Abstract: The feature interaction problem occurs when two or
more independently developed components interact with each
other in unanticipated ways, resulting in undesirable system
behaviors. Feature interaction problems remain a challenge for
emerging domains in cyber-physical systems (CPS), such as the
Internet of Things and autonomous drones. Existing techniques
for resolving feature interactions take a Γ’β¬Εwinner-takes-allΓ’β¬Β approach, where one out of the conflicting features is selected
as the most desirable one, and the rest are disabled. However,
when multiple of the conflicting features fulfill important system
requirements, being forced to select one of them can result in
an undesirable system outcome. In this paper, we propose a new
resolution approach that allows all of the conflicting features
to continue to partially fulfill their requirements during the
resolution process. In particular, our approach leverages the
idea of adaptive requirement weakening, which involves one or
more features temporarily weakening their level of performance
in order to co-exist with the other features in a consistent
manner. Given feature requirements specified in Signal Temporal
Logic (STL), we propose an automated method and a runtime
architecture for automatically weakening the requirements to
resolve a conflict. We demonstrate our approach through case
studies on feature interactions in autonomous drones.
Abstract: Modern software systems are deployed in a highly dynamic, uncertain environment. Ideally, a system that is robust should be capable of establishing its most critical requirements even in the presence of possible deviations in the environment. We propose a technique called behavioral robustification, which involves systematically and rigorously improving the robustness of a design against potential deviations. Given behavioral models of a system and its environment, along with a set of user-specified deviations, our robustification method produces a redesign that is capable of satisfying a desired property even when the environment exhibits those deviations. In particular, we describe how the robustification problem can be formulated as a multi- objective optimization problem, where the goal is to restrict the deviating environment from causing a violation of a desired property, while maximizing the amount of existing functionality and minimizing the cost of changes to the original design. We demonstrate the effectiveness of our approach on case studies involving the robustness of an electronic voting machine and safety-critical interfaces.
Abstract: In software design, guaranteeing the correctness of run-time system behavior while achieving an acceptable balance among multiple quality attributes remains a challenging problem.
Moreover, providing guarantees about the satisfaction of those requirements when systems are subject to uncertain environments is even more challenging.
While recent developments in architectural analysis techniques can assist architects in exploring the satisfaction of quantitative guarantees across the design space, existing approaches are still limited because they do not explicitly link design decisions to satisfaction of quality requirements.
Furthermore, the amount of information they yield can be overwhelming to a human designer, making it difficult to distinguish the forest through the trees.
In this paper, we present an approach to analyzing architectural design spaces that addresses these limitations and provides a basis to enable the explainability of design tradeoffs.
Our approach combines dimensionality reduction techniques employed in machine learning pipelines with quantitative verification to enable architects to understand how design decisions contribute to the satisfaction of strict quantitative guarantees under uncertainty across the design space.
Our results show feasibility of the approach in two case studies and evidence that dimensionality reduction is a viable approach to facilitate comprehension of tradeoffs in poorly-understood design spaces.
π
Abstract: Many self-adaptive systems benefit from human involvement, where human operators can complement the capabilities of systems (e.g., by supervising decisions, or performing adaptations and tasks involving physical changes that cannot be automated). However, insufficient preparation (e.g., lack of task context comprehension) may hinder the effectiveness of human involvement, especially when operators are unexpectedly interrupted to perform a new task. Preparatory notification of a task provided in advance can sometimes help human operators focus their attention on the forthcoming task and understand its context before task execution, hence improving effectiveness. Nevertheless, deciding when to use preparatory notification as a tactic is not obvious and entails considering different factors that include uncertainties induced by human operator behavior (who might ignore the notice message), human attributes (e.g., operator training level), and other information that refers to the state of the system and its environment.
In this paper, informed by work in cognitive science on human attention and context management, we introduce a formal framework to reason about
the usage of preparatory notifications
in self-adaptive systems involving human operators. Our framework characterizes the effects of managing attention via task notification in terms of task context comprehension. We also build on our framework to develop an automated probabilistic reasoning technique able to determine when and in what form a preparatory notification tactic should be used to optimize system goals. We illustrate our approach in a representative scenario of human-robot collaborative goods delivery.
Abstract: [Context and motivation:] For realistic self-adaptive systems,
multiple quality attributes need to be considered and traded off
against each other. These quality attributes are commonly encoded in
a utility function, for instance, a weighted sum of relevant objectives.
[Question/problem:] The research agenda for requirements engineering
for self-adaptive systems has raised the need for decision-making
techniques that consider the trade-offs and priorities of multiple objectives.
