Publications

@article{nokey,

title = {FM-PRO: A Feature Modeling Process},

author = {Johan Martinson and Wardah Mahmood and Jude Gyimah and Thorsten Berger},

year  = {2024},

date = {2024-12-05},

journal = {IEEE Transactions on Software Engineering (TSE)},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Software Reconfiguration in Robotics},

author = {Sven Peldszus and Davide Brugali and Daniel Strüber and Patrizio Pelliccione and Thorsten Berger},

url = {https://arxiv.org/pdf/2310.01039},

year  = {2024},

date = {2024-10-24},

journal = {Empirical Software Engineering (EMSE) Journal},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Virtual Platform: Effective and Seamless Variability Management for Software Systems},

author = {Wardah Mahmood and Gül Calikli and Daniel Strüber and Ralf Lämmel and Mukelabai Mukelabai and Thorsten Berger},

year  = {2024},

date = {2024-05-01},

urldate = {2024-05-01},

journal = {IEEE Transactions on Software Engineering (TSE)},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Runtime Verification and Field Testing for ROS-Based Robotic Systems},

author = {Ricardo Caldas and Juan Antonio Piñera García and Matei Schiopu and Patrizio Pelliccione and Genaína Rodrigues and Thorsten Berger},

url = {https://arxiv.org/abs/2404.11498},

year  = {2024},

date = {2024-04-17},

urldate = {2024-04-17},

journal = {IEEE Transactions on Software Engineering (TSE)},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Detecting Semantic Conflicts with Unit Tests},

author = {Leuson Da Silva and Paulo Borba and Toni Maciel and Wardah Mahmood and Thorsten Berger and Joao Moisakis and Aldiberg Gomes and Vinicius Leite},

year  = {2024},

date = {2024-04-15},

journal = {Journal of Systems and Software},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {A Meta-Study of Software-Change Intentions},

author = {Jacob Krüger and Yi Li and Kirill Lossev and Chenguang Zhu and Marsha Chechik and Thorsten Berger and Julia Rubin},

year  = {2024},

date = {2024-04-01},

journal = {ACM Computing Surveys (CSUR)},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {A Driver-Vehicle Model for ADS Scenario-based Testing},

author = {Rodrigo Queiroz and Divit Sharma and Ricardo Caldas and Krzysztof Czarnecki and Sergio García and Thorsten Berger and Patrizio Pelliccione},

url = {https://se.ruhr-uni-bochum.de/wp-content/uploads/2024/02/2205.02911.pdf},

year  = {2024},

date = {2024-03-01},

urldate = {2024-03-01},

journal = {IEEE Transactions on Intelligent Transportation Systems (T-ITS)},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{PBJ2024,

title = {UMLsecRT: Reactive Security Monitoring of Java Applications With Round-Trip Engineering},

author = {Sven Peldszus and Jens Bürger and Jan Jürjens},

url = {https://peldszus.com/wp-content/uploads/2024/01/2024-TSE-UMLsecRT-preprint.pdf},

doi = {10.1109/TSE.2023.3326366},

year  = {2024},

date = {2024-01-01},

journal = {IEEE Transactions on Software Engineering (TSE)},

volume = {50},

number = {1},

pages = {16–47},

abstract = {Today's software systems tend to be long-living and often process security-critical data, so keeping up with ever-changing security measures, attacks, and mitigations is critical to maintaining their security. While it has become common practice to consider security aspects during the design of a system, OWASP still identifies insecure design as one of the top 10 threats to security. Furthermore, even if the planned design is secure, verifying that the planned security assumptions hold at run-time and investigating any violations that may have occurred is cumbersome. In particular, the configuration of run-time monitors such as the Java Security Manager, which could enforce design-time security assumptions, is non-trivial and therefore used in practice rarely. To address these challenges, we present UMLsecRT for automatically supporting model-based security engineering with run-time monitoring of design-time security specifications and round-trip engineering for propagating run-time observations to the design level. Following the established security-by-design approach UMLsec, security experts annotate system models with security properties that UMLsecRT automatically synchronizes with corresponding source code annotations for the automatic configuration of UMLsecRT's run-time monitor. To this end, UMLecRT monitors these security properties at run-time without additional effort to specify monitoring policies. Developers can define mitigations for attacks detected at run-time in advance by adjusting the automatically synchronized annotations at implementation time. Triggered by a security violation, UMLsecRT can adapt the design-time models based on run-time findings to facilitate the investigation of security violations. We evaluated UMLsecRT concerning its effectiveness and applicability to security violations extracted from real-world attacks and the DaCapo benchmark, conducted user studies on the usability of the adapted models and the feasibility of UMLsecRT in practice, especially concerning countermeasures, and investigated the scalability of UMLsecRT. To study the applicability of the whole development process, we applied UMLsecRT in two case studies to the Eclipse Secure Storage and the electronic health record system iTrust.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Machine Learning Experiment Management Tools: A Mixed-Methods Empirical Study},

author = {Samuel Idowu and Osman Osman and Daniel Strüber and Thorsten Berger},

year  = {2024},

date = {2024-01-01},

urldate = {2024-01-01},

journal = {Empirical Software Engineering (EMSE) Journal},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Detecting Semantic Conflicts with Unit Tests},

author = {Léuson Da Silva and Paulo Borba and Toni Maciel and Wardah Mahmood and Thorsten Berger and João Moisakis and Aldiberg Gomes and Vinícius Leite},

