IOGP Geomatics Guidance Note 3. Google Cloud joins OPC Foundation. OPC teams with CESMII and Open Industry 4.0 Alliance. Oil Companies International Marine Forum publishes ‘Dynamic positioning failure mode’ guide. Open Geospatial Consortium approves HDF5. Industrial Internet Consortium white paper on distributed ledgers in the IIoT. New ISO standards for the IoT. Linux Foundation’s EdgeX Foundry ‘Geneva’ release. NIST on a Chip. PPDM V3 of Well Status & Classification taxonomy. PPDM Board explains relationship with OSDU. Alliance for the Internet of Things and the Semantic Interoperability Expert Group of the World Wide Web Consortium (WC3) to compile ontology landscape for the IoT.
Santiago Figueroa-Lorenzo, Jon Goya, Javier Añorga, Iñigo Adín · 6 authors
The European Union is moving toward the “smart” era having as one of the key topics the smart mobility. What is more, the European union (EU) is moving toward Mobility as a Service (MaaS). The key concept behind MaaS is the capability to offer both the traveler's mobility and goods' transport solutions based on travel needs. For example, unique payment methods, intermodal tickets, passenger services, freight transport services, etc. The introduction of new services implies the integration of many Internet-of-Things (IoT) sensors. At this point, security gains a key role in the railway sector. Considering an environment where sensor data are monitored from sensor events, and alarms are detected and emitted when events contain an anomaly, this document proposes the development of an alarms collection system, which ensures both traceability and privacy of these alarms. This system is based on Ethereum blockchain events-log, as an efficient storage mechanism, which guarantees that any railway entity can participate in the network, ensuring both entity security and information privacy.
Jovan Nikolić, Nursultan Jubatyrov, Evangelos Pournaras
Large-scale decentralized systems of autonomous agents interacting via asynchronous communication often experience the following self-healing dilemma: fault detection inherits network uncertainties making a remote faulty process indistinguishable from a slow process. In the case of a slow process without fault, fault correction is undesirable as it can trigger new faults that could be prevented with fault tolerance that is a more proactive system maintenance. But in the case of an actual faulty process, fault tolerance alone without eventually correcting persistent faults can make systems underperforming. Measuring, understanding and resolving such self-healing dilemmas is a timely challenge and critical requirement given the rise of distributed ledgers, edge computing, the Internet of Things in several energy, transport and health applications. This paper contributes a novel and general-purpose modeling of fault scenarios during system runtime. They are used to accurately measure and predict inconsistencies generated by the undesirable outcomes of fault correction and fault tolerance as the means to improve self-healing of large-scale decentralized systems at the design phase. A rigorous experimental methodology is designed that evaluates 696 experimental settings of different fault scales, fault profiles and fault detection thresholds in a prototyped decentralized network of 3000 nodes. Almost 9 million measurements of inconsistencies were collected in a network, where each node monitors the health status of another node, while both can defect. The prediction performance of the modeled fault scenarios is validated in a challenging application scenario of decentralized and dynamic in-network data aggregation using real-world data from a Smart Grid pilot project. Findings confirm the origin of inconsistencies at design phase and provide new insights how to tune self-healing at an early stage. Strikingly, the aggregation accuracy is well predicted as shown by high correlations and low root mean square errors.
Microservices architecture has become one of the most prominent software architectures in the software development processes due to its features such as scalability, maintainability, resilience, and composability. It allows developing business applications in a decentralized manner by dividing the important business logic into separate independent services. Digital certificates are used to verify the identity of microservices in most cases. However, the certificate authorities (CA) who issue the certificates to microservices cannot be trusted always since they can issue certificates without the consent of the relevant microservice. Nevertheless, existing implementations of certificate transparency are mostly centralized and has the vulnerability of the single point of failure. The distributed ledger technologies such as blockchain can be used to achieve decentralized nature in certificate transparency implementations. A blockchain-based decentralized certificate transparency system specified for microservices architecture is proposed in this paper to ensure secure communication among services. After the implementation and deployment in a cloud service, the system expressed average certificate querying time of 643 milliseconds along with the highly secured service provided.
