Dr. Mohamed El-Attar homepage

Department of Information and Computer Science

.: Journals (refereed)

[Expand All]

Extending the UML Statecharts Notation to Model Security Aspects, M. El-Attar, H. Luqman, P. Karpati, G. Sindre, A. L. Opdahl IEEE Transactions on Software Engineering (2015) (Accepted - In print)
ABSTRACT Model Driven Security has become an active area of research during the past decade. While many research works have contributed significantly to this objective by extending popular modeling notations to model security aspects, there has been little modeling support for state-based views of security issues. This paper undertakes a scientific approach to propose a new notational set that extends the UML (Unified Modeling Language) statecharts notation. An online industrial survey was conducted to measure the perceptions of the new notation with respect to its semantic transparency as well as its coverage of modeling state based security aspects. The survey results indicate that the new notation encompasses the set of semantics required in a state based security modeling language and was largely intuitive to use and understand provided very little training. A subject-based empirical evaluation using software engineering professionals was also conducted to evaluate the cognitive effectiveness of the proposed notation. The main finding was that the new notation is cognitively more effective than the original notational set of UML statecharts as it allowed the subjects to read models created using the new notation much quicker.

A Scientific Evaluation of the Misuse Case Diagrams Visual Syntax, F. Saleh M. El-Attar, Information and Software Technology (2015) (Accepted - In print)
ABSTRACT

Context: Misuse case modeling is a well-known technique in the domain of capturing and specifying functional security requirements. Misuse case modeling provides a mechanism for security analysts to consider and account for security requirements in the early stages of a development process instead of relying on generic defensive mechanisms that are augmented to software systems towards the latter stages of development.

Objective: Many research contributions in the area of misuse case modeling have been devoted to extending the notation to increase its coverage of additional security related semantics. However, there lacks research that evaluates the perception of misuse case models by its readers. A misread or misinterpreted misuse case model can have dire consequences downstream leading to the development of an insecure system.

Method: This paper presents an assessment of the design of the original misuse case modeling notation based on the Physics of Notations framework. A number of improvements to the notation were suggested. A survey and a controlled experiment were carried out to compare the cognitive effectiveness of the new notation in comparison to the original notation.

Results: The survey had 55 participants for have mostly indicated that the new notation is more semantically transparent than the original notation. The results of the experiment show that subjects reading diagrams developed using the new notation performed their tasks an average 6 minutes quicker, while in general the subjects performed their tasks in approximately 14.5 minutes. The experimental tasks only required subjects reading diagrams and not creating them.

Conclusion: The main finding of this paper is that the use of colors and icons has improved the readability of misuse case diagrams. Software engineering notations are usually black and white. It is expected that the readability of other software notations will improve if they utilize colors and icons.

Using Security Robustness Analysis for Early-Stage Validation of Functional Security Requirements, M. El-Attar, H. A. Abdul-Ghani, Requirements Engineering Journal (2014) (Accepted - In print)
ABSTRACT Security is nowadays an indispensable requirement in software systems. Traditional software engineering processes focus primarily on business requirements, leaving security as an afterthought to be addressed via generic أآ¢أ¢â€ڑآ¬إâ€œpatched-onأآ¢أ¢â€ڑآ¬‌ defensive mechanisms. This approach is insufficient and software systems need to have security functionality engineered within in a similar fashion as ordinary business functional requirements. Functional security requirements need to be elicited, analyzed, specified and validated at the early stages of the development life-cycle. If the functional security requirements were not properly validated, then there is a risk of developing a system that is insecure, deeming it unusable. Acceptance testing is an effective technique to validate requirements. However, an ad-hoc approach to develop acceptance tests will suffer the omission of important tests. This paper presents a systematic approach to develop executable acceptance tests that is specifically geared for model-based secure software engineering processes. The approach utilizes early stage artifacts, namely misuse case and domain models, and robustness diagrams. The feasibility of the proposed approach is demonstrated by applying it to a real-world system. The results show that a comprehensive set of security acceptance tests can be developed based upon misuse case models for early stage validation of functional security requirements.

Using Model Transformation to Refactor Use Case Models Based on Antipatterns, Y. A. Khan, M. El-Attar Information Systems Frontiers (2014) (Accepted - In print)
ABSTRACT Use Case modeling is a popular technique for documenting functional requirements of software systems. Refactoring is the process of enhancing the structure of a software artifact without changing its intended behavior. Refactoring, which was first introduced for source code, has been extended for use case models. Antipatterns are low quality solutions to commonly occurring design problems. The presence of antipatterns in a use case model is likely to propagate defects to other software artifacts. Therefore, detection and refactoring of antipatterns in use case models is crucial for ensuring the overall quality of a software system. Model transformation can greatly ease several software development activities including model refactoring. In this paper, a model transformation approach is proposed for improving the quality of use case models. Model transformations which can detect antipattern instances in a given use case model, and refactor them appropriately are defined and implemented. The practicability of the approach is demonstrated by applying it on a case study that pertains to biodiversity database system. The results show that model transformations can efficiently improve quality of use case models by saving time and effort.

