Software Center

Task force meeting for planning sprint 25
2023-06-16 10:00 - 12:00 (Europe/Stockholm) | Virtual event, Sweden

Reporting workshop
2023-06-15 10:00 - 17:00
In Software Center, companies and universities work together to accelerate the adoption of novel approaches to software engineering. The reporting workshop takes place twice a year, in June and December. This one day event aims at sharing results from research and cooperation within Software Center. The agenda ranges from keynote presentations to in-depth sessions for themes and projects. The cooperation between academia and companies in Software Center creates the software engineering success stories that industry needs.
Place:
For this reporting workshop we will focus on a LIVE meeting at the Wallenberg Conference Center in Gothenburg (Medicinaregatan 20). To maximize the opportunities to meet and discuss there will also be a joint informal lunch at the conference center for all participants. For those of you who cant come to Gothenburg there is a teams link below to join digitally.
We are looking forward to meeting you all again, and to discuss projects and further collaboration!

Registration:
Please register at this link: https://forms.gle/UtFMjGBYiPv1S3UD8

Agenda, June 15th:
09.30 – 10.00: Registration and coffee
10:00-10:20: Opening: Jan Bosch
10:20-10:50: Lifting AI from Code to Software: Keynote presentation by Miroslaw Staron, Chalmers & University of Gothenburg, and Albert Ziegler, Principal Machine Learning Engineer, GitHub CoPilot
10.50-11.00: Reliable, Safe and Secure Intelligent Autonomous Systems: presentation of the Industrial graduate school RELIANT by Mikael Sjödin, Research leader Embedded Systems, Mälardalen University
11:10-12:00: Poster session and time to mingle with project teams
AND parallel Birds-of-a-feather sessions* (reach out to the organizers if you want to add/run a session!)

Automated Export Control: Miroslaw Staron together with Thomas Olsson and Robert Lagerstedt, Engineering Excellence at Bosch Nordic, Miroslaw Staron, Chalmers / Univ of Gothenburg
Room: Antarktis

12:00 – 13: 00: Lunch together at Wallenberg Conference Center
13:00 – 15:00: Up-dates from Software Center communities, themes and projects – parallel tracks (incl coffee break):

Theme 1 & 2: Continuous Delivery & Architecture
Room: Sydamerika
Chairs: Jan Carlson and Kristian Sandahl

13:00 – 13:10 Welcome and introduction, Jan Carlson (MDU) and Kristian Sandahl (LiU)

13:10 – 13:30 “Taming Uncertainty and Inconsistency with Flexible Modeling for Continuous Architecting, Robbert Jongeling, Mälardalen University

13:30 – 13:50 “The new norm: from solid products to liquid products. What about safety assurance?“, Barbara Gallina, Mälardalen University

13:50 – 14:10 “AI in testing”, Azeem Ahmad, Ericsson & Linköping University

14:10 – 14: 30 “Static analysis of testware”, Jean Malm, Mälardalen University

14:30 – 15:00 Coffee and discussions

Theme 3: Metrics
Room: Antarktis
Chair: Miroslaw Staron

13.00 – 13.15: Requirements and OpenAI, GPT-4 (Miroslaw)

13.15 – 13.30: Communication (Nataliya Berbyuk-Lindström and Aleksandre Asatiani)

13.30 – 14.00: Data leaks results (Md Abu Ahammed Babu)

14.00 – 14.30: NFR for ML (Khan Mohammad Habibullah)
14.30 – 15.00: Design pattern recognition (Sushant Kumar Pandey)

Strategic Digital Product Management in the age of AI: PdM and AI Engineering communities
Chairs: Helena H Olsson and Jan Bosch
Room: Wallenbergssalen
How to change current PdM practices to work with digital technologies and digital offerings? What is the future of PdM practices and what are the key characteristics of digital product management?
In this session, we focus on the topic of software product management and how PdM practices are rapidly changing. We invite to talks and discussions and together we explore and define how to do PdM for digital products.

13:00 – 13:10: Welcome and introduction
13:10 – 13:20: “Software Product Management: from opinions to data-driven experimentation”: Jan Bosch, Chalmers
13:20 – 13:30: “Software Product Management: current state and challenges”: Helena Holmström Olsson, Malmö University
13:30 – 14:00: ”From product focus to service deployment by thinking big but starting small”: Ingmar Bengtsson (Director of Business & Partner development, Volvo Group) and David Klippudde (Director of Services, Volvo Group)
14:00 – 15:00: Group discussion

15:00 – 15.40: Cyber security challenges and practices: Keynote presentation by Patrik Åkesson, Vice President R&D at Advenica
15.40: GATE AI, Big Data for Smart Society Institute: Sylvia Ilieva, director, Sofia University, Bulgaria
https://gate-ai.eu/en/
16.00 – 16.30: Plans, reflections & closing: Jan Bosch

Abstracts:

Lifting AI from Code to Software: Albert Ziegler, GitHub CoPilot

The first truly generative models for code (the Codex series) were trained on isolated source files. Their first large scale application (completions in GitHub Copilot) helps developers by suggesting snippets in their current file.

