首页 > 最新文献

2019 IEEE/ACM 41st International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)最新文献

英文 中文
(Do Not) Trust in Ecosystems (不要)相信生态系统
Emilia Cioroaica, T. Kuhn, Barbora Buhnova
In the context of Smart Ecosystems, systems engage in dynamic cooperation with other systems to achieve their goals. Expedient operation is only possible when all systems cooperate as expected. This requires a level of trust between the components of the ecosystem. New systems that join the ecosystem therefore first need to build up a level of trust. Humans derive trust from behavioral reputation in key situations. In Smart Ecosystems (SES), the reputation of a system or system component can also be based on observation of its behavior. In this paper, we introduce a method and a test platform that support virtual evaluation of decisions at runtime, thereby supporting trust building within SES. The key idea behind the platform is that it employs and evaluates Digital Twins, which are executable models of system components, to learn about component behavior in observed situations. The trust in the Digital Twin then builds up over time based on the behavioral compliance of the real system component with its Digital Twin. In this paper, we use the context of automotive ecosystems and examine the concepts for building up reputation on control algorithms of smart agents dynamically downloaded at runtime to individual autonomous vehicles within the ecosystem.
在智能生态系统的背景下,系统与其他系统进行动态合作以实现其目标。只有当所有系统按预期合作时,权宜操作才有可能。这需要在生态系统的组件之间建立一定程度的信任。因此,加入生态系统的新系统首先需要建立一定程度的信任。在关键情况下,人类从行为声誉中获得信任。在智能生态系统(SES)中,系统或系统组件的声誉也可以基于对其行为的观察。在本文中,我们介绍了一种支持在运行时对决策进行虚拟评估的方法和测试平台,从而支持在SES中建立信任。该平台背后的关键思想是,它采用并评估系统组件的可执行模型Digital Twins,以了解观察到的情况下的组件行为。然后,基于真实系统组件与其数字孪生的行为遵从性,对数字孪生的信任随着时间的推移而建立起来。在本文中,我们使用汽车生态系统的背景,并研究了在运行时动态下载到生态系统内各个自动驾驶汽车的智能代理控制算法上建立声誉的概念。
{"title":"(Do Not) Trust in Ecosystems","authors":"Emilia Cioroaica, T. Kuhn, Barbora Buhnova","doi":"10.1109/ICSE-NIER.2019.00011","DOIUrl":"https://doi.org/10.1109/ICSE-NIER.2019.00011","url":null,"abstract":"In the context of Smart Ecosystems, systems engage in dynamic cooperation with other systems to achieve their goals. Expedient operation is only possible when all systems cooperate as expected. This requires a level of trust between the components of the ecosystem. New systems that join the ecosystem therefore first need to build up a level of trust. Humans derive trust from behavioral reputation in key situations. In Smart Ecosystems (SES), the reputation of a system or system component can also be based on observation of its behavior. In this paper, we introduce a method and a test platform that support virtual evaluation of decisions at runtime, thereby supporting trust building within SES. The key idea behind the platform is that it employs and evaluates Digital Twins, which are executable models of system components, to learn about component behavior in observed situations. The trust in the Digital Twin then builds up over time based on the behavioral compliance of the real system component with its Digital Twin. In this paper, we use the context of automotive ecosystems and examine the concepts for building up reputation on control algorithms of smart agents dynamically downloaded at runtime to individual autonomous vehicles within the ecosystem.","PeriodicalId":180082,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2019-05-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127236283","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 26
Mining Plausible Hypotheses from the Literature Via Meta-Analysis 通过元分析从文献中挖掘可信的假设
Jooyong Yi, Vladimir Ivanov, G. Succi
Meta-analysis is highly advocated in many fields of empirical research such as medicine and psychology, due to its capability to synthesize quantitative evidence of effects from the literature, based on statistical analysis. However, the adoption of meta-analysis to software engineering is still suffering from inertia, despite the fact that many software engineering researchers have long been arguing the need for it. As an attempt to move beyond the lockstep, we in this paper explore a different use of meta-analysis. Our proposition is that meta-analysis is useful for mining hypotheses because their plausibility is backed by evidence accumulated in the literature, and thus researchers could focus their effort on the areas that are of particular need. We assess our proposition by conducting a lightweight case study on the literature of defect prediction. We found that three out of five hypotheses we extract from our meta-analysis were indeed investigated in separate papers, indicating the usefulness of our approach. We also recognize two uninvestigated hypotheses whose validity we plan to investigate in the future.