Using SMCD to Reduce Inconsistencies in Misuse Case Models: A Subject-Based Empirical Evaluation, M. El-Attar Journal of Systems and Software 87(1): 104-118 (2014)
ABSTRACT Security is a crucial requirement in software systems which need to be addressed as early as the requirements phase. The technique of misuse case modeling has been introduced slightly over a decade ago to elicit and specify functional security requirements. Development efforts downstream will be driven by the functional security requirements specified in misuse case models. Consequently, the quality of a misuse case model influences the effectiveness of downstream development efforts. Inconsistencies are an undesired attribute that can severely reduce the quality of misuse case models. In this paper, a controlled experiment involving students is presented which evaluates the reduction of inconsistencies in misuse case models resulting from utilizing a structure called SMCD (Structured Misuse Case Descriptions). The experiment also examines the impact of using SMCD upon other quality attributes of misuse case models. The results of the experiment indicate that using SMCD improves the consistency levels of the developed misuse case models.

From Misuse Cases to Mal-Activity Diagrams: Bridging the Gap between Functional Security Analysis and Design, M. El-Attar Journal of Software and Systems Modeling 13(1): 173-190 (2014)
ABSTRACT Secure software engineering is concerned with developing software systems that will continue delivering its intended functionality despite a multitude of harmful software technologies that can attack these systems from anywhere and at anytime. Misuse cases and mal-activity diagrams are two techniques to model functional security requirements in order address security concerns early in the development life cycle. This allows system designers to equip their systems with security mechanisms built within system design rather than relying on external defensive mechanisms. In a model-driven engineering process, misuse cases are expected to drive the construction of mal-activity diagrams. However, a systematic approach to transform misuse cases into mal-activity diagrams is missing. Therefore, this process remains dependent on human skill and judgment, which raises the risk of developing mal-activity diagrams that are inconsistent with the security requirements described in misuse cases, leading to the development of an insecure system. This paper presents an authoring structure for misuse cases and a transformation technique to systematically perform this desired model transformation. A study was conducted to evaluate the proposed technique using 46 attack stories outlined in a book by a former well-known hacker [Mitnick]. The results indicate that applying the proposed technique produces correct mal-activity diagrams from misuse cases.

Towards Developing Consistent Misuse Case Models, M. El-Attar, Journal of Systems and Software 85 (2): 323-339 (2012)
ABSTRACT There is an increasing recognition for the need to develop high-quality use case (UC) models. Quality in UC models is of particular importance when they are utilized within a UC driven development process. Many practitioners and researchers have provided guidelines, suggestions and techniques, which aim to prevent أآآ¢أآ¢أ¢â‚¬ڑآآ¬إأ¢â‚¬إ“poor practicesأآآ¢أآ¢أ¢â‚¬ڑآآ¬‌ which typically lead to low-quality models. This invaluable body of knowledge has been disseminated across numerous literature resources. Without unifying this knowledge into a single resource, it is unlikely that a UC modeler will be aware of the entire body of knowledge. This paper presents a systematic review of that literature to identify and amalgamate this knowledge. The amalgamated knowledge is presented in a unified form, specifically as a set of 21 antipatterns, which modelers can use to avoid common deficiencies when constructing UC models.

Constructing High Quality Use Case Models: A Systematic Review of Current Practices, M. El-Attar, J. Miller, Requirements Engineering Journal 17(3): 187-201 (2012)
ABSTRACT There is an increasing recognition for the need to develop high-quality use case (UC) models. Quality in UC models is of particular importance when they are utilized within a UC driven development process. Many practitioners and researchers have provided guidelines, suggestions and techniques, which aim to prevent أآآ¢أآ¢أ¢â‚¬ڑآآ¬إأ¢â‚¬إ“poor practicesأآآ¢أآ¢أ¢â‚¬ڑآآ¬‌ which typically lead to low-quality models. This invaluable body of knowledge has been disseminated across numerous literature resources. Without unifying this knowledge into a single resource, it is unlikely that a UC modeler will be aware of the entire body of knowledge. This paper presents a systematic review of that literature to identify and amalgamate this knowledge. The amalgamated knowledge is presented in a unified form, specifically as a set of 21 antipatterns, which modelers can use to avoid common deficiencies when constructing UC models.

A Framework for Improving Quality in Misuse Case Models, M. El-Attar, Business Process Management Journal 18 (2): 168 - 196 (2012)
ABSTRACT
Purpose أآآ¢أآ¢أ¢â‚¬ڑآآ¬أآ¢أ¢â€ڑآ¬إâ€œ Security is a vital requirement for software systems. Misuse case models allow system designers to inject security considerations within their designs early in the development cycle rather than patching an end system with security mechanisms after it was developed. The notation and syntactical rules of misuse case models are relatively simple. However, misuse case modeling practitioners are highly vulnerable to modeling pitfalls, creating defective models that can have catastrophic effects downstream in the development cycle. This paper presents a framework that unitizes antipatterns to help remedy defective misuse case models and poor modeling practices.

Design/methodology/approach أآآ¢أآ¢أ¢â‚¬ڑآآ¬أآ¢أ¢â€ڑآ¬إâ€œ A repository of antipatterns was constructed and formatted to be machine-readable whenever possible so that it can be utilized by the proposed framework. The feasibility of the proposed approach was then demonstrated using a real-world misuse case model of an online bookstore system.

