Publications

@article{nokey,

title = {A Meta-Study of Software-Change Intentions},

author = {Jacob Krüger and Yi Li and Kirill Lossev and Chenguang Zhu and Marsha Chechik and Thorsten Berger and Julia Rubin},

year  = {2024},

date = {2024-04-01},

journal = {ACM Computing Surveys (CSUR)},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {A Driver-Vehicle Model for ADS Scenario-based Testing},

author = {Rodrigo Queiroz and Divit Sharma and Ricardo Caldas and Krzysztof Czarnecki and Sergio García and Thorsten Berger and Patrizio Pelliccione},

url = {https://se.ruhr-uni-bochum.de/wp-content/uploads/2024/02/2205.02911.pdf},

year  = {2024},

date = {2024-03-01},

urldate = {2024-03-01},

journal = {IEEE Transactions on Intelligent Transportation Systems (T-ITS)},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{PBJ2024,

title = {UMLsecRT: Reactive Security Monitoring of Java Applications With Round-Trip Engineering},

author = {Sven Peldszus and Jens Bürger and Jan Jürjens},

url = {https://peldszus.com/wp-content/uploads/2024/01/2024-TSE-UMLsecRT-preprint.pdf},

doi = {10.1109/TSE.2023.3326366},

year  = {2024},

date = {2024-01-01},

journal = {IEEE Transactions on Software Engineering (TSE)},

volume = {50},

number = {1},

pages = {16–47},

abstract = {Today's software systems tend to be long-living and often process security-critical data, so keeping up with ever-changing security measures, attacks, and mitigations is critical to maintaining their security. While it has become common practice to consider security aspects during the design of a system, OWASP still identifies insecure design as one of the top 10 threats to security. Furthermore, even if the planned design is secure, verifying that the planned security assumptions hold at run-time and investigating any violations that may have occurred is cumbersome. In particular, the configuration of run-time monitors such as the Java Security Manager, which could enforce design-time security assumptions, is non-trivial and therefore used in practice rarely. To address these challenges, we present UMLsecRT for automatically supporting model-based security engineering with run-time monitoring of design-time security specifications and round-trip engineering for propagating run-time observations to the design level. Following the established security-by-design approach UMLsec, security experts annotate system models with security properties that UMLsecRT automatically synchronizes with corresponding source code annotations for the automatic configuration of UMLsecRT's run-time monitor. To this end, UMLecRT monitors these security properties at run-time without additional effort to specify monitoring policies. Developers can define mitigations for attacks detected at run-time in advance by adjusting the automatically synchronized annotations at implementation time. Triggered by a security violation, UMLsecRT can adapt the design-time models based on run-time findings to facilitate the investigation of security violations. We evaluated UMLsecRT concerning its effectiveness and applicability to security violations extracted from real-world attacks and the DaCapo benchmark, conducted user studies on the usability of the adapted models and the feasibility of UMLsecRT in practice, especially concerning countermeasures, and investigated the scalability of UMLsecRT. To study the applicability of the whole development process, we applied UMLsecRT in two case studies to the Eclipse Secure Storage and the electronic health record system iTrust.},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Behavior Trees and State Machines in Robotics Applications (Summary)},

author = {Razan Ghzouli and Thorsten Berger and Einar Broch Johnsen and Andrzej Wasowski and Swaib Dragule},

year  = {2024},

date = {2024-01-01},

urldate = {2024-01-01},

journal = {Software Engineering (SE). Extended abstract of our TSE'23 article},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {FeatRacer: Locating Features Through Assisted Traceability (Summary)},

author = {Mukelabai Mukelabai and Kevin Hermann and Thorsten Berger and Jan-Philipp Steghöfer},

year  = {2024},

date = {2024-01-01},

urldate = {2024-01-01},

journal = {Software Engineering (SE). Extended abstract of our TSE'23 article},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Machine Learning Experiment Management Tools: A Mixed-Methods Empirical Study},

author = {Samuel Idowu and Osman Osman and Daniel Strüber and Thorsten Berger},

year  = {2024},

date = {2024-01-01},

urldate = {2024-01-01},

journal = {Empirical Software Engineering (EMSE) Journal},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Detecting Semantic Conflicts with Unit Tests},

author = {Léuson Da Silva and Paulo Borba and Toni Maciel and Wardah Mahmood and Thorsten Berger and João Moisakis and Aldiberg Gomes and Vinícius Leite},

url = {https://se.ruhr-uni-bochum.de/wp-content/uploads/2023/10/2310.02395.pdf},

year  = {2023},

date = {2023-10-03},

urldate = {2023-10-03},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {FeatRacer: Locating Features Through Assisted Traceability},

