Abstract: Over the past decade, a number of automated techniques
and tools have been developed for optimizing architectural
designs with respect to quality-attribute goals. In these systems,
the optimization process is typically seen as a black box, since it
is not possible for a human to have access to the decisions that led
to a particular solution generated by an optimization tool. Even
when these decisions are available for inspection, the amount of
information can be overwhelming for the architect. As a result,
humans might not completely understand the rationale behind
a given solution or trust that a tool made correct decisions. To
mitigate this problem, we propose a semi-automated approach
for generating textual explanations for any architectural solution
produced by a tool. This kind of explanation provides a summary
of the key architectural tactics that were applied to achieve an
optimized architecture that satisfies a set of quality-attribute objectives.
In this paper, we discuss two procedures for determining
the key tactics to be explained. As an initial experiment, we used a
popular optimization tool to generate solutions and explanations
for a small but non-trivial design space involving performance,
reliability, and cost objectives. We also performed an exploratory
user study to assess the effectiveness of these explanations.
Abstract: In software design, guaranteeing the correctness of run-time system behavior while achieving an acceptable balance among multiple quality attributes remains a challenging problem.
Moreover, providing guarantees about the satisfaction of those requirements when systems are subject to uncertain environments is even more challenging.
While recent developments in architectural analysis techniques can assist architects in exploring the satisfaction of quantitative guarantees across the design space, existing approaches are still limited because they do not explicitly link design decisions to satisfaction of quality requirements.
Furthermore, the amount of information they yield can be overwhelming to a human designer, making it difficult to distinguish the forest through the trees.
In this paper, we present an approach to analyzing architectural design spaces that addresses these limitations and provides a basis to enable the explainability of design tradeoffs.
Our approach combines dimensionality reduction techniques employed in machine learning pipelines with quantitative verification to enable architects to understand how design decisions contribute to the satisfaction of strict quantitative guarantees under uncertainty across the design space.
Our results show feasibility of the approach in two case studies and evidence that dimensionality reduction is a viable approach to facilitate comprehension of tradeoffs in poorly-understood design spaces.
🏆
Abstract: Many self-adaptive systems benefit from human involvement, where human operators can complement the capabilities of systems (e.g., by supervising decisions, or performing adaptations and tasks involving physical changes that cannot be automated). However, insufficient preparation (e.g., lack of task context comprehension) may hinder the effectiveness of human involvement, especially when operators are unexpectedly interrupted to perform a new task. Preparatory notification of a task provided in advance can sometimes help human operators focus their attention on the forthcoming task and understand its context before task execution, hence improving effectiveness. Nevertheless, deciding when to use preparatory notification as a tactic is not obvious and entails considering different factors that include uncertainties induced by human operator behavior (who might ignore the notice message), human attributes (e.g., operator training level), and other information that refers to the state of the system and its environment.
In this paper, informed by work in cognitive science on human attention and context management, we introduce a formal framework to reason about
the usage of preparatory notifications
in self-adaptive systems involving human operators. Our framework characterizes the effects of managing attention via task notification in terms of task context comprehension. We also build on our framework to develop an automated probabilistic reasoning technique able to determine when and in what form a preparatory notification tactic should be used to optimize system goals. We illustrate our approach in a representative scenario of human-robot collaborative goods delivery.
Abstract: [Context and motivation:] For realistic self-adaptive systems,
multiple quality attributes need to be considered and traded off
against each other. These quality attributes are commonly encoded in
a utility function, for instance, a weighted sum of relevant objectives.
[Question/problem:] The research agenda for requirements engineering
for self-adaptive systems has raised the need for decision-making
techniques that consider the trade-offs and priorities of multiple objectives.
Human stakeholders need to be engaged in the decision-making
process so that the relative importance of each objective can be correctly
elicited. [Principal ideas/results:] This research preview paper
presents a method that supports multiple stakeholders in prioritizing
relevant quality attributes, negotiating priorities to reach an agreement,
and giving input to define utility functions for self-adaptive systems.
[Contribution:] The proposed method constitutes a lightweight solution
for utility function definition. It can be applied by practitioners and
researchers who aim to develop self-adaptive systems that meet stakeholders'
requirements. We present details of our plan to study the application
of our method using a case study.
Abstract: Security attacks present unique challenges to self-adaptive
system design due to the adversarial nature of the environment. Game
theory approaches have been explored in security to model malicious
behaviors and design reliable defense for the system in a mathematically
grounded manner. However, modeling the system as a single player, as
done in prior works, is insufficient for the system under partial compromise
and for the design of fine-grained defensive strategies where the rest of the
system with autonomy can cooperate to mitigate the impact of attacks.
To deal with such issues, we propose a new self-adaptive framework incorporating
Bayesian game theory and model the defender (i.e., the system)
at the granularity of components. Under security attacks, the architecture
model of the system is translated into a Bayesian multi-player game,
where each component is explicitly modeled as an independent player
while security attacks are encoded as variant types for the components.
