Formal development of resilient distributed systems

Resilience is the property of a system to remain trustworthy despite changes. Changes of a different nature, whether due to failures of system components or varying operational conditions, significantly increase the complexity of system development. Therefore, advanced development technologies are required to build robust and flexible system architectures capable of adapting to such changes. Moreover, powerful quantitative techniques are needed to assess the impact of these changes on various system characteristics. Architectural flexibility is achieved by embedding into the system design the mechanisms for identifying changes and reacting on them. Hence a resilient system should have both advanced monitoring and error detection capabilities to recognise changes as well as sophisticated reconfiguration mechanisms to adapt to them. The aim of such reconfiguration is to ensure that the system stays operational, i.e., remains capable of achieving its goals. Design, verification and assessment of the system reconfiguration mechanisms is a challenging and error prone engineering task. In this thesis, we propose and validate a formal framework for development and assessment of resilient systems. Such a framework provides us with the means to specify and verify complex component interactions, model their cooperative behaviour in achieving system goals, and analyse the chosen reconfiguration strategies. Due to the variety of properties to be analysed, such a framework should have an integrated nature. To ensure the system functional correctness, it should rely on formal modelling and verification, while, to assess the impact of changes on such properties as performance and reliability, it should be combined with quantitative analysis. To ensure scalability of the proposed framework, we choose Event-B as the basis for reasoning about functional correctness. Event-B is a statebased formal approach that promotes the correct-by-construction development paradigm and formal verification by theorem proving. Event-B has a mature industrial-strength tool support { the Rodin platform. Proof-based verification as well as the reliance on abstraction and decomposition adopted in Event-B provides the designers with a powerful support for the development of complex systems. Moreover, the top-down system development by refinement allows the developers to explicitly express and verify critical system-level properties. Besides ensuring functional correctness, to achieve resilience we also need to analyse a number of non-functional characteristics, such as reliability and performance. Therefore, in this thesis we also demonstrate how formal development in Event-B can be combined with quantitative analysis. Namely, we experiment with integration of such techniques as probabilistic model checking in PRISM and discrete-event simulation in SimPy with formal development in Event-B. Such an integration allows us to assess how changes and di erent recon guration strategies a ect the overall system resilience. The approach proposed in this thesis is validated by a number of case studies from such areas as robotics, space, healthcare and cloud domain.

Threat modeling a factory environment using Microsoft Security Development Lifecycle methodology

The number of security violations is increasing and a security breach could have irreversible impacts to business. There are several ways to improve organization security, but some of them may be difficult to comprehend. This thesis demystifies threat modeling as part of secure system development. Threat modeling enables developers to reveal previously undetected security issues from computer systems. It offers a structured approach for organizations to find and address threats against vulnerabilities. When implemented correctly threat modeling will reduce the amount of defects and malicious attempts against the target environment. In this thesis Microsoft Security Development Lifecycle (SDL) is introduced as an effective methodology for reducing defects in the target system. SDL is traditionally meant to be used in software development, principles can be however partially adapted to IT-infrastructure development. Microsoft threat modeling methodology is an important part of SDL and it is utilized in this thesis to find threats from the Acme Corporation’s factory environment. Acme Corporation is used as a pseudonym for a company providing high-technology consumer electronics. Target for threat modeling is the IT-infrastructure of factory’s manufacturing execution system. Microsoft threat modeling methodology utilizes STRIDE –mnemonic and data flow diagrams to find threats. Threat modeling in this thesis returned results that were important for the organization. Acme Corporation now has more comprehensive understanding concerning IT-infrastructure of the manufacturing execution system. On top of vulnerability related results threat modeling provided coherent views of the target system. Subject matter experts from different areas can now agree upon functions and dependencies of the target system. Threat modeling was recognized as a useful activity for improving security.

Grammatikdidaktik: Svensk grammatik och språklig medvetenhet i några läromedel för grundskolans första årskurser

Mitt övergripande forskningsintresse är grammatikdidaktik, medan det explicita syftet med denna licentiatavhandling är att erhålla ny kunskap om grammatikdidaktik så som den synliggörs i nutida läromedel för grundskolans första årskurser. Den empiriska undersökningen är gjord i tre nutida läromedelspaket avsedda för undervisning i skolämnet modersmål och litteratur i årskurs ett och två, läromedlen som undersöks är de finlandssvenska serierna Läseboken och Litteraturboken samt den sverigesvenska serien Kom och läs! Bland resultaten kan nämnas att det finns ett brett spektrum av nivåer av extern grammatik i alla de undersökta läromedelspaketen. Den fonologiska och syntaktiska medvetenheten, vilka bägge är viktiga för läs- och skrivutvecklingen i de diskuterade årskurserna, satsas på i alla tre läromedelspaket. Det jag dock också märkt i läromedlen som kan påverka läs- och skrivutvecklingen är att andelen belägg för grafonomi är större i årskurs två än i årskurs ett. Härigenom får eleverna på detta sätt småningom växa in i en skriftkultur. Det finns betydligt fler muntliga uppgifter i lärarhandledningarna till serierna Litteraturboken och Kom och läs! än i Läseboken. Det exakta ”hur” står inte alltid utskrivet i lärarhandledningarna, men de flesta gånger verkar tanken vara att det rör sig om diskussioner eller andra muntliga genrer. I många fall känns de muntliga uppgifterna mer funktionella än skriftliga uppgifter som inte verkar vara helt genomtänkta. Att mitt material innehåller fler funktionella uppgifter i lärarhandledningar och fler formalistiska eller delvis funktionella uppgifter i arbetsböcker överensstämmer med att lärarhandledningar kan vara en bättre väg för att öka elevernas kunskapssökande och minska förmedlingspedagogiken.

