首页 > 最新文献

2020 35th IEEE/ACM International Conference on Automated Software Engineering (ASE)最新文献

英文 中文
Generating Highly-structured Input Data by Combining Search-based Testing and Grammar-based Fuzzing 结合基于搜索的测试和基于语法的模糊测试生成高度结构化的输入数据
Mitchell Olsthoorn, A. Deursen, Annibale Panichella
Software testing is an important and time-consuming task that is often done manually. In the last decades, researchers have come up with techniques to generate input data (e.g., fuzzing) and automate the process of generating test cases (e.g., search-based testing). However, these techniques are known to have their own limitations: search-based testing does not generate highly-structured data; grammar-based fuzzing does not generate test case structures. To address these limitations, we combine these two techniques. By applying grammar-based mutations to the input data gathered by the search-based testing algorithm, it allows us to co-evolve both aspects of test case generation. We evaluate our approach, called G-EVOSUITE, by performing an empirical study on 20 Java classes from the three most popular JSON parsers across multiple search budgets. Our results show that the proposed approach on average improves branch coverage for JSON related classes by 15 % (with a maximum increase of 50 %) without negatively impacting other classes.
软件测试是一项重要且耗时的任务,通常是手工完成的。在过去的几十年里,研究人员已经提出了生成输入数据(例如,模糊测试)和自动化生成测试用例过程(例如,基于搜索的测试)的技术。然而,已知这些技术有其自身的局限性:基于搜索的测试不能生成高度结构化的数据;基于语法的模糊测试不会生成测试用例结构。为了解决这些限制,我们将这两种技术结合起来。通过将基于语法的突变应用到由基于搜索的测试算法收集的输入数据,它允许我们共同发展测试用例生成的两个方面。我们通过对来自三个最流行的JSON解析器的20个Java类在多个搜索预算中执行实证研究来评估我们的方法G-EVOSUITE。我们的结果表明,建议的方法平均将JSON相关类的分支覆盖率提高了15%(最大增幅为50%),而不会对其他类产生负面影响。
{"title":"Generating Highly-structured Input Data by Combining Search-based Testing and Grammar-based Fuzzing","authors":"Mitchell Olsthoorn, A. Deursen, Annibale Panichella","doi":"10.1145/3324884.3418930","DOIUrl":"https://doi.org/10.1145/3324884.3418930","url":null,"abstract":"Software testing is an important and time-consuming task that is often done manually. In the last decades, researchers have come up with techniques to generate input data (e.g., fuzzing) and automate the process of generating test cases (e.g., search-based testing). However, these techniques are known to have their own limitations: search-based testing does not generate highly-structured data; grammar-based fuzzing does not generate test case structures. To address these limitations, we combine these two techniques. By applying grammar-based mutations to the input data gathered by the search-based testing algorithm, it allows us to co-evolve both aspects of test case generation. We evaluate our approach, called G-EVOSUITE, by performing an empirical study on 20 Java classes from the three most popular JSON parsers across multiple search budgets. Our results show that the proposed approach on average improves branch coverage for JSON related classes by 15 % (with a maximum increase of 50 %) without negatively impacting other classes.","PeriodicalId":106337,"journal":{"name":"2020 35th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"13 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115255054","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 12
Styx: A Data-Oriented Mutation Framework to Improve the Robustness of DNN Styx:一个面向数据的突变框架,以提高深度神经网络的鲁棒性
Meixi Liu, Weijiang Hong, Weiyu Pan, Chendong Feng, Zhenbang Chen, Ji Wang
The robustness of deep neural network (DNN) is critical and challenging to ensure. In this paper, we propose a general data-oriented mutation framework, called Styx, to improve the robustness of DNN. Styx generates new training data by slightly mutating the training data. In this way, Styx ensures the DNN's accuracy on the test dataset while improving the adaptability to small perturbations, i.e., improving the robustness. We have instantiated Styx for image classification and proposed pixel-level mutation rules that are applicable to any image classification DNNs. We have applied Styx on several commonly used benchmarks and compared Styx with the representative adversarial training methods. The preliminary experimental results indicate the effectiveness of Styx.