N. Sánchez-Gómez, L. Morales-Trujillo, Javier Gutiérrez, Jesús Torres Valderrama
The use of smart contract augurs a world without intermediaries because the code and the agreements contained therein exist across a distributed, decentralized blockchain network. In software engineering, this collaboration is usually represented by using business process models and smart contracts can be used to implement business collaborations in general and inter-organizational business processes. The validation of this contract and the assurance of its quality are critical for its right application. Early testing in smart contract definition is the fact of this paper. The paper discusses the possibility to use transformation protocols to obtain derived artefacts like test case definitions and smart contract code scaffolds. Generation of derived artefacts significantly reduces the number of defects before deploying the smart contract code in the blockchain network. Transformations protocols are created using model-based software development and modelling techniques. This approach allows to simplify and improve the management and execution of collaborative business processes. This would allow, in addition, the application of systematic mechanisms to evaluate and validate the smart contract and, particularly, the application of early testing techniques which would help to reduce the number of defects and, ultimately, the cost of the final review.
The concept of microservices architecture has nowadays become popular in the development of most software systems due to their benefits of application modularity and flexibility. Nevertheless, such architecture poses new security concerns especially on how to handle APIs that act as points of communication between different services. Traditional API protection strategies, based on predetermined patterns and a centralized platform, can be ineffective in guarding microservices because of the loosely connected structure of the latter. These limitations make APIs a sweet spot of highly skilled cyber threats like unauthorized data access, injection assaults, and Distributed Denial of Service (DDoS). This research presents a conceptual framework known as Dynamic Adaptive API Security Framework that uses Artificial Intelligence (AI) and blockchain technology to address these challenges. This first one uses AI to monitor API traffic and detect anomalies in real time with the help of the proposed framework. Through anomaly detection, machine learning models can detect unusual activity such as Suspicious usage patterns, patterns with malicious payloads, and pattern of many API calls. Also, AI offers an analytic feature, which can predict the vulnerability a certain target, based on data from previous attacks, and allow targeted prevention. Alongside AI, blockchain innovation is used to create an unalterable, distributed record of communication between API. Based on consensus mechanisms like Proof of Stake or Practical Byzantine Fault Tolerance, the framework guarantees the provenance of API transaction logs. These logs offer a great resource for the forensic activities in case of a breach of the system’s security. Also, smart contracts support even complex and constantly changing dynamic access control policies, adjusting as soon as AI-driven threat intelligence data is available. This synergy of using AI and blockchain in the framework generates an adaptable, transparent, and resilient security model that interfaces threats. Real-time anomaly detection together with immutable auditability integrated in the proposed framework improves the level of API security in microservices while simultaneously supporting GDPR and HIPAA compliance. This approach fills the gap in existing security solutions which cannot cope with the growing security issues in microservices format, providing a long-term solution for increasing security of complicated, decentralized microservices landscape. Summing up, this work presents a new comprehensive strategy to API security using the advantages of both AI and blockchain technologies. Applying the framework identifies how these technologies can be synchronously balanced and orchestrated to respond to threats, protect data input, and offer clear microservices security and foundation for the advancement of subsequent generation of software.
Blockchain and smart contracts are being embraced by more and more industrial practitioners in multiple domains including agriculture, manufacturing, and healthcare. As a distributed, immutable, and partly public ledger, the consortium blockchain demonstrates its potential to enable trustworthy interoperability and collaboration between organizations. However, the mismatch between the unruled software engineering practices and the increased interest of the consortium blockchain technology may pose threats to the quality of systems implemented. To mitigate the possible threats, this study takes the angle of software engineering to systematically understand the challenges and possible solutions in terms of developing and operating a consortium blockchain-based system. For this purpose, we conducted a case study on a typical consortium blockchain-based system and exhaustively collected the data by two rounds in-depth interviews on practitioners of different roles in the case project. Based on the data analysis, eight pairs of challenges and potential solutions were identified, which cover the phases of the development and operation of consortium blockchains. Moreover, we also captured two implications after further analysis of the findings, which worth the special attention of researchers in the near future, i.e. DevOps and microservices for blockchain or smart contracts.