author = {Mukelabai Mukelabai and Kevin Hermann and Thorsten Berger and Jan-Philipp Steghöfer},

year  = {2023},

date = {2023-10-01},

urldate = {2023-10-01},

journal = {IEEE Transactions on Software Engineering (TSE)},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{nokey,

title = {Software Variability in Service Robots (Summary)},

author = {Sergio Garcia and Daniel Strueber and Davide Brugali and Alessandro Di Fava and Patrizio Pelliccione and Thorsten Berger},

url = {https://se.ruhr-uni-bochum.de/wp-content/uploads/2023/07/2023-splc-roboticsvar.pdf},

year  = {2023},

date = {2023-01-01},

urldate = {2023-01-01},

journal = {27th ACM International Systems and Software Product Line Conference (SPLC), Journal First track},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{ghzouli.ea:2023:tse,

title = {Behavior Trees and State Machines in Robotics Applications},

author = {Razan Ghzouli and Thorsten Berger and Einar Broch Johnsen and Andrzej Wasowski and Swaib Dragule},

url = {../wp-content/uploads/2023/08/2023-tse-behaviortrees.pdf},

year  = {2023},

date = {2023-01-01},

urldate = {2023-01-01},

journal = {IEEE Transactions on Software Engineering},

publisher = {IEEE Computer Society},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{derks2023vpbench,

title = {A Benchmark Generator Framework for Evolving Variant-Rich Software},

author = {Christoph Derks and Daniel Strüber and Thorsten Berger},

url = {/wp-content/uploads/2023/08/DSB23.pdf},

year  = {2023},

date = {2023-01-01},

urldate = {2023-01-01},

journal = {Journal of Systems and Software},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{TPS+2022,

title = {Checking Security Compliance between Models and Code},

author = {Katja Tuma and Sven Peldszus and Daniel Strüber and Riccardo Scandariato and Jan Jürjens},

doi = {10.1007/s10270-022-00991-5},

year  = {2022},

date = {2022-03-18},

urldate = {2022-03-18},

journal = {Software and Systems Modeling (SoSyM)},

abstract = {It is challenging to verify that the planned security mechanisms are actually implemented in the software. In the context of model-based development, the implemented security mechanisms must capture all intended security properties that were considered in the design models. Assuring this compliance manually is labor-intensive and can be error-prone. This work introduces the first semi-automatic technique for secure data flow compliance checks between design models and code. We develop heuristic-based automated mappings between a design-level model (SecDFD, provided by humans) and a code-level representation (Program Model, automatically extracted from the implementation) in order to guide users in discovering compliance violations, and hence, potential security flaws in the code. These mappings enable an automated, and project-specific static analysis of the implementation with respect to the desired security properties of the design model. We developed two types of security compliance checks and evaluated the entire approach on open source Java projects.},

note = {Open Access},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{queiroz2022dvm,

title = {A Driver-Vehicle Model for ADS Scenario-based Testing},

author = {Rodrigo Queiroz and Divit Sharma and Ricardo Caldas and Krzysztof Czarnecki and Sergio Garc'ia and Thorsten Berger and Patrizio Pelliccione},

url = {https://arxiv.org/pdf/2205.02911.pdf},

year  = {2022},

date = {2022-01-01},

journal = {arXiv preprint arXiv:2205.02911},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{samuel2022csur,

title = {Asset Management in Machine Learning: State-of-research and State-of-practice},

author = {Samuel Idowu and Daniel Strueber and Thorsten Berger},

url = {../wp-content/uploads/2022/07/2022-csur-mlassetmgmt.pdf},

year  = {2022},

date = {2022-01-01},

journal = {ACM Computing Surveys},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{garcia.ea:2022:robotvar,

title = {Software Variability in Service Robotics},

author = {Sergio Garcia and Daniel Strueber and Davide Brugali and Alessandro Di Fava and Patrizio Pelliccione and Thorsten Berger},

url = {../wp-content/uploads/2022/07/2022-emse-roboticsvariability.pdf},

year  = {2022},

date = {2022-01-01},

urldate = {2022-01-01},

journal = {Empirical Software Engineering},

publisher = {Springer},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{mahmood.ea:2022:emsemodelvar,

title = {Effects of Variability in Models: A Family of Experiments},

author = {Wardah Mahmood and Daniel Strueber and Anthony Anjorin and Thorsten Berger},

url = {../wp-content/uploads/2022/07/2022-emse-modelvar.pdf},

year  = {2022},

date = {2022-01-01},

urldate = {2022-01-01},

journal = {Empirical Software Engineering},

publisher = {Springer},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{businge.ea:2022:emse,