But a source file is to software what a brick is to a house. A single one does nothing, and even many together don’t hold it up alone. So applications of generative AI for development are getting ever more ambitious:
– taking in context from the whole repository,
– considering artefacts of its evolution like issues, commits and pull requests,
– reading documentation and running code.

I will examine which kinds of challenges this presents to the AI designers: how to gather context, how to present it to the model, and how to control the output. And I will discuss which kinds of opportunities this presents to software developers: how this will impact their workflow, and how to make sure it’s for the better.

Cybersecurity challenges and practices: Keynote presentation by Patrik Åkesson, Vice President R&D at Advenica
Democracies are under increasing attack in the cyber-security landscape – by organized crime looking for short-term profits, and nation-state backed agressors looking to further their political agendas and to de-stablilize our society. The intelligence community warns that hybrid warfare is the new normal, and that cyber-attacks are targeting all segments of society, including private companies. The EUs response Is Cybersecurity legislation – legislation targeting different sectors, and legislation targeting any product that contains software. How will this affect companies building or distributing products that contain software?”
* Birds-of-a-feather session:
An informal discussion group, typically at a conference, based on a shared interest and without any fixed agenda.

Eiffel Summit 2023
2023-06-13 09:00 - 2023-06-14 17:00
This in-person two-day conference for people interested in the Eiffel protocol and its ecosystem will have a mix of presentations and discussions. Newcomers as well as experienced practitioners are welcome!

Place

Lindholmen, Gothenburg (check Eiffel website for details)

Registration

at the Eiffel Summit website: https://eiffel-community.github.io/summit.html

Deadline Sprint 25 project proposals
2023-06-09 12:00 - 14:00 | Virtual event, Sweden

Deadline for NEW project proposals
2023-06-02 12:00 - 14:00 | Virtual event, Sweden

Systems Engineering community workshop
2023-05-26 13:00
Online workshop for the Systems Engineering community in Software Center
Brief agenda:

Recap our previously selected themes (attached)
Look at 1-2 case studies from Tetra Pak
Open discussion: similar experiences and success strategies

For more information:
contact Magnus Timmerby

Coordination team meeting
2023-05-22 11:00 - 12:00, 2023-04-24 11:00 - 12:00, 2023-03-27 09:00 - 09:30, 2023-02-27 11:00 - 12:00, 2023-01-16 11:00 - 12:00 | Virtual event, Sweden

CAIN conference
2023-05-15 - 2023-05-16 | Virtual meeting, Sweden
Welcome to CAIN’23 – 2nd International Conference on AI Engineering – Software Engineering for AI
We are committed to providing you with a unique online and onsite experience. Therefore, CAIN’23 will take place in Melbourne on May 20th and online on May 15-16th.
The aim of CAIN’23 is to bring together researchers and practitioners in software engineering, in data-science and AI, and to build up a community that will target the new challenges emerging in Software Engineering for AI-enabled systems.
In development and implementation of AI-enabled systems, the main challenge is not to develop the best models/algorithms, but to provide support for the entire lifecycle – from a business idea, through collection, training, and management of data, code development, product deployment and operation, and its maintenance and evolution. There is a clear need for specific support of Software Engineering for AI.
CAIN has the following goals for the next few years.

Identify the main challenges of AI engineering, from an AI and SE perspective, considering industrial needs and their current experiences;
Create a roadmap capturing the research directions in AI engineering in relation to AI-based systems lifecycle;
Contribute to a better understating of practical problems and understanding differences in approaches of data science and AI/ML and SE;
Identify industrial challenges in building and using AI-enabled systems and contribute to solving them
Build a thriving community of SE, and data-science and AI practitioners and researchers.

CAIN’23 will have all sessions in a single track. The following sessions are planned:

Invited keynotes and panels
Presentation of accepted papers
Industrial Talks
Poster presentations

Stay tuned for more information:
https://conf.researchr.org/home/cain-2023

Software Center workshop on automated testing
2023-03-31 10:00 - 16:30 | Virtual meeting, Sweden
This is a members-only workshop where we present and discuss current and coming topics for collaboration in software testing.
Register for the workshop here:
https://forms.office.com/e/xVPHz85CGJ
(Deadline 2023-03-27)

Mid-sprint steering committee meeting
2023-03-27 09:30 - 12:00 | Virtual event, Sweden

Systems Engineering meet-up
2023-01-17 15:00 - 16:30 | Virtual event, Sweden
Restarting the Systems Engineering community in Software Center:
Welcome all to an online workshop to kick off the Systems Engineering community again! This meeting is ONLINE (Teams) to keep it simple.
Registration:
Please register at the link below to get the Teams link to the meeting:
https://forms.gle/9JmEg6Czee3ojSit6
Suggested agenda:

