首页 > 最新文献

2019 IEEE International Conference on Software Maintenance and Evolution (ICSME)最新文献

英文 中文
An Empirical Study of Abbreviations and Expansions in Software Artifacts 软件构件中缩略语与展开的实证研究
Pub Date : 2019-09-01 DOI: 10.1109/ICSME.2019.00040
Christian D. Newman, M. J. Decker, Reem S. Alsuhaibani, Anthony S Peruma, D. Kaushik, Emily Hill
Expanding abbreviations is an important text normalization technique used for the purpose of either increasing developer comprehension or supporting the application of natural-language-based tools for source code identifiers. This paper closely studies abbreviations and where their expansions occur in different software artifacts. Without abbreviation expansion, developers will spend more time in comprehending the code they need to update, and tools analyzing software may obtain weak or non-generalizable results. There are numerous techniques for expanding abbreviations, most of which struggle to reach an average expansion accuracy of 59-62% on general source code identifiers. In this paper, we reveal some characteristics of abbreviations and their expansions through an empirical study of 861 abbreviation-expansion pairs extracted from 5 open-source systems in addition to analyzing previous literature. We use these characteristics to identify how current approaches may be complementary and how their results should be reported in the future to help maximize both our understanding of how they compare with other expansion techniques and their reproducibility.
展开缩写是一种重要的文本规范化技术,用于提高开发人员的理解能力或支持基于自然语言的源代码标识符工具的应用程序。本文仔细研究了缩略语及其在不同软件工件中的扩展。如果没有缩写扩展,开发人员将花费更多的时间来理解他们需要更新的代码,并且分析软件的工具可能会获得弱的或不可概括的结果。有许多扩展缩写的技术,其中大多数在通用源代码标识符上难以达到59-62%的平均扩展精度。本文在分析前人文献的基础上,通过对从5个开源系统中提取的861对缩略语展开对的实证研究,揭示了缩略语及其展开的一些特征。我们利用这些特征来确定当前的方法是如何互补的,以及它们的结果应该如何在未来报告,以帮助我们最大限度地了解它们与其他扩展技术的比较以及它们的可重复性。
{"title":"An Empirical Study of Abbreviations and Expansions in Software Artifacts","authors":"Christian D. Newman, M. J. Decker, Reem S. Alsuhaibani, Anthony S Peruma, D. Kaushik, Emily Hill","doi":"10.1109/ICSME.2019.00040","DOIUrl":"https://doi.org/10.1109/ICSME.2019.00040","url":null,"abstract":"Expanding abbreviations is an important text normalization technique used for the purpose of either increasing developer comprehension or supporting the application of natural-language-based tools for source code identifiers. This paper closely studies abbreviations and where their expansions occur in different software artifacts. Without abbreviation expansion, developers will spend more time in comprehending the code they need to update, and tools analyzing software may obtain weak or non-generalizable results. There are numerous techniques for expanding abbreviations, most of which struggle to reach an average expansion accuracy of 59-62% on general source code identifiers. In this paper, we reveal some characteristics of abbreviations and their expansions through an empirical study of 861 abbreviation-expansion pairs extracted from 5 open-source systems in addition to analyzing previous literature. We use these characteristics to identify how current approaches may be complementary and how their results should be reported in the future to help maximize both our understanding of how they compare with other expansion techniques and their reproducibility.","PeriodicalId":106748,"journal":{"name":"2019 IEEE International Conference on Software Maintenance and Evolution (ICSME)","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2019-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122889541","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 15
TECCD: A Tree Embedding Approach for Code Clone Detection 一种用于代码克隆检测的树嵌入方法
Pub Date : 2019-09-01 DOI: 10.1109/ICSME.2019.00025
Yi Gao, Zan Wang, Shuang Liu, Lin Yang, Wei Sang, Yuanfang Cai
Clone detection techniques have been explored for decades. Recently, deep learning techniques has been adopted to improve the code representation capability, and improve the state-of-the-art in code clone detection. These approaches usually require a transformation from AST to binary tree to incorporate syntactical information, which introduces overheads. Moreover, these approaches conduct term-embedding, which requires large training datasets. In this paper, we introduce a tree embedding technique to conduct clone detection. Our approach first conducts tree embedding to obtain a node vector for each intermediate node in the AST, which captures the structure information of ASTs. Then we compose a tree vector from its involving node vectors using a lightweight method. Lastly Euclidean distances between tree vectors are measured to determine code clones. We implement our approach in a tool called TECCD and conduct an evaluation using the BigCloneBench (BCB) and 7 other large scale Java projects. The results show that our approach achieves good accuracy and recall and outperforms existing approaches.
