Policy Enforcement with Proactive Libraries

Abstract

Software libraries implement APIs that deliver reusable functionalities. To correctly use these functionalities, software applications must satisfy certain correctness policies, for instance policies about the order some API methods can be invoked and about the values that can be used for the parameters. If these policies are violated, applications may produce misbehaviors and failures at runtime. Although this problem is general, applications that incorrectly use API methods are more frequent in certain contexts. For instance, Android provides a rich and rapidly evolving set of APIs that might be used incorrectly by app developers who often implement and publish faulty apps in the marketplaces. To mitigate this problem, we introduce the novel notion of proactive library, which augments classic libraries with the capability of proactively detecting and healing misuses at run- time. Proactive libraries blend libraries with multiple proactive modules that collect data, check the correctness policies of the libraries, and heal executions as soon as the violation of a correctness policy is detected. The proactive modules can be activated or deactivated at runtime by the users and can be implemented without requiring any change to the original library and any knowledge about the applications that may use the library. We evaluated proactive libraries in the context of the Android ecosystem. Results show that proactive libraries can automati- cally overcome several problems related to bad resource usage at the cost of a small overhead.Comment: O. Riganelli, D. Micucci and L. Mariani, "Policy Enforcement with Proactive Libraries" 2017 IEEE/ACM 12th International Symposium on Software Engineering for Adaptive and Self-Managing Systems (SEAMS), Buenos Aires, Argentina, 2017, pp. 182-19

Evaluation of Self-Healing Systems: An Analysis of the State-of-the-Art and Required Improvements

“…97% of the analyzed studies employ simulators to mimic a real SHS in their performance evaluations. We identified a single study (3%) that executes a real system to evaluate the performance of SHS [21]. This is inline with the related finding of [6], which suggests that simulation-based experiments are the most dominant approach employed for the evaluation of SAS in general.…”

“…Our literature review identifies a single paper using a real system for the evaluation of SHS [21]. In this paper, failures are not artificially injected to the system and occur as the real system equipped with self-healing properties is executed in its real operational environment.…”

Increasing the Reusability of Enforcers with Lifecycle Events

“…Research on runtime enforcement has already delivered both theoretical [16,10,12,17] and practical results [15,11,13,19]. However, identifying policies, specifying enforcement strategies, and implementing the corresponding enforcers is still a difficult and time consuming task.…”

“…Let us refer to the Plumeria 2 app, a simple Android app, to illustrate the concept of proactive library [19]. Plumeria has a fault, that is, one of its activities does not release the camera when it is suspended, as a consequence the camera becomes inaccessible to the other apps of the device.…”

Verifying Policy Enforcers

“…Conclusions. The reliability of software applications can be improved by exploiting advanced execution environments equipped with mechanisms to enforce correctness policies, such as security [16,27] and resource usage policies [32,16]. Although enforcers can be effective when used in isolation, their effect on the application and the execution environment when executed jointly might be hard to predict and potentially harmful.…”