Who is who – quick introduction around the table
Recap of previous objectives (Magnus / Jan)
Discussion on suggested themes going forward
Plan next on-site workshop

NOTE: The Systems Engineering community is mainly for Systems Engineers or similar roles, i.e. integrating disparate technologies (software + hardware) with a full lifecycle perspective.
Contact:
Magnus Timmerby
Digitalization Champion, FSM Base Mat, Tetra Pak

Github Co-Pilot and legal aspects of auto-generated code
2023-01-13 13:00 - 14:30 | Virtual event, Sweden
We would like to invite you to a seminar in our Software Engineering community. This time we have guests from the Department of Law, who specialize in IPR questions, with focus on software products.
Please spread this invitation to your colleagues. The seminar is online to make sure that all SC companies can attend.
GitHub Co-pilot has changed the way in which modern tools support programmers and designers. With its advanced language model, Co-pilot can generate code from natural language descriptions and it can learn the programming style of individual programmers. It is gaining popularity in the programming community, but one of the aspects that is still stopping its adoption is the legality of the generated code. Since Co-pilot has been trained on code available from open source projects, there is a theoretical risk that the code generated by Co-pilot can violate license terms of the training open source projects. However, this issue is not as simple as it seems.
In this seminar, we problematize the legal aspects of AI-based code generation by exploring how IPR laws regard use of licensed code in commercial products, we explore what kind of issues can arise from the open source community side and we look at a few examples of generated code in order to start a discussion about it.
Agenda:
13.00 – 13.20: Examples of autogenerated code and its legal aspects, Miroslaw Staron, – Department of Computer Science and Engineering, Chalmers | University of Gothenrburg
13.20 – 13.40: GitHub Co-pilot and open source systems: Jesper Derehag, Ericsson AB
13.40 – 14.00: Legal aspects of code generation, IPR: Jannice Käll, Merima Brincevic – Department of Law, University of Gothenburg
14.00 – 14.00: Discussions and questions

Steering committee meeting
2022-12-19 09:30 - 12:00 | Virtual event, Sweden
December 19 (09:30-12): Steering committee meeting

Coordination team meeting
2022-12-19 09:00 - 09:30 | Virtual event, Sweden
December 19 (9-09:30): Coordination team meeting

Task force meeting for planning sprint 24
2022-12-16 13:00 - 16:00 | Virtual event, Sweden
December 16 (13-16): Task force meeting for planning sprint 24

Reporting workshop
2022-12-15 10:00 - 17:00 | Lindholmen Conference Centre, Lindholmspiren 5, Gothenburg, 417 56, Sweden
In Software Center, companies and universities work together to accelerate the adoption of novel approaches to software engineering. The reporting workshop takes place twice a year, in June and December. This one day event aims at sharing results from research and cooperation within Software Center. The agenda ranges from keynote presentations to in-depth sessions for themes and projects. The cooperation between academia and companies in Software Center creates the software engineering success stories that industry needs.
Registration:
Please register at this link: https://forms.gle/9LgzMLn7rFzsbcqB6
Place: Lindholmen Conference Centre, Gothenburg
For this reporting workshop we will focus on a live meeting at Lindholmen Conference Center in Gothenburg. We are looking forward to meeting you all again, and to discuss projects and further collaboration!
All plenary sessions will be in room Pascal, parallel sessions take place in Pascal, Tesla and Newton.
Link for virtual participation – all plenary sessions:
We will stream the meeting for those who cant come to Gothenburg, but the digital solution will not offer any opportunity to interact with speakers. The link below takes you to all sessions in room Pascal, plenary sessions and break-out sessions. Join on your computer, mobile app or room device:
Click here to join the meeting
Meeting ID: 379 333 230 680
Passcode: [REDACTED]
Agenda:
09.00 – 10.00: Registration and coffee
10:00-10:30: Opening: Jan Bosch
10:30-11:00: Keynote presentation by Ödgärd Andersson, CEO Zenseact
11:00-12:00: Community updates in parallel:

Software engineering – Room Tesla, MS Teams
Chairs: Miroslaw Staron, Jan Carlson and Kristian Sandahl

11.00– 11.20: ChatGPT and its use for software engineering tasks, Miroslaw Staron, Chalmers | University of Gothenburg
11.20 – 11.30: Sustainability in software engineering, Kristian Sandahl, Linköping University
11.30 – 11.50: Updates on Cybersecurity workshop at MDU: Marjan Sirjani, Mälardalen University

Product management & AI Engineering – Room Pascal

Chairs: Helena H Olsson and Jan Bosch
Click here to join the meeting Meeting ID: 379 333 230 680, Passcode: [REDACTED]

11:00 – 11:25: Ways of Working – SAFe® in a DEIF context: Janne Villumsen, Vice President, Specialists and Portfolio & Project Management, DEIF

11:25 – 11:50: Industrial grade AI – Putting Machine Learning to work: Daniel Gillblad, Director, Chalmers AI Research Center and co-Director, AI Sweden

