首页 > 最新文献

Proceedings of the 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering最新文献

英文 中文
Ten years with evidence-based software engineering. What is it? Has it had any impact? What's next? 十年的循证软件工程。这是什么?有什么影响吗?接下来是什么?
M. Jørgensen
An evidence-based software engineer is one who is able to: 1) Formulate a question, related to a decision or judgment, so that it can be answered by the use of evidence, 2) Collect, critically evaluate and summarise relevant evidence from research, practice and local studies, 3) Apply the evidence, integrated with knowledge about the local context, to guide decisions and judgments. The keynote reflects on what it in practise means to be evidence-based in software engineering contexts, where the number of different contexts is high and the research-based evidence sparse, and why there is a need for more evidence-based practises. We summarise our experience from ten years of Evidence-Based Software Engineering in the context of university courses, training of software engineers and systematic literature reviews of software engineering research. While there are challenges in training people in evidence-based practise, our experience suggest that it is feasible and that the training can make an important difference in terms of quality of software engineering judgment and decisions. Based on our experience we suggest changes in how evidence-based software engineering should be presented and taught, and how we should ease the transfer of research results into evidence-based practises.
基于证据的软件工程师能够:1)提出一个与决策或判断相关的问题,以便通过使用证据来回答;2)从研究、实践和当地研究中收集、批判性地评估和总结相关证据;3)将证据与当地背景知识相结合,应用于指导决策和判断。主题反映了在软件工程环境中,在不同的环境数量很高,而基于研究的证据很少的情况下,实践中以证据为基础意味着什么,以及为什么需要更多的以证据为基础的实践。我们在大学课程、软件工程师培训和软件工程研究的系统文献综述的背景下总结了我们十年来基于证据的软件工程的经验。虽然在以证据为基础的实践中培训人员存在挑战,但我们的经验表明,这是可行的,并且培训可以在软件工程判断和决策的质量方面产生重要的差异。根据我们的经验,我们建议改变基于证据的软件工程应该如何呈现和教授,以及我们应该如何简化将研究结果转化为基于证据的实践。
{"title":"Ten years with evidence-based software engineering. What is it? Has it had any impact? What's next?","authors":"M. Jørgensen","doi":"10.1145/2635868.2684428","DOIUrl":"https://doi.org/10.1145/2635868.2684428","url":null,"abstract":"An evidence-based software engineer is one who is able to: 1) Formulate a question, related to a decision or judgment, so that it can be answered by the use of evidence, 2) Collect, critically evaluate and summarise relevant evidence from research, practice and local studies, 3) Apply the evidence, integrated with knowledge about the local context, to guide decisions and judgments. The keynote reflects on what it in practise means to be evidence-based in software engineering contexts, where the number of different contexts is high and the research-based evidence sparse, and why there is a need for more evidence-based practises. We summarise our experience from ten years of Evidence-Based Software Engineering in the context of university courses, training of software engineers and systematic literature reviews of software engineering research. While there are challenges in training people in evidence-based practise, our experience suggest that it is feasible and that the training can make an important difference in terms of quality of software engineering judgment and decisions. Based on our experience we suggest changes in how evidence-based software engineering should be presented and taught, and how we should ease the transfer of research results into evidence-based practises.","PeriodicalId":250543,"journal":{"name":"Proceedings of the 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering","volume":"95 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-11-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117212346","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Efficient runtime-enforcement techniques for policy weaving 用于策略编织的高效运行时强制技术
R. Joiner, T. Reps, S. Jha, Mohan Dhawan, V. Ganapathy
Policy weaving is a program-transformation technique that rewrites a program so that it is guaranteed to be safe with respect to a stateful security policy. It utilizes (i) static analysis to identify points in the program at which policy violations might occur, and (ii) runtime checks inserted at such points to monitor policy state and prevent violations from occurring. The promise of policy weaving stems from the possibility of blending the best aspects of static and dynamic analysis components. Therefore, a successful instantiation of policy weaving requires a careful balance and coordination between the two. In this paper, we examine the strategy of using a combination of transactional introspection and statement indirection to implement runtime enforcement in a policy-weaving system. Transactional introspection allows the state resulting from the execution of a statement to be examined and, if the policy would be violated, suppressed. Statement indirection serves as a light-weight runtime analysis that can recognize and instrument dynamically generated code that is not available to the static analysis. These techniques can be implemented via static rewriting so that all possible program executions are protected against policy violations. We describe our implementation of transactional introspection and statement indirection for policy weaving, and report experimental results that show the viability of the approach in the context of real-world JavaScript programs executing in a browser.
