首页 > 最新文献

2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)最新文献

英文 中文
On the Deterioration of Learning-Based Malware Detectors for Android 基于学习的Android恶意软件检测器劣化研究
Xiaoqin Fu, Haipeng Cai
Classification using machine learning has been a major class of defense solutions against malware. Yet in the presence of a large and growing number of learning-based malware detection techniques for Android, malicious apps keep breaking out, with an increasing momentum, in various Android app markets. In this context, we ask the question "what is it that makes new and emerging malware slip through such a great collection of detection techniques?". Intuitively, performance deterioration of malware detectors could be a main cause—trained on older samples, they are increasingly unable to capture new malware. To understand the question, this work sets off to investigate the deterioration problem in four state-of-the-art Android malware detectors. We confirmed our hypothesis that these existing solutions do deteriorate largely and rapidly over time. We also propose a new classification approach that is built on the results of a longitudinal characterization study of Android apps with a focus on their dynamic behaviors. We evaluated this new approach against the four existing detectors and demonstrated significant advantages of our new solution. The main lesson learned is that studying app evolution provides a promising avenue for long-span malware detection.
使用机器学习进行分类已经成为针对恶意软件的主要防御解决方案。然而,随着大量基于学习的Android恶意软件检测技术的出现,恶意应用不断涌现,在各种Android应用市场中势头日益强劲。在这种情况下,我们提出了这样一个问题:“是什么让新的和新兴的恶意软件通过了如此强大的检测技术?”直观地说,恶意软件检测器的性能下降可能是一个主要原因——在旧的样本上训练,它们越来越无法捕获新的恶意软件。为了理解这个问题,这项工作开始调查四个最先进的Android恶意软件检测器的恶化问题。我们证实了我们的假设,即随着时间的推移,这些现有的解决方案确实在很大程度上迅速恶化。我们还提出了一种新的分类方法,该方法基于Android应用程序的纵向特征研究结果,重点关注其动态行为。我们将这种新方法与现有的四种检测器进行了比较,并展示了我们的新解决方案的显著优势。从中得到的主要教训是,研究应用程序的演变为长期恶意软件检测提供了一条有前途的途径。
{"title":"On the Deterioration of Learning-Based Malware Detectors for Android","authors":"Xiaoqin Fu, Haipeng Cai","doi":"10.1109/ICSE-Companion.2019.00110","DOIUrl":"https://doi.org/10.1109/ICSE-Companion.2019.00110","url":null,"abstract":"Classification using machine learning has been a major class of defense solutions against malware. Yet in the presence of a large and growing number of learning-based malware detection techniques for Android, malicious apps keep breaking out, with an increasing momentum, in various Android app markets. In this context, we ask the question \"what is it that makes new and emerging malware slip through such a great collection of detection techniques?\". Intuitively, performance deterioration of malware detectors could be a main cause—trained on older samples, they are increasingly unable to capture new malware. To understand the question, this work sets off to investigate the deterioration problem in four state-of-the-art Android malware detectors. We confirmed our hypothesis that these existing solutions do deteriorate largely and rapidly over time. We also propose a new classification approach that is built on the results of a longitudinal characterization study of Android apps with a focus on their dynamic behaviors. We evaluated this new approach against the four existing detectors and demonstrated significant advantages of our new solution. The main lesson learned is that studying app evolution provides a promising avenue for long-span malware detection.","PeriodicalId":273100,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)","volume":"63 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-05-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114204983","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 37
AC3R: Automatically Reconstructing Car Crashes from Police Reports AC3R:自动重建车祸从警察报告
Tri Huynh, Alessio Gambi, G. Fraser
Autonomous driving carries the promise to drastically reduce car accidents, but recently reported fatal crashes involving self-driving cars suggest that the self-driving car software should be tested more thoroughly. For addressing this need, we introduce AC3R (Automatic Crash Constructor from Crash Report) which elaborates police reports to automatically recreate car crashes in a simulated environment that can be used for testing self-driving car software in critical situations. AC3R enables developers to quickly generate relevant test cases from the massive historical dataset of recorded car crashes. We demonstrate how AC3R can generate simulations of different car crashes and report the findings of a large user study which concluded that AC3R simulations are accurate. A video illustrating AC3R in action is available at: https://youtu.be/V708fDG_ux8