The optimal defensive strategy for the system is dynamically computed
by solving the pure equilibrium (i.e., adaptation response) to achieve
the best possible system utility, improving the resiliency of the system
against security attacks. We illustrate our approach using an example
involving load balancing and a case study on inter-domain routing.
Abstract: Software systems are designed and implemented with assumptions about the environment. However, once the system is deployed,the actual environment may deviate from its expected behavior,possibly undermining desired properties of the system. To enable systematic design of systems that are robust against potential environmental deviations, we propose a rigorous notion of robustness for software systems. In particular, the robustness of a system is de-fined as the largest set of deviating environmental behaviors under which the system is capable of guaranteeing a desired property. We describe a new set of design analysis problems based on our notion of robustness, and a technique for automatically computing robustness of a system given its behavior description. We demonstrate potential applications of our robustness notion on two case studies involving network protocols and safety-critical interfaces.
Abstract: End-users’ trust in automated agents is important as automated decision-making and planning is increasingly used in many aspects of people’s lives. In real-world applications of planning, multiple optimization objectives are often involved.Thus, planning agents’ decisions can involve complex tradeoffs among competing objectives. It can be difficult for the end-users to understand why an agent decides on a particular planning solution on the basis of its objective values. As a result, the users may not know whether the agent is making the right decisions, and may lack trust in it. In this work, we contribute an approach, based on contrastive explanation, that enables a multi-objective MDP planning agent to explain its decisions in a way that communicates its tradeoff rationale in terms of the domain-level concepts. We conduct a human subjects experiment to evaluate the effectiveness of our explanation approach in a mobile robot navigation domain. The results show that our approach significantly improves the users’ understanding, and confidence in their understanding, of the tradeoff rationale of the planning agent
Abstract: Many applications have taken advantage of cloud
provided autonomic capabilities, commonly auto-scaling, to harness
easily available compute capacity to maintain performance
against defined quality objectives. This has caused the management
complexity of enterprise applications to increase. It is
now common for an application to be a collection of autonomic
sub-systems. However, combining individual autonomic systems
to create an application can lead to behaviors that negatively
impact the global aggregate utility of the application and in
some cases can be conflicting and self-destructive. Commonly,
human administrators address these behaviors as part of a design
time analysis of the situation or a run time mitigation of the
undesired effects. However, the task of controlling and mitigating
undesirable behaviors is complex and error prone. To handle the
complexity of managing a collection of autonomic systems we
have previously proposed an automated approach to the creation
of a higher level autonomic management system, referred to as a
Meta-Manager. In this paper, we improve upon prior work with
a more streamlined and understandable formal representation of
the approach, expand its capabilities to include global knowledge,
and test its potential applicability and effectiveness by managing
the complexity of a collection of autonomic systems in a case
study of a major outage suffered by the Google Cloud Platform.
Abstract: Self-adaptive software systems rely on planning to
make adaptation decisions autonomously. Planning is required
to produce high-quality adaptation plans in a timely manner;
however, quality and timeliness of planning are conflicting in
nature. This conflict can be reconciled with hybrid planning,
which can combine reactive planning (to quickly provide an
emergency response) with deliberative planning that take time
but determine a higher-quality plan. While often effective, reactive
planning sometimes risks making the situation worse. Hence,
a challenge in hybrid planning is to decide whether to invoke
reactive planning until the deliberative planning is ready with a
high-quality plan. To make this decision, this paper proposes a
novel learning-based approach. We demonstrate that this learning-based
approach outperforms existing techniques that are based
on specifying fixed conditions to invoke reactive planning in two
domains: enterprise cloud systems and unmanned aerial vehicles.
Abstract: Many self-adaptive systems benefit from human involvement, where a human operator can provide expertise not available to the system and perform adaptations involving physical changes that cannot be automated.
However, a lack of transparency and intelligibility of system goals and the autonomous behaviors enacted to achieve them may hinder a human operator's effort to make such involvement effective.
Explanation is sometimes helpful to allow the human to understand why the system is making certain decisions. However, explanations come with costs in terms of, e.g., delayed actions.
Hence, it is not always obvious whether explanations will improve the satisfaction of system goals and, if so,
when to provide them to the operator. In this work, we define a formal framework for reasoning about explanations of adaptive system behaviors and the conditions under which they are warranted. Specifically, we characterize explanations in terms of their impact on a human operator's ability to effectively engage in adaptive actions.
We then present
a decision-making approach for planning in self-adaptation
that leverages a probabilistic reasoning tool to determine when the explanation should be used
in an adaptation strategy in order to improve overall system utility.
We illustrate our approach in a representative scenario for the application of an adaptive news website in the context of potential denial-of-service attacks.