策略编织是一种程序转换技术,它重写程序,以保证它相对于有状态安全策略是安全的。它利用(i)静态分析来确定程序中可能发生策略违反的点,以及(ii)在这些点插入的运行时检查来监视策略状态并防止发生违反。策略编织的前景源于混合静态和动态分析组件的最佳方面的可能性。因此,策略编织的成功实例需要在两者之间进行仔细的平衡和协调。在本文中,我们研究了在策略编织系统中使用事务自省和语句间接的组合来实现运行时强制的策略。事务自省允许检查语句执行所产生的状态,如果违反了策略,则将其抑制。语句间接充当轻量级运行时分析,可以识别和检测静态分析不可用的动态生成的代码。这些技术可以通过静态重写来实现,这样所有可能的程序执行都不会违反策略。我们描述了用于策略编织的事务内省和语句间接实现,并报告了实验结果,这些结果显示了该方法在浏览器中执行的真实JavaScript程序上下文中的可行性。
{"title":"Efficient runtime-enforcement techniques for policy weaving","authors":"R. Joiner, T. Reps, S. Jha, Mohan Dhawan, V. Ganapathy","doi":"10.1145/2635868.2635907","DOIUrl":"https://doi.org/10.1145/2635868.2635907","url":null,"abstract":"Policy weaving is a program-transformation technique that rewrites a program so that it is guaranteed to be safe with respect to a stateful security policy. It utilizes (i) static analysis to identify points in the program at which policy violations might occur, and (ii) runtime checks inserted at such points to monitor policy state and prevent violations from occurring. The promise of policy weaving stems from the possibility of blending the best aspects of static and dynamic analysis components. Therefore, a successful instantiation of policy weaving requires a careful balance and coordination between the two. In this paper, we examine the strategy of using a combination of transactional introspection and statement indirection to implement runtime enforcement in a policy-weaving system. Transactional introspection allows the state resulting from the execution of a statement to be examined and, if the policy would be violated, suppressed. Statement indirection serves as a light-weight runtime analysis that can recognize and instrument dynamically generated code that is not available to the static analysis. These techniques can be implemented via static rewriting so that all possible program executions are protected against policy violations. We describe our implementation of transactional introspection and statement indirection for policy weaving, and report experimental results that show the viability of the approach in the context of real-world JavaScript programs executing in a browser.","PeriodicalId":250543,"journal":{"name":"Proceedings of the 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering","volume":"241-244 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-11-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121583045","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 7
Identifying the characteristics of vulnerable code changes: an empirical study 识别易受攻击代码更改的特征:一项实证研究
Amiangshu Bosu, Jeffrey C. Carver, M. Hafiz, Patrick Hilley, Derek Janni
To focus the efforts of security experts, the goals of this empirical study are to analyze which security vulnerabilities can be discovered by code review, identify characteristics of vulnerable code changes, and identify characteristics of developers likely to introduce vulnerabilities. Using a three-stage manual and automated process, we analyzed 267,046 code review requests from 10 open source projects and identified 413 Vulnerable Code Changes (VCC). Some key results include: (1) code review can identify common types of vulnerabilities; (2) while more experienced contributors authored the majority of the VCCs, the less experienced contributors' changes were 1.8 to 24 times more likely to be vulnerable; (3) the likelihood of a vulnerability increases with the number of lines changed, and (4) modified files are more likely to contain vulnerabilities than new files. Knowing which code changes are more prone to contain vulnerabilities may allow a security expert to concentrate on a smaller subset of submitted code changes. Moreover, we recommend that projects should: (a) create or adapt secure coding guidelines, (b) create a dedicated security review team, (c) ensure detailed comments during review to help knowledge dissemination, and (d) encourage developers to make small, incremental changes rather than large changes.