The last decade has sparked several valiant efforts in deductive verification of distributed agreement protocols such as consensus and leader election. Oddly, there have been far fewer verification efforts that go beyond the core protocols and target applications that are built on top of agreement protocols. This is unfortunate, as agreement-based distributed services such as data stores, locks, and ledgers are ubiquitous and potentially permit modular, scalable verification approaches that mimic their modular design. We address this need for verification of distributed agreement-based systems through our novel modeling and verification framework, QuickSilver, that is not only modular, but also fully automated. The key enabling feature of QuickSilver is our encoding of abstractions of verified agreement protocols that facilitates modular, decidable, and scalable automated verification. We demonstrate the potential of QuickSilver by modeling and efficiently verifying a series of tricky case studies, adapted from real-world applications, such as a data store, a lock service, a surveillance system, a pathfinding algorithm for mobile robots, and more.
Pamella Soares, Nataniel Parente Nogueira, Rayane Santos, Paulo Henrique M. Maia · 5 authors
The problem of lack of trust in data sharing between different parties can bureaucratize processes carried out by entities such as notary's office. Blockchain technology can circumvent this problem by providing a distributed and unchanging base. By merging this technology with the microservice architecture, secure and robust systems can be created due to the independent deployments and development of microservices, thus easing the application maintenance and evolution. Considering the advantages in the combination of the mentioned technologies, the present work aims to propose an approach that allows the integration between notary's offices and other institutions, ensuring security and celerity in the exchange of information between the parties. In this paper we report on our academic experience in the creation of the proposed approach, a pilot prototype, the development process and the tools used in the implementation, and the lessons learned.
The increasing use of information and communication technology over the last decade has driven a new range of information needs in business. A number of these software systems in deployment, however, suffer from detrimental unintended integrity and consistency compromise due to anomaly infestation. Primarily, the effects of this usually culminate in unpredictable and catastrophic results, which must be adequately checked to yield highly dependable software. This paper proposes a unified framework for analyzing propagations of anomalies in software systems employing ontology to characterize, categorize, and identify these errors; also, to provide guidelines for the implementation of the proposed solution. The generic approach captures the conventional semantics and structure of different types of anomalies with the notion of anomaly ontology. The prototype Ontology-based Software Anomaly Propagation Detection System (OBSAPDS) was built with the Protégé 4.3 knowledge acquisition tool, and Java programming languagPe was used for the development of the application and MySQL Server as the back en--gine. The combination of the domain ontology in Protégé and inference rules in Jena formed the knowledge system for the elicitation and the validation of domain facts. Besides, a proof-of-concept evaluation of the proposed framework confirmed how efficiently the approach could discover and resolve anomalies for different types of systems through demonstration. The division by zero error and the read access to uninitialized error conditions served as case studies.Keywords: Ontology, software systems, anomaly propagation
Christopher Klinkmüller, Ingo Weber, Alexander Ponomarev, An Binh Tran · 5 authors
Second generation blockchain platforms, like Ethereum, can store arbitrary data and execute user-defined smart contracts. Due to the shared nature of blockchains, understanding the usage of blockchain-based applications and the underlying network is crucial. Although log analysis is a well-established means, data extraction from blockchain platforms can be highly inconvenient and slow, not least due to the absence of logging libraries. To close the gap, we here introduce the Ethereum Logging Framework (ELF) which is highly configurable and available as open source. ELF supports users (i) in generating cost-efficient logging code readily embeddable into smart contracts and (ii) in extracting log analysis data into common formats regardless of whether the code generation has been used during development. We provide an overview of and rationale for the framework's features, outline implementation details, and demonstrate ELF's versatility based on three case studies from the public Ethereum blockchain.
