Impact of Correlated Failures on System Security

Composite E. Xample CS530DL Project Proposal Computer Science Department Colorado State University, Fort Collins, CO 80523 aaabbb@lamar.csu.edu

Abstract This example proposal was constructed using multiple proposals from previous semesters to serve as an example. Thus the proposal as a whole will not make sense. This proposal is a longer one, Your own proposal does not have to be this long. Also you dont have to use the two-column format for the proposal, although it will be required for the final paper. Correlated Failures occur when several key checks and balances are undone. This paper attempts to investigate several cases of correlated failures between the check and balances for complex systems and ways to possibly mitigate those failures that can affect reliability. This paper will investigate further in several cases that correlated failures caused a unreliability in the system. The Wall Street Crash market revealed systematic failures between investors assumptions and their reliance on the Gaussian copula function. Also the Challenger accident of 1986 failures in checks in balance to create a reliable system. Also the more recent Columbia Accident of 2003 which cites striking similarities in failures. 1. Motivation In my job I work on a wide variety of in-house software development projects. Mostly these projects relate around integration of our custom software to third party products in order to provide new services for our customers or to provide integration points between systems that can be then used to integrate these services into our software ecosystem. As such we depend significantly on the behavior and correctness of software components that are not directly under our control during software development process or more importantly production but are vital part of the services we provide. I would like to examine how we can use combination of the unit testing, static

code analysis and integration testing to achieve higher final product reliability. My hope is that this will give us metrics to decide, based on the circumstances, what approach and level of testing will yield the highest results fastest and help us concentrate testing in the right areas. Secondly I would like to present the integration testing approach we have undertaken for testing web services (which are integral part of all three mentioned projects). Ive developed a testing model and I turned it into a small tool/application to increase our ability to run full regression tests and to decrease the amount of time and manpower required to execute those tests. I would like to use these three projects as benchmarks to determine what value my tool brings to the testing process both from product reliability perspective but also from time/monetary perspective.

2. Proposed Approach We will look at three different projects of various complexities. Two are recently completed projects that are in their final implementation stage or initial production rollout stage and one is in the early stage of development and will be close to implementation by the time this paper is finalized. Specifically, the cyclomatic complexity of each features pseudo-code will be obtained in addition to the total number of test cases needed to cover the feature purely from a conformance perspective. The latter will be obtained both by writing a test plan, analyzing existing tests for the feature on test262.ecmascript.org, and determining the union of both. Finally, an attempt will be made to try to numerically correlate cyclomatic complexity of the pseudo-code to the number of test cases needed for minimal yet complete feature coverage. However, their approach to integration and

regression testing is different in a sense that one relies on traditional boots on the ground testing where the other two projects are utilizing more automated process in during integration phase of testing. My hope is to prove that reliability as well as cost of testing is significantly lower with the more automated approach. I will also introduce reader to my simple web service testing model that I have developed to improve our testing productivity in the integration and QA Testing phases of the product development cycle. References Websites: [1] Felix Salmon. (2.23.2009). Recipe for Disaster: The Formula That Killed Wall Street, Wired magazine, http://www.wired.com/techbiz/it/magazine/1703/wp_quant?currentPage=all [2] Committee on Science and Technology House of Representatives Ninety-Ninth Congress Second Session. (1986). Investigation of the Challenger Accident. http://www.gpoaccess.gov/challenger/64_420.pdf [3] Risk management. http://en.wikipedia.org/wiki/Risk_management, Visited 1/19/2011. 5:12PM. Journals: [4] Ellims, Michael; Bridges, James; Ince, Darrel. The Economics of Unit Testing, Empirical Software Engineering, vol. 11, no. 1, pp.5-31, 16 Mar 2006 [2] Belli, Fevzi; Linschulte, Michael. Event-driven modeling and testing of real-time web services, Service Oriented Computing and Applications, vol. 4, no. 1, pp. 3-15, 1 Mar 2010 [3] Bocciarelli, Paolo; DAmbrogio, Andrea. A model-driven method for describing and predicting the reliability of composite services, Software and Systems Modeling, pp. 1-16, 21 Feb 2010 Conferences: [7] John McMullan, Negligence: engineering safetycritical systems, SCS '02: Proceedings of the seventh Australian workshop conference on Safety critical systems and software 2002. Pages. 63-72

[8] Menghui Cao and William J. Morokoff, Calibrating credit portfolio loss distributions, WSC '04 Proceedings of the 36th conference on Winter simulation. [9] Martin Thomas. Engineering Judgment, SCS '04: Proceedings of the 9th Australian workshop on Safety critical systems and software. Pages 43-47 Organization/research-groups: [10] Software Testing Research Group in the School of Computing and Information Sciences (SCIS) at FIU, http://webresearch.cis.fiu.edu/strg/ [11] Space Shuttle Program, National Aeronautics and Space Administration, URL: http://www.nasa.gov/mission_pages/shuttle/main/index. html [12] The client & cloud applications group, Microsoft Research, http://research.microsoft.com/enus/groups/caps/