为了集中安全专家的工作,本实证研究的目标是分析哪些安全漏洞可以通过代码审查发现,识别易受攻击的代码更改的特征,以及识别可能引入漏洞的开发人员的特征。使用手动和自动化的三阶段流程,我们分析了来自10个开源项目的267,046个代码审查请求,并确定了413个易受攻击的代码更改(VCC)。一些关键结果包括:(1)代码审查可以识别常见的漏洞类型;(2)虽然经验丰富的贡献者撰写了大部分vcc,但经验不足的贡献者的变更易受攻击的可能性是其1.8 ~ 24倍;(3)漏洞的可能性随着修改行数的增加而增加;(4)修改后的文件比新文件更容易包含漏洞。了解哪些代码更改更容易包含漏洞,可以让安全专家专注于提交的代码更改的较小子集。此外,我们建议项目应该:(a)创建或适应安全编码指南,(b)创建一个专门的安全审查小组,(c)确保在审查期间提供详细的评论,以帮助知识传播,以及(d)鼓励开发人员进行小的、渐进的更改,而不是大的更改。
{"title":"Identifying the characteristics of vulnerable code changes: an empirical study","authors":"Amiangshu Bosu, Jeffrey C. Carver, M. Hafiz, Patrick Hilley, Derek Janni","doi":"10.1145/2635868.2635880","DOIUrl":"https://doi.org/10.1145/2635868.2635880","url":null,"abstract":"To focus the efforts of security experts, the goals of this empirical study are to analyze which security vulnerabilities can be discovered by code review, identify characteristics of vulnerable code changes, and identify characteristics of developers likely to introduce vulnerabilities. Using a three-stage manual and automated process, we analyzed 267,046 code review requests from 10 open source projects and identified 413 Vulnerable Code Changes (VCC). Some key results include: (1) code review can identify common types of vulnerabilities; (2) while more experienced contributors authored the majority of the VCCs, the less experienced contributors' changes were 1.8 to 24 times more likely to be vulnerable; (3) the likelihood of a vulnerability increases with the number of lines changed, and (4) modified files are more likely to contain vulnerabilities than new files. Knowing which code changes are more prone to contain vulnerabilities may allow a security expert to concentrate on a smaller subset of submitted code changes. Moreover, we recommend that projects should: (a) create or adapt secure coding guidelines, (b) create a dedicated security review team, (c) ensure detailed comments during review to help knowledge dissemination, and (d) encourage developers to make small, incremental changes rather than large changes.","PeriodicalId":250543,"journal":{"name":"Proceedings of the 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering","volume":"2 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-11-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122999988","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 101
Software maintenance like maintenance in other engineering disciplines 软件维护就像其他工程学科的维护一样
G. Villavicencio
abstract Software maintenance exhibits many differences regarding how other engineering disciplines carry out maintenance on their artifacts. Such dissimilarity is caused due to the fact that it is easy to get a copy from the original artifact to be used in maintenance, and also because the flat dimension of the software text facilitates access to the components by simply using a text editor. Other engineering disciplines resort to different artifact versions (obtained by dissassembling) where the introduction of modifications (previous comprehension) is easier. After which the artifact is reassembled. In software engineering this approach can be simulated by combining program transformation techniques, search-based software engineering technology and design attributes. %%This easiness (absent in the other engineering sciences) as well as the intangible software nature can lead to the belief %%that a software maintenance model similar to those of the other engineering sciences is unnecessary or unfeasible. %%This paper states the opposite, and as a consequence, an entirely new and more robust software maintenance model emerges. abstract
关于其他工程学科如何对其工件进行维护,软件维护表现出许多不同之处。这种不同是由于从原始工件中获得用于维护的副本很容易,而且还因为软件文本的平面尺寸便于通过简单地使用文本编辑器访问组件而引起的。其他工程规程诉诸于不同的工件版本(通过拆卸获得),其中引入修改(先前的理解)更容易。之后,工件被重新组装。在软件工程中,可以通过结合程序转换技术、基于搜索的软件工程技术和设计属性来模拟这种方法。这种简单性(在其他工程科学中不存在)以及软件的无形性可能导致这样的信念,即类似于其他工程科学的软件维护模型是不必要的或不可行的。本文提出了相反的观点,因此,出现了一个全新的、更健壮的软件维护模型。摘要
{"title":"Software maintenance like maintenance in other engineering disciplines","authors":"G. Villavicencio","doi":"10.1145/2635868.2666613","DOIUrl":"https://doi.org/10.1145/2635868.2666613","url":null,"abstract":"abstract Software maintenance exhibits many differences regarding how other engineering disciplines carry out maintenance on their artifacts. Such dissimilarity is caused due to the fact that it is easy to get a copy from the original artifact to be used in maintenance, and also because the flat dimension of the software text facilitates access to the components by simply using a text editor. Other engineering disciplines resort to different artifact versions (obtained by dissassembling) where the introduction of modifications (previous comprehension) is easier. After which the artifact is reassembled. In software engineering this approach can be simulated by combining program transformation techniques, search-based software engineering technology and design attributes. %%This easiness (absent in the other engineering sciences) as well as the intangible software nature can lead to the belief %%that a software maintenance model similar to those of the other engineering sciences is unnecessary or unfeasible. %%This paper states the opposite, and as a consequence, an entirely new and more robust software maintenance model emerges. abstract","PeriodicalId":250543,"journal":{"name":"Proceedings of the 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering","volume":"76 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-11-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127546479","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