meta分析在医学、心理学等实证研究领域备受推崇,因为它能够在统计分析的基础上,从文献中合成定量证据。然而,在软件工程中采用元分析仍然受到惯性的影响,尽管许多软件工程研究人员长期以来一直在争论它的必要性。作为一种超越同步的尝试,我们在本文中探索了元分析的不同用途。我们的主张是,元分析对于挖掘假设是有用的,因为它们的合理性得到了文献中积累的证据的支持,因此研究人员可以将他们的努力集中在特别需要的领域。我们通过对缺陷预测文献进行轻量级案例研究来评估我们的命题。我们发现,我们从meta分析中提取的五个假设中有三个确实在单独的论文中进行了研究,这表明我们的方法是有用的。我们也承认两个未经调查的假设,我们计划在未来调查其有效性。
{"title":"Mining Plausible Hypotheses from the Literature Via Meta-Analysis","authors":"Jooyong Yi, Vladimir Ivanov, G. Succi","doi":"10.1109/ICSE-NIER.2019.00017","DOIUrl":"https://doi.org/10.1109/ICSE-NIER.2019.00017","url":null,"abstract":"Meta-analysis is highly advocated in many fields of empirical research such as medicine and psychology, due to its capability to synthesize quantitative evidence of effects from the literature, based on statistical analysis. However, the adoption of meta-analysis to software engineering is still suffering from inertia, despite the fact that many software engineering researchers have long been arguing the need for it. As an attempt to move beyond the lockstep, we in this paper explore a different use of meta-analysis. Our proposition is that meta-analysis is useful for mining hypotheses because their plausibility is backed by evidence accumulated in the literature, and thus researchers could focus their effort on the areas that are of particular need. We assess our proposition by conducting a lightweight case study on the literature of defect prediction. We found that three out of five hypotheses we extract from our meta-analysis were indeed investigated in separate papers, indicating the usefulness of our approach. We also recognize two uninvestigated hypotheses whose validity we plan to investigate in the future.","PeriodicalId":180082,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2019-05-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126580773","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
API Fluency API流利
R. Robbes, M. Lungu, Andrea Janes
Application Programming Interfaces (APIs) are critical to improve developer productivity: developers can reuse a significant amount of functionality instead of writing it themselves. The flip side of API popularity is that APIs are large and numerous: developers often spend significant time searching for the functionality they need. Worse, they may not even be aware that an API exists for a given task and thus waste time reinventing the wheel. We argue for API fluency: the ability for developers to internalize how an API is used. The more developers have internalized the APIs they need, the more productive they can become. We propose an approach to improve API fluency, relying on spaced repetition of recommended API elements.
应用程序编程接口(api)对于提高开发人员的生产力至关重要:开发人员可以重用大量的功能,而不是自己编写功能。API流行的另一面是API庞大且数量众多:开发人员经常花费大量时间搜索他们需要的功能。更糟糕的是,他们甚至可能不知道给定任务存在API,从而浪费时间重新发明轮子。我们支持API流畅性:开发人员内化API使用方式的能力。开发人员内部化他们需要的api越多,他们的生产力就越高。我们提出了一种提高API流畅性的方法,依赖于推荐的API元素的间隔重复。
{"title":"API Fluency","authors":"R. Robbes, M. Lungu, Andrea Janes","doi":"10.1109/ICSE-NIER.2019.00033","DOIUrl":"https://doi.org/10.1109/ICSE-NIER.2019.00033","url":null,"abstract":"Application Programming Interfaces (APIs) are critical to improve developer productivity: developers can reuse a significant amount of functionality instead of writing it themselves. The flip side of API popularity is that APIs are large and numerous: developers often spend significant time searching for the functionality they need. Worse, they may not even be aware that an API exists for a given task and thus waste time reinventing the wheel. We argue for API fluency: the ability for developers to internalize how an API is used. The more developers have internalized the APIs they need, the more productive they can become. We propose an approach to improve API fluency, relying on spaced repetition of recommended API elements.","PeriodicalId":180082,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2019-05-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133675371","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 4
Navigation-Aware and Personalized Prefetching of Network Requests in Android Apps Android应用中导航感知和个性化的网络请求预取
I. Malavolta, Francesco Nocera, P. Lago, M. Mongiello
Prefetching network requests has been advocated as a highly effective way of reducing network latency experienced by the user since it allows network responses to be generated immediately from a local cache. In this paper we discuss how user navigation patterns can be used for developing navigation-aware techniques for personalized prefetching of network requests of Android apps. The proposed idea opens for a new family of prefetching opportunities since it focusses at a higher level of abstraction with respect to state-of-the-art approaches for network requests prefetching. The proposed idea allows the development of approaches which adapt their prefetching behaviour according to the unique navigation patterns each user exhibits while interacting with a mobile app.
