首页 > 最新文献

2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)最新文献

英文 中文
Visually Identifying Potential Sensitive Information Leaks in Access-Controlled Data Services 可视化识别访问控制数据服务中潜在的敏感信息泄漏
Kalvin Eng
We present a novel visual-inspection methodology that relies on formal concept analysis to help developers ensure that only needed parts of sensitive information are released to authorized users in an access control model. The first step involves the annotation of the to-be-exposed data using a domain-specific ontology, which includes sensitivity attributes at a meta-level for its elements. During the role-creation step, roles are assigned privileges in the form of queries that access different parts of the data. The resulting set of roles, each associated with its own set of queries, is represented in a roles-permissions matrix and transformed into a graphical concept lattice. The lattice can be analyzed and inspected for deficiencies in the access-control model, based on the data sensitivity attributes. We hypothesize that visualizing concept lattices are useful when creating access-control models to manage data access so that the unauthorized access to sensitive and private information is curtailed.
我们提出了一种新的视觉检查方法,该方法依赖于形式概念分析,以帮助开发人员确保在访问控制模型中仅向授权用户发布敏感信息的必要部分。第一步涉及使用特定于领域的本体对要公开的数据进行注释,该本体包括元级别元素的敏感性属性。在角色创建步骤中,以查询的形式为角色分配特权,以访问数据的不同部分。生成的角色集(每个角色都与自己的查询集相关联)用角色-权限矩阵表示,并转换为图形概念格。基于数据敏感性属性,可以分析和检查访问控制模型中的缺陷。我们假设可视化的概念格在创建访问控制模型来管理数据访问时是有用的,这样可以减少对敏感和私有信息的未经授权的访问。
{"title":"Visually Identifying Potential Sensitive Information Leaks in Access-Controlled Data Services","authors":"Kalvin Eng","doi":"10.1109/ICSE-Companion.2019.00057","DOIUrl":"https://doi.org/10.1109/ICSE-Companion.2019.00057","url":null,"abstract":"We present a novel visual-inspection methodology that relies on formal concept analysis to help developers ensure that only needed parts of sensitive information are released to authorized users in an access control model. The first step involves the annotation of the to-be-exposed data using a domain-specific ontology, which includes sensitivity attributes at a meta-level for its elements. During the role-creation step, roles are assigned privileges in the form of queries that access different parts of the data. The resulting set of roles, each associated with its own set of queries, is represented in a roles-permissions matrix and transformed into a graphical concept lattice. The lattice can be analyzed and inspected for deficiencies in the access-control model, based on the data sensitivity attributes. We hypothesize that visualizing concept lattices are useful when creating access-control models to manage data access so that the unauthorized access to sensitive and private information is curtailed.","PeriodicalId":273100,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)","volume":"15 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-05-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129498649","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Towards a More Reliable Interpretation of Defect Models 迈向更可靠的缺陷模型解释
Jirayus Jiarpakdee
Software Quality Assurance (SQA) activities are exercised to ensure high-quality software systems. Defect models help developers identify the most risky modules to prioritise their limited SQA resources. The interpretation of defect models also helps managers understand what factors impact software quality to chart quality improvement plans. Unfortunately, the commonly-used interpretation techniques (e.g., ANOVA for logistic regression and variable importance for random forests) only explain defect models at the high level (e.g., what factors impact software quality). Researchers and practitioners also raise concerns about a lack of explainability of defect models that hinders the adoption in practice. This thesis hypothesises that: A lack of explainability poses a critical challenge when adopting defect models in practice. To validate the hypothesis, we formulate 3 research questions, i.e., (1) what is the best defect modelling workflow that produces the most accurate and reliable interpretation of defect models?, (2) what is the best technique for explaining the predictions of defect models?, and (3) how do practitioners perceive when adopting explainable defect models? Through case studies of publicly-available open-source and industrial software systems, the results show that correlated variables impact the interpretation of defect models and must be mitigated; our proposed feature selection technique, AutoSpearman, is the only studied feature selection technique that can automatically mitigate correlated variables with a little impact on model performance; and the instance-level interpretation of defect models is needed to derive actionable insights to guide operational and technical decisions in SQA efforts.