Building call graphs for embedded client-side code in dynamic web applications 为动态web应用程序中的嵌入式客户端代码构建调用图
H. V. Nguyen, Christian Kästner, T. Nguyen
When developing and maintaining a software system, programmers often rely on IDEs to provide editor services such as syntax highlighting, auto-completion, and "jump to declaration". In dynamic web applications, such tool support is currently limited to either the server-side code or to hand-written or generated client-side code. Our goal is to build a call graph for providing editor services on client-side code while it is still embedded as string literals within server-side code. First, we symbolically execute the server-side code to identify all possible client-side code variations. Subsequently, we parse the generated client-side code with all its variations into a VarDOM that compactly represents all DOM variations for further analysis. Based on the VarDOM, we build conditional call graphs for embedded HTML, CSS, and JS. Our empirical evaluation on real-world web applications show that our analysis achieves 100% precision in identifying call-graph edges. 62% of the edges cross PHP strings, and 17% of them cross files - in both situations, navigation without tool support is tedious and error prone.
在开发和维护软件系统时,程序员通常依赖于ide来提供编辑器服务,如语法高亮显示、自动完成和“跳转到声明”。在动态web应用程序中,这种工具支持目前仅限于服务器端代码或手写或生成的客户端代码。我们的目标是构建一个调用图,用于在客户端代码上提供编辑器服务,而它仍然作为字符串文字嵌入到服务器端代码中。首先,我们象征性地执行服务器端代码,以识别所有可能的客户端代码变体。随后,我们将生成的客户端代码及其所有变体解析为一个VarDOM,该VarDOM紧凑地表示所有DOM变体,以供进一步分析。基于VarDOM,我们为嵌入的HTML、CSS和JS构建条件调用图。我们对现实世界web应用程序的经验评估表明,我们的分析在识别调用图边缘方面达到了100%的精度。62%的边与PHP字符串交叉,17%的边与文件交叉——在这两种情况下,没有工具支持的导航都是乏味且容易出错的。
{"title":"Building call graphs for embedded client-side code in dynamic web applications","authors":"H. V. Nguyen, Christian Kästner, T. Nguyen","doi":"10.1145/2635868.2635928","DOIUrl":"https://doi.org/10.1145/2635868.2635928","url":null,"abstract":"When developing and maintaining a software system, programmers often rely on IDEs to provide editor services such as syntax highlighting, auto-completion, and \"jump to declaration\". In dynamic web applications, such tool support is currently limited to either the server-side code or to hand-written or generated client-side code. Our goal is to build a call graph for providing editor services on client-side code while it is still embedded as string literals within server-side code. First, we symbolically execute the server-side code to identify all possible client-side code variations. Subsequently, we parse the generated client-side code with all its variations into a VarDOM that compactly represents all DOM variations for further analysis. Based on the VarDOM, we build conditional call graphs for embedded HTML, CSS, and JS. Our empirical evaluation on real-world web applications show that our analysis achieves 100% precision in identifying call-graph edges. 62% of the edges cross PHP strings, and 17% of them cross files - in both situations, navigation without tool support is tedious and error prone.","PeriodicalId":250543,"journal":{"name":"Proceedings of the 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering","volume":"58 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-11-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123242829","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 29
How we get there: a context-guided search strategy in concolic testing 我们如何实现这一目标:在结肠测试中使用上下文引导的搜索策略
Hyunmin Seo, Sunghun Kim
One of the biggest challenges in concolic testing, an automatic test generation technique, is its huge search space. Concolic testing generates next inputs by selecting branches from previous execution paths. However, a large number of candidate branches makes a simple exhaustive search infeasible, which often leads to poor test coverage. Several search strategies have been proposed to explore high-priority branches only. Each strategy applies different criteria to the branch selection process but most do not consider context, how we got to the branch, in the selection process. In this paper, we introduce a context-guided search (CGS) strategy. CGS looks at preceding branches in execution paths and selects a branch in a new context for the next input. We evaluate CGS with two publicly available concolic testing tools, CREST and CarFast, on six C subjects and six Java subjects. The experimental results show that CGS achieves the highest coverage of all twelve subjects and reaches a target coverage with a much smaller number of iterations on most subjects than other strategies.