N. Sánchez-Gómez, Jesús Torres Valderrama, J. A. García-García, Javier Gutiérrez · 5 authors
Blockchain technology promises to spark a real revolution. One of most important concepts associated with this technology is smart contracts, which enable the automatic execution of agreements and augur a world without intermediaries. The conditions and rules of “contracts” are established in a computer codes and trust is enforced by consensus among the participants. One relevant feature associated with smart contract is the immutability property, which establishes the non-alteration of blockchain network data after the clauses of the contract are been approved by all parties or entities involved. For this reason, smart contract development requires more effort and care than the development of other common programs. They require systematic mechanisms to collect requirements and functional specifications. In addition, it is necessary to verify and validate the agreed functionality and the implemented code before they are deployed in the blockchain platform. This article presents a systematic literature review of primary studies in the field of Software Development Life Cycle, focusing on model-based software design and testing in the blockchain domain of smart contracts. This research aims to identify gaps and/or opportunities for further research. After carried out this review, it was observed that no clear methodology exists for evaluating and validating the quality either of this software or the overall development process. This means that software developers may implement smart contract code in which bugs and serious security vulnerabilities appear when the software is delivered to their customers.
Grant Chung, Luc Desrosiers, Manav Gupta, Andrew Sutton · 7 authors
Blockchain scalability can be complicated and costly. As enterprises begin to adopt blockchain technology to solve business problems, there are valid concerns if blockchain applications can support the transactional demands of production systems. In fact, the multiple distributed components and protocols that underlie blockchain applications makes performance optimization a non-trivial task. Blockchain performance optimization and scalability require a methodology to reduce complexity and cost. Furthermore, existing performance results often lack the requirements, load, and infrastructure of a production application. In this paper, we first develop a methodical approach to performance tuning enterprise blockchain applications to increase performance and transaction capacity. The methodology is applied to an enterprise blockchain-based application (leveraging Hyperledger Fabric) for performance tuning and optimization with the goal of bridging the gap between laboratory and production deployed system performance. We then present extensive results and analysis of our performance testing for on-premise and cloud deployments, in which we were able to scale the application from 30 to 3000 TPS without forking the Hyperledger Fabric source code and maintaining a reasonable infrastructure footprint. We also provide blockchain application and platform recommendations for performance improvement.
Ivan Homoliak, Sarad Venugopalan, Daniel Reijsbergen, Qingze Hum · 6 authors
Blockchains are distributed systems, in which security is a critical factor for their success. However, despite their increasing popularity and adoption, there is a lack of standardized models that study blockchain-related security threats. To fill this gap, the main focus of our work is to systematize and extend the knowledge about the security and privacy aspects of blockchains and contribute to the standardization of this domain. We propose the security reference architecture (SRA) for blockchains, which adopts a stacked model (similar to the ISO/OSI) describing the nature and hierarchy of various security and privacy aspects. The SRA contains four layers: (1) the network layer, (2) the consensus layer, (3) the replicated state machine layer, and (4) the application layer. At each of these layers, we identify known security threats, their origin, and countermeasures, while we also analyze several cross-layer dependencies. Next, to enable better reasoning about security aspects of blockchains by the practitioners, we propose a blockchain-specific version of the threat-risk assessment standard ISO/IEC 15408 by embedding the stacked model into this standard. Finally, we provide designers of blockchain platforms and applications with a design methodology following the model of SRA and its hierarchy.