克隆检测技术已经探索了几十年。近年来,深度学习技术被用于提高代码表示能力,提高代码克隆检测的水平。这些方法通常需要从AST转换到二叉树,以合并语法信息,这会带来开销。此外,这些方法进行术语嵌入,这需要大量的训练数据集。本文介绍了一种树嵌入技术来进行克隆检测。我们的方法首先进行树嵌入,获取AST中每个中间节点的节点向量,获取AST的结构信息。然后,我们用一种轻量级的方法将其涉及的节点向量组合成一个树向量。最后,测量树向量之间的欧氏距离来确定代码克隆。我们在一个名为TECCD的工具中实现了我们的方法,并使用BigCloneBench (BCB)和其他7个大型Java项目进行了评估。结果表明,该方法具有较好的准确率和查全率,优于现有方法。
{"title":"TECCD: A Tree Embedding Approach for Code Clone Detection","authors":"Yi Gao, Zan Wang, Shuang Liu, Lin Yang, Wei Sang, Yuanfang Cai","doi":"10.1109/ICSME.2019.00025","DOIUrl":"https://doi.org/10.1109/ICSME.2019.00025","url":null,"abstract":"Clone detection techniques have been explored for decades. Recently, deep learning techniques has been adopted to improve the code representation capability, and improve the state-of-the-art in code clone detection. These approaches usually require a transformation from AST to binary tree to incorporate syntactical information, which introduces overheads. Moreover, these approaches conduct term-embedding, which requires large training datasets. In this paper, we introduce a tree embedding technique to conduct clone detection. Our approach first conducts tree embedding to obtain a node vector for each intermediate node in the AST, which captures the structure information of ASTs. Then we compose a tree vector from its involving node vectors using a lightweight method. Lastly Euclidean distances between tree vectors are measured to determine code clones. We implement our approach in a tool called TECCD and conduct an evaluation using the BigCloneBench (BCB) and 7 other large scale Java projects. The results show that our approach achieves good accuracy and recall and outperforms existing approaches.","PeriodicalId":106748,"journal":{"name":"2019 IEEE International Conference on Software Maintenance and Evolution (ICSME)","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2019-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126167359","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 23
Deep Learning Anti-Patterns from Code Metrics History 从代码度量历史中深度学习反模式
Pub Date : 2019-09-01 DOI: 10.1109/ICSME.2019.00021
Antoine Barbez, Foutse Khomh, Yann-Gaël Guéhéneuc
Anti-patterns are poor solutions to recurring design problems. Number of empirical studies have highlighted the negative impact of anti-patterns on software maintenance which motivated the development of various detection techniques. Most of these approaches rely on structural metrics of software systems to identify affected components while others exploit historical information by analyzing co-changes occurring between code components. By relying solely on one aspect of software systems (i.e., structural or historical), existing approaches miss some precious information which limits their performances. In this paper, we propose CAME (Convolutional Analysis of code Metrics Evolution), a deep-learning based approach that relies on both structural and historical information to detect anti-patterns. Our approach exploits historical values of structural code metrics mined from version control systems and uses a Convolutional Neural Network classifier to infer the presence of anti-patterns from this information. We experiment our approach for the widely know God Class anti-pattern and evaluate its performances on three software systems. With the results of our study, we show that: (1) using historical values of source code metrics allows to increase the precision; (2) CAME outperforms existing static machine-learning classifiers; and (3) CAME outperforms existing detection tools.