Abstract: Plan reuse is a promising approach for enabling self- systems to effectively adapt to unexpected changes, such as evolving existing adaptation strategies after an unexpected change using stochastic search. An ideal self- planner should be able to reuse repertoires of adaptation strategies, but this is challenging due to the evaluation overhead. For effective reuse, a repertoire should be both (a) likely to generalize to future situations, and (b) cost effective to evaluate. In this work, we present an approach inspired by chaos engineering for generating a diverse set of adaptation strategies to reuse, and we explore two analysis approaches based on clone detection and syntactic transformation for constructing repertoires of adaptation tactics that are likely to be amenable to reuse in stochastic search self-* planners. An evaluation of the proposed approaches on a simulated system inspired by Amazon AWS shows planning effectiveness improved by up to 20% and reveals tradeoffs in planning timeliness and optimality.
Abstract: Many self-adaptive systems benefit from human involvement and
oversight, where a human operator can provide expertise not available
to the system and can detect problems that the system is
unaware of. One way of achieving this is by placing the human
operator on the loop – i.e., providing supervisory oversight and
intervening in the case of questionable adaptation decisions. To
make such interaction effective, explanation is sometimes helpful to
allow the human to understand why the system is making certain
decisions and calibrate confidence from the human perspective.
However, explanations come with costs in terms of delayed actions
and the possibility that a human may make a bad judgement. Hence,
it is not always obvious whether explanations will improve overall
utility and, if so, what kinds of explanation to provide to the operator.
In this work, we define a formal framework for reasoning
about explanations of adaptive system behaviors and the conditions
under which they are warranted. Specifically, we characterize
explanations in terms of explanation content, effect, and cost. We
then present a dynamic adaptation approach that leverages a probabilistic
reasoning technique to determine when the explanation
should be used in order to improve overall system utility.
Sheila Venero,
Bradley Schmerl, Leonardo Montecchi, Julio Cesar Dos Reis and Cecilia M. F. Rubira. Automated Planning for supporting Knowledge-intensive Processes. In Proceedings of the 20th Business Process Modeling, Development and Support (BPMDS) Working Conference. June 8-9, 2020.
https://doi.org/10.1007/978-3-030-49418-6_7.
Abstract: Knowledge-intensive processes (KiPs) are processes characterized by high levels of unpredictability and dynamism. Their process structure may not be known before their execution. One way to cope with this uncertainty is to defer decisions regarding the process structure until run time. In this paper, we consider the definition of the process structure as a planning problem. Our approach uses automated planning techniques to generate plans that define process models according to the current context. The generated plan model relies on a metamodel called METAKIP that represents the basic elements of KiPs.
Our solution explores Markov Decision Processes (MDP) to generate plan models. This technique allows uncertainty representation by defining state transition probabilities, which gives us more flexibility than traditional approaches. We construct an MDP model and solve it with the help of the PRISM model-checker. The solution is evaluated by means of a proof of concept in the medical domain and reveals the feasibility of our approach.
Abstract: Advanced persistent threats (APTs) are a particularly troubling challenge
for software systems. The adversarial nature of the security
domain, and APTs in particular, poses unresolved challenges to
the design of self- systems, such as how to defend against multiple
types of attackers with different goals and capabilities. In
this interaction, the observability of each side is an important and
under-investigated issue in the self- domain. We propose a model
of APT defense that elevates observability as a first-class concern.
We evaluate this model by showing how an informed approach that
uses observability improves the defender’s utility compared to a
uniform random strategy, can enable robust planning through sensitivity
analysis, and can inform observability-related architectural
design decisions.
Abstract: As Cyber-Physical Systems (CPSs) become more autonomous,
it becomes harder for humans who interact with the CPSs to
understand the behavior of the systems. Particularly for CPSs
that must perform tasks while optimizing for multiple quality
objectives and acting under uncertainty, it can be difficult
for humans to understand the system behavior generated by
an automated planner. This work-in-progress presents an
approach at clarifying system behavior through interactive
explanation by allowing end-users to ask Why and Why-Not questions about specific behaviors of the system, and
providing answers in the form of contrastive explanation.
🏅
Abstract: Research in self-adaptive systems often uses web applications as
target systems, running the actual software on real web servers.
This approach has three drawbacks. First, these systems are not
easy and/or cheap to deploy. Second, run-time conditions cannot
be replicated exactly to compare diferent adaptation approaches
due to uncontrolled factors. Third, running experiments is time-
consuming. To address these issues, we present SWIM, an exemplar
that simulates a web application. SWIM can be used as a target
system with an external adaptation manager interacting with it
through its TCP-based interface. Since the servers are simulated,
this use case addresses the irst two problems. The full beneit
of SWIM is attained when the adaptation manager is built as a
simulation module. An experiment using a simulated 60-server
cluster, processing 18 hours of traic with 29 million requests takes
only 5 minutes to run on a laptop computer. SWIM has been used
for evaluating self-adaptation approaches, and for a comparative
study of model-based predictive approaches to self-adaptation.