The increasing digitization of financial services by the late 2010s resulted in the generation of massive volumes of transactional data across payment systems, trading platforms, digital banking applications, and regulatory reporting pipelines. These transaction logs, originally designed for auditing, reconciliation, and failure recovery, gradually emerged as a valuable source of behavioral and operational insight. However, the scale, velocity, and structural heterogeneity of transactional logs posed significant challenges to traditional analytical techniques, which were often optimized for static datasets or narrowly defined reporting use cases. As a result, organizations began exploring systematic approaches to mine patterns from transaction logs in order to better understand system behavior, detect anomalies, and improve decision-making. Pattern mining from transaction logs refers to the process of discovering recurring structures, sequences, correlations, and deviations within recorded transactional events. By September 2019, this practice was informed by a combination of data mining research, distributed systems logging techniques, and operational analytics developed in large-scale production environments. Unlike conventional business intelligence queries, pattern mining emphasizes the identification of latent relationships and temporal structures that are not explicitly encoded in application logic. These patterns may reflect normal operational workflows, emergent system behaviors, or early indicators of faults, fraud, or performance degradation. In financial systems, transaction logs capture more than simple state changes; they encode regulatory-relevant actions such as authorization decisions, settlement progressions, risk evaluations, and ledger mutations. Mining patterns from these logs enables institutions to analyze end-to-end transaction lifecycles, correlate technical events with business outcomes, and identify systemic inefficiencies or vulnerabilities. Importantly, such analysis must operate within strict constraints related to data privacy, auditability, and regulatory compliance, distinguishing transaction log mining in financial domains from analogous practices in less regulated environments. This paper examines pattern mining from transaction logs as understood and applied by September 2019, situating it within the broader evolution of logging, distributed systems observability, and data mining research. It synthesizes academic literature and industry practices to propose a conceptual and architectural framework for extracting meaningful patterns from transactional data at scale. The analysis focuses on methodological considerations, architectural layering, and practical challenges encountered in regulated, high-throughput systems, while avoiding retrospective interpretations based on post-2019 technologies or techniques.
The blockchain is a key technology that has been adopted in many application areas to increase security and reliability and to avoid the need for a central trusted authority. One of its essential underlying foundations are smart contracts, which are executable programs for managing data or assets on the blockchain. It is crucial that smart contracts are tested thoroughly due to their immutable nature and since even small bugs can lead to huge monetary losses. However, it is not enough to just test smart contracts, it is also important to ensure the quality and completeness of the tests. Hence, we introduce new smart contract specific mutation operators as well as a novel killing condition that is able to detect a deviation in the gas consumptions, i.e., in the monetary value that is required to perform transactions. Moreover, we establish a baseline for mutation testing of smart contracts by applying our method to a replay test suite and by testing about a thousand contracts.
Mark Mossberg, Felipe Andrés Manzano, Eric Hennenfent, Alex Groce · 8 authors
An effective way to maximize code coverage in software tests is through dynamic symbolic execution$-$a technique that uses constraint solving to systematically explore a program's state space. We introduce an open-source dynamic symbolic execution framework called Manticore for analyzing binaries and Ethereum smart contracts. Manticore's flexible architecture allows it to support both traditional and exotic execution environments, and its API allows users to customize their analysis. Here, we discuss Manticore's architecture and demonstrate the capabilities we have used to find bugs and verify the correctness of code for our commercial clients.
A blockchain based system integrity (BCSI) framework for assuring the integrity of information system processes is presented. BCSI is well suited for a broad class of large scale real-world information systems. Under the BCSI framework, the integrity of any information system I is assured by executing the finite state machine model for system I processes in a blockchain network. The BCSI framework is compared and contrasted with the Clark-Wilson (CW) system integrity model, and existing blockchain based frameworks like Ethereum.
We’ll see the same kind of Cambrian explosion we witnessed in the web world once we started using mutualized infrastructure in public clouds and frameworks. It took only three weeks to learn enough Ruby on Rails and Heroku to push out the first version of a management system for that brokerage. And that’s because I had to think only about the models, the views, and the controllers. The hardest part, of course, had to do with building a secure wallet.