执行软件质量保证(SQA)活动以确保高质量的软件系统。缺陷模型帮助开发人员识别风险最大的模块,以确定有限的SQA资源的优先级。缺陷模型的解释也帮助管理人员理解影响软件质量的因素,从而制定质量改进计划。不幸的是,常用的解释技术(例如,逻辑回归的方差分析和随机森林的可变重要性)只能在高层次上解释缺陷模型(例如,什么因素影响软件质量)。研究人员和实践者还提出了对缺陷模型缺乏可解释性的担忧,这阻碍了在实践中的采用。本文假设:在实践中采用缺陷模型时,缺乏可解释性是一个关键的挑战。为了验证这个假设,我们提出了3个研究问题,即,(1)产生最准确和可靠的缺陷模型解释的最佳缺陷建模工作流是什么?(2)解释缺陷模型预测的最佳技术是什么?(3)当采用可解释的缺陷模型时,从业者是如何感知的?通过对公开可用的开源软件和工业软件系统的案例研究,结果表明相关变量影响缺陷模型的解释,必须加以缓解;我们提出的特征选择技术AutoSpearman是唯一一种可以自动减轻相关变量而对模型性能影响很小的特征选择技术;并且需要缺陷模型的实例级解释来派生可操作的见解,以指导SQA工作中的操作和技术决策。
{"title":"Towards a More Reliable Interpretation of Defect Models","authors":"Jirayus Jiarpakdee","doi":"10.1109/ICSE-Companion.2019.00084","DOIUrl":"https://doi.org/10.1109/ICSE-Companion.2019.00084","url":null,"abstract":"Software Quality Assurance (SQA) activities are exercised to ensure high-quality software systems. Defect models help developers identify the most risky modules to prioritise their limited SQA resources. The interpretation of defect models also helps managers understand what factors impact software quality to chart quality improvement plans. Unfortunately, the commonly-used interpretation techniques (e.g., ANOVA for logistic regression and variable importance for random forests) only explain defect models at the high level (e.g., what factors impact software quality). Researchers and practitioners also raise concerns about a lack of explainability of defect models that hinders the adoption in practice. This thesis hypothesises that: A lack of explainability poses a critical challenge when adopting defect models in practice. To validate the hypothesis, we formulate 3 research questions, i.e., (1) what is the best defect modelling workflow that produces the most accurate and reliable interpretation of defect models?, (2) what is the best technique for explaining the predictions of defect models?, and (3) how do practitioners perceive when adopting explainable defect models? Through case studies of publicly-available open-source and industrial software systems, the results show that correlated variables impact the interpretation of defect models and must be mitigated; our proposed feature selection technique, AutoSpearman, is the only studied feature selection technique that can automatically mitigate correlated variables with a little impact on model performance; and the instance-level interpretation of defect models is needed to derive actionable insights to guide operational and technical decisions in SQA efforts.","PeriodicalId":273100,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)","volume":"43 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-05-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129581032","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
Message from the Technical Briefings Chairs of ICSE 2019 ICSE 2019技术简报主席的致辞
{"title":"Message from the Technical Briefings Chairs of ICSE 2019","authors":"","doi":"10.1109/icse-companion.2019.00014","DOIUrl":"https://doi.org/10.1109/icse-companion.2019.00014","url":null,"abstract":"","PeriodicalId":273100,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115715555","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Studies on the Software Testing Profession 软件测试专业研究
Luiz Fernando Capretz, P. Waychal, Jingdong Jia, Daniel Varona, Yadira Lizama
This paper attempts to understand motivators and de-motivators that influence the decisions of software professionals to take up and sustain software testing careers across four different countries, i.e. Canada, China, Cuba, and India. The research question can be framed as "How many software professionals across different geographies are keen to take up testing careers, and what are the reasons for their choices?" Towards that, we developed a cross-sectional but simple survey-based instrument. In this study we investigated how software testers perceived and valued what they do and their environmental settings. The study pointed out the importance of visualizing software testing activities as a set of human-dependent tasks and emphasized the need for research that examines critically individual assessments of software testers about software testing activities. This investigation can help global industry leaders to understand the impact of work-related factors on the motivation of testing professionals, as well as inform and support management and leadership in this context.