12:00 – 13: 00 Lunch break (lunch at own expense)
13:00 – 15:00: Up-dates from Software Center projects – parallel tracks (incl coffee break):

Theme 1 & 2: Continuous delivery & Architecture – Room Newton

Chairs: Jan Carlson and Kristian Sandahl
Klicka här för att ansluta till mötet Meeting-ID: 371 642 656 059, passw: B2pSGk
13:00-13:20: #6 Good testers, in industry and in published literature – mind the gap (Torvald Mårtensson)
13:20-13:40: #29 Learning Activation Functions for Improving Adversarial Robustness (Maghsood Salimi)
13:40-14:00: #35 Managing Model Inconsistencies (Robbert Jongeling)
14:00-14:30: #49 Standards-Assurance Case-Process-Product-Aware SafeOps & #50 Trace Evidence 4 Continuous Quality Product Process Assurance Justification (Barbara Gallina)
14:30-14:40: #51 Mission and Capability Engineering for Systems-of-Systems (Jan Carlson)
14:40-15:00: Coffee break

Theme 3: Metrics – Room Tesla, MS Teams
Chair: Miroslaw Staron

13.00 – 13.20: ML requirements, project: VR (Habib)
13.20 – 13.40: Handling noise in SE data, project: Metrics (Khaled)
13.40 – 14.00: Stakeholder communication, project: Metric communication (Nataliya/Alex)
14.00 – 14.20: Data and KPI for model training, project: DeVeLoP (Sushant)
14.20 – 14.40: Language models and security analyses, project: Metrics (Miroslaw Staron)
14.40 – 15.00: Language models and industrial code, project: T4AI (Sushant)

Theme 4 & 5: Customer Data & Ecosystem Driven Development, and AI Engineering – Room Pascal

Chairs: Helena H Olsson and Jan Bosch
Click here to join the meeting Meeting ID: 379 333 230 680, Passcode: [REDACTED]
13:00 – 13.20: Project 5 ‘Accelerating Digitalization Through Data’ (Helena H. Olsson)
13:20 – 13:40: Project 27 ‘Engineering Knowledge Flows in Large-Scale Agile System Development’ (Jennifer Horkoff/Eric Knauss)
13:40 – 14:00: Project 9 ‘Ecosystem Driven R&D Management’ (Helena H. Olsson)
14:00 – 14:20: Project 19 ‘Data-Driven Continuous Evolution of Autonomous Systems of Systems: Federated Learning and Reinforcement Learning’ (Hongyi Zhang)
14:20 – 14:30: Project 19 ‘Data-Driven Continuous Evolution of Autonomous Systems of Systems: ‘Semi-supervised Learning and data labeling’ (Teodor Fredriksson)
14:30 – 14:40: Project 41 ‘Design methods and processes for ML/DL models’ (Meenu Mary John)
14:40 – 15:00: Q&A and group discussion

15:00 – 16.00: Panel discussion: What´s next? What expertise do we need in 10 years from now and how do we get there?
Click here to join the meeting
Meeting ID: 379 333 230 680, Passcode: [REDACTED]
16.00 – 16:30 Plans, reflections & closing: Jan Bosch

Deadline sprint 24 project proposals
2022-12-09 08:00 - 10:00
December 9: Deadline sprint 24 project proposals (continued projects)

Public defense: Robbert Jongeling’s doctoral thesis
2022-12-02 13:30 - 17:00 | Virtual meeting, Sweden
The public defense of Robbert Jongeling’s doctoral thesis in Computer Science will take place at Mälardalen University, room Gamma (Västerås Campus) at 13:30 on 2nd December 2022, title:
Lightweight consistency checking for advancing continuous model-based development in industry
The faculty examiner is Professor Antonio Vallecillo, UMA, Spain.
The examining committee consists of Professor Ileana Ober, IRIT/University of Toulouse, France; Dr Henrik Lönn, Volvo, Sweden and Professor Manuel Wimmer, JKU, Austria.
Reserve is Professor Alessandro Papadopoulos, MDU, Sweden.
Summary
The engineering of modern software‐intensive systems requires collaboration between many people in many different disciplines. To effectively design and communicate, these engineers create a large number of development artefacts throughout the system development, such as models, informal diagrams, and textual
descriptions. These artefacts describe the intended structure and behaviour of systems. Contradictions between the artefacts or misunderstandings based on the understandings of engineers and what is captured in the artefacts can lead to unmet requirements, bugs, overruns of development budget and time, or even system
failures.
Inconsistencies between these development artefacts occur continuously throughout the system’s development and maintenance, simply due to the incremental nature of the development of artefacts. To prevent the inconsistencies causing the earlier mentioned bad outcomes, it is often desirable to check to what extent various development artefacts are consistent with each other, that is, if they contain contradicting information about the same aspects of the system.
The potential informality and incompleteness of models and other development artefacts, in combination with a strife for shorter development iterations, presents challenges to consistency checking approaches. In this thesis, we consider model‐based development settings in which short development cycles are aspired. We show a tight coupling between introducing short development cycles and the need for increased support for consistency checking across models and other artefacts. In particular, we identify the need for lightweight consistency
checking approaches, which we break down into four required aspects.
This thesis supplements the literature on consistency checking by providing industrial perspectives in the following two ways. First, we survey industrial settings and present the various needs for consistency checking based on a broad range of settings and scenarios. Moreover, we use these industrial settings to define in what aspects a consistency checking approach should be lightweight to enable its industrial adoption. Second, we include detailed experiences of iintroducing lightweight consistency checks in industrial settings. In summary, this thesis presents contributions to consistency management in complex industrial settings to facilitate the adoption of continuous model-based development.
Read more at the MDU web site:
https://www.mdu.se/en/malardalen-university/calendar/2022/the-public-defense-of-robbert-jongelings-doctoral-thesis-in-computer-science
Video: “From informal architecture diagrams to flexible blended models” by Robbert Jongeling
This video is a short summary of the paper “From informal architecture diagrams to flexible blended models” by Robbert Jongeling from Mälardalen University. Authors are Robbert Jongeling, Federico Ciccozzi, Antonio Cicchetti, and Jan Carlson. The paper was published at the 16th European Conference on Software Architecture (ECSA 2022) and awarded the Best paper award.
View the video here: https://youtu.be/Pia7zZFp9RE