深度神经网络(DNN)的鲁棒性是一个非常重要且具有挑战性的问题。在本文中,我们提出了一个通用的面向数据的突变框架,称为Styx,以提高深度神经网络的鲁棒性。Styx通过稍微改变训练数据来生成新的训练数据。这样,Styx保证了DNN在测试数据集上的准确性,同时提高了对小扰动的适应性,即提高了鲁棒性。我们已经实例化了Styx用于图像分类,并提出了适用于任何图像分类dnn的像素级突变规则。我们将Styx应用于几种常用的基准测试,并将Styx与具有代表性的对抗性训练方法进行了比较。初步实验结果表明了Styx的有效性。
{"title":"Styx: A Data-Oriented Mutation Framework to Improve the Robustness of DNN","authors":"Meixi Liu, Weijiang Hong, Weiyu Pan, Chendong Feng, Zhenbang Chen, Ji Wang","doi":"10.1145/3324884.3418903","DOIUrl":"https://doi.org/10.1145/3324884.3418903","url":null,"abstract":"The robustness of deep neural network (DNN) is critical and challenging to ensure. In this paper, we propose a general data-oriented mutation framework, called Styx, to improve the robustness of DNN. Styx generates new training data by slightly mutating the training data. In this way, Styx ensures the DNN's accuracy on the test dataset while improving the adaptability to small perturbations, i.e., improving the robustness. We have instantiated Styx for image classification and proposed pixel-level mutation rules that are applicable to any image classification DNNs. We have applied Styx on several commonly used benchmarks and compared Styx with the representative adversarial training methods. The preliminary experimental results indicate the effectiveness of Styx.","PeriodicalId":106337,"journal":{"name":"2020 35th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"9 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129659074","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
Scalable Multiple-View Analysis of Reactive Systems via Bidirectional Model Transformations 通过双向模型转换的可伸缩反应系统多视图分析
Christos Tsigkanos, Nianyu Li, Zhi Jin, Zhenjiang Hu, C. Ghezzi
Systematic model-driven design and early validation enable engineers to verify that a reactive system does not violate its requirements before actually implementing it. Requirements may come from multiple stakeholders, who are often concerned with different facets - design typically involves different experts having different concerns and views of the system. Engineers start from a specification which may be sourced from some domain model, while validation is often done on state-transition structures that support model checking. Two computationally expensive steps may work against scalability: transformation from specification to state-transition structures, and model checking. We propose a technique that makes the former efficient and also makes the resulting transition systems small enough to be efficiently verified. The technique automatically projects the specification into submodels depending on a property sought to be evaluated, which captures some stakeholder's viewpoint. The resulting reactive system submodel is then transformed into a state-transition structure and verified. The technique achieves cone-of-influence reduction, by slicing at the specification model level. Submodels are analysis-equivalent to the corresponding full model. If stakeholders propose a change to a submodel based on their own view, changes are automatically propagated to the specification model and other views affected. Automated reflection is achieved thanks to bidirectional model transformations, ensuring correctness. We cast our proposal in the context of graph-based reactive systems whose dynamics is described by rewriting rules. We demonstrate our view-based framework in practice on a case study within cyber-physical systems.