url = {https://se.ruhr-uni-bochum.de/wp-content/uploads/2023/10/2310.02395.pdf},

year  = {2023},

date = {2023-10-03},

urldate = {2023-10-03},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {FeatRacer: Locating Features Through Assisted Traceability},

author = {Mukelabai Mukelabai and Kevin Hermann and Thorsten Berger and Jan-Philipp Steghöfer},

year  = {2023},

date = {2023-10-01},

urldate = {2023-10-01},

journal = {IEEE Transactions on Software Engineering (TSE)},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{ghzouli.ea:2023:tse,

title = {Behavior Trees and State Machines in Robotics Applications},

author = {Razan Ghzouli and Thorsten Berger and Einar Broch Johnsen and Andrzej Wasowski and Swaib Dragule},

url = {../wp-content/uploads/2023/08/2023-tse-behaviortrees.pdf},

year  = {2023},

date = {2023-01-01},

urldate = {2023-01-01},

journal = {IEEE Transactions on Software Engineering},

publisher = {IEEE Computer Society},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{derks2023vpbench,

title = {A Benchmark Generator Framework for Evolving Variant-Rich Software},

author = {Christoph Derks and Daniel Strüber and Thorsten Berger},

url = {/wp-content/uploads/2023/08/DSB23.pdf},

year  = {2023},

date = {2023-01-01},

urldate = {2023-01-01},

journal = {Journal of Systems and Software},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{TPS+2022,

title = {Checking Security Compliance between Models and Code},

author = {Katja Tuma and Sven Peldszus and Daniel Strüber and Riccardo Scandariato and Jan Jürjens},

doi = {10.1007/s10270-022-00991-5},

year  = {2022},

date = {2022-03-18},

urldate = {2022-03-18},

journal = {Software and Systems Modeling (SoSyM)},

abstract = {It is challenging to verify that the planned security mechanisms are actually implemented in the software. In the context of model-based development, the implemented security mechanisms must capture all intended security properties that were considered in the design models. Assuring this compliance manually is labor-intensive and can be error-prone. This work introduces the first semi-automatic technique for secure data flow compliance checks between design models and code. We develop heuristic-based automated mappings between a design-level model (SecDFD, provided by humans) and a code-level representation (Program Model, automatically extracted from the implementation) in order to guide users in discovering compliance violations, and hence, potential security flaws in the code. These mappings enable an automated, and project-specific static analysis of the implementation with respect to the desired security properties of the design model. We developed two types of security compliance checks and evaluated the entire approach on open source Java projects.},

note = {Open Access},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{queiroz2022dvm,

title = {A Driver-Vehicle Model for ADS Scenario-based Testing},

author = {Rodrigo Queiroz and Divit Sharma and Ricardo Caldas and Krzysztof Czarnecki and Sergio Garc'ia and Thorsten Berger and Patrizio Pelliccione},

url = {https://arxiv.org/pdf/2205.02911.pdf},

year  = {2022},

date = {2022-01-01},

journal = {arXiv preprint arXiv:2205.02911},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{samuel2022csur,

title = {Asset Management in Machine Learning: State-of-research and State-of-practice},

author = {Samuel Idowu and Daniel Strueber and Thorsten Berger},

url = {../wp-content/uploads/2022/07/2022-csur-mlassetmgmt.pdf},

year  = {2022},

date = {2022-01-01},

journal = {ACM Computing Surveys},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{garcia.ea:2022:robotvar,

title = {Software Variability in Service Robotics},

author = {Sergio Garcia and Daniel Strueber and Davide Brugali and Alessandro Di Fava and Patrizio Pelliccione and Thorsten Berger},

url = {../wp-content/uploads/2022/07/2022-emse-roboticsvariability.pdf},

year  = {2022},

date = {2022-01-01},

urldate = {2022-01-01},

journal = {Empirical Software Engineering},

publisher = {Springer},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{businge.ea:2022:emse,

title = {Reuse and Maintenance Practices among Divergent Forks in Three Software Ecosystems},

author = {John Businge and Openja Moses and Sarah Nadi and Thorsten Berger},

url = {../wp-content/uploads/2022/07/2022-emse-appfamilies.pdf},

year  = {2022},

date = {2022-01-01},

urldate = {2022-01-01},

journal = {Empirical Software Engineering},

volume = {27},

number = {2},

pages = {54},

publisher = {Springer},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{mahmood.ea:2022:emsemodelvar,

title = {Effects of Variability in Models: A Family of Experiments},

author = {Wardah Mahmood and Daniel Strueber and Anthony Anjorin and Thorsten Berger},

url = {../wp-content/uploads/2022/07/2022-emse-modelvar.pdf},

year  = {2022},

date = {2022-01-01},

urldate = {2022-01-01},

journal = {Empirical Software Engineering},

publisher = {Springer},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{linsbauer2021varcs,

title = {Concepts of Variation Control Systems},

author = {Lukas Linsbauer and Felix Schwaegerl and Thorsten Berger and Paul Gruenbacher},

url = {../wp-content/uploads/2022/07/2020-jss-varcs.pdf},

year  = {2021},

date = {2021-01-01},

urldate = {2021-01-01},

journal = {Journal of Systems and Software},

volume = {171},

pages = {110796},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{PBKJ2021,

title = {Ontology-Driven Evolution of Software Security},

author = {Sven Peldszus and Jens Bürger and Timo Kehrer and Jan Jürjens},

doi = {10.1016/j.datak.2021.101907},

year  = {2021},

date = {2021-01-01},

journal = {Data & Knowledge Engineering (DKE)},

volume = {134},

keywords = {},

pubstate = {published},

tppubtype = {article}

}