Deadline for NEW project proposals
2022-12-02 08:00 - 10:00
December 2: Deadline for NEW project proposals

Software Center day Denmark
2022-11-29 13:00 - 16:00 | Grundfos, Bjerringbro, Denmark, Denmark
At the Software Center Denmark workshop we will bring together experts from industry and academia to talk about the challenges and solutions in the software-intensive industry. Jan Bosch, director of Software Center and professor at Chalmers University of Technology will talk about industrial digitalization, including highlight cases from the member companies of Software Center. Anne Katrine Windfeld, Head of Software Development and interim Head of Digital Development at Grundfos, will introduce the day and give a perspective of Grundfos as a partner of Chalmers Software Center. The workshop is an open event and will take place at Grundfos in Bjerringbro.
Registration:
Registration closed on November 24.
Place:
Grundfos, Bjerringsbro, Denmark:
Poul Due Jensens Academy, Poul Due Jensens Vej 21, DK-8850 Bjerringbro
Map in pdf invite >>
Agenda:
12.00: Lunch at Grundfos
13:00: Welcome: Anne Katrine Windfeld, Grundfos
13:10: AI: from experimentation to delivering value: Jan Bosch, Chalmers University of Technology & Software Center
13.30 Trustworthiness in testing and continuous integration: Kristian Sandahl, Linköping University
13.50: Presentation of selected Software Center projects:
– Accelerating Digitalization Through Data
– Strategic Ecosystem-Driven R&D Management
Participating researchers:
– Jan Bosch, Chalmers
– Helena Holmström Olsson, Malmö University
– Kristian Sandahl, Linköping University
– Eduard Enoiu, Mälardalen University
– Jean Malm, Mälardalen University
14.15 Interactive workshop on digitalization – topics based on interests of the participants
15:45 Closing: Jan Bosch

About Grundfos
We are more than just a water pump company. We believe that every drop of water has the power to change the world, and we’re all about unlocking that potential. Because where others see problems, we see opportunities.
Water has always been the heart and soul of Grundfos. That is why we are driven to pioneer solutions to the world’s water and climate challenges and improve quality of life for people. This purpose is central to everything we do and is supported by our six core values.
We believe that if you have the capabilities, you have an obligation to positively impact the planet. Our brands help us to achieve this, playing crucial roles in our purpose of pioneering solutions to the world’s water challenges and improving the quality of life for people.
We rely heavily on our strategic partnerships. Collaborating with our partners is key in managing end-to-end innovation that not only provides end-customer value, but also pioneers solutions to the world’s water and climate challenges. We are driven by collaboration and the possibilities we can bring to life together. Because together, we can achieve more.

Swedish German Business Day
2022-11-17 09:00 - 17:00 | Swedish Embassy, Berlin, Berlin, Germany
Up-dates will follow

Coordination team meeting
2022-11-14 09:00 - 10:00 | Virtual event, Sweden
November 14 (9-10): Coordination team meeting

Steering committee meeting
2022-10-10 09:30 - 12:00 | Virtual event, Sweden
October 10 (09:30-12): Mid-sprint steering committee meeting

Coordination team meeting
2022-10-10 09:00 - 09:30 | Virtual event, Sweden
October 10 (9-09:30): Coordination team meeting

Coordination team meeting
2022-09-12 09:00 - 10:00 | Virtual event, Sweden
September 12 (9-10): Coordination team meeting

Workshop on Cybersecurity at Mälardalen University
2022-09-07 10:00 - 17:00 | Virtual meeting, Sweden
Welcome to the second Software Center workshop on Cyber-Security at Mälardalen University: September 7, R Building (and online)
At the Software Center/MDU workshop we will bring together experts from academia and industry to talk about the problems, challenges, and solutions in the domain of cybersecurity.
The workshop is an open hybrid event and will take place in the Milos (in the morning) and Omega (in the afternoon) conference rooms at Mälardalen University, Västerås (online participation is also possible). Necessary information will be distributed after registration.