自动驾驶有望大幅减少交通事故,但最近报道的涉及自动驾驶汽车的致命事故表明,自动驾驶汽车的软件应该进行更彻底的测试。为了满足这一需求,我们引入了AC3R(来自碰撞报告的自动碰撞构造器),它详细阐述了警方报告,以在模拟环境中自动重现车祸,可用于在危急情况下测试自动驾驶汽车软件。AC3R使开发人员能够从记录车祸的大量历史数据集中快速生成相关的测试用例。我们演示了AC3R如何生成不同车祸的模拟,并报告了一项大型用户研究的结果,该研究得出的结论是AC3R模拟是准确的。说明AC3R运行的视频可在:https://youtu.be/V708fDG_ux8
{"title":"AC3R: Automatically Reconstructing Car Crashes from Police Reports","authors":"Tri Huynh, Alessio Gambi, G. Fraser","doi":"10.1109/ICSE-Companion.2019.00031","DOIUrl":"https://doi.org/10.1109/ICSE-Companion.2019.00031","url":null,"abstract":"Autonomous driving carries the promise to drastically reduce car accidents, but recently reported fatal crashes involving self-driving cars suggest that the self-driving car software should be tested more thoroughly. For addressing this need, we introduce AC3R (Automatic Crash Constructor from Crash Report) which elaborates police reports to automatically recreate car crashes in a simulated environment that can be used for testing self-driving car software in critical situations. AC3R enables developers to quickly generate relevant test cases from the massive historical dataset of recorded car crashes. We demonstrate how AC3R can generate simulations of different car crashes and report the findings of a large user study which concluded that AC3R simulations are accurate. A video illustrating AC3R in action is available at: https://youtu.be/V708fDG_ux8","PeriodicalId":273100,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)","volume":"30 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-05-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117031192","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 7
Optimal MC/DC Test Case Generation 生成最佳MC/DC测试用例
J. Jaffar, Sangharatna Godboley, Rasool Maghareh
We present a new method for automated test case generation based on symbolic execution and a custom process of interpolation. The method first identifies program execution paths in order to define a corresponding set of test inputs. It then annotates the program with assertions so as to identify feasible and infeasible cases, the former of which are processed to produce the desired test inputs. The main contribution is that performing symbolic execution using a custom form of interpolation significantly prunes the search space. Our main result is that the set of Modified Condition/Decision Coverage (MC/DC) test cases we produce is optimal.
提出了一种基于符号执行和自定义插值过程的自动化测试用例生成方法。该方法首先确定程序执行路径,以便定义一组相应的测试输入。然后用断言注释程序,以便识别可行和不可行的情况,处理前者以产生所需的测试输入。它的主要贡献是使用自定义形式的插值执行符号,从而显著地减少了搜索空间。我们的主要结果是,我们生成的修改条件/决策覆盖(MC/DC)测试用例集是最优的。
{"title":"Optimal MC/DC Test Case Generation","authors":"J. Jaffar, Sangharatna Godboley, Rasool Maghareh","doi":"10.1109/ICSE-Companion.2019.00118","DOIUrl":"https://doi.org/10.1109/ICSE-Companion.2019.00118","url":null,"abstract":"We present a new method for automated test case generation based on symbolic execution and a custom process of interpolation. The method first identifies program execution paths in order to define a corresponding set of test inputs. It then annotates the program with assertions so as to identify feasible and infeasible cases, the former of which are processed to produce the desired test inputs. The main contribution is that performing symbolic execution using a custom form of interpolation significantly prunes the search space. Our main result is that the set of Modified Condition/Decision Coverage (MC/DC) test cases we produce is optimal.","PeriodicalId":273100,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-05-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127401178","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 4
Finding Concurrency Exploits on Smart Contracts 在智能合约上发现并发漏洞
Yue Li
Smart contracts have been widely used on Ethereum to enable business services across various application domains. However, they are prone to different forms of security attacks due to the dynamic and non-deterministic blockchain runtime environment. In this work, we highlighted a general miner-side type of exploit, called concurrency exploit, which attacks smart contracts via generating malicious transaction sequences. Moreover, we designed a systematic algorithm to automatically detect such exploits. In our preliminary evaluation, our approach managed to identify real vulnerabilities that cannot be detected by other tools in the literature.