系统的模型驱动设计和早期验证使工程师能够在实际实现之前验证反应系统是否违反其需求。需求可能来自多个涉众,他们通常关注不同的方面——设计通常涉及不同的专家,他们对系统有不同的关注和看法。工程师从可能来自某个领域模型的规范开始,而验证通常是在支持模型检查的状态转换结构上完成的。两个计算代价昂贵的步骤可能不利于可伸缩性:从规范到状态转换结构的转换,以及模型检查。我们提出了一种技术,使前者有效,也使产生的过渡系统足够小,可以有效地验证。该技术根据要评估的属性自动将规范投影到子模型中,这捕获了一些涉众的观点。然后将生成的反应系统子模型转换为状态转换结构并进行验证。该技术通过在规范模型级别进行切片来实现影响锥减小。子模型是分析等效于相应的完整模型。如果涉众根据自己的视图对子模型提出更改,则更改将自动传播到规范模型和受影响的其他视图。通过双向模型转换实现了自动反射,从而确保了正确性。我们在基于图的反应性系统的上下文中提出了我们的建议,该系统的动态是通过重写规则来描述的。我们在网络物理系统的案例研究中演示了我们基于视图的框架。
{"title":"Scalable Multiple-View Analysis of Reactive Systems via Bidirectional Model Transformations","authors":"Christos Tsigkanos, Nianyu Li, Zhi Jin, Zhenjiang Hu, C. Ghezzi","doi":"10.1145/3324884.3416579","DOIUrl":"https://doi.org/10.1145/3324884.3416579","url":null,"abstract":"Systematic model-driven design and early validation enable engineers to verify that a reactive system does not violate its requirements before actually implementing it. Requirements may come from multiple stakeholders, who are often concerned with different facets - design typically involves different experts having different concerns and views of the system. Engineers start from a specification which may be sourced from some domain model, while validation is often done on state-transition structures that support model checking. Two computationally expensive steps may work against scalability: transformation from specification to state-transition structures, and model checking. We propose a technique that makes the former efficient and also makes the resulting transition systems small enough to be efficiently verified. The technique automatically projects the specification into submodels depending on a property sought to be evaluated, which captures some stakeholder's viewpoint. The resulting reactive system submodel is then transformed into a state-transition structure and verified. The technique achieves cone-of-influence reduction, by slicing at the specification model level. Submodels are analysis-equivalent to the corresponding full model. If stakeholders propose a change to a submodel based on their own view, changes are automatically propagated to the specification model and other views affected. Automated reflection is achieved thanks to bidirectional model transformations, ensuring correctness. We cast our proposal in the context of graph-based reactive systems whose dynamics is described by rewriting rules. We demonstrate our view-based framework in practice on a case study within cyber-physical systems.","PeriodicalId":106337,"journal":{"name":"2020 35th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"80 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130615842","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 9
Synthesizing Smart Solving Strategy for Symbolic Execution 符号执行的综合智能求解策略
Zehua Chen, Zhenbang Chen, Ziqi Shuai, Yufeng Zhang, Weiyu Pan
Constraint solving is one of the challenges for symbolic execution. Modern SMT solvers allow users to customize the internal solving procedure by solving strategies. In this extended abstract, we report our recent progress in synthesizing a program-specific solving strategy for the symbolic execution of a program. We propose a two-stage procedure for symbolic execution. At the first stage, we synthesize a solving strategy by utilizing deep learning techniques. Then, the strategy will be used in the second stage to improve the performance of constraint solving. The preliminary experimental results indicate the promising of our method.
约束求解是符号执行的挑战之一。现代SMT求解器允许用户通过求解策略定制内部求解程序。在这篇扩展摘要中,我们报告了我们在合成程序符号执行的特定于程序的求解策略方面的最新进展。我们提出了一个两阶段的符号执行过程。在第一阶段,我们利用深度学习技术合成了一个求解策略。然后,在第二阶段将使用该策略来提高约束求解的性能。初步的实验结果表明了该方法的可行性。
{"title":"Synthesizing Smart Solving Strategy for Symbolic Execution","authors":"Zehua Chen, Zhenbang Chen, Ziqi Shuai, Yufeng Zhang, Weiyu Pan","doi":"10.1145/3324884.3418904","DOIUrl":"https://doi.org/10.1145/3324884.3418904","url":null,"abstract":"Constraint solving is one of the challenges for symbolic execution. Modern SMT solvers allow users to customize the internal solving procedure by solving strategies. In this extended abstract, we report our recent progress in synthesizing a program-specific solving strategy for the symbolic execution of a program. We propose a two-stage procedure for symbolic execution. At the first stage, we synthesize a solving strategy by utilizing deep learning techniques. Then, the strategy will be used in the second stage to improve the performance of constraint solving. The preliminary experimental results indicate the promising of our method.","PeriodicalId":106337,"journal":{"name":"2020 35th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"24 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114346727","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Continuous Compliance 连续的合规
Martin Kellogg, Martin Schäf, S. Tasiran, Michael D. Ernst
