Earticle

본 연구는 소프트웨어 개발과 성과에 대한 연구를 조사하였다. 소프트웨어의 생산성과 품질 성과 크게 두 측면으로 조사되었다. 소프트웨어에 대한 기존 연구를 통하여 많은 연구들이 진행되어 왔지만 생산성과 품질에 대한 전체적인 영향요인을 포괄적으로 다룬 연구는 매우 적은편이다. 본 연구는 20개국에서 13년 동안 수행된 프로젝트의 성과를 대상으로 영향요인을 조사하였다. 영향요인은 다음과 같다. 소프트웨어 개발 형태, 개발 플랫폼, 개발 기술, 개발 언어, DBMS, 방법론, 방법론 획득 방식, CASE 툴, 총 개발투입 시간, 인적자원 참여 수준, 최대 팀 사이즈가 조사되었다. 본 연구결과 펑션 포인트, 코드 라인 수, 소프트웨어 결함(치명적, 중요, 작은)각 품질과 생산성을 대표하는 변수로 측정되었고 제시된 영향요인과 관련이 있음이 조사되었다. 따라서 소프트웨어 개발에 있어 성과와 품질에 영향을 미치는 요인들이 각각 틀리며 이와 같은 이유 때문에 개발에 참여한 소프트웨어 개발자들은 두 가지 측면에 요인을 균형있게 고려해야 할 것이다.

Performance of software development is measured by two major criteria – roductivity and quality. Although the criteria is empirically tested in software engineering research, they often present with a limited way under consideration of a few factors or contexts for developers to focus on the either productivity facets or quality facets. Analyzing data on software development performance collected over a 13-year period from 20 countries, we investigated how major software development factors – development type, development platform, development technique, language type, DBMS, methodology, methodology acquisition, CASE,, summary of work effort, resource level, max team size, affect the performance of software development. The results suggest that productivity and quality of software development are affected by different factors and context: function points, line of code, extreme defects, major defects, or minor defects. This research provides the empirical evidence that the two performance criteria require for software developer to have careful attention to find the optimal balance between the two performance criteria.

Recently, bottom-up information systems (BUIS), developed according to the requirements of individual user departments, have become popular. However, effective management of BUIS projects is not enough, with many organizations having experienced integration challenges with such individual projects. BUIS projects are relatively small and limited in scope, as opposed to the large, complex systems developed through traditional top-down information system development projects. Due to these differences in characteristics, the control modes as well as the aspects to improve development performance in each type of project are also different. Therefore, it is difficult to apply the results of prior research on control in system development projects to improve BUIS project performance. The purpose of this study is to derive a new theory of control to improve BUIS project performance. The results contribute to the improvement of firm performance through effective control of BUIS projects in modern enterprises.

The crowdsourcing software development (CSD) is growing rapidly in the open call format in a competitive environment. In CSD, tasks are posted on a web-based CSD platform for CSD workers to compete for the task and win rewards. Task searching and assigning are very important aspects of the CSD environment because tasks posted on different platforms are in hundreds. To search and evaluate a thousand submissions on the platform are very difficult and time-consuming process for both the developer and platform. However, there are many other problems that are affecting CSD quality and reliability of CSD workers to assign the task which include the required knowledge, large participation, time complexity and incentive motivations. In order to attract the right person for the right task, the execution of action plans will help the CSD platform as well the CSD worker for the best matching with their tasks. This study formalized the task assignment method by utilizing different situations in a CSD competition-based environment in artificial intelligence (AI) planning. The results from this study suggested that assigning the task has many challenges whenever there are undefined conditions, especially in a competitive environment. Our main focus is to evaluate the AI automated planning to provide the best possible solution to matching the CSD worker with their personality type.

Agile methods are highly attractive for small projects, but no agile method works well as a standalone system. Therefore, some adaption or customization is always required. In this paper, the Agile Framework for Small Projects (AFSP) was applied to four industry cases. The AFSP provides a structured way for software organizations to adopt agile practices and evaluate the results. The framework includes an extended Scrum process and agile practices, which are based on agility and critical success factors in agile software projects that are selected from Scrum, XP, FDD, DSDM and Crystal Clear. AFSP also helps software managers and developers effectively use agile engineering techniques throughout the software development lifecycle. The case study projects were evaluated on the basis of risk-based agility factors, the agility of the adopted practices, agile adoption levels, and the degree of the agile project success. The analysis of the results showed that the framework used in the aforementioned cases was effective.