智能合约已在以太坊上广泛使用,以实现跨各种应用领域的业务服务。然而,由于区块链运行时环境的动态性和不确定性,它们容易受到不同形式的安全攻击。在这项工作中,我们强调了一种通用的矿工端攻击类型,称为并发攻击,它通过生成恶意交易序列来攻击智能合约。此外,我们还设计了一个系统的算法来自动检测这些漏洞。在我们的初步评估中,我们的方法设法识别了文献中其他工具无法检测到的真正漏洞。
{"title":"Finding Concurrency Exploits on Smart Contracts","authors":"Yue Li","doi":"10.1109/ICSE-Companion.2019.00061","DOIUrl":"https://doi.org/10.1109/ICSE-Companion.2019.00061","url":null,"abstract":"Smart contracts have been widely used on Ethereum to enable business services across various application domains. However, they are prone to different forms of security attacks due to the dynamic and non-deterministic blockchain runtime environment. In this work, we highlighted a general miner-side type of exploit, called concurrency exploit, which attacks smart contracts via generating malicious transaction sequences. Moreover, we designed a systematic algorithm to automatically detect such exploits. In our preliminary evaluation, our approach managed to identify real vulnerabilities that cannot be detected by other tools in the literature.","PeriodicalId":273100,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)","volume":"64 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-05-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126426276","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 5
Effects of Automated Static Analysis Tools: A Multidimensional View on Quality Evolution 自动化静态分析工具的影响:质量演变的多维视角
Alexander Trautsch
Leveraging and acting on the results of static analysis is a well-known best practice. Static analysis also is an integral part of software quality assurance which is highlighted by the inclusion of static analysis results in software quality models like ColumbusQM and Quamoco. Although there are studies that explore if tools for static analysis are used and how they are configured, few publications explore the longitudinal effects of acting on static analysis results on software and on the evolution of software. Especially effects on quality criteria, e.g., software quality metrics, defects, or readability are missing. With our research, we will bridge this gap and measure the effects of static analysis on software quality evolution. We will measure the effect the removal of code that generates static analysis warnings has on software quality metrics. Furthermore, we will measure long term effects on external quality attributes, e.g., reported issues and defects. Finally, we want to predict false positives of static analysis warnings by training predictive models on our collected data.
利用静态分析的结果并对其采取行动是众所周知的最佳实践。静态分析也是软件质量保证的一个组成部分,在软件质量模型(如ColumbusQM和Quamoco)中包含静态分析结果突出了这一点。尽管有研究探索是否使用静态分析工具以及如何配置它们,但很少有出版物探索作用于软件上的静态分析结果和软件演变的纵向影响。特别是对质量标准的影响,例如,软件质量度量、缺陷或可读性被忽略了。通过我们的研究,我们将弥合这一差距,并度量静态分析对软件质量演变的影响。我们将度量删除生成静态分析警告的代码对软件质量度量的影响。此外,我们将度量对外部质量属性的长期影响,例如,报告的问题和缺陷。最后,我们希望通过在我们收集的数据上训练预测模型来预测静态分析警告的误报。
{"title":"Effects of Automated Static Analysis Tools: A Multidimensional View on Quality Evolution","authors":"Alexander Trautsch","doi":"10.1109/ICSE-Companion.2019.00075","DOIUrl":"https://doi.org/10.1109/ICSE-Companion.2019.00075","url":null,"abstract":"Leveraging and acting on the results of static analysis is a well-known best practice. Static analysis also is an integral part of software quality assurance which is highlighted by the inclusion of static analysis results in software quality models like ColumbusQM and Quamoco. Although there are studies that explore if tools for static analysis are used and how they are configured, few publications explore the longitudinal effects of acting on static analysis results on software and on the evolution of software. Especially effects on quality criteria, e.g., software quality metrics, defects, or readability are missing. With our research, we will bridge this gap and measure the effects of static analysis on software quality evolution. We will measure the effect the removal of code that generates static analysis warnings has on software quality metrics. Furthermore, we will measure long term effects on external quality attributes, e.g., reported issues and defects. Finally, we want to predict false positives of static analysis warnings by training predictive models on our collected data.","PeriodicalId":273100,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)","volume":"52 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-05-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130054178","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
Characterizing and Detecting Duplicate Logging Code Smells 描述和检测重复的日志代码气味
Zhenhao Li
Software logs are widely used by developers to assist in various tasks. Despite the importance of logs, prior studies show that there is no industrial standard on how to write logging statements. Recent research on logs often only considers the appropriateness of a log as an individual item (e.g., one single logging statement); while logs are typically analyzed in tandem. In this paper, we focus on studying duplicate logging statements, which are logging statements that have the same static text message. Such duplications in the text message are potential indications of logging code smells, which may affect developers' understanding of the dynamic view of the system. We manually studied over 3K duplicate logging statements and their surrounding code in four large-scale open source systems and uncovered five patterns of duplicate logging code smells. For each instance of the problematic code smell, we contact developers in order to verify our manual study result. We integrated our manual study result and developers' feedback into our automated static analysis tool, DLFinder, which automatically detects problematic duplicate logging code smells. We evaluated DLFinder on the manually studied systems and two additional systems. In total, combining the results of DLFinder and our manual analysis, DLFinder is able to detect over 85% of the instances which were reported to developers and then fixed.