Vendors who wish to provide software or services to large corporations and governments must often obtain numerous certificates of compliance. Each certificate asserts that the software satisfies a compliance regime, like SOC or the PCI DSS, to protect the privacy and security of sensitive data. The industry standard for obtaining a compliance certificate is an auditor manually auditing source code. This approach is expensive, error-prone, partial, and prone to regressions. We propose continuous compliance to guarantee that the codebase stays compliant on each code change using lightweight verification tools. Continuous compliance increases assurance and reduces costs. Continuous compliance is applicable to any source-code compliance requirement. To illustrate our approach, we built verification tools for five common audit controls related to data security: cryptographically unsafe algorithms must not be used, keys must be at least 256 bits long, credentials must not be hard-coded into program text, HTTPS must always be used instead of HTTP, and cloud data stores must not be world-readable. We evaluated our approach in three ways. (1) We applied our tools to over 5 million lines of open-source software. (2) We compared our tools to other publicly-available tools for detecting misuses of encryption on a previously-published benchmark, finding that only ours are suitable for continuous compliance. (3) We deployed a continuous compliance process at AWS, a large cloud-services company: we integrated verification tools into the compliance process (including auditors accepting their output as evidence) and ran them on over 68 million lines of code. Our tools and the data for the former two evaluations are publicly available.
希望为大公司和政府提供软件或服务的供应商通常必须获得大量的合规证书。每个证书都断言该软件满足合规性制度,如SOC或PCI DSS,以保护敏感数据的隐私和安全。获取符合性证书的行业标准是由审核员手动审核源代码。这种方法代价昂贵、容易出错、不完整,而且容易出现回归。我们建议使用轻量级的验证工具来保证代码库在每次代码变更时保持一致性。持续的遵从性增加了保证并降低了成本。持续遵从性适用于任何源代码遵从性需求。为了说明我们的方法,我们为与数据安全相关的五种常见审计控制构建了验证工具:不得使用加密不安全的算法,密钥必须至少256位长,凭证不得硬编码到程序文本中,必须始终使用HTTPS而不是HTTP,并且云数据存储不能是世界可读的。我们从三个方面评估了我们的方法。(1)我们将我们的工具应用于超过500万行开源软件。(2)我们将我们的工具与其他公开可用的工具进行了比较,这些工具用于检测先前发布的基准上的加密滥用,发现只有我们的工具适合持续合规。(3)我们在大型云服务公司AWS部署了一个持续的合规流程:我们将验证工具集成到合规流程中(包括审计员接受其输出作为证据),并在超过6800万行代码上运行它们。我们用于前两种评估的工具和数据是公开的。
{"title":"Continuous Compliance","authors":"Martin Kellogg, Martin Schäf, S. Tasiran, Michael D. Ernst","doi":"10.1145/3324884.3416593","DOIUrl":"https://doi.org/10.1145/3324884.3416593","url":null,"abstract":"Vendors who wish to provide software or services to large corporations and governments must often obtain numerous certificates of compliance. Each certificate asserts that the software satisfies a compliance regime, like SOC or the PCI DSS, to protect the privacy and security of sensitive data. The industry standard for obtaining a compliance certificate is an auditor manually auditing source code. This approach is expensive, error-prone, partial, and prone to regressions. We propose continuous compliance to guarantee that the codebase stays compliant on each code change using lightweight verification tools. Continuous compliance increases assurance and reduces costs. Continuous compliance is applicable to any source-code compliance requirement. To illustrate our approach, we built verification tools for five common audit controls related to data security: cryptographically unsafe algorithms must not be used, keys must be at least 256 bits long, credentials must not be hard-coded into program text, HTTPS must always be used instead of HTTP, and cloud data stores must not be world-readable. We evaluated our approach in three ways. (1) We applied our tools to over 5 million lines of open-source software. (2) We compared our tools to other publicly-available tools for detecting misuses of encryption on a previously-published benchmark, finding that only ours are suitable for continuous compliance. (3) We deployed a continuous compliance process at AWS, a large cloud-services company: we integrated verification tools into the compliance process (including auditors accepting their output as evidence) and ran them on over 68 million lines of code. Our tools and the data for the former two evaluations are publicly available.","PeriodicalId":106337,"journal":{"name":"2020 35th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"32 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128029455","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 7
A Program Verification based Approach to Find Data Race Vulnerabilities in Interrupt-driven Program 中断驱动程序中基于程序验证的数据竞争漏洞查找方法
Haining Feng
The data race problem is common in the interrupt-driven program, and it is difficult to find as a result of complicated interrupt interleaving. Static analysis is a mainstream technology to detect those problems, however, the synchronization mechanism of interrupt is hard to be processed by the existing method, which brings many false alarms. Eliminating false alarms in static analysis is the main challenge for precisely data race detection. In this paper, we present a framework of static analysis combined with program verification, which performs static analysis to find all potential races, and then verifies every race to eliminate false alarms. The experiment results on related race benchmarks show that our implementation finds all race bugs in the phase of static analysis, and eliminates all false alarms through program verification.