预取网络请求被认为是减少用户网络延迟的一种非常有效的方法,因为它允许立即从本地缓存生成网络响应。在本文中,我们讨论了如何使用用户导航模式来开发导航感知技术,以个性化地预取Android应用程序的网络请求。所提出的想法为一系列新的预取机会打开了大门,因为它关注的是相对于最先进的网络请求预取方法的更高抽象级别。所提出的想法允许开发方法,根据每个用户在与移动应用程序交互时展示的独特导航模式来调整其预取行为。
{"title":"Navigation-Aware and Personalized Prefetching of Network Requests in Android Apps","authors":"I. Malavolta, Francesco Nocera, P. Lago, M. Mongiello","doi":"10.1109/ICSE-NIER.2019.00013","DOIUrl":"https://doi.org/10.1109/ICSE-NIER.2019.00013","url":null,"abstract":"Prefetching network requests has been advocated as a highly effective way of reducing network latency experienced by the user since it allows network responses to be generated immediately from a local cache. In this paper we discuss how user navigation patterns can be used for developing navigation-aware techniques for personalized prefetching of network requests of Android apps. The proposed idea opens for a new family of prefetching opportunities since it focusses at a higher level of abstraction with respect to state-of-the-art approaches for network requests prefetching. The proposed idea allows the development of approaches which adapt their prefetching behaviour according to the unique navigation patterns each user exhibits while interacting with a mobile app.","PeriodicalId":180082,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2019-05-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124667945","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 4
Conditional Compilation is Dead, Long Live Conditional Compilation! 条件编译已死,条件编译万岁!
Paul Gazzillo, Shiyi Wei
Highly-configurable systems written in C form our most critical computing infrastructure. The preprocessor is integral to C, because conditional compilation enables such systems to produce efficient object code. However, the preprocessor makes code harder to reason about for both humans and tools. Previous approaches to this challenge developed new program analyses for unpreprocessed source code or developed new languages and constructs to replace the preprocessor. But having special-purpose analyses means maintaining a new toolchain, while new languages face adoption challenges and do not help with existing software. We propose the best of worlds: eliminate the preprocessor but preserve its benefits. Our design replaces preprocessor usage with C itself, augmented with syntax-preserving, backwards-compatible dependent types. We discuss automated conditional compilation to replicate preprocessor performance. Our approach opens new directions for research into new compiler optimizations, dependent types for configurable software, and automated translation away from preprocessor use.
