首页 > 最新文献

2013 20th Working Conference on Reverse Engineering (WCRE)最新文献

英文 中文
Extracting business rules from COBOL: A model-based framework 从COBOL中提取业务规则:基于模型的框架
Pub Date : 2013-11-21 DOI: 10.1109/WCRE.2013.6671316
Valerio Cosentino, Jordi Cabot, P. Albert, Philippe Bauquel, Jacques Perronnet
Organizations rely on the logic embedded in their Information Systems for their daily operations. This logic implements the business rules in place in the organization, which must be continuously adapted in response to market changes. Unfortunately, this evolution implies understanding and evolving also the underlying software components enforcing those rules. This is challenging because, first, the code implementing the rules is scattered throughout the whole system and, second, most of the time documentation is poor and out-of-date. This is specially true for older systems that have been maintained and evolved for several years (even decades). In those systems, it is not even clear which business rules are enforced nor whether rules are still consistent with the current organizational policies. In this sense, the goal of this paper is to facilitate the comprehension of legacy systems (in particular COBOL-based ones) by providing a model driven reverse engineering framework able to extract and visualize the business logic embedded in them.
组织依靠嵌入在其信息系统中的逻辑进行日常操作。此逻辑在组织中实现业务规则,必须不断地对其进行调整以响应市场变化。不幸的是,这种演变意味着理解并演变执行这些规则的底层软件组件。这是具有挑战性的,因为,首先,实现规则的代码分散在整个系统中,其次,大多数时候文档都很差且过时。对于已经维护和发展了几年(甚至几十年)的旧系统来说尤其如此。在这些系统中,甚至不清楚执行哪些业务规则,也不清楚规则是否仍然与当前的组织策略一致。从这个意义上说,本文的目标是通过提供一个模型驱动的逆向工程框架来促进对遗留系统(特别是基于cobol的系统)的理解,该框架能够提取和可视化嵌入其中的业务逻辑。
{"title":"Extracting business rules from COBOL: A model-based framework","authors":"Valerio Cosentino, Jordi Cabot, P. Albert, Philippe Bauquel, Jacques Perronnet","doi":"10.1109/WCRE.2013.6671316","DOIUrl":"https://doi.org/10.1109/WCRE.2013.6671316","url":null,"abstract":"Organizations rely on the logic embedded in their Information Systems for their daily operations. This logic implements the business rules in place in the organization, which must be continuously adapted in response to market changes. Unfortunately, this evolution implies understanding and evolving also the underlying software components enforcing those rules. This is challenging because, first, the code implementing the rules is scattered throughout the whole system and, second, most of the time documentation is poor and out-of-date. This is specially true for older systems that have been maintained and evolved for several years (even decades). In those systems, it is not even clear which business rules are enforced nor whether rules are still consistent with the current organizational policies. In this sense, the goal of this paper is to facilitate the comprehension of legacy systems (in particular COBOL-based ones) by providing a model driven reverse engineering framework able to extract and visualize the business logic embedded in them.","PeriodicalId":275092,"journal":{"name":"2013 20th Working Conference on Reverse Engineering (WCRE)","volume":"98 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-11-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115782750","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 17
Mining the relationship between anti-patterns dependencies and fault-proneness 挖掘反模式依赖和错误倾向之间的关系
Pub Date : 2013-11-21 DOI: 10.1109/WCRE.2013.6671310
Fehmi Jaafar, Yann-Gaël Guéhéneuc, Sylvie Hamel, Foutse Khomh
Anti-patterns describe poor solutions to design and implementation problems which are claimed to make object oriented systems hard to maintain. Anti-patterns indicate weaknesses in design that may slow down development or increase the risk of faults or failures in the future. Classes in anti-patterns have some dependencies, such as static relationships, that may propagate potential problems to other classes. To the best of our knowledge, the relationship between anti-patterns dependencies (with non anti-patterns classes) and faults has yet to be studied in details. This paper presents the results of an empirical study aimed at analysing anti-patterns dependencies in three open source software systems, namely ArgoUML, JFreeChart, and XerecesJ. We show that, in almost all releases of the three systems, classes having dependencies with anti-patterns are more fault-prone than others. We also report other observations about these dependencies such as their impact on fault prediction. Software organizations could make use of these knowledge about anti-patterns dependencies to better focus their testing and reviews activities toward the most risky classes, e.g., classes with fault-prone dependencies with anti-patterns.