数据争用问题是中断驱动程序中常见的问题,由于复杂的中断交错,数据争用问题很难发现。静态分析是检测此类问题的主流技术,但现有方法难以处理中断的同步机制,导致误报较多。消除静态分析中的虚警是精确数据竞争检测的主要挑战。本文提出了一种静态分析与程序验证相结合的框架,通过静态分析找出所有潜在的赛跑,然后对每一个赛跑进行验证以消除误报。在相关的竞赛基准测试上的实验结果表明,我们的实现在静态分析阶段就发现了所有的竞赛bug,并通过程序验证消除了所有的虚警。
{"title":"A Program Verification based Approach to Find Data Race Vulnerabilities in Interrupt-driven Program","authors":"Haining Feng","doi":"10.1145/3324884.3418925","DOIUrl":"https://doi.org/10.1145/3324884.3418925","url":null,"abstract":"The data race problem is common in the interrupt-driven program, and it is difficult to find as a result of complicated interrupt interleaving. Static analysis is a mainstream technology to detect those problems, however, the synchronization mechanism of interrupt is hard to be processed by the existing method, which brings many false alarms. Eliminating false alarms in static analysis is the main challenge for precisely data race detection. In this paper, we present a framework of static analysis combined with program verification, which performs static analysis to find all potential races, and then verifies every race to eliminate false alarms. The experiment results on related race benchmarks show that our implementation finds all race bugs in the phase of static analysis, and eliminates all false alarms through program verification.","PeriodicalId":106337,"journal":{"name":"2020 35th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"39 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131357370","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
The New Approach to IT Testing : Real Transaction-Based Automated Validation Solution IT测试的新方法:真正的基于事务的自动验证解决方案
Yongsik Kim, SoAh Min, Youkyung Kim
Traditional IT projects have rolled out newly developed software or systems after iterating manual tests based on the scenarios and cases that are considered sufficient. However, due to the time and budget limitation of IT projects, these traditional tests almost always fail to include all the possible scenarios and cases of the real world. Thus, we cannot eliminate all potential defects before go-live and unexpected failures might occur as a result, which can lead to severe damage to both customers and IT project contractors. This paper demonstrates a real transaction-based automated testing approach named ‘PerfecTwin’ with several real-world examples. PerfecTwin overcomes the above limitations of the traditional testing by running the new and old systems side-by-side, automatically validating the new system against the old system's actual transactions, in real time, which can eliminate almost all potential defects before go-live.