软件日志被开发人员广泛用于协助完成各种任务。尽管日志很重要,但之前的研究表明,没有关于如何编写日志记录语句的工业标准。最近对日志的研究通常只考虑日志作为一个单独项目的适当性(例如,一个单独的日志记录语句);而日志通常是串联分析的。本文主要研究重复日志语句,即具有相同静态文本消息的日志语句。文本消息中的这种重复是日志代码异味的潜在指示,这可能会影响开发人员对系统动态视图的理解。我们在四个大型开源系统中手动研究了超过3K个重复日志语句及其周围代码,并发现了重复日志代码气味的五种模式。对于有问题的代码气味的每个实例,我们联系开发人员以验证我们的手工研究结果。我们将手工研究结果和开发人员的反馈集成到自动静态分析工具DLFinder中,该工具可以自动检测有问题的重复日志代码气味。我们在人工研究的系统和另外两个系统上评估了DLFinder。总的来说,结合DLFinder的结果和我们的手工分析,DLFinder能够检测到超过85%的向开发人员报告并修复的实例。
{"title":"Characterizing and Detecting Duplicate Logging Code Smells","authors":"Zhenhao Li","doi":"10.1109/ICSE-Companion.2019.00062","DOIUrl":"https://doi.org/10.1109/ICSE-Companion.2019.00062","url":null,"abstract":"Software logs are widely used by developers to assist in various tasks. Despite the importance of logs, prior studies show that there is no industrial standard on how to write logging statements. Recent research on logs often only considers the appropriateness of a log as an individual item (e.g., one single logging statement); while logs are typically analyzed in tandem. In this paper, we focus on studying duplicate logging statements, which are logging statements that have the same static text message. Such duplications in the text message are potential indications of logging code smells, which may affect developers' understanding of the dynamic view of the system. We manually studied over 3K duplicate logging statements and their surrounding code in four large-scale open source systems and uncovered five patterns of duplicate logging code smells. For each instance of the problematic code smell, we contact developers in order to verify our manual study result. We integrated our manual study result and developers' feedback into our automated static analysis tool, DLFinder, which automatically detects problematic duplicate logging code smells. We evaluated DLFinder on the manually studied systems and two additional systems. In total, combining the results of DLFinder and our manual analysis, DLFinder is able to detect over 85% of the instances which were reported to developers and then fixed.","PeriodicalId":273100,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)","volume":"5 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-05-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130019471","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 8
Deobfuscating Android Native Binary Code 解混淆Android原生二进制代码
Zeliang Kan, Haoyu Wang, Lei Wu, Yao Guo, Guoai Xu
In this paper, we propose an automated approach to facilitate the deobfuscation of Android native binary code. Specifically, given a native binary obfuscated by Obfuscator-LLVM (the most popular native code obfuscator), our deobfuscation system is capable of recovering the original Control Flow Graph. To the best of our knowledge, it is the first work that aims to tackle the problem. We have applied our system in different scenarios, and the experimental results demonstrate the effectiveness of our system based on generic similarity comparison metrics.