作为一种自动测试生成技术,圆锥测试面临的最大挑战之一是其巨大的搜索空间。Concolic测试通过从先前的执行路径中选择分支来生成下一个输入。然而,大量的候选分支使得简单的穷举搜索不可行,这通常会导致较差的测试覆盖率。已经提出了几种搜索策略,仅用于搜索高优先级分支。每种策略在分支选择过程中应用不同的标准,但大多数策略在选择过程中都没有考虑上下文,即我们如何到达分支。本文介绍了一种上下文引导搜索(CGS)策略。CGS在执行路径中查看前面的分支,并在新的上下文中为下一个输入选择分支。我们使用CREST和CarFast两种公开可用的结肠测试工具对6名C受试者和6名Java受试者进行CGS评估。实验结果表明,CGS在所有12个主题中覆盖率最高,并且在大多数主题上的迭代次数比其他策略少得多,达到了目标覆盖率。
{"title":"How we get there: a context-guided search strategy in concolic testing","authors":"Hyunmin Seo, Sunghun Kim","doi":"10.1145/2635868.2635872","DOIUrl":"https://doi.org/10.1145/2635868.2635872","url":null,"abstract":"One of the biggest challenges in concolic testing, an automatic test generation technique, is its huge search space. Concolic testing generates next inputs by selecting branches from previous execution paths. However, a large number of candidate branches makes a simple exhaustive search infeasible, which often leads to poor test coverage. Several search strategies have been proposed to explore high-priority branches only. Each strategy applies different criteria to the branch selection process but most do not consider context, how we got to the branch, in the selection process. In this paper, we introduce a context-guided search (CGS) strategy. CGS looks at preceding branches in execution paths and selects a branch in a new context for the next input. We evaluate CGS with two publicly available concolic testing tools, CREST and CarFast, on six C subjects and six Java subjects. The experimental results show that CGS achieves the highest coverage of all twelve subjects and reaches a target coverage with a much smaller number of iterations on most subjects than other strategies.","PeriodicalId":250543,"journal":{"name":"Proceedings of the 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering","volume":"6 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-11-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121125939","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 55
Are you getting traction? tales from the tech transfer trenches (invited talk) 你有收获吗?技术转移战壕中的故事(特邀演讲)
S. Chandra
So you have developed a new software productivity tool, written an FSE or an ICSE paper about it, and are justifiably proud of your work. If you work for a company, your (curmudgeonly) manager now wants to see its “impact” on the business. This is the part where you have to convince someone else to use your shiny new tool in their day-to-day work, or ship it as a product. But you soon realize that getting traction with developers or product managers is significantly harder than the research itself. Sounds familiar? In the past several years, I have been involved in taking a variety of software productivity tools to various constituencies within a company: internal users, product teams, and service delivery teams. In this talk, I will share my experiences in interacting with these constituencies; sometimes successful experiences, but at other times not so successful ones. I will focus broadly on tools in two areas: bug finding and test automation. I will make some observations on when tech transfer works and when it stumbles.