title = {Reuse and Maintenance Practices among Divergent Forks in Three Software Ecosystems},

author = {John Businge and Openja Moses and Sarah Nadi and Thorsten Berger},

url = {../wp-content/uploads/2022/07/2022-emse-appfamilies.pdf},

year  = {2022},

date = {2022-01-01},

urldate = {2022-01-01},

journal = {Empirical Software Engineering},

volume = {27},

number = {2},

pages = {54},

publisher = {Springer},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{lindohf.ea:2021:emse,

title = {Software Product-Line Evaluation in the Large},

author = {Robert Lindohf and Jacob Krueger and Erik Herzog and Thorsten Berger},

url = {../wp-content/uploads/2022/07/2020-emse-productlineevaluation.pdf},

year  = {2021},

date = {2021-01-01},

urldate = {2021-01-01},

journal = {Empirical Software Engineering},

volume = {26},

number = {30},

issue = {2},

publisher = {Springer},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{dragule.ea:2020:sosym,

title = {A Survey on the Design Space of End-User Oriented Languages for Specifying Robotic Missions},

author = {Swaib Dragule and Thorsten Berger and Claudio Menghi and Patrizio Pelliccione},

url = {https://se.ruhr-uni-bochum.de/wp-content/uploads/2022/07/2020-sosym-missionspec.pdf},

year  = {2021},

date = {2021-01-01},

urldate = {2021-01-01},

journal = {International Journal of Software and Systems Modeling},

volume = {20},

number = {4},

pages = {1123--1158},

publisher = {Springer},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{passos.ea:2021:tse,

title = {A Study of Feature Scattering in the Linux Kernel},

author = {Leonardo Passos and Rodrigo Queiroz and Mukelabai Mukelabai and Thorsten Berger and Sven Apel and Krzysztof Czarnecki and Jesus Padilla},

url = {../wp-content/uploads/2022/07/2018-tse-scattering.pdf},

year  = {2021},

date = {2021-01-01},

urldate = {2021-01-01},

journal = {IEEE Transactions on Software Engineering},

volume = {47},

issue = {1},

pages = {146--164},

publisher = {IEEE Computer Society},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{linsbauer2021varcs,

title = {Concepts of Variation Control Systems},

author = {Lukas Linsbauer and Felix Schwaegerl and Thorsten Berger and Paul Gruenbacher},

url = {../wp-content/uploads/2022/07/2020-jss-varcs.pdf},

year  = {2021},

date = {2021-01-01},

urldate = {2021-01-01},

journal = {Journal of Systems and Software},

volume = {171},

pages = {110796},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{dragule.ea:2021:sosym,

title = {A Survey on the Design Space of End-User Oriented Languages for Specifying Robotic Missions},

author = {Swaib Dragule and Thorsten Berger and Claudio Menghi and Patrizio Pelliccione},

url = {../wp-content/uploads/2022/07/2020-sosym-missionspec.pdf},

year  = {2021},

date = {2021-01-01},

journal = {International Journal of Software and Systems Modeling},

volume = {20},

number = {4},

pages = {1123--1158},

publisher = {Springer},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{menghi.ea:2021:tse,

title = {Specification Patterns for Robotic Missions},

author = {Claudio Menghi and Christos Tsigkanos and Patrizio Pelliccione and Carlo Ghezzi and Thorsten Berger},

url = {../wp-content/uploads/2022/07/2019-tse-roboticpatterns-preprint.pdf},

year  = {2021},

date = {2021-01-01},

journal = {IEEE Transactions on Software Engineering},

volume = {47},

number = {10},

pages = {2208--2224},

publisher = {IEEE Computer Society},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{mukelabai2021feature,

title = {Feature-Oriented Defect Prediction: Scenarios, Metrics, and Classifiers},

author = {Mukelabai Mukelabai and Stefan Strüder and Daniel Strüber and Thorsten Berger},

url = {https://arxiv.org/pdf/2104.06161.pdf},

year  = {2021},

date = {2021-01-01},

journal = {arXiv preprint arXiv:2104.06161},

keywords = {},

pubstate = {published},

tppubtype = {article}

}

@article{PBKJ2021,

title = {Ontology-Driven Evolution of Software Security},

author = {Sven Peldszus and Jens Bürger and Timo Kehrer and Jan Jürjens},

doi = {10.1016/j.datak.2021.101907},

year  = {2021},

date = {2021-01-01},

journal = {Data & Knowledge Engineering (DKE)},

volume = {134},

keywords = {},

pubstate = {published},

tppubtype = {article}

}