在本文中,我们提出了一种自动化的方法来简化Android原生二进制代码的解混淆。具体来说,给定一个被obfusator - llvm(最流行的本地代码混淆器)混淆的本地二进制文件,我们的去混淆系统能够恢复原始的控制流图。据我们所知,这是第一部旨在解决这个问题的作品。我们已经在不同的场景中应用了我们的系统,实验结果证明了基于通用相似度比较指标的系统的有效性。
{"title":"Deobfuscating Android Native Binary Code","authors":"Zeliang Kan, Haoyu Wang, Lei Wu, Yao Guo, Guoai Xu","doi":"10.1109/ICSE-Companion.2019.00135","DOIUrl":"https://doi.org/10.1109/ICSE-Companion.2019.00135","url":null,"abstract":"In this paper, we propose an automated approach to facilitate the deobfuscation of Android native binary code. Specifically, given a native binary obfuscated by Obfuscator-LLVM (the most popular native code obfuscator), our deobfuscation system is capable of recovering the original Control Flow Graph. To the best of our knowledge, it is the first work that aims to tackle the problem. We have applied our system in different scenarios, and the experimental results demonstrate the effectiveness of our system based on generic similarity comparison metrics.","PeriodicalId":273100,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)","volume":"253 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-05-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"117304583","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 10
A Winning Team - What Personality Has To Do With Software Engineering 一个成功的团队——个性与软件工程的关系
Erica Weilemann
Nowadays, software is developed in teams. But how should teams be put together in order to build a high quality team? This study shows how the different roles in a software development team - project leader, requirements engineer, architect/ designer, and developer/tester/maintainer - should be staffed with respect to HEXACO personality traits in order to form a high quality team. We conducted a qualitative analysis by leading 12 semistructured interviews with interviewees who work in the software engineering sector and have working experience of at least 2 years. We followed a Grounded Theory approach to derive personality traits and link them to software engineering roles. Our study shows that different personality profiles are indeed beneficial for the different roles. A project leader e.g. should have a more pronounced Agreeableness domain whereas the Extraversion domain should be pronounced with a requirements engineer. Our results should support the composition of software engineering teams with the aim to successfully build high quality teams.
如今,软件是在团队中开发的。但是,为了建立一个高质量的团队,团队应该如何组成呢?本研究展示了软件开发团队中的不同角色——项目负责人、需求工程师、架构师/设计师和开发人员/测试人员/维护者——应该如何根据HEXACO的个性特征来组建一个高质量的团队。我们对在软件工程领域工作且至少有2年工作经验的受访者进行了12次半结构化访谈,进行了定性分析。我们遵循扎根理论的方法来推导个性特征,并将它们与软件工程角色联系起来。我们的研究表明,不同的性格特征确实对不同的角色有益。例如,项目负责人应该有一个更明显的宜人性域,而外向性域应该与需求工程师一起发音。我们的结果应该支持以成功构建高质量团队为目标的软件工程团队的组成。
{"title":"A Winning Team - What Personality Has To Do With Software Engineering","authors":"Erica Weilemann","doi":"10.1109/ICSE-Companion.2019.00100","DOIUrl":"https://doi.org/10.1109/ICSE-Companion.2019.00100","url":null,"abstract":"Nowadays, software is developed in teams. But how should teams be put together in order to build a high quality team? This study shows how the different roles in a software development team - project leader, requirements engineer, architect/ designer, and developer/tester/maintainer - should be staffed with respect to HEXACO personality traits in order to form a high quality team. We conducted a qualitative analysis by leading 12 semistructured interviews with interviewees who work in the software engineering sector and have working experience of at least 2 years. We followed a Grounded Theory approach to derive personality traits and link them to software engineering roles. Our study shows that different personality profiles are indeed beneficial for the different roles. A project leader e.g. should have a more pronounced Agreeableness domain whereas the Extraversion domain should be pronounced with a requirements engineer. Our results should support the composition of software engineering teams with the aim to successfully build high quality teams.","PeriodicalId":273100,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)","volume":"124 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-05-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116333070","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
Property Oriented Verification Via Iterative Abstract Interpretation 基于迭代抽象解释的属性导向验证
Banghu Yin
Static analysis by abstract interpretation is one of the widely used automatic approaches to program verification, due to its soundness guarantee and scalability. A key challenge for abstract interpretation with convex and linear abstract domain is verifying complex programs with disjunctive or non-linear behaviors. Our approach is conducting abstract interpretation in an iterative forward and backward manner. It utilizes dynamic input space partitioning to split the input space into sub-spaces. Thus each sub-space involves fewer disjunctive and non-linear program behaviors and is easier to be verified. We have implemented our approach. The experimental results are promising.