用C语言编写的高度可配置系统构成了我们最关键的计算基础设施。预处理器是C语言不可或缺的一部分,因为条件编译使这样的系统能够产生高效的目标代码。然而,预处理器使代码对人和工具来说都更难以推理。之前解决这一挑战的方法为未预处理的源代码开发了新的程序分析,或者开发了新的语言和结构来取代预处理器。但是,有特殊目的的分析意味着维护一个新的工具链,而新的语言面临着采用的挑战,并且对现有的软件没有帮助。我们的建议是两全其美:取消预处理器,但保留其优点。我们的设计用C本身取代了预处理器的使用,增强了保留语法、向后兼容的依赖类型。我们讨论了自动条件编译来复制预处理器的性能。我们的方法为研究新的编译器优化、可配置软件的依赖类型以及不使用预处理器的自动翻译开辟了新的方向。
{"title":"Conditional Compilation is Dead, Long Live Conditional Compilation!","authors":"Paul Gazzillo, Shiyi Wei","doi":"10.1109/ICSE-NIER.2019.00035","DOIUrl":"https://doi.org/10.1109/ICSE-NIER.2019.00035","url":null,"abstract":"Highly-configurable systems written in C form our most critical computing infrastructure. The preprocessor is integral to C, because conditional compilation enables such systems to produce efficient object code. However, the preprocessor makes code harder to reason about for both humans and tools. Previous approaches to this challenge developed new program analyses for unpreprocessed source code or developed new languages and constructs to replace the preprocessor. But having special-purpose analyses means maintaining a new toolchain, while new languages face adoption challenges and do not help with existing software. We propose the best of worlds: eliminate the preprocessor but preserve its benefits. Our design replaces preprocessor usage with C itself, augmented with syntax-preserving, backwards-compatible dependent types. We discuss automated conditional compilation to replicate preprocessor performance. Our approach opens new directions for research into new compiler optimizations, dependent types for configurable software, and automated translation away from preprocessor use.","PeriodicalId":180082,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2019-05-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122105328","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
Simulator-Based Diff-Time Performance Testing 基于模拟器的差时性能测试
Ivan Postolski, V. Braberman, D. Garbervetsky, Sebastián Uchitel
We propose an approach for rapid detection of performance regressions using a simulator built from the original program by dynamic slicing and a certificate built using static analysis that generalizes its correctness. We discuss two case-studies that illustrate the potential benefits of the proposal.
我们提出了一种快速检测性能回归的方法,使用通过动态切片从原始程序构建的模拟器和使用静态分析构建的证书来推广其正确性。我们讨论了两个案例研究,说明了该提议的潜在好处。
{"title":"Simulator-Based Diff-Time Performance Testing","authors":"Ivan Postolski, V. Braberman, D. Garbervetsky, Sebastián Uchitel","doi":"10.1109/ICSE-NIER.2019.00029","DOIUrl":"https://doi.org/10.1109/ICSE-NIER.2019.00029","url":null,"abstract":"We propose an approach for rapid detection of performance regressions using a simulator built from the original program by dynamic slicing and a certificate built using static analysis that generalizes its correctness. We discuss two case-studies that illustrate the potential benefits of the proposal.","PeriodicalId":180082,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2019-05-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122435226","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
Blockchain-Based Software Engineering 基于区块链的软件工程
M. Beller, J. Hejderup
Blockchain technology has found a great number of applications, from banking to the Internet of Things (IoT). However, it has not yet been envisioned whether and which problems in Software Engineering (SE) Blockchain technology could solve. In this paper, we coin this field "Blockchain-based Software Engineering" and exemplify how Blockchain technology could solve two core SE problems: Continuous Integration (CI) Services such as Travis CI and Package Managers such as apt-get. We believe that Blockchain technology could help (1) democratize and professionalize Software Engineering infrastructure that currently relies on free work done by few volunteers, (2) improve the quality of artifacts and services, and (3) increase trust in ubiquitously used systems like GitHub or Travis CI.
