软件属性保障中的源代码静态分析技术研究

随着硬件性能的不断提升，计算机正在被赋予越来越艰巨的任务，运行其上的软件作为沟通人类思维和底层硬件的桥梁，其重要性日益增加。与此同时，软件系统的规模也在不断变大，所涉及的逻辑也更为复杂，这导致开发人员难免会由于疏漏在软件设计实现的过程中引入缺陷、埋下隐患。所以,如何检验、确保软件的属性就成为时下一个亟待解决的热点问题。而在此背景下，源代码静态分析技术由于恰好可以弥补现有测试方法的不足，已经开始在这一研究领域崭露头角。有鉴于此，本文为了推进安全信息系统的研发，分别围绕源代码静态分析技术在软件属性保障中两个最主要的应用场景展开研究，涉及高等级安全操作系统开发过程中的源代码自动化审计，以及分布式信息系统中平台间互信建立时针对软件属性所进行的远程验证，其中，前者是为从深度上将现有安全操作系统向更高等级推进提供助力，而后者是为了从广度上将信息安全领域现有的围绕单机平台的研究成果向分布式架构推广建立基础。具体来说，本文选择针对编程接口规范的一致性检验和应用静态分析的软件属性远程验证作为研究的切入点，探讨了应用源代码静态分析技术检验、确保软件属性的方法和用途，主要取得以下几个方面的成果： 第一，本文给出了一个基于值等价类的别名分析方法。该方法依据相关的传值操作维护一个值等价类空间，可以在编程接口规范一致性检验的过程中按需推导变量符号间的等值关系，不仅有能力支持上下文相关、路径相关的全局分析，还可以有效应对C代码中因结构、指针等构件所衍生出来的大量变量符号。 第二，针对大部分现有代码静态分析工具分析规模受限的问题，本文围绕编程接口规范的一致性检验给出了可以与别名分析有效结合的性能优化方案。该方案不仅能通过剔除与分析无关的执行分支和引入缓存机制提高分析效率，还可以尽量确保分析的准确性少受影响。 第三，我们设计、实现了一个C代码静态分析工具ABAZER（A Bug AnalyZER）。该工具可以依据用户使用有限自动机模型描述的编程接口规范，对操作系统内核级别的软件进行全局分析，指出代码中可能有悖于规范的部分。我们使用ABAZER实际考查了FreeBSD内核中锁机制以及GCC 4.x中库GNU Libiberty的使用情况，从中发现了若干真实的缺陷。 第四，本文针对现有应用可信计算技术、基于完整性信息进行远程验证的方案在灵活性和实用性上所存在的不足，给出一个扩展方案。该方案通过引入虚拟机技术，在软件构建过程中收集举证信息，应用静态分析方法分析软件功能模块间的相关性，划分出与验证相关的模块，有效控制用户定制软件验证时所要依赖的可信列表的规模，使其有能力适应当今网络环境中的大量异质平台和各种安全需求。此外，它还可以为自身所依赖的可信计算基的替换和更新提供支持。 第五，本文针对Flask架构的特点，给出了一个既能检验强制访问控制实现正确性，又能最大限度保留软件灵活性、使得用户可以在一定程度上对软件进行定制的远程验证方案。该方案依赖源代码静态分析技术界定软件中无需基于完整性进行验证的模块，在进一步缩减可信列表规模的同时，使用代码改写技术在这些模块中自动化地插入监控代码约束软件的动态行为，以达到确保强制访问控制实现正确性的目的。该方案初步展现了源代码静态分析技术在远程验证中广阔的应用前景。

基于过程控制的软件质量管理

质量形成于过程.以预防为主的过程管理思想在软件产业引入了软件的工程过程、管理过程和支持过程三类基本过程,以过程为中心的软件开发、生产与质量管理是现代软件产业的时代特征.本文阐述了软件质量管理的基本原理,提出了一个基于CMM过程管理控制的软件质量管理模型及平台,帮助软件组织达到较高的成熟度水平.

软件质量管理中的统计过程控制

统计过程控制（SPC, Statistical Process Control）是一种借助数理统计工具的过程控制方法，它利用统计工具及技术（如控制图）对过程或过程输出进行分析，找出过程中的不确定因素并及时消除，控制、管理、改进过程产品的质量或过程能力，从而达到保证产品质量的目的。它能帮助用户采取适当措施来保证过程处于统计意义的受控状态，并且帮助用户提高生产能力，以满足或超越顾客的期望。SPC最早是在工业界提出的，在工业界的成功也促使它被应用于其它许多商业领域。本文主要探讨统计过程控制在软件质量管理中的实施。

基于ISO9000和CMM的软件质量管理系统的研究

中国计算机学会

基于ISO/IEC 9126标准的软件质量评价系统

中国计算机学会

基于模糊评价方法的软件质量评价研究

针对软件质量评价研究中的度量问题建立了基于ISO/IEC 9126标准的软件质量指标体系模型,结合质量评价方法研究中的常见问题,运用指标体系模型和模糊数学方法对软件质量评价标准进行模糊化处理,以度量数据为基础,根据软件质量子特性和指标之间的关系,采用模糊综合评价方法评价子特性质量和特性质量,通过建立软件质量评价模型,有效地解决了软件质量的多指标评价问题,可用于指导用户进行软件过程改进.