View the videos from the previous Cybersecurity workshop at Mälardalen University in the Software Center YouTube channel >>

Registration:
Please register at this link: https://forms.gle/gwK3x5q8H3cd4kWN7
Agenda & rooms:
10.00 – 12.00: Milos Conference Room
10:00 – 10:05 Marjan Sirjani (MDU): Welcome
10:05 – 10:30 Stefano Zanero (Politecnico di Milano university): Automotive Security: to br(e)ak(e) is easier than to patch
10:30 – 11:00 Miroslaw Staron (Chalmers): Can Language Models Help to Design more Cybersecure Software?
11:00 – 11:30 Pierre Kleberger (RISE): Interplay between Safety and Cybersecurity in Vehicle Development
11:30 – 12:00 Sara Abbaspour (MDU): Cyberattacks: Modeling, Analysis, and Mitigation
Café Origo
12:00 to 13:30 Lunch and Mingling
13.30 – 17.00: Omega Conference Room
13:30 – 14:00 Marjan Sirjani (MDU): Integrating Design-time and Run-time Methods for Detecting Cyber-Attacks
14:00 – 14:30 Björn Leander (MDU, ABB): Access Control in Dynamic Industrial Automation and Control Systems
14:30 – 15:00 Ghada Almashaqbeh (University of Connecticut): Access On the Power of Smart Contracts—The Good and The Bad
15:00 – 15:15 Coffee Break
15:15 – 16:00 Panel and Discussion
16:00 – 16:45 Marsha Chechik (University of Toronto): A Software Engineer’s take on Safety, Assurance and Reliability
16:45 – 17:00 Marjan Sirjani (MDU): Closing
Find the way to Mälardalen University:
Map and directions in google maps >>

