according to the Google Dataflow model and we show that the enforcement approach behaves correctly in the considered cases and introduces a performance overhead that is acceptable given the requirements of a typical DIA.

As part of the DevOps tactics, Infrastructure-as-Code (IaC) provides the ability to create, configure, and manage complex infrastructures by means of executable code. Writing IaC, however, is not an easy task, since it requires blending different infrastructure programming languages and abstractions, each specialized on a particular aspect of infrastructure creation, configuration, and management. Moreover, the more the architectures become large and complex (e.g. Data-Intensive or Microservice-based architectures), the more dire the need of IaC becomes. The goal of this paper is to exploit Model-Driven Engineering (MDE) to create language-agnostic models that are then automatically transformed into IaC. We focus on the domain of Data-Intensive Applications as these typically exploit complex infrastructures which demand sophisticated and fine-grained configuration and re-configuration — we show that, through our approach, called DICER, it is possible to create complex IaC with significant amounts of time savings, both in IaC design as well as deployment and re-deployment times.

The rise of Big Data is leading to an increasing demand for data-intensive applications (DIAs), which, in many cases, are expected to process massive amounts of sensitive data. In this context, ensuring data privacy becomes paramount. While the way we design and develop DIAs has radically changed over the last few years in order to deal with Big Data, there has been relatively little effort to make such design privacy-aware. As a result, enforcing privacy policies in large-scale data processing is currently an open research problem. This thesis proposal makes one step towards this investigation: after identifying the dataflow model as the reference computational model for large-scale DIAs, (1) we propose a novel language for specifying privacy policies on dataflow applications along with (2) a dataflow rewriting mechanism to enforce such policies during DIA execution. Although a systematic evaluation still needs to be carried out, preliminary results are promising. We plan to implement our approach within a model-driven solution to ultimately simplify the design and development of privacy-aware DIAs, i.e. DIAs that ensure privacy policies at runtime.

DevOps entails a series of software engineering tactics aimed at shortening the actionable operation of software design changes. One of these tactics is to harness infrastructure-as-code, that is, writing a blueprint that contains deployment specifications ready for orchestration in the cloud. This abstract briefly discusses all necessary elements and abstractions in writing and maintaining that blueprint, revolving around a key standard for its expression, namely, the OASIS "Topology and Orchestration Specification for Cloud Applications" (TOSCA) industrial standard adopted by as many as 60+ big industrial players worldwide.

With the onset of Big Data and Data-Intensive Applications (DIAs) exploiting such big data, the problem of offering privacy guarantees to data owners becomes crucial, even more so with the emergence of DevOps development strategies where speed is paramount. This paper outlines this complex scenario and the challenges therein. On one hand, we outline a tool prototype that addresses the key challenge we found in industry, more specifically, assisting the process of continuous DIA architecting for the purpose of offering privacy-by-design guarantees. On the other hand we define a research roadmap in pursuit of a more correct and complete solution for ensured privacy-by-design in the context of Big Data DevOps.

Recently we witnessed a deep transformation in the the design, development and management of modern applications, which have grown in scope and size becoming distributed and service-oriented.A big part in this metamorphosis is played by the Cloud with the availability of almost-infinite resources, high availability and outsourced maintenance.This has led to the emergence of new software development methodologies to effectively deal with this paradigm shift in the field of software engineering.DevOps is one of them, it advocates for a greater level of collaboration and convergence between developers and other IT professionals.Consequently, new tools, purposely designed to ease this process, are required.In this scenario, we present SPACE4Cloud, a DevOps integrated environment for model-driven design-time quality of service assessment and optimization, and runtime capacity allocation of Cloud applications.

Big Data technologies are rapidly becoming a key enabler for modern industries. However, the entry costs inherent to ``going Big" are considerable, ranging from learning curve, renting/buying infrastructure, etc. A key component of these costs is the time spent on learning about and designing with the many big data frameworks (e.g., Spark, Storm, HadoopMR, etc.) on the market. To reduce said costs while decreasing time-to-market we advocate the usage of Model-Driven Engineering (MDE), i.e., software engineering by means of models and their automated manipulation. This paper outlines a tool architecture to support MDE for big data applications, illustrating with a case-study.

DevOps entails a series of software engineering strategies and tools that promise to deliver quality and speed at the same time with little or no additional expense. In our work we strived to enable a DevOps way of working, combining Model-Driven Engineering tenets with the challenges of delivering a model-driven continuous deployment tool that allows quick (re-)deployment of cloud applications for the purpose of continuous improvement. This paper illustrates the DICER tool and elaborates on how it can bring about the DevOps promise and enable the quality-awareness.

DevOps is an emerging software engineering strategy entailing the joined efforts of development and operations people, their concerns and best practices with the purpose of realising a coherent working group for increased software development and operations speed. To allow software architecture practitioners to enrich and properly elaborate their architecture specifications in a manner which is consistent with DevOps, we surveyed a number of DevOps stakeholders. We studied concerns and challenges to be tackled with respect to preparing a software architecture which is DevOps-ready, i.e., described in all details needed to enact DevOps scenarios. Subsequently, we introduce SQUID, that stands for Specification Quality In DevOps. SQUID is a software architecture framework that supports the model-based documentation of software architectures and their quality properties in DevOps scenarios with the goal of providing DevOps-ready software architecture descriptions. We illustrate our framework in a case-study in the Big Data domain.

We present the open reference architecture of the SeaClouds solution. It aims at enabling a seamless adaptive multi-cloud management of complex applications by supporting the distribution, monitoring and reconfiguration of app modules over heterogeneous cloud providers.

Cloud computing has been a game changer in the design, development and management of modern applications, which have grown in scope and size becoming distributed and service oriented. New methodologies have emerged to deal with this paradigm shift in software engineering. Consequently, new tools, devoted to ease the convergence between developers and other IT professional, are required. Here, we present SPACE4Cloud, a DevOps integrated environment for model-driven design-time QoS assessment and optimization, and runtime capacity allocation for Cloud applications.