传统的IT项目是在基于被认为足够的场景和用例迭代手动测试之后推出新开发的软件或系统的。然而,由于IT项目的时间和预算限制,这些传统的测试几乎总是不能包括现实世界中所有可能的场景和案例。因此,我们不能在上线之前消除所有潜在的缺陷,结果可能会出现意想不到的故障,这可能会对客户和IT项目承包商造成严重损害。本文用几个真实的例子演示了一个名为“PerfecTwin”的基于事务的自动化测试方法。PerfecTwin通过并排运行新旧系统来克服传统测试的上述限制,实时地根据旧系统的实际事务自动验证新系统,这可以在上线之前消除几乎所有潜在的缺陷。
{"title":"The New Approach to IT Testing : Real Transaction-Based Automated Validation Solution","authors":"Yongsik Kim, SoAh Min, Youkyung Kim","doi":"10.1145/3324884.3421839","DOIUrl":"https://doi.org/10.1145/3324884.3421839","url":null,"abstract":"Traditional IT projects have rolled out newly developed software or systems after iterating manual tests based on the scenarios and cases that are considered sufficient. However, due to the time and budget limitation of IT projects, these traditional tests almost always fail to include all the possible scenarios and cases of the real world. Thus, we cannot eliminate all potential defects before go-live and unexpected failures might occur as a result, which can lead to severe damage to both customers and IT project contractors. This paper demonstrates a real transaction-based automated testing approach named ‘PerfecTwin’ with several real-world examples. PerfecTwin overcomes the above limitations of the traditional testing by running the new and old systems side-by-side, automatically validating the new system against the old system's actual transactions, in real time, which can eliminate almost all potential defects before go-live.","PeriodicalId":106337,"journal":{"name":"2020 35th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"33 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116299064","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Inferring and Applying Def-Use Like Configuration Couplings in Deployment Descriptors 在部署描述符中推断和应用类似自定义使用的配置耦合
Chengyuan Wen, Yaxuan Zhang, Xiao He, Na Meng
When building enterprise applications on Java frameworks (e.g., Spring), developers often specify components and configure operations with a special kind of XML files named “deployment descriptors (DD)”. Maintaining such XML files is challenging and time-consuming; because (1) the correct configuration semantics is domain-specific but usually vaguely documented, and (2) existing compilers and program analysis tools rarely examine XML files. To help developers ensure the quality of DD, this paper presents a novel approach-XEDITOR-that extracts configuration couplings (i.e., frequently co-occurring configurations) from DD, and adopts the coupling rules to validate new or updated files. Xeditor has two phases: coupling extraction and bug detection. To identify couplings, Xeditor first mines DD in open-source projects, and extracts XML entity pairs that (i) frequently coexist in the same files and (ii) hold the same data at least once. Xeditor then applies customized association rule mining to the extracted pairs. For bug detection, given a new XML file, Xeditor checks whether the file violates any coupling; if so, Xeditor reports the violation(s). For evaluation, we first created two data sets with the 4,248 DD mined from 1,137 GitHub projects. According to the experiments with these data sets, Xeditor extracted couplings with high precision (73%); it detected bugs with 92% precision, 96% recall, and 94% accuracy. Additionally, we applied Xeditor to the version history of another 478 GitHub projects. Xeditor identified 25 very suspicious XML updates, 15 of which were later fixed by developers.
当在Java框架(例如Spring)上构建企业应用程序时,开发人员通常使用一种名为“部署描述符(DD)”的特殊XML文件来指定组件和配置操作。维护这样的XML文件既困难又耗时;因为(1)正确的配置语义是特定于领域的,但通常是模糊的文档;(2)现有的编译器和程序分析工具很少检查XML文件。为了帮助开发人员确保DD的质量,本文提出了一种新颖的方法——xeditor,它从DD中提取配置耦合(即,经常共同发生的配置),并采用耦合规则来验证新的或更新的文件。Xeditor有两个阶段:耦合提取和bug检测。为了识别耦合,Xeditor首先在开源项目中挖掘DD,并提取(i)经常共存于相同文件中的XML实体对和(ii)至少保存一次相同数据的XML实体对。然后Xeditor对提取的对应用自定义关联规则挖掘。对于bug检测,给定一个新的XML文件,Xeditor检查该文件是否违反了任何耦合;如果是,Xeditor会报告违规行为。为了进行评估,我们首先用从1137个GitHub项目中挖掘的4248个DD创建了两个数据集。根据这些数据集的实验,Xeditor提取耦合的精度很高(73%);它检测漏洞的准确率为92%,召回率为96%,准确率为94%。此外,我们将Xeditor应用于另外478个GitHub项目的版本历史。Xeditor发现了25个非常可疑的XML更新,其中15个后来由开发人员修复。