本文试图理解影响软件专业人员在四个不同国家(即加拿大、中国、古巴和印度)从事和维持软件测试职业的决策的激励因素和不激励因素。这个研究问题可以被框定为“不同地区有多少软件专业人员热衷于从事测试工作,他们选择的原因是什么?”为此,我们开发了一种横断面但简单的基于调查的仪器。在这项研究中,我们调查了软件测试人员如何感知和评估他们所做的事情以及他们的环境设置。该研究指出了可视化软件测试活动作为一组依赖于人类的任务的重要性,并强调了对软件测试人员关于软件测试活动的批判性个人评估进行研究的必要性。这项调查可以帮助全球行业领导者了解与工作相关的因素对测试专业人员动机的影响,并在此背景下告知和支持管理和领导。
{"title":"Studies on the Software Testing Profession","authors":"Luiz Fernando Capretz, P. Waychal, Jingdong Jia, Daniel Varona, Yadira Lizama","doi":"10.1109/ICSE-Companion.2019.00105","DOIUrl":"https://doi.org/10.1109/ICSE-Companion.2019.00105","url":null,"abstract":"This paper attempts to understand motivators and de-motivators that influence the decisions of software professionals to take up and sustain software testing careers across four different countries, i.e. Canada, China, Cuba, and India. The research question can be framed as \"How many software professionals across different geographies are keen to take up testing careers, and what are the reasons for their choices?\" Towards that, we developed a cross-sectional but simple survey-based instrument. In this study we investigated how software testers perceived and valued what they do and their environmental settings. The study pointed out the importance of visualizing software testing activities as a set of human-dependent tasks and emphasized the need for research that examines critically individual assessments of software testers about software testing activities. This investigation can help global industry leaders to understand the impact of work-related factors on the motivation of testing professionals, as well as inform and support management and leadership in this context.","PeriodicalId":273100,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)","volume":"79 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123197531","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 14
Configuration-Dependent Fault Localization 依赖配置的故障定位
S. Nguyen
In a buggy configurable system, configuration-dependent bugs cause the failures in only certain configurations due to unexpected interactions among features. Manually localizing configuration-dependent faults in configurable systems could be highly time-consuming due to their complexity. However, the cause of configuration-dependent bugs is not considered by existing automated fault localization techniques, which are designed to localize bugs in non-configurable code. Thus, their capacity for efficient configuration-dependent localization is limited. In this work, we propose COFL, a novel approach to localize configuration-dependent bugs by identifying and analyzing suspicious feature interactions that potentially cause the failures in buggy configurable systems. We evaluated the efficiency of COFL in fault localization of artificial configuration-dependent faults in a highly-configurable system. We found that COFL significantly improves the baseline spectrum-based approaches. With COFL, on average, the correctness in ranking the buggy statements increases more than 7 times, and the search space is significantly narrowed down, about 15 times.
在错误的可配置系统中,由于功能之间的意外交互,与配置相关的错误仅在某些配置中导致失败。由于可配置系统的复杂性,手动定位与配置相关的故障可能非常耗时。然而,现有的自动化故障定位技术并没有考虑到与配置相关的错误的原因,这些技术的目的是在非可配置代码中定位错误。因此,他们的能力有效的配置依赖的定位是有限的。在这项工作中,我们提出了COFL,这是一种通过识别和分析可能导致错误的可配置系统故障的可疑特征交互来定位配置相关错误的新方法。我们评估了COFL在高度可配置系统中人工配置相关故障的故障定位效率。我们发现COFL显著改善了基于基线光谱的方法。使用COFL,对错误语句排序的正确性平均提高了7倍以上,搜索空间明显缩小,约为15倍。
{"title":"Configuration-Dependent Fault Localization","authors":"S. Nguyen","doi":"10.1109/ICSE-Companion.2019.00065","DOIUrl":"https://doi.org/10.1109/ICSE-Companion.2019.00065","url":null,"abstract":"In a buggy configurable system, configuration-dependent bugs cause the failures in only certain configurations due to unexpected interactions among features. Manually localizing configuration-dependent faults in configurable systems could be highly time-consuming due to their complexity. However, the cause of configuration-dependent bugs is not considered by existing automated fault localization techniques, which are designed to localize bugs in non-configurable code. Thus, their capacity for efficient configuration-dependent localization is limited. In this work, we propose COFL, a novel approach to localize configuration-dependent bugs by identifying and analyzing suspicious feature interactions that potentially cause the failures in buggy configurable systems. We evaluated the efficiency of COFL in fault localization of artificial configuration-dependent faults in a highly-configurable system. We found that COFL significantly improves the baseline spectrum-based approaches. With COFL, on average, the correctness in ranking the buggy statements increases more than 7 times, and the search space is significantly narrowed down, about 15 times.","PeriodicalId":273100,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)","volume":"38 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116479502","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