反模式是反复出现的设计问题的糟糕解决方案。大量的实证研究强调了反模式对软件维护的负面影响,这推动了各种检测技术的发展。这些方法中的大多数依赖于软件系统的结构度量来识别受影响的组件,而其他方法则通过分析代码组件之间发生的共同更改来利用历史信息。由于仅仅依赖于软件系统的一个方面(即,结构的或历史的),现有的方法错过了一些宝贵的信息,从而限制了它们的性能。在本文中,我们提出了卷积分析代码度量进化(CAME),这是一种基于深度学习的方法,依赖于结构和历史信息来检测反模式。我们的方法利用从版本控制系统中挖掘的结构代码度量的历史值,并使用卷积神经网络分类器从该信息中推断反模式的存在。我们对广为人知的God Class反模式进行了实验,并在三个软件系统上评估了它的性能。研究结果表明:(1)使用源代码度量的历史值可以提高精度;(2) CAME优于现有的静态机器学习分类器;(3) CAME优于现有的检测工具。
{"title":"Deep Learning Anti-Patterns from Code Metrics History","authors":"Antoine Barbez, Foutse Khomh, Yann-Gaël Guéhéneuc","doi":"10.1109/ICSME.2019.00021","DOIUrl":"https://doi.org/10.1109/ICSME.2019.00021","url":null,"abstract":"Anti-patterns are poor solutions to recurring design problems. Number of empirical studies have highlighted the negative impact of anti-patterns on software maintenance which motivated the development of various detection techniques. Most of these approaches rely on structural metrics of software systems to identify affected components while others exploit historical information by analyzing co-changes occurring between code components. By relying solely on one aspect of software systems (i.e., structural or historical), existing approaches miss some precious information which limits their performances. In this paper, we propose CAME (Convolutional Analysis of code Metrics Evolution), a deep-learning based approach that relies on both structural and historical information to detect anti-patterns. Our approach exploits historical values of structural code metrics mined from version control systems and uses a Convolutional Neural Network classifier to infer the presence of anti-patterns from this information. We experiment our approach for the widely know God Class anti-pattern and evaluate its performances on three software systems. With the results of our study, we show that: (1) using historical values of source code metrics allows to increase the precision; (2) CAME outperforms existing static machine-learning classifiers; and (3) CAME outperforms existing detection tools.","PeriodicalId":106748,"journal":{"name":"2019 IEEE International Conference on Software Maintenance and Evolution (ICSME)","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2019-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126716431","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 13
Continuous Collateral Privacy Risk Auditing of Evolving Autonomous Driving Software 不断发展的自动驾驶软件的连续附带隐私风险审计
Pub Date : 2019-09-01 DOI: 10.1109/ICSME.2019.00055
Chang Liu, Krerkkiat Chusap, Zhongen Li, Zhaojie Chen, Dylan Rogers, Fanghao Song
Autonomous driving systems have a rich and diverse set of sensors and collect a tremendous amount of data during their operations. This has significant implications for individual privacy and induces a new type of potential privacy risks - collateral privacy risks. It is important for the public and the developer community to be aware of the collateral privacy risk posed by current autonomous driving software systems. We performed data privacy analysis for the Apollo project, an open-source autonomous driving software system. We applied source code-based privacy auditing techniques tailored for this particular problem and produced preliminary results, although there were unresolved open issues remaining. As we performed auditing, Apollo was upgraded from version 3.0 to 3.5 with significant under-the-hood technology changes. It was a challenge to perform the analysis as the underlying software evolves and maintain a result that is up-to-date. To address this challenge, we developed and deployed a continuous source code privacy risk analysis tool to assist in the process. In this paper, we discuss our experience and lessons learned from this industrial case study.