所以你已经开发了一个新的软件生产力工具,写了一篇关于它的FSE或ICSE论文,并且有理由为你的工作感到自豪。如果你在一家公司工作,你的(脾气暴躁的)经理现在希望看到它对业务的“影响”。在这个阶段,你必须说服其他人在日常工作中使用你的新工具,或者将其作为产品发布。但你很快就会意识到,吸引开发人员或产品经理比研究本身要困难得多。听起来熟悉吗?在过去的几年中,我参与了将各种软件生产力工具应用到公司内的不同群体的工作:内部用户、产品团队和服务交付团队。在这次演讲中,我将分享我与这些选民互动的经验;有时是成功的经历,但有时则不那么成功。我将广泛地关注两个领域的工具:bug查找和测试自动化。我将对技术转移何时起作用以及何时失败进行一些观察。
{"title":"Are you getting traction? tales from the tech transfer trenches (invited talk)","authors":"S. Chandra","doi":"10.1145/2635868.2684430","DOIUrl":"https://doi.org/10.1145/2635868.2684430","url":null,"abstract":"So you have developed a new software productivity tool, written an FSE or an ICSE paper about it, and are justifiably proud of your work. If you work for a company, your (curmudgeonly) manager now wants to see its “impact” on the business. This is the part where you have to convince someone else to use your shiny new tool in their day-to-day work, or ship it as a product. But you soon realize that getting traction with developers or product managers is significantly harder than the research itself. Sounds familiar? In the past several years, I have been involved in taking a variety of software productivity tools to various constituencies within a company: internal users, product teams, and service delivery teams. In this talk, I will share my experiences in interacting with these constituencies; sometimes successful experiences, but at other times not so successful ones. I will focus broadly on tools in two areas: bug finding and test automation. I will make some observations on when tech transfer works and when it stumbles.","PeriodicalId":250543,"journal":{"name":"Proceedings of the 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering","volume":"45 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-11-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126326811","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Managing lots of models: the FaMine approach 管理大量模型:饥荒方法
David Wille
In this paper we present recent developments in reverse engineering variability for block-based data-flow models.
在本文中,我们介绍了基于块的数据流模型的逆向工程可变性的最新发展。
{"title":"Managing lots of models: the FaMine approach","authors":"David Wille","doi":"10.1145/2635868.2661681","DOIUrl":"https://doi.org/10.1145/2635868.2661681","url":null,"abstract":"In this paper we present recent developments in reverse engineering variability for block-based data-flow models.","PeriodicalId":250543,"journal":{"name":"Proceedings of the 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering","volume":"19 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-11-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127093063","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 18
ConceptCloud: a tagcloud browser for software archives ConceptCloud:用于软件存档的标签云浏览器
Gillian J. Greene, B. Fischer
ConceptCloud is an interactive browser for SVN and Git repositories. Its main novelty is the combination of an intuitive tag cloud interface with an underlying concept lattice that provides a formal structure for navigation. This combination allows users to explore repositories serendipitously, without predefined search goals and along different navigation paths. ConceptCloud can derive different lattice types for a repository and supports concurrent navigation in multiple linked tag clouds that can each be individually customized, which allows multi-faceted repository explorations.