软件质量控制支持工具SQC的研究与实现

针对现有的软件评审、软件测试支持工具在软件缺陷数据统计支持上的局限性,提出了一种集成软件测试和软件评审的软件质量控制活动模型,从缺陷数据管理的角度将以上两种质量控制手段结合起来,提高了缺陷数据对于软件项目数据分析的价值,同时也提高了软件质量控制活动本身的效率。介绍了软件质量控制支持工具SQC,并对该工具的设计和实现进行详细的说明。

Concentrations of alkyphenol polyethoxylates entering UK estuaries

Concentrations of the weakly oestrogenic degradation products of alkylphenol polyethoxylate (APE) surfactants (nonylphenol, octylphenol, nonylphenol monoethoxylate and nonylphenol diethoxylate) were measured in water and sediments from British rivers and estuaries collected during 1994 and 1995. In addition, a series of samples of tissues of wild fish from the River Aire, and from a laboratory dosing experiment were analysed for alkylphenols, to assess the degree of bioaccumulation of these compounds. Measurable concentrations of APE residues were recorded in the River Aire (15–76 μg/l total extractable alkylphenols), the River Mersey (6–11 μg/l) and the Tees estuary (up to 76 μg/l). These levels exceed, or are close to, the no observed effect concentration for the induction of vitellogenesis in caged trout (5–20 μg/l total extractable alkylphenols), and may be sufficient to exert an oestrogenic effect on fish populations in these areas. A sediment sample from Bingley on the River Aire contained 15 μg/g (dry weight) nonylphenol, and concentrations in sediments from the Tees and Mersey estuaries exceeded 1 μg/g. These rivers receive a variety of trade waters via sewage treatment works (STW) effluents containing significant concentrations of APE. Elsewhere, concentrations in water and sediments were near or below limits of detection and biological effects are unlikely, suggesting that any oestrogenic effects observed in sewage outfalls and rivers not directly impacted by APE-containing trade-waters may be caused by other chemicals. Analysis of samples of trout muscle taken from a tank dosed at 65 μg/l nonylphenol indicated a bioaccumulation factor of between 90 and 125 after 3 weeks exposure. Samples of wild fish from the River Aire contained up to 0.8 μg/g nonylphenol in the muscle, a tissue bioaccumulation factor of approximately 50 relative to measured concentrations in water samples. A series of fish samples taken from offshore for food quality assurance purposes contained no detectable levels of APE residues (0.05–0.1 μg/g nonylphenol).

The statistic inversion algorithms of water constituents for the Huanghai Sea and the East China Sea

A group of statistical algorithms are proposed for the inversion of the three major components of Case-H waters in the coastal area of the Huanghai Sea and the East China Sea. The algorithms are based on the in situ data collected in the spring of 2003 with strict quality assurance according to NASA ocean bio-optic protocols. These algorithms are the first ones with quantitative confidence that can be applied for the area. The average relative error of the inversed and in situ measured components' concentrations are: Chl-a about 37%, total suspended matter (TSM) about 25%, respectively. This preliminary result is quite satisfactory for Case-H waters, although some aspects in the model need further study. The sensitivity of the input error of 5% to remote sensing reflectance (Rrs) is also analyzed and it shows the algorithms are quite stable. The algorithms show a large difference with Tassan's local SeaWiFS algorithms for different waters, except for the Chl-a algorithm.

the trustworthiness metric model of software process quality based-on life circle

Communication University of China; Wuhan University; James Madison University; Institute of Policy and Management, Chinese Academy of Sciences; IEEE Wuhan Section

an integrity assurance mechanism for run-time programs

Chinese Assoc Cryptol Res, State Key Lab Informat Secur, Inst Software, Grad Univ Chinese Acad Sci, Natl Nat Sci Fdn China

Fingerprinting quality control of Qianghuo by high-performance liquid chromatography-photodiode array detection

A novel, simple and accurate fingerprint method was developed using high-performance liquid chromatography-photodiode array detection (HPLC-DAD) for the quality control of Qianghuo, a Tibetan folk and Chinese herbal medicine used as a diaphoretic, an antifebrile and an anodyne. For the first time, the feasibility and advantages of employing chromatographic fingerprint were investigated and demonstrated for the evaluation of Qianghuo by systematically comparing chromatograms of aqueous extracts with the professional analytical software recommended by State Food and Drug Administration (SFDA). Our results revealed that the chromatographic fingerprint combing similarity evaluation could efficiently identify and distinguish raw herbs of Qianghno from different sources and different species. The effects on Notopterygium forbesii Boiss (Apiaceae) chromatographic fingerprints resulted from collecting locations, harvesting time were also examined. (c) 2006 Elsevier lrelanc Ltd. All rights reserved.