MULAPI: A Tool for API Method and Usage Location Recommendation MULAPI:一个API方法和使用位置推荐的工具
Congying Xu, Bosen Min, Xiaobing Sun, Jiajun Hu, Bin Li, Yucong Duan
Software is incrementally evolved as various new feature requests are implemented to meet users' requirements. To accelerate the incoming feature implementation, developers often utilize existing third-party APIs that encapsulate featurerelated functionality into simple APIs. However, it is non-trivial for developers to choose which APIs to use and where to use them in a target program since the search space of APIs and their usage locations are usually large. In this paper, we introduce a tool, MULAPI, to facilitate the decision of suitable APIs at potential usage locations for implementing the incoming feature requests. MULAPI combines feature localization and information retrieval techniques to accomplish API recommendation and usage location. Empirical studies demonstrate that MULAPI can effectively recommend correct APIs and their usage locations with higher precision than state-of-the-art approaches. The video of our demo is available at https://youtu.be/s3Cs5ltqdvs.
随着实现各种新特性请求以满足用户需求,软件会逐步发展。为了加速即将到来的特性实现,开发人员经常利用现有的第三方api,这些api将特性相关的功能封装到简单的api中。然而,对于开发人员来说,在目标程序中选择使用哪些api以及在何处使用它们是非常重要的,因为api的搜索空间及其使用位置通常很大。在本文中,我们介绍了一个工具MULAPI,以方便在潜在的使用位置决定合适的api,以实现传入的功能请求。MULAPI结合了特征定位和信息检索技术来完成API推荐和使用定位。实证研究表明,MULAPI可以有效地推荐正确的api及其使用位置,并且比最先进的方法具有更高的精度。我们的演示视频可以在https://youtu.be/s3Cs5ltqdvs上找到。
{"title":"MULAPI: A Tool for API Method and Usage Location Recommendation","authors":"Congying Xu, Bosen Min, Xiaobing Sun, Jiajun Hu, Bin Li, Yucong Duan","doi":"10.1109/ICSE-Companion.2019.00053","DOIUrl":"https://doi.org/10.1109/ICSE-Companion.2019.00053","url":null,"abstract":"Software is incrementally evolved as various new feature requests are implemented to meet users' requirements. To accelerate the incoming feature implementation, developers often utilize existing third-party APIs that encapsulate featurerelated functionality into simple APIs. However, it is non-trivial for developers to choose which APIs to use and where to use them in a target program since the search space of APIs and their usage locations are usually large. In this paper, we introduce a tool, MULAPI, to facilitate the decision of suitable APIs at potential usage locations for implementing the incoming feature requests. MULAPI combines feature localization and information retrieval techniques to accomplish API recommendation and usage location. Empirical studies demonstrate that MULAPI can effectively recommend correct APIs and their usage locations with higher precision than state-of-the-art approaches. The video of our demo is available at https://youtu.be/s3Cs5ltqdvs.","PeriodicalId":273100,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)","volume":"74 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127589331","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 10
An Empirical Study on Leveraging Logs for Debugging Production Failures 利用日志调试生产故障的实证研究
A. Chen
In modern software development, maintenance is one of the most expensive processes. When end-users encounter software defects, they report the bug to developers by specifying the expected behavior and error messages (e.g., log message). Then, they wait for a bug fix from the developers. However, on the developers' side, it can be very challenging and expensive to debug the problem. To fix the bugs, developers often have to play the role of detectives: seeking clues in the user-reported logs files or stack trace in a snapshot of specific system execution. This debugging process may take several hours or even days. In this paper, we first look at the usefulness of the user-reported logs. Then, we propose an automated approach to assist the debugging process by reconstructing the execution path. Through the analysis, our investigation shows that 31% of the time, developer further requests logs from the reporter. Moreover, our preliminary results show that the reconducted path illustrates the user's execution. We believe that our approach proposes a novel solution in debugging production failures.