ConceptCloud是一个用于SVN和Git存储库的交互式浏览器。它的主要新颖之处在于将直观的标记云界面与底层概念格相结合,后者为导航提供了正式的结构。这种组合允许用户在没有预定义的搜索目标和沿着不同的导航路径的情况下偶然地探索存储库。ConceptCloud可以为存储库派生不同的格类型,并支持在多个链接的标记云(每个标记云都可以单独定制)中并发导航,从而允许对存储库进行多方面的探索。
{"title":"ConceptCloud: a tagcloud browser for software archives","authors":"Gillian J. Greene, B. Fischer","doi":"10.1145/2635868.2661676","DOIUrl":"https://doi.org/10.1145/2635868.2661676","url":null,"abstract":"ConceptCloud is an interactive browser for SVN and Git repositories. Its main novelty is the combination of an intuitive tag cloud interface with an underlying concept lattice that provides a formal structure for navigation. This combination allows users to explore repositories serendipitously, without predefined search goals and along different navigation paths. ConceptCloud can derive different lattice types for a repository and supports concurrent navigation in multiple linked tag clouds that can each be individually customized, which allows multi-faceted repository explorations.","PeriodicalId":250543,"journal":{"name":"Proceedings of the 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering","volume":"81 7 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-11-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128148331","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 9
How should we measure functional sameness from program source code? an exploratory study on Java methods 我们应该如何衡量程序源代码的功能一致性?对Java方法的探索性研究
Yoshiki Higo, S. Kusumoto
Program source code is one of the main targets of software engineering research. A wide variety of research has been conducted on source code, and many studies have leveraged structural, vocabulary, and method signature similarities to measure the functional sameness of source code. In this research, we conducted an empirical study to ascertain how we should use three similarities to measure functional sameness. We used two large datasets and measured the three similarities between all the method pairs in the datasets, each of which included approximately 15 million Java method pairs. The relationships between the three similarities were analyzed to determine how we should use each to detect functionally similar code. The results of our study revealed the following. (1) Method names are not always useful for detecting functionally similar code. Only if there are a small number of methods having a given name, the methods are likely to include functionally similar code. (2) Existing file-level, method-level, and block-level clone detection techniques often miss functionally similar code generated by copy-and-paste operations between different projects. (3) In the cases we use structural similarity for detecting functionally similar code, we obtained many false positives. However, we can avoid detecting most false positives by using a vocabulary similarity in addition to a structural one. (4) Using a vocabulary similarity to detect functionally similar code is not suitable for method pairs in the same file because such method pairs use many of the same program elements such as private methods or private fields.
程序源代码是软件工程研究的主要对象之一。对源代码进行了各种各样的研究,许多研究利用结构、词汇表和方法签名的相似性来度量源代码的功能相似性。在本研究中,我们进行了一项实证研究,以确定我们应该如何使用三个相似性来衡量功能的相同。我们使用了两个大型数据集,并测量了数据集中所有方法对之间的三个相似性,每个方法对都包含大约1500万个Java方法对。分析了三种相似性之间的关系,以确定我们应该如何使用它们来检测功能相似的代码。我们的研究结果揭示了以下几点。(1)方法名对于检测功能相似的代码并不总是有用。只有当有少数方法具有给定的名称时,这些方法才可能包含功能相似的代码。(2)现有的文件级、方法级和块级克隆检测技术往往会忽略由不同项目之间的复制-粘贴操作生成的功能相似的代码。(3)当我们使用结构相似度来检测功能相似的代码时,我们得到了很多误报。然而,除了结构相似性之外,我们还可以通过使用词汇相似性来避免检测大多数误报。(4)使用词汇表相似性来检测功能相似的代码不适用于同一文件中的方法对,因为这些方法对使用许多相同的程序元素,如私有方法或私有字段。
{"title":"How should we measure functional sameness from program source code? an exploratory study on Java methods","authors":"Yoshiki Higo, S. Kusumoto","doi":"10.1145/2635868.2635886","DOIUrl":"https://doi.org/10.1145/2635868.2635886","url":null,"abstract":"Program source code is one of the main targets of software engineering research. A wide variety of research has been conducted on source code, and many studies have leveraged structural, vocabulary, and method signature similarities to measure the functional sameness of source code. In this research, we conducted an empirical study to ascertain how we should use three similarities to measure functional sameness. We used two large datasets and measured the three similarities between all the method pairs in the datasets, each of which included approximately 15 million Java method pairs. The relationships between the three similarities were analyzed to determine how we should use each to detect functionally similar code. The results of our study revealed the following. (1) Method names are not always useful for detecting functionally similar code. Only if there are a small number of methods having a given name, the methods are likely to include functionally similar code. (2) Existing file-level, method-level, and block-level clone detection techniques often miss functionally similar code generated by copy-and-paste operations between different projects. (3) In the cases we use structural similarity for detecting functionally similar code, we obtained many false positives. However, we can avoid detecting most false positives by using a vocabulary similarity in addition to a structural one. (4) Using a vocabulary similarity to detect functionally similar code is not suitable for method pairs in the same file because such method pairs use many of the same program elements such as private methods or private fields.","PeriodicalId":250543,"journal":{"name":"Proceedings of the 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering","volume":"4 3","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-11-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133622498","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 18
期刊
Proceedings of the 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:604180095
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1