Human stakeholders need to be engaged in the decision-making
process so that the relative importance of each objective can be correctly
elicited. [Principal ideas/results:] This research preview paper
presents a method that supports multiple stakeholders in prioritizing
relevant quality attributes, negotiating priorities to reach an agreement,
and giving input to define utility functions for self-adaptive systems.
[Contribution:] The proposed method constitutes a lightweight solution
for utility function definition. It can be applied by practitioners and
researchers who aim to develop self-adaptive systems that meet stakeholders'
requirements. We present details of our plan to study the application
of our method using a case study.
Abstract: Security attacks present unique challenges to self-adaptive
system design due to the adversarial nature of the environment. Game
theory approaches have been explored in security to model malicious
behaviors and design reliable defense for the system in a mathematically
grounded manner. However, modeling the system as a single player, as
done in prior works, is insufficient for the system under partial compromise
and for the design of fine-grained defensive strategies where the rest of the
system with autonomy can cooperate to mitigate the impact of attacks.
To deal with such issues, we propose a new self-adaptive framework incorporating
Bayesian game theory and model the defender (i.e., the system)
at the granularity of components. Under security attacks, the architecture
model of the system is translated into a Bayesian multi-player game,
where each component is explicitly modeled as an independent player
while security attacks are encoded as variant types for the components.
The optimal defensive strategy for the system is dynamically computed
by solving the pure equilibrium (i.e., adaptation response) to achieve
the best possible system utility, improving the resiliency of the system
against security attacks. We illustrate our approach using an example
involving load balancing and a case study on inter-domain routing.
Abstract: Software systems are designed and implemented with assumptions about the environment. However, once the system is deployed,the actual environment may deviate from its expected behavior,possibly undermining desired properties of the system. To enable systematic design of systems that are robust against potential environmental deviations, we propose a rigorous notion of robustness for software systems. In particular, the robustness of a system is de-fined as the largest set of deviating environmental behaviors under which the system is capable of guaranteeing a desired property. We describe a new set of design analysis problems based on our notion of robustness, and a technique for automatically computing robustness of a system given its behavior description. We demonstrate potential applications of our robustness notion on two case studies involving network protocols and safety-critical interfaces.
Abstract: End-usersΓ’β¬β’ trust in automated agents is important as automated decision-making and planning is increasingly used in many aspects of peopleΓ’β¬β’s lives. In real-world applications of planning, multiple optimization objectives are often involved.Thus, planning agentsΓ’β¬β’ decisions can involve complex tradeoffs among competing objectives. It can be difficult for the end-users to understand why an agent decides on a particular planning solution on the basis of its objective values. As a result, the users may not know whether the agent is making the right decisions, and may lack trust in it. In this work, we contribute an approach, based on contrastive explanation, that enables a multi-objective MDP planning agent to explain its decisions in a way that communicates its tradeoff rationale in terms of the domain-level concepts. We conduct a human subjects experiment to evaluate the effectiveness of our explanation approach in a mobile robot navigation domain. The results show that our approach significantly improves the usersΓ’β¬β’ understanding, and confidence in their understanding, of the tradeoff rationale of the planning agent
Abstract: Self-adaptive software systems rely on planning to
make adaptation decisions autonomously. Planning is required
to produce high-quality adaptation plans in a timely manner;
however, quality and timeliness of planning are conflicting in
nature. This conflict can be reconciled with hybrid planning,
which can combine reactive planning (to quickly provide an
emergency response) with deliberative planning that take time
but determine a higher-quality plan. While often effective, reactive
planning sometimes risks making the situation worse. Hence,
a challenge in hybrid planning is to decide whether to invoke
reactive planning until the deliberative planning is ready with a
high-quality plan. To make this decision, this paper proposes a
novel learning-based approach. We demonstrate that this learning-based
approach outperforms existing techniques that are based
on specifying fixed conditions to invoke reactive planning in two
domains: enterprise cloud systems and unmanned aerial vehicles.
Abstract: Many self-adaptive systems benefit from human involvement, where a human operator can provide expertise not available to the system and perform adaptations involving physical changes that cannot be automated.
However, a lack of transparency and intelligibility of system goals and the autonomous behaviors enacted to achieve them may hinder a human operator's effort to make such involvement effective.
Explanation is sometimes helpful to allow the human to understand why the system is making certain decisions. However, explanations come with costs in terms of, e.g., delayed actions.
Hence, it is not always obvious whether explanations will improve the satisfaction of system goals and, if so,
when to provide them to the operator. In this work, we define a formal framework for reasoning about explanations of adaptive system behaviors and the conditions under which they are warranted. Specifically, we characterize explanations in terms of their impact on a human operator's ability to effectively engage in adaptive actions.