在现代软件开发中,维护是最昂贵的过程之一。当最终用户遇到软件缺陷时,他们通过指定预期的行为和错误消息(例如,日志消息)向开发人员报告错误。然后,他们等待开发人员修复错误。然而,在开发人员方面,调试这个问题可能是非常具有挑战性和昂贵的。为了修复这些错误,开发人员通常必须扮演侦探的角色:在用户报告的日志文件中寻找线索,或者在特定系统执行的快照中寻找堆栈跟踪。这个调试过程可能需要几个小时甚至几天。在本文中,我们首先看看用户报告的日志的用处。然后,我们提出了一种自动化的方法,通过重建执行路径来辅助调试过程。通过分析,我们的调查显示,31%的情况下,开发人员会进一步向记者请求日志。此外,我们的初步结果表明,重新进行的路径说明了用户的执行。我们相信我们的方法为调试生产故障提供了一种新颖的解决方案。
{"title":"An Empirical Study on Leveraging Logs for Debugging Production Failures","authors":"A. Chen","doi":"10.1109/ICSE-Companion.2019.00055","DOIUrl":"https://doi.org/10.1109/ICSE-Companion.2019.00055","url":null,"abstract":"In modern software development, maintenance is one of the most expensive processes. When end-users encounter software defects, they report the bug to developers by specifying the expected behavior and error messages (e.g., log message). Then, they wait for a bug fix from the developers. However, on the developers' side, it can be very challenging and expensive to debug the problem. To fix the bugs, developers often have to play the role of detectives: seeking clues in the user-reported logs files or stack trace in a snapshot of specific system execution. This debugging process may take several hours or even days. In this paper, we first look at the usefulness of the user-reported logs. Then, we propose an automated approach to assist the debugging process by reconstructing the execution path. Through the analysis, our investigation shows that 31% of the time, developer further requests logs from the reporter. Moreover, our preliminary results show that the reconducted path illustrates the user's execution. We believe that our approach proposes a novel solution in debugging production failures.","PeriodicalId":273100,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133722067","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 13
Git-Based Integrated Uncertainty Manager 基于git的集成不确定性管理器
Naoyasu Ubayashi, Takuya Watanabe, Yasutaka Kamei, Ryosuke Sato
Nowadays, many software systems are required to be updated and delivered in a short period of time. It is important for developers to make software embrace uncertainty, because user requirements or design decisions are not always completely determined. This paper introduces iArch-U, an Eclipse-based uncertainty-aware software development tool chain, for developers to properly describe, trace, and manage uncertainty crosscutting over UML modeling, Java programming, and testing phases. Integrating with Git, iArch-U can manage why/when/where uncertain concerns arise or are fixed to be certain in a project. In this tool demonstration, we show the world of uncertainty-aware software development using iArch-U. Our tool is open source software released from http://posl.github.io/iArch/.
如今,许多软件系统都需要在很短的时间内进行更新和交付。对于开发人员来说,让软件接受不确定性是很重要的,因为用户需求或设计决策并不总是完全确定的。本文介绍了iArch-U,一个基于eclipse的不确定性感知软件开发工具链,用于开发人员正确地描述、跟踪和管理UML建模、Java编程和测试阶段的不确定性横切。通过与Git集成,iArch-U可以管理项目中出现不确定问题的原因/时间/地点,或者将不确定问题固定为确定问题。在这个工具演示中,我们展示了使用iArch-U进行不确定性感知软件开发的世界。我们的工具是从http://posl.github.io/iArch/发布的开源软件。
{"title":"Git-Based Integrated Uncertainty Manager","authors":"Naoyasu Ubayashi, Takuya Watanabe, Yasutaka Kamei, Ryosuke Sato","doi":"10.1109/ICSE-Companion.2019.00047","DOIUrl":"https://doi.org/10.1109/ICSE-Companion.2019.00047","url":null,"abstract":"Nowadays, many software systems are required to be updated and delivered in a short period of time. It is important for developers to make software embrace uncertainty, because user requirements or design decisions are not always completely determined. This paper introduces iArch-U, an Eclipse-based uncertainty-aware software development tool chain, for developers to properly describe, trace, and manage uncertainty crosscutting over UML modeling, Java programming, and testing phases. Integrating with Git, iArch-U can manage why/when/where uncertain concerns arise or are fixed to be certain in a project. In this tool demonstration, we show the world of uncertainty-aware software development using iArch-U. Our tool is open source software released from http://posl.github.io/iArch/.","PeriodicalId":273100,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)","volume":"299 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116787047","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Message from the Posters Chairs of ICSE 2019 来自ICSE 2019海报主席的信息