Presentations & speakers
Automotive Security: to br(e)ak(e) is easier than to patch: Stefano Zanero
Abstract: First, we will present a selective denial-of-service attack against the CAN standard which does not involve the transmission of any complete frames for its execution. This type of attack is obviously not detectable via frame-level analysis, which makes most currently proposed detection systems useless. As the attack is based on CAN protocol weaknesses, all CAN bus implementations by all manufacturers were, and are, vulnerable.
After showing a proof-of-concept, we will move on to the much harder part of proposing a possible countermeasure for detecting and preventing such an attack, along with our implementation experience and some thoughts around this and other attacks that may arise from the CAN bus protocol itself.
We will also outline our research on anomaly detection for CAN networks based on LSTM autoencoders, as well as our evaluation of the best combination of different IDS techniques to increase detection performances in real world scenarios.
We will also briefly discuss our upcoming research accepted at CCS 2022, related to CAN polyglots.
Bio: Stefano Zanero received a PhD in Computer Engineering from Politecnico di Milano, where he is currently an associate professor at the Dipartimento di Elettronica, Informazione e Bioingegneria. His research focuses on malware analysis, cyberphysical security, and cybersecurity in general. Besides teaching “Computer Security” and “Digital Forensics and Cybercrime” at Politecnico, he has an extensive speaking and training experience in Italy and abroad. He co-authored over 90 scientific papers and books. He is a Senior Member of the IEEE and sits in the Board of Governors of the IEEE Computer Society; he is a lifetime senior member of the ACM, which has named him a Distinguished Speaker; and has been named a Fellow of the ISSA (Information System Security Association). Stefano is also a co-founder and chairman of Secure Network, a leading cybersecurity assessment firm, and a co-founder of BankSealer, a startup in the FinTech sector that addresses fraud detection through machine learning techniques.
Can Language Models Help to Design more Cybersecure Software?
Miroslaw Staron
Abstract: Working with cybersecurity entails analysis of source code and identifying vulnerabilities in the code base. Usually, this is done using dedicated tools and/or during dedicated testing scenarios. The analyses are based on pre-defined rules, developed by cybersecurity specialists and security engineers. However, the number of cybersecurity threats grows faster than the number of tools and rules defined in them. In this talk, we explore the idea of using modern language models (e.g., GPT-3) to design tools for identifying vulnerabilities based on parsing source code provided in CVE/CWEs. As these models have shown large potential for identifying similarities in other use cases (e.g., to identify design patterns), there is a potential for use of these models to find cybersecurity vulnerabilities in source code.
Bio: Miroslaw Staron is a Professor in Software Engineering at the Department of Computer Science and Engineering at the University of Gothenburg, Sweden. He obtained his PhD in Software Engineering in 2005 from Blekinge Institute of Technology. His research interests are centered around industrial software engineering with the emphasis on software metrics, measurement processes and model driven software engineering. Dr. Staron has been collaborating with Ericsson, Volvo Information Technology, Telelogic, Volvo Car Corporation, RUAG Space and recently Saab AB.
Interplay between Safety and Cybersecurity in Vehicle Development: Pierre Kleberger
Abstract: In this talk, we look at the challenges in interplay between safety and cybersecurity and assess whether these processes can be aligned and improved for the automotive domain. We also assess cybersecurity mechanisms’ impact on safety – which mechanisms may improve safety or may actually have a negative impact on vehicle safety. Finally, we conclude by highlighting possible ways forward.
Bio: Pierre Kleberger is a researcher in the Dependable Transport Systems Unit at RISE. His main research area is in automotive cybersecurity and interplay between safety and cybersecurity. Pierre received his PhD from Chalmers University of Technology in 2015 working on securing vehicle diagnostics and in-vehicle networks of connected cars.
Cyberattacks: Modeling, Analysis, and Mitigation: Sara Abbaspour
Abstract: Industrial cybersecurity has risen as an important topic of research nowadays. The heavy connectivity by the Internet of Things (IoT) and the growth of cyberattacks against industrial assets cause this rise and attract attention to the cybersecurity field. While fostering current software applications and use-cases, the ubiquitous access to the Internet has also exposed operational technologies to new and challenging security threats that need to be addressed. As the number of attacks increases, their visibility decreases. An attack can modify the Cyber-Physical Systems (CPSs) quality to avoid proper quality assessment. They can disrupt the system design process and adversely affect a product’s design purpose.
In this talk, we explore our proposed approach on how to model, analyze, and mitigate cyberattacks in CPSs. We model the normal behavior of the application as well as cyberattacks with the help of the Microsoft threat modeling approach (STRIDE) and Threat Analysis and Risk Assessment (TARA). The results can be used to improve the system design to overcome the vulnerabilities.
Bio: Sara Abbaspour is an associated senior lecturer and researcher working in the Cyber-Physical Systems Analysis group at Mälardalen University in Västerås, Sweden. Her main research interests include safety and security-relevant cyber-physical systems; Debugging, testing and runtime verification of concurrent and parallel software. She was a Post Doc researcher from 2018 until 2020 at Mälardalen University. She has completed her PhD and defended her PhD thesis entitled “Concurrency Bugs: Characterization, Debugging and Runtime Verification” in 2018. Before starting PhD, she worked as a researcher and developer in various aspects of the industrial environment such as Mobile Development Systems, Smart Cards and RFID Technologies, Software System Testing and Multimedia Technologies.
Integrating Design-time and Run-time Methods for Detecting Cyber-Attacks: Marjan Sirjani
Abstract: In this talk I will explain our method for detecting cyber-attacks on CPS using formal verification at design time, and runtime monitoring during operation. We develop a monitor that uses an abstract digital twin, the so-called Tiny Twin, to detect false sensor data and faulty control commands. The Tiny Twin is a state transition diagram that represents the required behavior of the system, observable from the monitor point of view. We model the components of the system and the physical processes using Rebeca modeling language and use its model checker to generate the state space. The Tiny Twin is built automatically by reducing the state space, keeping the observable behavior of the system, and preserving the trace equivalence. Lingua Franca language is used to develop the system and run the simulations. I show the method using a few case studies. In our future work we will focus on causality and finding the sources of anomalies and vulnerabilities. We will also focus on human interactions with the systems and trustworthiness.
Bio: Marjan Sirjani is a Professor at Mälardalen University, and the leader of Cyber-Physical Systems Analysis research group. Her main research interest is applying formal methods in Software Engineering. She works on modeling and verification of concurrent, distributed, timed, and self-adaptive systems. Marjan and her research group are pioneers in building model checking tools, compositional verification theories, and state-space reduction techniques for actor-based models. She has been working on analyzing actors since 2001 using the modeling language Rebeca (http://www.rebeca-lang.org). Her research is now focused on safety and security assurance and performance evaluation of cyber-physical and autonomous systems. Marjan has been the PC member and PC chair of several international conferences including SEFM, iFM, Coordination, FM, FMICS, SAC, FSEN, and DATE. She is an editor of the journal of Science of Computer Programming.
Access Control in Dynamic Industrial Automation and Control Systems: Björn Leander
Abstract: Industrial control systems are undergoing a transformation driven by business requirements as well as technical advances, aiming towards increased connectivity, flexibility and high level of modularity, which consequently implies a need to revise existing cybersecurity measures. Access control, being one of the major security mechanisms in any system, is largely affected by these advances. Certain system types will by their nature be dynamic, i.e., the composition and functionality of the system is not well defined at design time. This short talk will describe current challenges and provide some solutions in the area of access control policy formulation and enforcement in such dynamic systems.
Bio: Björn Leander graduated as a M.Sc in Computer Science and Control Theory, from Luleå University of Technology in 2002. After working with many aspects of software development, he started at ABB in 2014, where he now works as a cybersecurity engineer at ABB Industrial Automation, Process Control Platform, working in R&D projects related to engineering and control. In 2019 he continued his academic career as an industrial PhD Student at Mälardalen University as part of the ARRAY postgraduate school. His research area is within the intersection of industrial automation systems, the industrial internet and cybersecurity, with an orientation toward access control.
Access On the Power of Smart Contracts—The Good and The Bad: Ghada Almashaqbeh
Abstract: Cryptocurrencies and blockchain technology continue to build innovative computing models and economic tools that can reshape the services and systems around us. Fueled by the huge interest this technology received, researchers and practitioners alike are racing to build new applications and improve existing ones. Smart contracts facilitate this process; individuals can deploy arbitrary code on a blockchain, allowing for trustless collaboration between participants under terms enforced by the contract execution. More recently, the concept of oracles has been introduced; these are external services that supplement a smart contract with information about real-world events.
This talk will explore the role of smart contracts in two topics: The good, namely, distributed resource markets that facilitate a blockchain to build decentralized digital services, e.g., file storage and online content delivery. We will discuss the security and performance challenges such markets encounter. And the bad, namely, criminal smart contracts, where smart contracts combined with oracles can be used to orchestrate collaborative attacks against real world targets (such as DDoS, ransomware, murder, etc.). The talk will discuss this concept and a framework that we devised to show how such attacks can be performed.
Bio: Ghada Almashaqbeh is an assistant professor of Computer Science and Engineering at the University of Connecticut. Her research interests span cryptography, privacy, and systems security with a large focus on blockchains and their applications. Ghada received her PhD from Columbia in 2019. Before joining UConn, she spent a while exploring the entrepreneurship world; she was a Cofounder and Research Scientist at CacheCash, and then a Cryptographer at NuCypher. Ghada is an affiliated member at the Connecticut Advanced Computing Center (CACC) and the Engineering for Human Rights Initiative at UConn, and a scientific advisor for Sunscreen Tech and The Melon.
A Software Engineer’s take on Safety, Assurance and Reliability: Marsha Chechik