Findings - The results indicate that the overall quality and clarity of the bookstore misuse case model is improved by applying the proposed technique and framework.

Research limitations/implications أآآ¢أآ¢أ¢â‚¬ڑآآ¬أآ¢أ¢â€ڑآ¬إâ€œ This research work presents a series of domain-independent antipatterns. Users of this framework may be interested to develop domain-dependent antipatterns to better suite their modeling and development needs.

Originality/value أآآ¢أآ¢أ¢â‚¬ڑآآ¬أآ¢أ¢â€ڑآ¬إâ€œ The proposed approach will help misuse case modelers, especially novice ones, to improve the quality of their current models as well as future models.

Embracing Composite Metrics in Software Experiments, M. El-Attar, R. Singh, J. Miller, Journal of Software 7(7): 1664-1676 (2012)

ABSTRACT Traditionally most Software Engineering experiments tend to formulate hypotheses and analyze an independent variable or a series of independent variables. This approach greatly reduces the type of research questions which can be explored. In addition, most Software Engineering situations are highly complex with many intertwined or ill-defined concepts, processes and أآآ¢أآ¢أ¢â‚¬ڑآآ¬إأ¢â‚¬إ“objectsأآآ¢أآ¢أ¢â‚¬ڑآآ¬‌. Hence, the question arises: are independent variables really sufficient for describing Software Engineering situations? This paper argues that the community needs to consider fuzzier models for Software Engineering artifacts, especially it recommends using composite indices as a mechanism to allow the greater exploration of the experimental design space. However, this extension is not without its risks; and hence in conjunction, it explains how to utilize analysis safeguards (sensitivity and uncertainty analysis) to explore any effects introduced when utilizing experimental formulations with composite metrics. Traditionally most Software Engineering experiments tend to formulate hypotheses and analyze an independent variable or a series of independent variables. This approach greatly reduces the type of research questions which can be explored. In addition, most Software Engineering situations are highly complex with many intertwined or ill-defined concepts, processes and أآآ¢أآ¢أ¢â‚¬ڑآآ¬إأ¢â‚¬إ“objectsأآآ¢أآ¢أ¢â‚¬ڑآآ¬‌. Hence, the question arises: are independent variables really sufficient for describing Software Engineering situations? This paper argues that the community needs to consider fuzzier models for Software Engineering artifacts, especially it recommends using composite indices as a mechanism to allow the greater exploration of the experimental design space. However, this extension is not without its risks; and hence in conjunction, it explains how to utilize analysis safeguards (sensitivity and uncertainty analysis) to explore any effects introduced when utilizing experimental formulations with composite metrics.

Is In-Depth Object-Oriented Knowledge Necessary to Develop Quality Robustness Diagrams?, M. El-Attar, M. O. Elish, S. Mahmood, J. Miller, Journal of Software 7(11): 2538-2552

ABSTRACT Robustness analysis is a technique that can be performed to help ensure the correctness, completeness and consistency of use case and domain models. Robustness analysis also helps bridge the gap between the analysis and design phases by providing a guided approach to identify a first-guess set of objects that will realize scenarios described in use cases. It is necessary to perform robustness analysis in the early phases of the development lifecycle in order to reap its benefits. In particular, robustness analysis needs to be performed by business analysts during the requirements phase to improve the quality of their models as well as help provide a seamless transition to the design phase. However, a core skill that is required to develop robustness diagrams is knowledge of OO concepts which business analysts normally do not have. To overcome this limitation, business analysts acquire brief knowledge of OO concepts via a small learning curve in order to develop and reap the benefits of creating robustness diagrams. However, is this brief knowledge of OO concepts attained through a small learning curve enough to allow business analysts to develop quality robustness diagrams?

Developing Comprehensive Acceptance Tests from Use Cases and Robustness Diagrams, M. El-Attar, J. Miller, Requirements Engineering Journal 15(3): 285-306 (2010)
ABSTRACT In agile development processes, the rewards from user acceptance testing are maximized by using the practice to drive the development process. Traditionally, User Stories are used in agile projects to describe a systemأآآ¢أآ¢أ¢â‚¬ڑآآ¬أآ¢أ¢â‚¬‍آآ¢s usage scenarios; and are utilized as a basis for developing acceptance tests. This paper introduces a technique that aims to achieve the benefits of acceptance testing within large-scale development projects that deploy a V-model development process, specifically those that utilize Use Case Models. The approach is based on utilizing a number of artifacts: Use Case Models أآآ¢أآ¢أ¢â‚¬ڑآآ¬إأ¢â‚¬إ“supported byأآآ¢أآ¢أ¢â‚¬ڑآآ¬‌ robustness diagrams and domain models. The feasibility of the proposed approach is demonstrated by applying it to a real-world system -- the RestoMapper system. The results show that a comprehensive set of acceptance tests can be developed based upon Use Case Models.