{"title":"Message from the Posters Chairs of ICSE 2019","authors":"","doi":"10.1109/icse-companion.2019.00008","DOIUrl":"https://doi.org/10.1109/icse-companion.2019.00008","url":null,"abstract":"","PeriodicalId":273100,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)","volume":"52 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127216963","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
MARVEL: A Generic, Scalable and Effective Vulnerability Detection Platform MARVEL:通用的、可扩展的、有效的漏洞检测平台
Xiaoning Du
Identifying vulnerabilities in real-world applications is challenging. Currently, static analysis tools are concerned with false positives; runtime detection tools are free of false positives but inefficient to achieve a full spectrum examination. In this work, we propose MARVEL, a generic, scalable and effective vulnerability detection platform. Firstly, a lightweight static tool, LEOPARD, is designed and implemented to identify potential vulnerable functions through program metrics. LEOPARD uses complexity metrics to group functions into a set of bins and then ranks functions in each bin with vulnerability metrics. Top functions in each bin are identified as potentially vulnerable. Secondly, a directed grey-box fuzzer is designed to take the results from LEOPARD for further confirmation. Our design stands out with the ability to automatically group adjacent functions and orchestrate both the macro level function directed fuzzing and the micro level path-condition directed fuzzing. LEOPARD is evaluated to cover 74.0% of vulnerable function when identifying 20% of functions as vulnerable and outperforms the baseline approaches. Further, three applications are proposed to demonstrate the usefulness of LEOPARD. As a result, we discovered 22 new bugs and eight of them are new vulnerabilities.
识别实际应用程序中的漏洞是一项挑战。目前,静态分析工具关注误报;运行时检测工具没有误报,但在实现全谱检查方面效率低下。在这项工作中,我们提出了一个通用的、可扩展的、有效的漏洞检测平台MARVEL。首先,设计并实现了一个轻量级静态工具LEOPARD,通过程序度量来识别潜在的脆弱功能。LEOPARD使用复杂性指标将功能分组到一组bin中,然后使用漏洞指标对每个bin中的功能进行排名。每个容器中的顶级函数都被识别为潜在的易受攻击。其次,设计了一个定向灰盒模糊仪,以获取LEOPARD的结果进行进一步确认。我们的设计具有自动分组相邻功能和协调宏观级功能定向模糊和微观级路径条件定向模糊的能力。当识别出20%的脆弱功能时,LEOPARD被评估为覆盖了74.0%的脆弱功能,并且优于基线方法。此外,提出了三个应用程序来演示LEOPARD的有用性。结果,我们发现了22个新漏洞,其中8个是新漏洞。
{"title":"MARVEL: A Generic, Scalable and Effective Vulnerability Detection Platform","authors":"Xiaoning Du","doi":"10.1109/ICSE-Companion.2019.00056","DOIUrl":"https://doi.org/10.1109/ICSE-Companion.2019.00056","url":null,"abstract":"Identifying vulnerabilities in real-world applications is challenging. Currently, static analysis tools are concerned with false positives; runtime detection tools are free of false positives but inefficient to achieve a full spectrum examination. In this work, we propose MARVEL, a generic, scalable and effective vulnerability detection platform. Firstly, a lightweight static tool, LEOPARD, is designed and implemented to identify potential vulnerable functions through program metrics. LEOPARD uses complexity metrics to group functions into a set of bins and then ranks functions in each bin with vulnerability metrics. Top functions in each bin are identified as potentially vulnerable. Secondly, a directed grey-box fuzzer is designed to take the results from LEOPARD for further confirmation. Our design stands out with the ability to automatically group adjacent functions and orchestrate both the macro level function directed fuzzing and the micro level path-condition directed fuzzing. LEOPARD is evaluated to cover 74.0% of vulnerable function when identifying 20% of functions as vulnerable and outperforms the baseline approaches. Further, three applications are proposed to demonstrate the usefulness of LEOPARD. As a result, we discovered 22 new bugs and eight of them are new vulnerabilities.","PeriodicalId":273100,"journal":{"name":"2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)","volume":"22 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2019-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116751914","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
期刊
2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1