{"title":"Inferring and Applying Def-Use Like Configuration Couplings in Deployment Descriptors","authors":"Chengyuan Wen, Yaxuan Zhang, Xiao He, Na Meng","doi":"10.1145/3324884.3416577","DOIUrl":"https://doi.org/10.1145/3324884.3416577","url":null,"abstract":"When building enterprise applications on Java frameworks (e.g., Spring), developers often specify components and configure operations with a special kind of XML files named “deployment descriptors (DD)”. Maintaining such XML files is challenging and time-consuming; because (1) the correct configuration semantics is domain-specific but usually vaguely documented, and (2) existing compilers and program analysis tools rarely examine XML files. To help developers ensure the quality of DD, this paper presents a novel approach-XEDITOR-that extracts configuration couplings (i.e., frequently co-occurring configurations) from DD, and adopts the coupling rules to validate new or updated files. Xeditor has two phases: coupling extraction and bug detection. To identify couplings, Xeditor first mines DD in open-source projects, and extracts XML entity pairs that (i) frequently coexist in the same files and (ii) hold the same data at least once. Xeditor then applies customized association rule mining to the extracted pairs. For bug detection, given a new XML file, Xeditor checks whether the file violates any coupling; if so, Xeditor reports the violation(s). For evaluation, we first created two data sets with the 4,248 DD mined from 1,137 GitHub projects. According to the experiments with these data sets, Xeditor extracted couplings with high precision (73%); it detected bugs with 92% precision, 96% recall, and 94% accuracy. Additionally, we applied Xeditor to the version history of another 478 GitHub projects. Xeditor identified 25 very suspicious XML updates, 15 of which were later fixed by developers.","PeriodicalId":106337,"journal":{"name":"2020 35th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"16 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121973877","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
Mastering Uncertainty in Performance Estimations of Configurable Software Systems 掌握可配置软件系统性能评估中的不确定性
Pub Date : 2020-09-01 DOI: 10.1007/s10664-022-10250-2
Johannes Dorn, S. Apel, Norbert Siegmund
{"title":"Mastering Uncertainty in Performance Estimations of Configurable Software Systems","authors":"Johannes Dorn, S. Apel, Norbert Siegmund","doi":"10.1007/s10664-022-10250-2","DOIUrl":"https://doi.org/10.1007/s10664-022-10250-2","url":null,"abstract":"","PeriodicalId":106337,"journal":{"name":"2020 35th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"6 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132954988","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 17
Scalability and Precision Improvement of Neural Program Synthesis 神经程序合成的可扩展性和精度提高
Yating Zhang
Mosts of the neural synthesis construct encoder-decoder models to learn a probability distribution over the space of programs. Two drawbacks in such neural program synthesis are that the synthesis scale is relatively small and the correctness of the synthesis result cannot be guaranteed. We address these problems by constructing a framework, which analyzes and solves problems from three dimensions: program space description, model architecture, and result processing. Experiments show that the scalability and precision of synthesis are improved in every dimension.
大多数神经综合构建编码器-解码器模型来学习程序空间上的概率分布。这种神经程序合成的两个缺点是合成规模较小,不能保证合成结果的正确性。我们通过构建一个框架来解决这些问题,该框架从三个维度分析和解决问题:程序空间描述、模型体系结构和结果处理。实验表明,该方法在各个维度上都提高了合成的可扩展性和精度。
{"title":"Scalability and Precision Improvement of Neural Program Synthesis","authors":"Yating Zhang","doi":"10.1145/3324884.3418912","DOIUrl":"https://doi.org/10.1145/3324884.3418912","url":null,"abstract":"Mosts of the neural synthesis construct encoder-decoder models to learn a probability distribution over the space of programs. Two drawbacks in such neural program synthesis are that the synthesis scale is relatively small and the correctness of the synthesis result cannot be guaranteed. We address these problems by constructing a framework, which analyzes and solves problems from three dimensions: program space description, model architecture, and result processing. Experiments show that the scalability and precision of synthesis are improved in every dimension.","PeriodicalId":106337,"journal":{"name":"2020 35th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2020-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130452665","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
期刊
2020 35th IEEE/ACM International Conference on Automated Software Engineering (ASE)
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1