Improving the Quality of Use Case Models Using Antipatterns, M. El-Attar, J. Miller, Journal of Software and Systems Modeling 9(2): 141-160 (2010)
ABSTRACT Use Case modeling is a popular requirements modeling technique. While these models are simple to create and read; this simplicity is often misconceived, leading practitioners to believe that creating high quality models is straightforward. Therefore, many low quality models that are inconsistent, incorrect, contain premature restrictive design decision and contain ambiguous information are produced. To combat this problem of creating low quality UC models, this paper presents a new technique that utilizes antipatterns as a mechanism for remedying quality problems in Use Case models. The technique, supported by the tool ARBIUM, provides a framework for developers to define antipatterns. The feasibility of the approach is demonstrated by applying it to a real-world system. The results indicate that applying the technique improves the overall quality and clarity of Use Case models.

A Subject-Based Empirical Evaluation of SSUCD's Performance in Reducing Inconsistencies in Use Case Models, M. El-Attar, J. Miller, Journal of Empirical Software Engineering 14(5): 477-512 (2009)
ABSTRACT The problem of inconsistencies in Use Case models has plagued practitioners over the years and has been a topic of interest for many researchers. In Use Case driven approaches, the damaging effects of inconsistencies escalate as inconsistencies have a detrimental influence on every aspect of the development process. The repercussions of inconsistencies have been well documented, but little progress has been made towards reducing and remedying their effects. This paper presents a controlled experiment, which evaluates the reduction of inconsistencies resulting from deploying a new structure called (Simple Structured Use Case Descriptions) SSUCD, which is used to assist with the development of Use Case descriptions. This experiment also investigates the impact of improving consistency amongst Use Case models on other key Use Case modeling quality attributes. The results of this experiment demonstrate that using SSUCD leads to an improvement in consistency between use case models and their associated descriptions.

Producing Robust Use Case Diagram via Reverse Engineering of Use Case Descriptions, M. El-Attar, J. Miller, Journal of Software and Systems Modeling 7(1): 67-83 (2008)
ABSTRACT In a use case driven development process, a use case model is utilized by a development team to construct an object-oriented software system. The large degree of informality in use case models, coupled with the fact that use case models directly affect the quality of all aspects of the development process, is a very dangerous combination. Naturally, informal use case models are prone to contain problems, which lead to the injection of defects at a very early stage in the development cycle. In this paper, we propose a structure that will aid the detection and elimination of potential defects caused by inconsistencies present in use case models. The structure contains a small set of formal constructs that will allow use case models to be machine readable while retaining their readability by retaining a large degree of unstructured natural language. In this paper we also propose a process which utilizes the structured use cases to systematically generate their corresponding use case diagrams and vice versa. Finally a tool provides support for the new structure and the new process. To demonstrate the feasibility of this, a simple study is conducted using a mock online hockey store system.

Empirical Evaluation of Optimisation Algorithms When Used in Goal-Oriented Automated Test Data Generation Techniques, M. Xiao, M. El-Attar, M. Reformat, J. Miller, Journal of Empirical Software Engineering 12(2): 183-239 (2007)
ABSTRACT Software testing is an essential process in software development. Software testing is very costly, often consuming half the financial resources assigned to a project. The most laborious part of software testing is the generation of test-data. Currently, this process has remained a manual process. Hence, the automation of test-data generation can significantly cut the total cost of software testing and the software development cycle in general. A number of automated test-data generation approaches have already been explored. This paper highlights the goal-oriented approach as a promising approach to devise automated test-data generators. Different optimization techniques can be used to implement these goal-oriented test-data generators, and their respective characteristics, when applied to these situations remain relatively unexplored. Therefore, in this paper, a comparative study about the effectiveness of the most commonly used optimization techniques is conducted.

A User-Centered Approach to Modeling BPEL Business Processes Using SUCD Use Cases, M. El-Attar, J. Miller, Journal of Software Development and Theory, Practice and Experimentation 1(1): 59-76 (2007)
ABSTRACT BPEL is being widely used to specify business processes through the orchestration, composition and coordination of web services. It is now common practice to begin the process of modeling the أآآ¢أآ¢أ¢â‚¬ڑآآ¬إأ¢â‚¬إ“workflowsأآآ¢أآ¢أ¢â‚¬ڑآآ¬‌ within a set of BPEL business processes using UML Activity Diagrams since they can be automatically mapped down onto BPEL code. However activity diagrams were not intended to explicitly model user goals and interactions with external systems offering web services. However, since the chief purpose of BPEL business processes is to first and foremost provide services to their users, using activity diagram modeling alone will not allow an E-commerce analyst to explicitly capture and model the usersأآآ¢أآ¢أ¢â‚¬ڑآآ¬أآ¢أ¢â‚¬‍آآ¢ goals. In this paper we propose an approach to solve this issue; initially model BPEL business processes using Use Cases to capture usersأآآ¢أآ¢أ¢â‚¬ڑآآ¬أآ¢أ¢â‚¬‍آآ¢ perspective, and to systematically develop activity diagrams from Use Case models. A Travel Agency system case study is presented illustrates the feasibility of the proposed approach.

.: Conferences (refereed)

[Expand All]

Evaluating the Cognitive Effectiveness of the Visual Syntax of Feature Diagrams, M. Saeed, F. Saleh, S. Al-insiaf, M. El-Attar, 1^st Asia Pacific Requirements Engineering Symposium, Auckland, New Zealand. 2014.