自动驾驶系统拥有丰富多样的传感器,并在运行过程中收集大量数据。这对个人隐私产生了重大影响,并引发了一种新的潜在隐私风险——附带隐私风险。公众和开发者社区必须意识到当前自动驾驶软件系统带来的附带隐私风险。我们为阿波罗项目进行了数据隐私分析,这是一个开源的自动驾驶软件系统。我们应用了针对这个特定问题定制的基于源代码的隐私审计技术,并产生了初步结果,尽管仍然存在未解决的开放问题。当我们执行审计时,Apollo从3.0版本升级到3.5版本,并对底层技术进行了重大更改。随着底层软件的发展,执行分析并维护最新的结果是一项挑战。为了应对这一挑战,我们开发并部署了一个持续的源代码隐私风险分析工具来协助这个过程。在本文中,我们讨论了我们从这个工业案例中获得的经验和教训。
{"title":"Continuous Collateral Privacy Risk Auditing of Evolving Autonomous Driving Software","authors":"Chang Liu, Krerkkiat Chusap, Zhongen Li, Zhaojie Chen, Dylan Rogers, Fanghao Song","doi":"10.1109/ICSME.2019.00055","DOIUrl":"https://doi.org/10.1109/ICSME.2019.00055","url":null,"abstract":"Autonomous driving systems have a rich and diverse set of sensors and collect a tremendous amount of data during their operations. This has significant implications for individual privacy and induces a new type of potential privacy risks - collateral privacy risks. It is important for the public and the developer community to be aware of the collateral privacy risk posed by current autonomous driving software systems. We performed data privacy analysis for the Apollo project, an open-source autonomous driving software system. We applied source code-based privacy auditing techniques tailored for this particular problem and produced preliminary results, although there were unresolved open issues remaining. As we performed auditing, Apollo was upgraded from version 3.0 to 3.5 with significant under-the-hood technology changes. It was a challenge to perform the analysis as the underlying software evolves and maintain a result that is up-to-date. To address this challenge, we developed and deployed a continuous source code privacy risk analysis tool to assist in the process. In this paper, we discuss our experience and lessons learned from this industrial case study.","PeriodicalId":106748,"journal":{"name":"2019 IEEE International Conference on Software Maintenance and Evolution (ICSME)","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2019-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127447652","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
Modeling the Relationship Between Identifier Name and Behavior 标识符名称和行为之间的关系建模
Pub Date : 2019-09-01 DOI: 10.1109/ICSME.2019.00062
Christian D. Newman, Anthony S Peruma, Reem S. Alsuhaibani
This paper presents the features of a model that relates the natural language found in identifiers with program semantics. The model takes advantage of part of speech information and static-analysis-based program models to understand how different types of statically-derived semantics correlates with the natural language meaning of identifiers.
本文提出了一个将标识符中的自然语言与程序语义联系起来的模型的特征。该模型利用词性信息和基于静态分析的程序模型来理解不同类型的静态派生语义如何与标识符的自然语言含义相关联。
{"title":"Modeling the Relationship Between Identifier Name and Behavior","authors":"Christian D. Newman, Anthony S Peruma, Reem S. Alsuhaibani","doi":"10.1109/ICSME.2019.00062","DOIUrl":"https://doi.org/10.1109/ICSME.2019.00062","url":null,"abstract":"This paper presents the features of a model that relates the natural language found in identifiers with program semantics. The model takes advantage of part of speech information and static-analysis-based program models to understand how different types of statically-derived semantics correlates with the natural language meaning of identifiers.","PeriodicalId":106748,"journal":{"name":"2019 IEEE International Conference on Software Maintenance and Evolution (ICSME)","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2019-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132465050","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 5
An Industrial Study on the Differences between Pre-Release and Post-Release Bugs 发布前和发布后bug差异的工业研究
Pub Date : 2019-09-01 DOI: 10.1109/ICSME.2019.00019
Renaud Rwemalika, Marinos Kintis, Mike Papadakis, Yves Le Traon, Pierre Lorrach
Software bugs constitute a frequent and common issue of software development. To deal with this problem, modern software development methodologies introduce dedicated quality assurance procedures. At the same time researchers aim at developing techniques capable of supporting the early discovery and fix of bugs. One important factor that guides such research attempts is the characteristics of software bugs and bug fixes. In this paper, we present an industrial study on the characteristics and differences between pre-release bugs, i.e. bugs detected during software development, and post-release bugs, i.e. bugs that escaped to production. Understanding such differences is of paramount importance as it will improve our understanding on the testing and debugging support that practitioners require from the research community, on the validity of the assumptions of several research techniques, and, most importantly, on the reasons why bugs escape to production. To this end, we analyze 37 industrial projects from BGL BNP Paribas and document the differences between pre-release bugs and post-release bugs. Our findings suggest that post-release bugs are more complex to fix, requiring developers to modify several source code files, written in different programming languages, and configuration files, as well. We also find that approximately 82% of the post-release bugs involve code additions and can be characterized as 'omission' bugs. Finally, we conclude the paper with a discussion on the implications of our study and provide guidance to future research directions.