摘要基于抽象解释的静态分析是目前应用广泛的程序验证自动化方法之一,具有良好的可靠性和可扩展性。对凸和线性抽象域进行抽象解释的一个关键挑战是验证具有析取或非线性行为的复杂程序。我们的方法是以一种迭代的向前和向后的方式进行抽象的解释。它利用动态输入空间划分将输入空间划分为子空间。因此,每个子空间涉及较少的析取和非线性规划行为,并且更容易被验证。我们已经实施了我们的方法。实验结果是有希望的。
{"title":"Property Oriented Verification Via Iterative Abstract Interpretation","authors":"Banghu Yin","doi":"10.1109/ICSE-Companion.2019.00067","DOIUrl":"https://doi.org/10.1109/ICSE-Companion.2019.00067","url":null,"abstract":"Static analysis by abstract interpretation is one of the widely used automatic approaches to program verification, due to its soundness guarantee and scalability. A key challenge for abstract interpretation with convex and linear abstract domain is verifying complex programs with disjunctive or non-linear behaviors. Our approach is conducting abstract interpretation in an iterative forward and backward manner. It utilizes dynamic input space partitioning to split the input space into sub-spaces. Thus each sub-space involves fewer disjunctive and non-linear program behaviors and is easier to be verified. We have implemented our approach. The experimental results are promising.","PeriodicalId":273100,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)","volume":"96 6","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-05-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131652276","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Mockingbird: A Framework for Enabling Targeted Dynamic Analysis of Java Programs 一个支持Java程序目标动态分析的框架
Derrick Lockwood, Benjamin Holland, S. Kothari
The paper presents the Mockingbird framework that combines static and dynamic analyses to yield an efficient and scalable approach to analyze large Java software. The framework is an innovative integration of existing static and dynamic analysis tools and a newly developed component called the Object Mocker that enables the integration. The static analyzers are used to extract potentially vulnerable parts from large software. Targeted dynamic analysis is used to analyze just the potentially vulnerable parts to check whether the vulnerability can actually be exploited. We present a case study to illustrate the use of the framework to analyze complex software vulnerabilities. The case study is based on a challenge application from the DARPA Space/Time Analysis for Cybersecurity (STAC) program. Interestingly, the challenge program had been hardened and was thought not to be vulnerable. Yet, using the framework we could discover an unintentional vulnerability that can be exploited for a denial of service attack. The accompanying demo video depicts the case study. Video: https://youtu.be/m9OUWtocWPE
本文介绍了Mockingbird框架,该框架结合了静态和动态分析,以产生一种高效且可扩展的方法来分析大型Java软件。该框架是现有静态和动态分析工具的创新集成,以及新开发的称为Object Mocker的组件,该组件支持集成。静态分析器用于从大型软件中提取潜在的易受攻击的部分。有针对性的动态分析是只分析可能存在漏洞的部分,检查漏洞是否真的可以被利用。我们提出了一个案例研究来说明使用该框架来分析复杂的软件漏洞。该案例研究基于DARPA网络安全时空分析(STAC)项目的挑战申请。有趣的是,这个挑战项目被强化了,被认为不容易受到攻击。然而,使用该框架,我们可能会发现一个无意的漏洞,可以被利用来进行拒绝服务攻击。附带的演示视频描述了案例研究。的视频:https://youtu.be/m9OUWtocWPE
{"title":"Mockingbird: A Framework for Enabling Targeted Dynamic Analysis of Java Programs","authors":"Derrick Lockwood, Benjamin Holland, S. Kothari","doi":"10.1109/ICSE-Companion.2019.00033","DOIUrl":"https://doi.org/10.1109/ICSE-Companion.2019.00033","url":null,"abstract":"The paper presents the Mockingbird framework that combines static and dynamic analyses to yield an efficient and scalable approach to analyze large Java software. The framework is an innovative integration of existing static and dynamic analysis tools and a newly developed component called the Object Mocker that enables the integration. The static analyzers are used to extract potentially vulnerable parts from large software. Targeted dynamic analysis is used to analyze just the potentially vulnerable parts to check whether the vulnerability can actually be exploited. We present a case study to illustrate the use of the framework to analyze complex software vulnerabilities. The case study is based on a challenge application from the DARPA Space/Time Analysis for Cybersecurity (STAC) program. Interestingly, the challenge program had been hardened and was thought not to be vulnerable. Yet, using the framework we could discover an unintentional vulnerability that can be exploited for a denial of service attack. The accompanying demo video depicts the case study. Video: https://youtu.be/m9OUWtocWPE","PeriodicalId":273100,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-05-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130368028","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
期刊
2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1