ABSTRACT [Context and Motivation] Feature models are widely used in the Software Product Line (SPL) domain to capture and communicate the commonality and variability of features in a product line. Feature models contain feature diagrams that graphically depict features in a hierarchical form. [Problem/Question] Many research works have been devoted to enriching the visual syntax of feature diagrams to extend its expressiveness to capture additional types of semantics, however, there is a lack of research that evaluates the visual perception of feature models by its readers. Models serve a dual purpose: to brainstorm and communicate. A very sophisticated yet unreadable model is arguably useless. To date, there has not been a scientific evaluation of the cognitive effectiveness of the visual syntax of feature diagrams. [Principle Ideas] This paper presents a scientific evaluation of the cognitive effectiveness of feature diagrams. The evaluation approach is based on theory and empirical evidence mainly from the cognitive science field. [Contribution] The evaluation reveals drawbacks in the visual notation of feature diagrams. The paper concludes with some recommendations for improvement to remedy the identified flaws.

An Evaluation of the Statechart Diagrams Visual Syntax, M. El-Attar, S. Anwer, 5^th IEEE International Conference on Information Science and Applications , Seoul, South Korea. 2014.

ABSTRACT Statechart diagrams are a popular modeling tool amongst designers as it provides the capabilities to model the behavior of a state-dependent system or system component. Statechart diagrams are one of the pillar diagram types of the Unified Modeling Language (UML), the de-facto modeling language for object-oriented systems, used to model requirements of a system. Although statechart diagrams have received great attention from the research community, there lacks research that evaluate the cognitive effectiveness of state transition diagrams. This paper presents a scientific evaluation of the cognitive effectiveness of UML statechart diagrams. The results of the evaluation reveal several problems with the UML statechart notation that reduces their cognitive effectiveness and that should be addressed.

Use Case Prioritization using Fuzzy Logic System, R. Ahmed, D. Musleh, M. Ahmed, M. El-Attar 5^th International Symposium on Business Modeling and Software, Beijing, China. 2014.

ABSTRACT Use cases have been used to model functional requirements of software systems. To ensure that customer requirements are met, software developer may prioritize their use cases so that those which are most important are developed earlier in the development life cycle. Limited work has been proposed for use case prioritization in the literature. They used analytical approaches for the purpose of use case prioritization. In this paper, we proposed a set of criteria to compare use case prioritization approaches. A number of use case prioritization approaches are discussed against these criteria. Furthermore, we have performed a new study in which we empirically investigated use case prioritization using Neuro fuzzy systems.

Using Ex-SMCD for Developing Consistent Misuse Case Models With Extended Notation, M. El-Attar, H. A. AbdulGhani, 3^rd International Symposium on Business Modeling and Software, Noorwijkerhout, Netherlands. 2013.

ABSTRACT Security is almost always a vital aspect in the development of any system. Many mission-critical systems are deemed unusable if they are not secure. Secure software development requires a secure software engineering process that takes into account security concerns from as early as the requirements phase. Misuse case modeling is a technique that was introduced to extend the already widespread technique of use case modeling for the purpose of eliciting, specifying and communicating functional security requirements. The notational set and syntax of misuse case modeling were further extended in order to more accurately specify the functional security aspects of a system. Similar to use case diagram, Misuse case diagrams created using this extended notational set are supplemented with textual descriptions that narrate the actual expected behaviour of a system. Since misuse case descriptions are described in syntax-free natural language, authors are likely to create misuse case models that are inconsistent, ultimately leading to the development a system that is functional non-secure. To counter this problem, this paper introduced a structure that guides authors while narrating misuse cases in order to significantly limit inconsistencies. A case study is presented to demonstrate and the application and feasibility of the proposed structure..

Using SSUCD to Develop Consistent Use Case Models: An Industrial Case Study, M. El-Attar, 7^th International Conference on Software Engineering Advances, Lisbon, Portugal. 2012.

ABSTRACT In software development projects that utilize a use case-driven development methodology, it is crucial to develop high quality use case models to ensure the development of a quality end product. There are many quality attributes for use case models. One of these qualities is consistency. A structure named SSUCD (Simple Structured Use Case Descriptions) was developed to guide use case authors while authoring their use cases. SSUCD was developed in previous work to specifically tackle the issue of consistency in use case models. In particular, SSUCD ensures structural consistency in use case models. Thus far, SSUCD has been validated using exemplars. While exemplars provide beneficial preliminary validation, a more thorough validation process is required to ensure the industrial applicability of SSUCD. To this end this paper presents an industrial case study that was used to validate SSUCD. The result of the case study shows that SSUCD can be effectively used to develop consistent use case models of industrial strength.

An Empirical Study Identifying High Perceived Value Requirements Engineering Practices in Global Software Development Projects, M. Niazi, M. El-Attar, M. Usman, N. Ikram, 7^th International Conference on Software Engineering Advances, Lisbon, Portugal. 2012.

ABSTRACT Requirements-related problems are reported to be the main reason in failures of global software development (GSD) projects. There is not much work done to improve requirements practices for GSD projects. In this paper, we report results of a study conducted in an ongoing project whose aim is to develop a framework for the requirements engineering process of global software development projects. The objective of this paper is to report a recent empirical study which was aimed in identifying high perceived value RE practices in the GSD projects. We used an online survey questionnaire to collect data from 39 RE practitioners of GSD organizations. We have identified 11 frequently cited high value RE practices that should be planned and implemented in GSD projects to avoid frequently occurring requirements related problems.