软件bug是软件开发中一个常见的问题。为了解决这个问题,现代软件开发方法引入了专门的质量保证程序。与此同时,研究人员的目标是开发能够支持早期发现和修复错误的技术。指导此类研究尝试的一个重要因素是软件错误和错误修复的特征。在本文中,我们对发布前bug(即在软件开发过程中检测到的bug)和发布后bug(即逃逸到生产中的bug)之间的特征和差异进行了工业研究。理解这些差异是至关重要的,因为它将提高我们对测试和调试支持的理解,这些支持是实践者需要从研究社区获得的,对几种研究技术假设的有效性的理解,最重要的是,对bug逃逸到生产环境的原因的理解。为此,我们分析了BGL BNP Paribas的37个工业项目,并记录了发布前bug和发布后bug之间的差异。我们的研究结果表明,发布后的bug修复起来更加复杂,需要开发人员修改几个用不同编程语言编写的源代码文件,以及配置文件。我们还发现,大约82%的发布后bug涉及代码添加,可以被描述为“遗漏”bug。最后,对本文的研究意义进行了讨论,并对未来的研究方向进行了指导。
{"title":"An Industrial Study on the Differences between Pre-Release and Post-Release Bugs","authors":"Renaud Rwemalika, Marinos Kintis, Mike Papadakis, Yves Le Traon, Pierre Lorrach","doi":"10.1109/ICSME.2019.00019","DOIUrl":"https://doi.org/10.1109/ICSME.2019.00019","url":null,"abstract":"Software bugs constitute a frequent and common issue of software development. To deal with this problem, modern software development methodologies introduce dedicated quality assurance procedures. At the same time researchers aim at developing techniques capable of supporting the early discovery and fix of bugs. One important factor that guides such research attempts is the characteristics of software bugs and bug fixes. In this paper, we present an industrial study on the characteristics and differences between pre-release bugs, i.e. bugs detected during software development, and post-release bugs, i.e. bugs that escaped to production. Understanding such differences is of paramount importance as it will improve our understanding on the testing and debugging support that practitioners require from the research community, on the validity of the assumptions of several research techniques, and, most importantly, on the reasons why bugs escape to production. To this end, we analyze 37 industrial projects from BGL BNP Paribas and document the differences between pre-release bugs and post-release bugs. Our findings suggest that post-release bugs are more complex to fix, requiring developers to modify several source code files, written in different programming languages, and configuration files, as well. We also find that approximately 82% of the post-release bugs involve code additions and can be characterized as 'omission' bugs. Finally, we conclude the paper with a discussion on the implications of our study and provide guidance to future research directions.","PeriodicalId":106748,"journal":{"name":"2019 IEEE International Conference on Software Maintenance and Evolution (ICSME)","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2019-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132506088","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 8
Automated Identification of Over-Privileged SmartThings Apps 自动识别权限过大的智能事物应用程序
Pub Date : 2019-09-01 DOI: 10.1109/ICSME.2019.00037
Atheer Abu Zaid, Manar H. Alalfi, A. Miri
The permission system in the SmartThings platform governs how apps access devices. The system was designed to protect devices from third-party apps, by forcing apps to access devices through their capabilities. Design flaws in the system result in apps being over-privileged with unauthorized capabilities. This vulnerability represents serious security challenges to this platform and its users. In this paper, we present an automated tool that can identify over-privilege vulnerability in SmartThings apps. We have identified common patterns, and we have used this knowledge to design our automated over-privilege detection tool. We have evaluated the effectiveness of our tool on 222 official and third-party apps, and we have found that approximately 5.5% of defined devices were misused with 76 identified instances of over-privilege.