区块链技术已经找到了大量的应用,从银行到物联网(IoT)。然而,目前还没有人设想区块链技术是否可以解决软件工程(SE)中的哪些问题。在本文中,我们创造了这个领域“基于区块链的软件工程”,并举例说明了区块链技术如何解决两个核心SE问题:持续集成(CI)服务,如Travis CI和包管理器,如apt-get。我们相信区块链技术可以帮助(1)实现软件工程基础设施的民主化和专业化,这些基础设施目前依赖于少数志愿者的免费工作,(2)提高工件和服务的质量,(3)增加对GitHub或Travis CI等普遍使用的系统的信任。
{"title":"Blockchain-Based Software Engineering","authors":"M. Beller, J. Hejderup","doi":"10.1109/ICSE-NIER.2019.00022","DOIUrl":"https://doi.org/10.1109/ICSE-NIER.2019.00022","url":null,"abstract":"Blockchain technology has found a great number of applications, from banking to the Internet of Things (IoT). However, it has not yet been envisioned whether and which problems in Software Engineering (SE) Blockchain technology could solve. In this paper, we coin this field \"Blockchain-based Software Engineering\" and exemplify how Blockchain technology could solve two core SE problems: Continuous Integration (CI) Services such as Travis CI and Package Managers such as apt-get. We believe that Blockchain technology could help (1) democratize and professionalize Software Engineering infrastructure that currently relies on free work done by few volunteers, (2) improve the quality of artifacts and services, and (3) increase trust in ubiquitously used systems like GitHub or Travis CI.","PeriodicalId":180082,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2019-05-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123425533","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 18
Towards a Systematic Study of Values in SE: Tools for Industry and Education 面向SE价值的系统研究:工业和教育的工具
E. Winter, S. Forshaw, Lucy Hunt, M. Ferrario
This paper reports on the development of ongoing research into the systematic study of human values in software engineering (SE). Firstly, we outline the rationale for this work, highlighting the significance of human values in SE and the need for both a more structured approach to their study and tools to support their articulation in the SE domain. We then explain our theoretical framework, which draws on social psychology research on values. Secondly, we introduce tools designed in line with this framework and the context of their use so far. Our tools adopt a variety of research methods, including structured mixed-method techniques, such as the 'Values Q-Sort' (V-QS), and more open design-based methods, such as the 'Values Probes'. Given the multi-faceted nature of the topic, we argue that a combination of qualitative, quantitative and design thinking techniques is a necessary step for the study of human values in SE; and that these methods should be both a) robust and replicable, and b) creative and provocative. Finally, we highlight the potential applications of our tools in SE industry and education.
本文报道了软件工程(SE)中对人的价值进行系统研究的进展。首先,我们概述了这项工作的基本原理,强调了人的价值在SE中的重要性,以及需要一种更结构化的研究方法和工具来支持他们在SE领域的表达。然后,我们解释了我们的理论框架,它借鉴了社会心理学对价值观的研究。其次,我们介绍了根据该框架设计的工具以及迄今为止它们的使用背景。我们的工具采用多种研究方法,包括结构化混合方法技术,如“值q排序”(V-QS),以及更开放的基于设计的方法,如“值探测”。鉴于这一主题的多面性,我们认为定性、定量和设计思维技术的结合是研究SE中人的价值的必要步骤;这些方法应该是a)稳健和可复制的,b)创造性和挑衅性的。最后,我们强调了我们的工具在SE工业和教育中的潜在应用。
{"title":"Towards a Systematic Study of Values in SE: Tools for Industry and Education","authors":"E. Winter, S. Forshaw, Lucy Hunt, M. Ferrario","doi":"10.1109/ICSE-NIER.2019.00024","DOIUrl":"https://doi.org/10.1109/ICSE-NIER.2019.00024","url":null,"abstract":"This paper reports on the development of ongoing research into the systematic study of human values in software engineering (SE). Firstly, we outline the rationale for this work, highlighting the significance of human values in SE and the need for both a more structured approach to their study and tools to support their articulation in the SE domain. We then explain our theoretical framework, which draws on social psychology research on values. Secondly, we introduce tools designed in line with this framework and the context of their use so far. Our tools adopt a variety of research methods, including structured mixed-method techniques, such as the 'Values Q-Sort' (V-QS), and more open design-based methods, such as the 'Values Probes'. Given the multi-faceted nature of the topic, we argue that a combination of qualitative, quantitative and design thinking techniques is a necessary step for the study of human values in SE; and that these methods should be both a) robust and replicable, and b) creative and provocative. Finally, we highlight the potential applications of our tools in SE industry and education.","PeriodicalId":180082,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2019-05-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122839880","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 7
VULTRON: Catching Vulnerable Smart Contracts Once and for All VULTRON:一劳永逸地抓住脆弱的智能合约
Haijun Wang, Yi Li, Shang-Wei Lin, Lei Ma, Yang Liu
Despite the high stakes involved, smart contracts are often developed in an undisciplined way thus far. The existence of vulnerabilities compromises the security and reliability of smart contracts, and endangers the trust of participants in their ongoing businesses. Existing vulnerability detection techniques are often designed case-by-case, making them difficult to generalize. In this paper, we design general principles for detecting vulnerable smart contracts. Our key insight is that almost all the existing transaction-related vulnerabilities are due to the mismatch between the actual transferred amount and the amount reflected on the contract's internal bookkeeping. Based on this, we propose a precise and generally applicable technique, VULTRON, which can detect irregular transactions due to various types of adversarial exploits. We also report preliminary results applying our technique to real-world case studies.