Selection of a suitable task from the extensively available large set of tasks is an intricate job for the developers in crowdsourcing software development (CSD). Besides, it is also a tiring and a time-consuming job for the platform to evaluate thousands of tasks submitted by developers. Previous studies stated that managerial and technical aspects have prime importance in bringing success for software development projects, however, these two aspects can be more effective and conducive if combined with human aspects. The main purpose of this paper is to present a conceptual framework for task assignment model for future research on the basis of personality types, that will provide a basic structure for CSD workers to find suitable tasks and also a platform to assign the task directly. This will also match their personality and task. Because personality is an internal force which whittles the behavior of developers. Consequently, this research presented a Task Assignment Model (TAM) from a developers point of view, moreover, it will also provide an opportunity to the platform to assign a task to CSD workers according to their personality types directly.

The rapid growth of communication and globalization has changed the software engineering process. Security has become a crucial component of any software system. However, software developers often lack the knowledge and skills needed to develop secure software. Clearly, the creation of secure software requires more than simply mandating the use of a secure software development lifecycle; the components produced by each stage of the lifecycle must be correctly implemented for the resulting system to achieve its intended goals. This study demonstrates that a more effective approach to the development of secure software can result from the integration of carefully selected security patterns into appropriate stages of the software development lifecycle to ensure that security designs are correctly implemented. The goal of this study is to provide developers with an Integrated Security Development Framework (ISDF) that can assist them in building more secure software.

유비쿼터스 컴퓨팅을 구현하기 위한 임베디드 시스템적 요소, 즉 각종 전자기기, 가전제품, 제어장치 들은 단순히 회로로만 구성되어 있는 것이 아니라 특정한 기능을 수행하도록 프로그램이 내장되어 있는데 이러한 시스템 제어역할을 수행하는 다양한 프로그램을 임베디드 소프트웨어라고 정의할 수 있다. 임베디드 소프트웨어는 시스템의 기능을 제어하는 핵심 요소이므로 내용이나 제어 구조가 공개되는 경우에는 심각한 영향을 받을 수 있다. 임베디드 소프트웨어의 보안은 크게 두 부분으로 나뉘어 고려될 수 있다. 첫 번째는 외부의 위협원이 내부로 침투하여 관련 정보를 유출하는 것이고, 두 번째는 내부 혹은 외부의 위협원이 임베디드 소프트웨어에 악성 코드를 삽입하는 등 불법적인 행동을 하는 것이다. 본 논문에서는 첫 번째 관점에서, 임베디드 소프트웨어를 개발하고 있는 개발 현장에 대한 보안 점검 요소들을 도출하고 제안하였다. 개발 현장에 대한 보안 점검을 통해 외부 위협원의 접근을 원천적으로 차단하는 동시에, 임베디드 소프트웨어의 비인가된 변형을 간접적으로 예방할 수 있을 것으로 기대된다.

Systematic components for implementing ubiquitous computing, for example, electronic devices, electric home appliances, and controllers, etc, are consist of not only circuits but also softwares expected to do some special system-controlling functions, and these softwares used to be called like as embedded software. Because embedded software is a core component controlling systems, the codes or control flows should be protected from being opened to the public or modified. Embedded software security can be divided into 2 parts: first is the unauthorized access to development site and embedded software, second is the unauthorized disclosure or modification. And this research is related to the first aspect of them.This paper proposes some security check requirements related to embedded software development site by analyzing the ALC_DVS.1 of the ISO/IEC 15408 and Base Practices (BPs) of the ISO/IEC 21827. By applying this research, we expect to protect unauthorized modification of embedded software indirectly.