SmartThings平台中的权限系统管理应用程序如何访问设备。该系统旨在通过强制应用程序通过其功能访问设备,从而保护设备免受第三方应用程序的攻击。系统中的设计缺陷导致应用程序被授予未经授权的权限。此漏洞对该平台及其用户构成了严重的安全挑战。在本文中,我们提出了一个自动化工具,可以识别智能事物应用程序中的过度特权漏洞。我们已经确定了常见的模式,并使用这些知识来设计我们的自动过度特权检测工具。我们已经对222个官方和第三方应用程序评估了我们的工具的有效性,我们发现大约5.5%的已定义设备被滥用,有76个已确定的过度特权实例。
{"title":"Automated Identification of Over-Privileged SmartThings Apps","authors":"Atheer Abu Zaid, Manar H. Alalfi, A. Miri","doi":"10.1109/ICSME.2019.00037","DOIUrl":"https://doi.org/10.1109/ICSME.2019.00037","url":null,"abstract":"The permission system in the SmartThings platform governs how apps access devices. The system was designed to protect devices from third-party apps, by forcing apps to access devices through their capabilities. Design flaws in the system result in apps being over-privileged with unauthorized capabilities. This vulnerability represents serious security challenges to this platform and its users. In this paper, we present an automated tool that can identify over-privilege vulnerability in SmartThings apps. We have identified common patterns, and we have used this knowledge to design our automated over-privilege detection tool. We have evaluated the effectiveness of our tool on 222 official and third-party apps, and we have found that approximately 5.5% of defined devices were misused with 76 identified instances of over-privilege.","PeriodicalId":106748,"journal":{"name":"2019 IEEE International Conference on Software Maintenance and Evolution (ICSME)","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2019-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128623782","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
Share, But be Aware: Security Smells in Python Gists 分享,但要警惕:Python Gists 中的安全隐患
Pub Date : 2019-09-01 DOI: 10.1109/ICSME.2019.00087
Md. Rayhanur Rahman, A. Rahman, L. Williams
Github Gist is a service provided by Github which is used by developers to share code snippets. While sharing, developers may inadvertently introduce security smells in code snippets as well, such as hard-coded passwords. Security smells are recurrent coding patterns that are indicative of security weaknesses, which could potentially lead to security breaches. The goal of this paper is to help software practitioners avoid insecure coding practices through an empirical study of security smells in publicly-available GitHub Gists. Through static analysis, we found 13 types of security smells with 4,403 occurrences in 5,822 publicly-available Python Gists. 1,817 of those Gists, which is around 31%, have at least one security smell including 689 instances of hard-coded secrets. We also found no significance relation between the presence of these security smells and the reputation of the Gist author. Based on our findings, we advocate for increased awareness and rigorous code review efforts related to software security for Github Gists so that propagation of insecure coding practices are mitigated.