We then present
a decision-making approach for planning in self-adaptation
that leverages a probabilistic reasoning tool to determine when the explanation should be used
in an adaptation strategy in order to improve overall system utility.
We illustrate our approach in a representative scenario for the application of an adaptive news website in the context of potential denial-of-service attacks.
Abstract: Many self-adaptive systems benefit from human involvement and
oversight, where a human operator can provide expertise not available
to the system and can detect problems that the system is
unaware of. One way of achieving this is by placing the human
operator on the loop Γ’β¬β i.e., providing supervisory oversight and
intervening in the case of questionable adaptation decisions. To
make such interaction effective, explanation is sometimes helpful to
allow the human to understand why the system is making certain
decisions and calibrate confidence from the human perspective.
However, explanations come with costs in terms of delayed actions
and the possibility that a human may make a bad judgement. Hence,
it is not always obvious whether explanations will improve overall
utility and, if so, what kinds of explanation to provide to the operator.
In this work, we define a formal framework for reasoning
about explanations of adaptive system behaviors and the conditions
under which they are warranted. Specifically, we characterize
explanations in terms of explanation content, effect, and cost. We
then present a dynamic adaptation approach that leverages a probabilistic
reasoning technique to determine when the explanation
should be used in order to improve overall system utility.
Abstract: Microservice application developers try to mitigate
the impact of partial outages typically by implementing
service-to-service interactions that use well-known resiliency
patterns, such as Retry, Fail Fast, and Circuit Breaker. However,
those resiliency patternsΓ’β¬βas well as their available open-source
implementationsΓ’β¬βare often documented informally, leaving it up
to application developers to figure out when and how to use those
patterns in the context of a particular microservice application.
In this paper, we take a first step towards improving on this
situation by introducing a model checking-based approach in
which we use the PRISM probabilistic model checker to analyze
the behavior of the Retry and Circuit Breaker resiliency patterns
as continuous-time Markov chains (CTMC). This approach has
enabled us to quantify the impact of applying each resiliency
pattern on multiple quality attributes, as well as to determine
how to best tune their parameters to deal with varying service
availability conditions, in the context of a simple client-service
interaction scenario.
Abstract: Advanced persistent threats (APTs) are a particularly troubling challenge
for software systems. The adversarial nature of the security
domain, and APTs in particular, poses unresolved challenges to
the design of self- systems, such as how to defend against multiple
types of attackers with different goals and capabilities. In
this interaction, the observability of each side is an important and
under-investigated issue in the self- domain. We propose a model
of APT defense that elevates observability as a first-class concern.
We evaluate this model by showing how an informed approach that
uses observability improves the defenderΓ’β¬β’s utility compared to a
uniform random strategy, can enable robust planning through sensitivity
analysis, and can inform observability-related architectural
design decisions.
Abstract: Modern enterprise IT systems are increasingly becoming
compositions of many subsystems each of which is
an autonomic system. These individual autonomic systems act
independently to maintain their locally defined SLAs but can take
actions which are inconsistent with and potentially detrimental
to the global system objective. Currently, human administrators
intervene to resolve these conflicts but are challenged by
complexity in the prediction of current and future states of
the constituent systems and their managers, multiple conflicting
quality dimensions which may change over time, combinatorially
large configuration space across the set of constituent systems,
and the time critical nature of the decisions to be made to prevent
further degradation. To address these challenges, this paper
proposes an approach that enables the creation of a higher level
autonomic system, referred to as a meta-manager, that does not
subsume the control functions nor does it directly orchestrate the
actions of the sub-autonomic managers. Instead, we encapsulate
and abstract the behavior of each subsystem as a parameterized
adaptation policy which can be adjusted by the meta-manager
to tune the adaptive behavior of the subsystem adaptation. We
can effectively instantiate this idea by considering each of the
subsystems as a player in a stochastic multi-player game against
itΓ’β¬β’s local environment, and synthesize an adaptation strategy
using off-the-shelf tools for stochastic game analysis.
Abstract: As Cyber-Physical Systems (CPSs) become more autonomous,
it becomes harder for humans who interact with the CPSs to
understand the behavior of the systems. Particularly for CPSs
that must perform tasks while optimizing for multiple quality
objectives and acting under uncertainty, it can be difficult
for humans to understand the system behavior generated by
an automated planner. This work-in-progress presents an
approach at clarifying system behavior through interactive
explanation by allowing end-users to ask Why and Why-Not questions about specific behaviors of the system, and
providing answers in the form of contrastive explanation.