본 연구는 소프트웨어 개발을 위하여 OWASP 상위 10개 보안 지침을 준수하는 과정에서 발생하는 인적 오류를 줄이는데 고급 AI 언어 모델인 GPT-4 Turbo 기술을 활용하는 방안을 제시한다. 특히, GPT-4 Turbo의 텍스트를 이해하고 생성하는 AI의 능력과 개발자의 전문성을 결합해 오류를 줄이는 것을 목표로 한다. 이를 위해 소프트웨어 개발 생명주기(SDLC) 전 과정에 GPT-4 Turbo 기술을 통합하는 방안을 연구하고, 소프트웨어 보안 과 신뢰성을 향상시킬 수 있는 프레임워크를 제안하였다. 제안한 프레임워크는 정기적으로 업데이트되는 OWASP 취약점에 대응하며 인적 오류를 줄이고 소프트웨어 보안을 강화하는데 도움을 제공하기 때문에 경영전략 관점에 서 소프트웨어 개발 및 관리 프로세스를 간소화하여 신속한 의사결정이 가능해진다.

This research introduces a strategy that leverages GPT-4 Turbo, an advanced AI language model, to minimize human errors encountered while complying with the OWASP Top Ten security guidelines in software development. The framework combines the AI's capabilities in text comprehension and generation with developers' expertise to reduce errors. It delves into integrating GPT-4 Turbo across the Software Development Life Cycle (SDLC), proposing a model that enhances both software security and reliability. This framework addresses and adapts to the regularly updated OWASP vulnerabilities, contributing to reduced human errors and improved security measures. Furthermore, it benefits in streamlining processes and accelerating decision-making within business strategy contexts, demonstrating the multifaceted advantages of integrating sophisticated AI solutions in software development and management practices.

The purpose of this paper is to propose a novel modeling approach called Services Ecosystem that applies the concept of ecosystems in ecology to Service-Oriented Software Development and Integration. For this purpose, an ecological system for software systems is proposed for the emerging Service-Oriented Computing paradigm, describing how participants interact with each other within their environments. Three emerging concepts, Service-Oriented Programming, Software Factories, and Service Grid, are employed to explain biotic and abiotic environments. Based upon the Services Ecosystem model, we demonstrate Services Ecosystem Model transformations by using a case example. The Services Ecosystem model is a novel approach for envisioning the Service-Oriented Computing paradigm in terms of an ecosystem in which the roles/perspectives of each participant and their relationships/interactions to environments are clearly described with a holistic view.

The dramatic increase in cyberattacks targeting government agencies, critical infrastructure, and defense contractors has revealed the inefficiencies of traditional software development life-cycle (SDLC) models. Most SDLC models do not indicate security explicitly, hence secure software development practices need to be infused into each phase so as to limit the exploitation of security loopholes and safeguard the security of high‑security systems. This document puts forward SSDF‑HS, a secure software development framework for high‑security organizations. The comparative study of various hypothetical projects reveals that SSDF‑HS significantly decreases vulnerability density and mean time to remediate while also enhancing compliance scores. The mathematical risk‑reduction model illustrates the lowering of residual risk when security is integrated early (shift‑left). The framework assists high‑security organizations in writing software that is inherently secure and can withstand future threats.

Research on information systems and software engineering has often neglected behavioral effects, which may play a role in decision making on software development. The current study addresses this issue by empirically investigating the behavioral roots of over-requirement in the context of a software development project via an experiment. The negative phenomenon of over-requirement refers to specifying a software system beyond the actual needs of the customer or the market, which overload the system with unneeded features. The research question addressed here is whether over-requirement is due in part to the emotional involvement of developers with the software features they developed because of behavioral effects. Previous studies have demonstrated that under the endowment, I-designed-it-myself, and IKEA effects, people become emotionally involved and overvalue physical items that they respectively possess, self-design, or self-create. The findings of our experiment show that participants over-valued features they were assigned to be responsible for, to specify, or to construct, thereby confirming that the three behavioral effects play a role in software development decisions and affect over-requirement. Thus, the study contributes to software development research and practice from the behavioral economics perspective, highlighting the roots of over-requirement.