尽管涉及高风险,但迄今为止,智能合约的开发往往不受约束。漏洞的存在损害了智能合约的安全性和可靠性,并危及参与者对其正在进行的业务的信任。现有的漏洞检测技术通常是逐案设计的,这使得它们难以推广。在本文中,我们设计了检测脆弱智能合约的一般原则。我们的关键见解是,几乎所有现有的与交易相关的漏洞都是由于实际转账金额与合同内部记账反映的金额之间的不匹配。在此基础上,我们提出了一种精确且普遍适用的技术——VULTRON,它可以检测到由于各种类型的对抗性攻击而导致的不规则交易。我们还报告了将我们的技术应用于现实世界案例研究的初步结果。
{"title":"VULTRON: Catching Vulnerable Smart Contracts Once and for All","authors":"Haijun Wang, Yi Li, Shang-Wei Lin, Lei Ma, Yang Liu","doi":"10.1109/ICSE-NIER.2019.00009","DOIUrl":"https://doi.org/10.1109/ICSE-NIER.2019.00009","url":null,"abstract":"Despite the high stakes involved, smart contracts are often developed in an undisciplined way thus far. The existence of vulnerabilities compromises the security and reliability of smart contracts, and endangers the trust of participants in their ongoing businesses. Existing vulnerability detection techniques are often designed case-by-case, making them difficult to generalize. In this paper, we design general principles for detecting vulnerable smart contracts. Our key insight is that almost all the existing transaction-related vulnerabilities are due to the mismatch between the actual transferred amount and the amount reflected on the contract's internal bookkeeping. Based on this, we propose a precise and generally applicable technique, VULTRON, which can detect irregular transactions due to various types of adversarial exploits. We also report preliminary results applying our technique to real-world case studies.","PeriodicalId":180082,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2019-05-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128857398","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 57
Detecting Suspicious Package Updates 检测可疑软件包更新
K. Garrett, G. Ferreira, Limin Jia, Joshua Sunshine, Christian Kästner
With an increased level of automation provided by package managers, which sometimes allow updates to be installed automatically, malicious package updates are becoming a real threat in software ecosystems. To address this issue, we propose an approach based on anomaly detection, to identify suspicious updates based on security-relevant features that attackers could use in an attack. We evaluate our approach in the context of Node.js/npm ecosystem, to show its feasibility in terms of reduced review effort and the correct identification of a confirmed malicious update attack. Although we do not expect it to be a complete solution in isolation, we believe it is an important security building block for software ecosystems.
随着包管理器提供的自动化程度的提高(有时允许自动安装更新),恶意包更新正在成为软件生态系统中的真正威胁。为了解决这个问题,我们提出了一种基于异常检测的方法,根据攻击者可能在攻击中使用的安全相关特性来识别可疑的更新。我们在Node.js/npm生态系统的背景下评估了我们的方法,以显示其在减少审查工作和正确识别已确认的恶意更新攻击方面的可行性。虽然我们不期望它是一个独立的完整解决方案,但我们相信它是软件生态系统的重要安全构建块。
{"title":"Detecting Suspicious Package Updates","authors":"K. Garrett, G. Ferreira, Limin Jia, Joshua Sunshine, Christian Kästner","doi":"10.1109/ICSE-NIER.2019.00012","DOIUrl":"https://doi.org/10.1109/ICSE-NIER.2019.00012","url":null,"abstract":"With an increased level of automation provided by package managers, which sometimes allow updates to be installed automatically, malicious package updates are becoming a real threat in software ecosystems. To address this issue, we propose an approach based on anomaly detection, to identify suspicious updates based on security-relevant features that attackers could use in an attack. We evaluate our approach in the context of Node.js/npm ecosystem, to show its feasibility in terms of reduced review effort and the correct identification of a confirmed malicious update attack. Although we do not expect it to be a complete solution in isolation, we believe it is an important security building block for software ecosystems.","PeriodicalId":180082,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2019-05-27","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130438898","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 27
期刊
2019 IEEE/ACM 41st International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1