A Model Transformation Approach towards Refactoring Use Case Models Based on Antipatterns, Y. Khan, M. El-Attar, 21^st International Conference on Software Engineering and Data Engineering, Los Angeles, California, USA. 2012. (Best Paper Award)

ABSTRACT The quality of use case models is crucial towards the success of a software development project, especially projects that utilize a use case driven development approach. Hence, the literature has presented many approaches to improve the quality of use case models. A category of such approaches is based on revising the use case model to better reflect the intended functional requirements. These approaches are based on the detection of unsound structures in existing diagrams and then refactoring the diagrams to improve their quality. One such promising approach is the utilization of antipatterns. An antipattern will describe a debatable structure in use case diagrams and its harmful consequences. The antipattern will also describe the proper form the diagram should be in. While the detection of the unsound structures described in antipatterns has been automated, the refactoring effort to enhance the use case diagram remains a manual process, which can be cumbersome and error-prone. In this paper, we present an approach to automate the refactoring of use case diagrams using model transformation. The transformation algorithms were tested using a biodiversity database system case study. The results show the refactorings have been applied correctly and accurately.

Using SMCD to Develop Consistent Misuse Case Models: An Industrial Case Study, M. El-Attar, M. S. Bin Salman, 21^st International Conference on Software Engineering and Data Engineering, Los Angeles, California, USA. 2012.

ABSTRACT Misuse case modeling is a technique that extends the use cases modeling notation to allow the specification of security requirements in a functional form. Similar to use case models, a misuse case model is comprised of a diagram and a set of corresponding misuse case descriptions. The consequences of an inconsistent misuse case model can lead to the development of an insecure system, which will likely render it useless in many domains. A number of templates to describe misuse cases have been proposed in the literature. However, none of these templates were designed with a focus to tackle the issue of inconsistency in misuse case models. In a recently published paper in the Journal of Systems and Software, a new structure named Structured Misuse Case Descriptions (SMCD) was proposed. The SMCD structure was specifically designed to reduce inconsistencies in misuse case models by at least ensuring their structural consistency. In this paper, we report on a successful application of SMCD to a real-world case study. SMCD was used to describe and construct a structurally consistent misuse case model belonging to the system of a Swiss bank.

Are Use Case Modeling Features Underutilized? A Lightweight Survey That Raises Concerns, M. Alsaleh, M. El-Attar, M. Niazi, K. Halawani, 7^th International Conference on Evaluation of Novel Approaches to Software Engineering, Wroclaw, Poland. 2012.

ABSTRACT Use case modeling is a very popular technique for eliciting, specifying and validating functional requirements. Use case modeling possesses a very rich notational set that allows its users to accurately specify a large variety of aspects about the underlying systemأآآ¢أآ¢أ¢â‚¬ڑآآ¬أآ¢أ¢â‚¬‍آآ¢s requirements. Many authoring techniques and templates were introduced to accurately describe a systemأآآ¢أآ¢أ¢â‚¬ڑآآ¬أآ¢أ¢â‚¬‍آآ¢s functional requirements. Although a relatively simple modeling technique, the literature has repeatedly reported on its misuse, leading to the development of end systems that do not satisfy the intended requirements. To this end, we have conducted a survey of use case models available online to shed light on the level of utilization of the use case modeling notation and how they are described, which can be symptomatic of how well do requirements engineers utilize the use case modeling technique and its modeling capabilities. In our survey we have collected and analysed 105 use case models. The results show an underutilization of the use case modeling notation and improper authoring techniques, which raises concern over the quality of the end systems.

Automated Transformation of Use Case Maps to UML Activity Diagrams, Y. Khan, M. El-Attar, 7^th International Conference on Software Paradigm Trends, Rome, Italy. 2012.

ABSTRACT Use Case Maps (UCMs) is a modeling language that has been successfully deployed to model the behaviour of many types of systems, such as telecommunication systems, web applications, agent based systems and operating systems. However, as a high-level modeling language there exist a conceptual gap between UCMs and code-level. The crucial responsibility of filling this gap is usually undertaken by programmers, which leaves them prone to development mistakes and delivering an end system that does not accurately realize the behaviour specified in UCMs. UML activity diagrams (ADs) share many concepts with UCMs. Unlike UCMs however, many approaches have been proposed and implemented that transform ADs into other design artefacts. In particular, ADs can be transformed into class diagrams which can be used to generate code skeleton and ensure consistency between the programming and modeling efforts. To capitalize on the advantages of ADs, a model transformation approach from UCM notation to AD notation has been implemented and proposed in this paper. Two sample transformations are presented to illustrate the application of the proposed model transformation approach. The generated ADs were thoroughly inspected and verified by the authors in addition to three independent Software Engineering professors at the host institution.

A Systematic Review on the Impact of CK Metrics on the Functional Correctness of Object-Oriented Classes, Y. Khan, M. O. Elish, M. El-Attar, 12^th International Conference on Computational Science and Applications, Salvador de Bahia, Brazil. 2012.