핀테크에 적용되는 소프트웨어의 규모 추정은 매우 난해하며, 오랜 시간이 소요되는 작업이기에 발주 기업 과 개발 업체들이 정확하게 소프트웨어 개발 규모를 산정하기 어려운 상황이다. 일반적으로 프로젝트 관리자들의 경험과, 일반적인 기능 점수 방식에 의하여 규모를 추정하고 있다. 본 논문에서는 기능 점수 모형을 사용자 관점에 서 요구 기능들을 정량적으로 산정하고, 규모를 측정하여, 실시간으로 규모를 산정하여 핀테크 개발 프로젝트에 적용할 수 있는 모델을 제안한다. 제안 모델을 통하여 개발 전에 업무량을 예상하여 규모를 측정할 수 있으며, 레이어 별 프로그램 목록을 기준으로 M/M 및 견적 금액을 산출할 수 있다. 향후 연구에서는 기존 핀테크 프로젝 트의 규모 산정 데이터를 다량 확보하여 정확한 규모 산정에 대한 연구가 필요하다.

Estimation on SW Sizing applied to fintech is very difficult, a task requiring long time, it is difficult for client companies and developer companies to accurately calculate the size of software development. The size is generally estimated based on the experience of project managers and the general functional scoring method. In this paper, propose a model that can be applied to fintech development projects by quantitatively calculating the required functions from the user's point of view, measuring the scale, and calculating the scale in real time. Through the proposed model, the amount of work can be estimated prior to development and the size can be measured, and the M/M and the estimated quotation amount can be calculated based on the program list by each layer. In future studies, by securing size computation data on existing the Fintech Project in mass, research on accurate size computation would be required.

In Korea, software education is being strengthened. As a result, the polarization in software education is getting worse due to the private education craze. Fortunately, there is room in South Korea to narrow the gap through after-school schools. However, the ability of after-school instructors and the acquisition of information are also important, so this study developed model textbooks. Model textbooks have recently applied Nobel Engineering, which has been gaining attention in South Korea. Through the developed model textbooks, we hope to help with fun software education by applying it to the school site after school.

In recent years, embedded systems have become so complex and the development time to market is required to be shorter than before. As embedded systems include more functions for new services, embedded software gradually grow in size, and development costs and time are increasing. In order to overcome this serious matter, we need a customized design and test technique for embedded software. In this paper, we present a software architecture style for embedded software. It facilitates the composition of reusable functions and helps developers to reduce development time. Because the costs associated with revealing errors of embedded software in applications are rising. we propose a test method and tools for target environments.

본 논문에서는 NICE(National Initiative for Cybersecurity Education)의 사이버보안 인력양성 프레임워 크에서 권고하는 보안 소프트웨어 개발 직무에 필요한 기술과 역량을 중심으로 연구하였다. 본 논문에서는 보안 소 프트웨어의 개발 직무에 어떤 보안기술이 필요하고 어떤 보안 역량을 보유해야 하는지에 대해 살펴보았다. 본 논문 의 초점은 보안 소프트웨어의 개발 직무에 필요한 보안기술(핵심기술과 특화기술)과 국내 서울에 위치한 정보보호 관련 학과의 교육과정 사이의 일치성을 분석하는데 있다. 이 분석을 하는 이유는 서울에 위치한 5개 대학의 정보보 호 관련 학과에서 실시하는 교육과정이 보안 소프트웨어 개발 직무를 수행하는데 얼마나 적합한 교육체계를 갖추고 있는지를 살펴보기 위함이다. 결론적으로, 만일 연구된 5개의 관련 학과가 보안 소프트웨어의 개발 직무 개발자를 집중적으로 양성하고자 한다면, 공통적으로 보안 테스팅과 소프트웨어 디버깅, 시큐어 소프트웨어 개발 방법, 위험관 리, 개인정보식별과 프라이버시, 정보보증에 대한 교육이 필요하다.

In this paper, the technology and capabilities required for the job of developing security software recommended by the Cybersecurity Human Resources Development Framework of the National Initiative for Cybersecurity Education (NICE) were studied. In this paper, we describe what security skills are needed for the task of developing security software and what security capabilities should be held. The focus of this paper is to analyze the consistency between security technologies (core and specialized technologies) required for security software development tasks and the curriculum of information protection-related departments located in Seoul, Korea. The reason for this analysis is to see how the curriculum at five universities in Seoul is suitable for performing security software development tasks. In conclusion, if the five relevant departments studied are to intensively train developers of development tasks for security software, they are commonly required to train security testing and software debugging, how secure software is developed, risk management, privacy and information assurance.