Github Gist 是 Github 提供的一项服务,用于开发人员共享代码片段。在共享时,开发人员可能会无意中在代码片段中引入安全隐患,例如硬编码密码。安全漏洞是一种重复出现的编码模式,表明存在安全漏洞,有可能导致安全漏洞。本文旨在通过对公开发布的 GitHub Gists 中的安全隐患进行实证研究,帮助软件从业人员避免不安全的编码实践。通过静态分析,我们在 5,822 个公开的 Python Gist 中发现了 13 种类型的安全漏洞,共出现了 4,403 次。其中 1817 个 Gists(约占 31%)至少有一种安全隐患,包括 689 个硬编码秘密实例。我们还发现,这些安全隐患的存在与 Gist 作者的声誉之间没有显著关系。基于我们的研究结果,我们主张提高 Github Gist 的软件安全意识,并对其进行严格的代码审查,以减少不安全编码实践的传播。
{"title":"Share, But be Aware: Security Smells in Python Gists","authors":"Md. Rayhanur Rahman, A. Rahman, L. Williams","doi":"10.1109/ICSME.2019.00087","DOIUrl":"https://doi.org/10.1109/ICSME.2019.00087","url":null,"abstract":"Github Gist is a service provided by Github which is used by developers to share code snippets. While sharing, developers may inadvertently introduce security smells in code snippets as well, such as hard-coded passwords. Security smells are recurrent coding patterns that are indicative of security weaknesses, which could potentially lead to security breaches. The goal of this paper is to help software practitioners avoid insecure coding practices through an empirical study of security smells in publicly-available GitHub Gists. Through static analysis, we found 13 types of security smells with 4,403 occurrences in 5,822 publicly-available Python Gists. 1,817 of those Gists, which is around 31%, have at least one security smell including 689 instances of hard-coded secrets. We also found no significance relation between the presence of these security smells and the reputation of the Gist author. Based on our findings, we advocate for increased awareness and rigorous code review efforts related to software security for Github Gists so that propagation of insecure coding practices are mitigated.","PeriodicalId":106748,"journal":{"name":"2019 IEEE International Conference on Software Maintenance and Evolution (ICSME)","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2019-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133005657","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 16
[Copyright notice] (版权)
Pub Date : 2019-09-01 DOI: 10.1109/icsme.2019.00003
{"title":"[Copyright notice]","authors":"","doi":"10.1109/icsme.2019.00003","DOIUrl":"https://doi.org/10.1109/icsme.2019.00003","url":null,"abstract":"","PeriodicalId":106748,"journal":{"name":"2019 IEEE International Conference on Software Maintenance and Evolution (ICSME)","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2019-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122445834","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Supporting Software Architecture Maintenance by Providing Task-Specific Recommendations 通过提供特定于任务的建议来支持软件架构维护
Pub Date : 2019-09-01 DOI: 10.1109/ICSME.2019.00060
M. Galster, Christoph Treude, Kelly Blincoe
During software maintenance, developers have different information needs (e.g., to understand what type of maintenance activity to perform, the impact of a maintenance activity and its effort). However, information to support developers may be distributed across various sources. Furthermore, information captured in formal architecture documentation may be outdated. In this paper, we put forward a late breaking idea and outline a solution to improve the productivity of developers by providing task-specific recommendations based on concrete information needs that arise during software maintenance.
在软件维护期间,开发人员有不同的信息需求(例如,了解要执行的维护活动的类型,维护活动及其工作的影响)。然而,支持开发人员的信息可能分布在不同的来源。此外,在正式的体系结构文档中捕获的信息可能已经过时。在本文中,我们提出了一个突破性的想法,并概述了一个解决方案,通过提供基于软件维护期间出现的具体信息需求的特定于任务的建议来提高开发人员的生产力。
{"title":"Supporting Software Architecture Maintenance by Providing Task-Specific Recommendations","authors":"M. Galster, Christoph Treude, Kelly Blincoe","doi":"10.1109/ICSME.2019.00060","DOIUrl":"https://doi.org/10.1109/ICSME.2019.00060","url":null,"abstract":"During software maintenance, developers have different information needs (e.g., to understand what type of maintenance activity to perform, the impact of a maintenance activity and its effort). However, information to support developers may be distributed across various sources. Furthermore, information captured in formal architecture documentation may be outdated. In this paper, we put forward a late breaking idea and outline a solution to improve the productivity of developers by providing task-specific recommendations based on concrete information needs that arise during software maintenance.","PeriodicalId":106748,"journal":{"name":"2019 IEEE International Conference on Software Maintenance and Evolution (ICSME)","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2019-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129170798","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
期刊
2019 IEEE International Conference on Software Maintenance and Evolution (ICSME)
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1