The rapid evolution of distributed systems during the 2010s fundamentally altered how software systems were designed, deployed, and operated, particularly in cloud-based and service-oriented environments. As organizations increasingly decomposed monolithic applications into microservices and event-driven components, traditional monitoring approaches centered on host-level metrics and reactive alerting proved insufficient. Failures became probabilistic rather than deterministic, symptoms emerged far from root causes, and system behavior could no longer be fully inferred from static architecture diagrams or predefined dashboards. Within this context, observability emerged not merely as an operational concern but as an engineering discipline that directly influences how systems are designed, instrumented, and evolved over time. Observability driven engineering refers to the practice of designing software systems such that their internal states can be inferred through externally visible signals under real-world operating conditions. By 2019, this concept had gained traction across distributed systems research and industry practice, informed by earlier control theory definitions and reinforced by practical challenges in debugging production microservices. Rather than treating telemetry as an afterthought added during operations, observability driven engineering integrates metrics, logs, and distributed traces into the development lifecycle itself, shaping interface contracts, failure semantics, and deployment strategies. This shift reflects a recognition that correctness, reliability, and performance in complex systems cannot be validated solely through pre-production testing. In regulated domains such as financial services, the need for observability carries additional significance. Payment processing systems, fraud detection pipelines, and ledger services operate under strict latency, consistency, and auditability requirements, while simultaneously being subject to partial failures, traffic bursts, and external dependencies. In such environments, the inability to explain system behavior during anomalies is not merely an inconvenience but a material operational and regulatory risk. Observability driven engineering therefore intersects with compliance obligations, incident response processes, and risk management practices, extending its relevance beyond purely technical concerns. This paper examines observability driven engineering as understood and practiced by May 2019, situating it within the broader evolution of software architecture from monolithic systems to distributed, cloud-native platforms. It synthesizes academic literature and industry experience to articulate a conceptual model for observability-aware system design, emphasizing the relationship between instrumentation, architectural layering, and operational feedback loops.
Thanks to rapid technological advances in the Internet of Things (IoT), a smart public safety (SPS) system has become feasible by integrating heterogeneous computing devices to collaboratively provide public protection services. While a service oriented architecture (SOA) has been adopted by IoT and cyber-physical systems (CPS), it is difficult for a monolithic architecture to provide scalable and extensible services for a distributed IoT based SPS system. Furthermore, traditional security solutions rely on a centralized authority, which can be a performance bottleneck or single point failure. Inspired by microservices architecture and blockchain technology, this paper proposes a BLockchain-ENabled Decentralized Microservices Architecture for Smart public safety (BlendMAS). Within a permissioned blockchain network, a microservices based security mechanism is introduced to secure data access control in an SPS system. The functionality of security services are decoupled into separate containerized microservices that are built using a smart contract, and deployed on edge and fog computing nodes. An extensive experimental study verified that the proposed BlendMAS is able to offer a decentralized, scalable and secured data sharing and access control to distributed IoT based SPS system.
Driven by the surge of interest generated around blockchain technologies over the last years, a new category of systems, called Blockchain-Oriented Software (BOS), which are strictly tied to Blockchain distributed environment, has become increasingly popular. Yet, there is not a thorough understanding of their structure and behaviour and if and to which extent they differ from traditional software systems. The present work provide a first statistical characterisation of BOS. We analysed and compared 5 C++ open source Blockchain-Oriented and 5 Traditional Java software systems, aiming at detecting potential differences between the two categories of projects, and specifically in the statistical distribution of 10 software metrics. Although, in general, the statistical distributions for Traditional software and Blockchain software show similarities, the distribution of Average Cyclomatic and Ration Comment To Code metrics reveal significant differences in their queue, whereas the Number of Statements metric shows meaningful differences on the double Pareto distribution.
Roberto Tonelli, Maria Ilaria Lunesu, Andrea Pinna, Davide Taibi · 5 authors
Blockchain technologies and smart contracts are becoming mainstream research fields in computer science and researchers are continuously investigating new frontiers for new applications. Likewise, microservices are getting more and more popular in the latest years thanks to their properties, that allow teams to slice existing information systems into small and independent services that can be developed independently by different teams. A symmetric paradigm applies to smart contracts as well, which represent well defined, usually isolated, executable programs, typically implementing simple and autonomous tasks with a well defined purpose, which can be assumed as services provided by the Contract. In this work we analyze a concrete case study where the microservices architecture environment is replicated and implemented through an equivalent set of smart contracts, showing for the first time the feasibility of implementing a microservices-based system with smart contracts and how the two innovative paradigms match together. Results show that it is possible to implement a simple microservices-based system with smart contracts maintaining the same set of functionalities and results. The result could be highly beneficial in contexts such as smart voting, where not only the data integrity is fundamental but also the source code executed must be trustable.