ABSTRACT The Chidamber and Kemerer (CK) metrics suite is one of the most popular and highly cited suites for measuring Object-Oriented (OO) designs. A great amount of empirical studies have been conducted to evaluate these metrics as indicators of the functional correctness of classes in OO systems. However, there has been no attempt to systematically review and report these empirical evidences. To identify the relation of CK metrics with functional correctness, we have performed a systematic review of empirical evidences published in the literature that support or reject CK metrics as indicators of functional correctness. Our search strategy identified 20 papers that contain relevant empirical evidences. Our results conclude that WMC, CBO, RFC and LCOM metrics are good indicators of functional correctness of OO classes. Inheritance metrics, DIT and NOC, are however not useful indicators of functional correctness.

GlobReq: A Framework for Improving Requirements Engineering in Global Software Development Projects: Preliminary Results, M. Niazi, M. El-Attar, M. Usman, N. Ikram, 16^th International Conference on Evaluation & Assessment in Software Engineering, Ciudad Real, Spain. 2012.

ABSTRACT

CONTEXT: Previous work suggests that half of the companies that have tried global software development (GSD) have failed to realise the anticipated outcomes, the root cause of which is often related to requirements problems. Despite the importance of this problem, little research has been carried out to improving requirements engineering process in the GSD projects.

OBJECTIVE: In this paper an ongoing project is discussed which will bring together the work of researchers and software development experts to develop a framework for the requirements engineering process of global software development projects (GlobReq). Managers of GSD projects will be able to use GlobReq to plan a requirements engineering process suitable for a specific GSD project. In this paper the need for such a framework along with the proposed methodology, novelty and the preliminary results are discussed.

METHODOLOGY: The basis of the GlobReq framework will be Sommerville et alأآآ¢أآ¢أ¢â‚¬ڑآآ¬أآ¢أ¢â‚¬‍آآ¢s framework of 66 requirements best practices as well as our empirical study with GSD organisations.

INITIAL RESULTS: The initial findings from 5 organisations are interesting to observe that not all 66 RE best practices are perceived as high value practices for GSD projects.

Migrating Functional Requirements in SSUCD Use Cases to a More Formal Representation, M. El-Attar, 6^th International Conference on Software Engineering Advances, Barcelona, Spain. 2011. (Best Paper Award)

ABSTRACT Use case modeling is popular technique to elicit and model functional requirements of a software development project. Requirements are seldom stable and consistently change throughout the life cycle of a project. It is crucial to understand how and why a systemأآآ¢أآ¢أ¢â‚¬ڑآآ¬أآ¢أ¢â‚¬‍آآ¢s functional requirements has reached its current state. To this end, this paper presented UseCaseDiff, an algorithm to automatically detect structural changes between subsequent versions of a use case model. The approach was applied to two subsequent versions of a use case model for a distributed biodiversity database system. The results validate the correctness of the algorithm in detecting the structural differences between the subsequent versions of the use case model.

UseCaseDiff: An Algorithm for Differencing Use Case Models, M. El-Attar, 9^th ACIS International Conference on Software Engineering, Research, Management and Applications, Baltimore, Maryland, USA. 2011.

ABSTRACT Use case modeling is popular technique to elicit and model functional requirements of a software development project. Requirements are seldom stable and consistently change throughout the life cycle of a project. It is crucial to understand how and why a systemأآآ¢أآ¢أ¢â‚¬ڑآآ¬أآ¢أ¢â‚¬‍آآ¢s functional requirements has reached its current state. To this end, this paper presented UseCaseDiff, an algorithm to automatically detect structural changes between subsequent versions of a use case model. The approach was applied to two subsequent versions of a use case model for a distributed biodiversity database system. The results validate the correctness of the algorithm in detecting the structural differences between the subsequent versions of the use case model.

Use Case-Based Effort Estimation Approaches: A Comparison Criteria, M. W. Kamal, M. Ahmed, M. El-Attar, 2^nd International Conference on Software Engineering and Computer Systems, Pahang, Malaysia. 2011.

ABSTRACT Reliable and accurate software development effort estimation has always been a daunting task for project managers. More recently, the use of Use Cases for software effort estimation has gained wide popularity. Researchers from academia as well as industry have shown interest in the Use Case based approaches because of the promising results obtained along with their early applicability. There has been a number of approaches proposed in the literature. However, there is no framework that could be used to aid practitioners in selecting appropriate approaches suitable for their particular development efforts. In this paper we present an attribute-based framework to classify and compare these approaches and provide such aid to practitioners. The framework is also meant to guide researchers interested in proposing new use case-based approaches. The paper discusses a number of representative Use Case-based effort estimation approaches against the framework. Analysis of the discussion highlights some open issues for future research..

Improving Quality in Misuse Case Models: A Risk-Based Approach, M. El-Attar, I. Ahmed, 10^th ACIS International Conference on Computer and Information Science, Sanya, Hainan Island, China. 2011.