Development and Effect Analysis of the Asteri Consultative Auditing Process - Safety and Security Management in Educational Institutions

The Finnish legislation requires for a safe and secure learning environment. However, the comprehensive, risk based safety and security management (SSM) and the management commitment in the implementation and development of the SSM are not mentioned in the legislation. Multiple institutions, operators and researchers have studied and developed safety and security in educational institutions over the past decade. Typically the approach has been fragmented and without bringing up the importance of the comprehensive SSM. The development needs of the safety and security operations in universities have been studied. However, in universities of applied sciences (UASs) and in elementary schools (ESs), the performance level, strengths and weaknesses of the comprehensive SSM have not been studied. The objective of this study was to develop the comprehensive, risk based SSM of educational institutions by developing the new Asteri consultative auditing process and study its effects on auditees. Furthermore, the performance level in the comprehensive SSM in UASs and ESs were studied using Asteri and the TUTOR model developed by the Keski-Uusimaa Department for Rescue Services. In addition, strengths, development needs and differences were identified. In total, 76 educational institutions were audited between the years 2011 and 2014. The study is based on logical empiricism, and an observational applied research design was used. Auditing, observation and an electronic survey were used for data collection. Statistical analysis was used to analyze the collected information. In addition, thematic analysis was used to analyze the development areas of the organizations mentioned by the respondents in the survey. As one of the main contributions, this research presents the new Asteri consultative auditing process. Organizations with low performance levels on the audited subject benefit the most from the Asteri consultative auditing process. Asteri may be usable in many different types of audits, not only in SSM audits. As a new result, this study provides new knowledge on attitudes related to auditing. According to the research findings, auditing may generate negative attitudes and the auditor should take them into account when planning and preparing for audits. Negative attitudes can be compensated by producing added value, objectivity and positivity for the audit and, thus, improve the positive effects of auditing on knowledge and skills. Moreover, as the results of this study shows, auditing safety and security issues do not increase feelings of insecurity, but rather increase feelings of safety and security when using the new Asteri consultative auditing process with the TUTOR model. The results showed that the SSM in the audited UASs was statistically significantly more advanced than that in the audited ESs. However, there is still room for improvement in the ESs and the UASs as the approach to the SSM was fragmented. It can be assumed that the majority of Finnish UASs and ESs do not likely meet the basic level of the comprehensive, risk based the SSM.

Adherence to Treatment in Psychotic Disorders - Development of user-centered mobile health intervention

The aim of this study was to explore adherence to treatment among people with psychotic disorders through the development of user-centered mobile technology (mHealth) intervention. More specifically, this study investigates treatment adherence as well as mHealth intervention and the factors related to its possible usability. The data were collected from 2010 to 2013. First, patients’ and professionals’ perceptions of adherence management and restrictive factors of adherence were described (n = 61). Second, objectives and methods of the intervention were defined based on focus group interviews and previously used methods. Third, views of patients and professionals about barriers and requirements of the intervention were described (n = 61). Fourth, mHealth intervention was evaluated based on a literature review (n = 2) and patients preferences regarding the intervention (n = 562). Adherence management required support in everyday activities, social networks and maintaining a positive outlook. The factors restricting adherence were related to illness, behavior and the environment. The objective of the intervention was to support the intention to follow the treatment guidelines and recommendations with mHealth technology. The barriers and requirements for the use of the mHealth were related to technology, organizational issues and the users themselves. During the course of the intervention, 33 (6%) out of 562 participants wanted to edit the content, timing or amount of the mHealth tool, and 23 (4%) quit the intervention or study before its conclusion. According to the review, mHealth interventions were ineffective in promoting adherence. Prior to the intervention, participants perceived that adherence could be supported, and the use of mHealth as a part of treatment was seen as an acceptable and efficient method for doing so. In conclusion, the use of mHealth may be feasible among people with psychotic disorders. However, clear evidence for its effectiveness in regards to adherence is still currently inconclusive.