Abstract: From financial services platforms to social networks to vehicle control, software has come to mediate many activities of daily life. Governing bodies and standards organizations have responded to this trend by creating regulations and standards to address issues such as safety, security and privacy. In this environment, the compliance of software development to standards and regulations has emerged as a key requirement. Compliance claims and arguments are often captured in assurance cases, with linked evidence of compliance. Evidence can come from test cases, verification proofs, human judgment, or a combination of these. That is, we try to build (safety-critical) systems carefully according to well-justified methods and articulate these justifications in an assurance case that is ultimately judged by a human.
Building safety arguments for traditional software systems is difficult — they are lengthy and expensive to maintain, especially as software undergoes change. Safety is also notoriously non-compositional — each subsystem might be safe but together they may create unsafe behaviors. It is also easy to miss cases, which in the simplest case would mean developing an argument for when a condition is true but missing arguing for a false condition. Furthermore, many ML-based systems are becoming safety-critical. For example, recent Tesla self-driving cars misclassified emergency vehicles and caused multiple crashes. ML-based systems typically do not have precisely specified and machine-verifiable requirements. While some safety requirements can be stated clearly: “the system should detect all pedestrians at a crossing”, these requirements are for the entire system, making them too high-level for safety analysis of individual components. Thus, systems with ML components (MLCs) add a significant layer of complexity for safety assurance.
I argue that safety assurance should be an integral part of building safe and reliable software systems, but this process needs support from advanced software engineering and software analysis. In this talk, I outline a few approaches for development of principled, tool-supported methodologies for creating and managing assurance arguments. I then describe some of the recent work on specifying and verifying reliability requirements for machine-learned components in safety-critical domains.
Bio: Marsha Chechik is Professor in the Department of Computer Science, and Acting Dean in the Faculty of Information at the University of Toronto. She received her Ph.D. from the University of Maryland. Prof. Chechik’s research interests are in the application of formal methods to improve the quality of software. She has authored over 200 papers in formal methods, software specification and verification, computer safety and security and requirements engineering. Marsha Chechik is Program Chair of the 2023 International Conference on Formal Methods (FM’23). She has been Program Committee Co-Chair of the 2021 International Conference on Foundations of Software Engineering (ESEC/FSE’21), 2018 International Conference in Software Engineering (ICSE’18), 2016 International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS’16), the 2016 Working Conference on Verified Software: Theories, Tools, and Experiments (VSTTE16), the 2014 International Conference on Automated Software Engineering (ASE’14), the 2008 International Conference on Concurrency Theory (CONCUR’08), the 2008 International Conference on Computer Science and Software Engineering (CASCON’08), and the 2009 International Conference on Formal Aspects of Software Engineering (FASE’09). She is a Distinguished Member of ACM, a Vice Chair of ACM SIGSOFT, and holds a Bell University Chair in Software Engineering.