ABSTRACT Security is a crucial requirement for many software systems. Misuse case modeling is a technique that allows system designers to inject security considerations within their designs early in the development cycle. This is potentially a much more effective approach to ensuring security than patching an end system with security mechanisms after it was developed. While the notation and syntactical rules of misuse case models are relatively simple, developing high quality misuse case models is not a straightforward task. Modeling practitioners are highly vulnerable to modeling mistakes, creating defective misuse case models that can lead to the development of insecure systems. In this paper, an approach based on antipatterns that attempts to repair defective misuse case models is presented. The misuse case model of an Online Phone Accessories Store subsystem is presented to demonstrate the feasibility of the approach. The results show that applying the technique has improved the overall quality of the misuse case model.

A Systematic Approach to Assemble Sequence Diagrams from Use Case Scenarios, M. El-Attar, International Conference on Systems Engineering and Modeling, Shanghai, China. 2011.

ABSTRACT The critical task of developing executable system-level sequence diagrams to represent those scenarios remains a manual task that has to be entirely performed by the tester. This obviously is time consuming, error prone and very costly, since even the smallest systems can potentially have a large number of scenarios. In this paper, we propose an approach to semi-automate the construction of system-level sequence diagrams. The approach is based on a traceability framework, which allows its users to efficiently specify scenarios at a high level using use case descriptions, while systematically building the corresponding sequence diagrams. An ATM case study is presented to demonstrate the feasibility of the proposed approach.

Developing Precise Misuse Cases with Security Robustness Analysis, M. El-Attar, 22^nd International Conference on Software Engineering and Knowledge Engineering, San Francisco, California, USA. 2010.

ABSTRACT In recent years, misuse modeling has emerged as a promising technique to elicit, model and communicate security requirements. Currently, misuse case authors have no guidance towards developing precise misuse case descriptions that accurately represent potential security threats and protection measures. Moreover, there remains a gap between the analysis and design phases of security aspects, meaning that misuse case models are solely and directly used to drive the development of detailed design artifacts that satisfy its underlying security requirements. Such large gap can lead to the development of an end system that does not satisfy its security requirements. This paper presents an approach that will guide misuse case modelers towards authoring precise misuse case descriptions. The approach is based on performing robustness analysis on use case descriptions with the intent of determining workflows of security attacks that may occur during the execution of a use case. The robustness analysis performed will also allow security analysts to precisely determine how mitigation measures against the misusage scenarios will be performed. The proposed approach can be used to bridge the gap between the analysis and design phases. The proposed approach is demonstrated through an industry strength case study of a restaurant mapping system.

Matching Antipatterns to Improve the Quality of Use Case Models, M. El-Attar, J. Miller, 14^thIEEE International Requirements Engineering Conference, Minneapolis, Minnesota, USA. 2006.

ABSTRACT Use Case modeling is an effective technique used to capture functional requirements. Use Case models are mainly composed of textual descriptions written in natural language and simple diagrams that adhere to a few syntactic rules. This simplicity can be deceptive as many modelers create Use Case models that are incorrect, inconsistent, and ambiguous and contain restrictive design decisions. In this paper, a new methodology is described that utilizes antipatterns to detect potentially defective areas in Use Case models. This paper introduces the tool ARBIUM, which will support the proposed technique and aid analysts to improve the quality of their models. ARBIUM presents a framework that will allow developers to define their own antipatterns using OCL and textual descriptions. The proposed approach and tool are applied to a distributed biodiversity database Use Case model to demonstrate its feasibility. Our results indicate that they can improve the overall clarity and precision of Use Case models.

AGADUC: Towards a More Precise Presentation of Functional Requirements in Use Case Models, M. El-Attar, J. Miller, 4th ACIS International Conference on Software Engineering, Research, Management and Applications, Seattle, Washington, USA. 2006.

ABSTRACT Use Case (UC) models describe functional requirements as a set of interactions between a software system and its environment. In essence, UC descriptions state a set of workflows that will allow a systemأآآ¢أآ¢أ¢â‚¬ڑآآ¬أآ¢أ¢â‚¬‍آآ¢s user to benefit from its services. It is critical that designers have a common and precise understanding of what these workflows are. Otherwise they are in danger of building the أآآ¢أآ¢أ¢â‚¬ڑآآ¬کwrongأآآ¢أآ¢أ¢â‚¬ڑآآ¬أآ¢أ¢â‚¬‍آآ¢ system. Traditionally, UC descriptions are authored using natural language, which as shown in this article, proves to be a poor vehicle, and insufficient, to describe the underlying workflows. Simply, the inherit ambiguity in natural language leads to misinterpretations and misunderstandings. UC diagrams do not provide any information about the dependencies between workflows spanning several UCs. In this paper, we present the process AGADUC, which will systematically generate activity-like diagrams that represent the embedded workflows in the UC textual descriptions. AGADUC provides a great deal of information regarding how UCs are dependent on each other, without the need to iterate through several pages of UC descriptions. Using activity-like diagrams will ensure that all stakeholders have a precise and consistent understanding of the workflows. A case study conducted on a simplified Library case is presented and have shown that AGADUC overcomes many limitations in traditional UC models. The featured tool AREUCD automates the AGADUC process and it is demonstrated within the case study.

.: Publication Listing from Bibliography Servers

DBLP

ACM DL/Guide

CSB

If you are interested in obtaining a copy of any of my publications, please email me and I will be happy to forward them to you. Also, it would be nice if you can email me incase you would like to cite any of my papers.