反模式描述了设计和实现问题的糟糕解决方案,这些问题被认为使面向对象系统难以维护。反模式指出设计中的弱点,这些弱点可能会减慢开发速度,或者增加将来出现错误或失败的风险。反模式中的类具有一些依赖关系,例如静态关系,这些依赖关系可能会将潜在问题传播给其他类。据我们所知,反模式依赖(非反模式类)和错误之间的关系还有待详细研究。本文提出了一项实证研究的结果,旨在分析三个开源软件系统(即ArgoUML、JFreeChart和XerecesJ)中的反模式依赖关系。我们表明,在这三个系统的几乎所有版本中,与反模式有依赖关系的类比其他类更容易出错。我们还报告了关于这些依赖关系的其他观察结果,例如它们对故障预测的影响。软件组织可以利用这些关于反模式依赖关系的知识,更好地将他们的测试和审查活动集中在最危险的类上,例如,与反模式具有容易出错依赖关系的类。
{"title":"Mining the relationship between anti-patterns dependencies and fault-proneness","authors":"Fehmi Jaafar, Yann-Gaël Guéhéneuc, Sylvie Hamel, Foutse Khomh","doi":"10.1109/WCRE.2013.6671310","DOIUrl":"https://doi.org/10.1109/WCRE.2013.6671310","url":null,"abstract":"Anti-patterns describe poor solutions to design and implementation problems which are claimed to make object oriented systems hard to maintain. Anti-patterns indicate weaknesses in design that may slow down development or increase the risk of faults or failures in the future. Classes in anti-patterns have some dependencies, such as static relationships, that may propagate potential problems to other classes. To the best of our knowledge, the relationship between anti-patterns dependencies (with non anti-patterns classes) and faults has yet to be studied in details. This paper presents the results of an empirical study aimed at analysing anti-patterns dependencies in three open source software systems, namely ArgoUML, JFreeChart, and XerecesJ. We show that, in almost all releases of the three systems, classes having dependencies with anti-patterns are more fault-prone than others. We also report other observations about these dependencies such as their impact on fault prediction. Software organizations could make use of these knowledge about anti-patterns dependencies to better focus their testing and reviews activities toward the most risky classes, e.g., classes with fault-prone dependencies with anti-patterns.","PeriodicalId":275092,"journal":{"name":"2013 20th Working Conference on Reverse Engineering (WCRE)","volume":"15 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-11-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130332654","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 42
Workshop on open and original problems in software language engineering 软件语言工程中的开放和原始问题研讨会
Pub Date : 2013-11-21 DOI: 10.1109/WCRE.2013.6671334
A. H. Bagge, Vadim Zaytsev
The OOPSLE workshop is a discussion-oriented and collaborative forum for formulating and addressing with open, unsolved and unsolvable problems in software language engineering (SLE), which is a research domain of systematic, disciplined and measurable approaches of development, evolution and maintenance of artificial languages used in software development. OOPSLE aims to serve as a think tank in selecting candidates for the open problem list, as well as other kinds of unconventional questions and definitions that do not necessarily have clear answers or solutions, thus facilitating the exposure of dark data. We also plan to formulate promising language-related challenges to organise in the future. http://oopsle.github.io
软件语言工程(SLE)是一个系统的、有纪律的、可测量的软件开发、进化和维护人工语言的研究领域,它是一个讨论导向的协作论坛,用于制定和解决软件语言工程(SLE)中开放的、未解决的和无法解决的问题。OOPSLE旨在为开放问题列表以及其他不一定有明确答案或解决方案的非常规问题和定义选择候选人提供智库,从而促进暗数据的暴露。我们还计划制定有前途的语言相关的挑战,以便在未来组织。http://oopsle.github.io
{"title":"Workshop on open and original problems in software language engineering","authors":"A. H. Bagge, Vadim Zaytsev","doi":"10.1109/WCRE.2013.6671334","DOIUrl":"https://doi.org/10.1109/WCRE.2013.6671334","url":null,"abstract":"The OOPSLE workshop is a discussion-oriented and collaborative forum for formulating and addressing with open, unsolved and unsolvable problems in software language engineering (SLE), which is a research domain of systematic, disciplined and measurable approaches of development, evolution and maintenance of artificial languages used in software development. OOPSLE aims to serve as a think tank in selecting candidates for the open problem list, as well as other kinds of unconventional questions and definitions that do not necessarily have clear answers or solutions, thus facilitating the exposure of dark data. We also plan to formulate promising language-related challenges to organise in the future. http://oopsle.github.io","PeriodicalId":275092,"journal":{"name":"2013 20th Working Conference on Reverse Engineering (WCRE)","volume":"69 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-11-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127887242","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Who allocated my memory? Detecting custom memory allocators in C binaries 谁分配了我的内存?检测C二进制文件中的自定义内存分配器
Pub Date : 2013-11-21 DOI: 10.1109/WCRE.2013.6671277
X. Chen, Asia Slowinska, H. Bos
Many reversing techniques for data structures rely on the knowledge of memory allocation routines. Typically, they interpose on the system's malloc and free functions, and track each chunk of memory thus allocated as a data structure. However, many performance-critical applications implement their own custom memory allocators. Examples include webservers, database management systems, and compilers like gcc and clang. As a result, current binary analysis techniques for tracking data structures fail on such binaries. We present MemBrush, a new tool to detect memory allocation and deallocation functions in stripped binaries with high accuracy. We evaluated the technique on a large number of real world applications that use custom memory allocators. As we show, we can furnish existing reversing tools with detailed information about the memory management API, and as a result perform an analysis of the actual application specific data structures designed by the programmer. Our system uses dynamic analysis and detects memory allocation and deallocation routines by searching for functions that comply with a set of generic characteristics of allocators and deallocators.
许多数据结构的反转技术依赖于内存分配例程的知识。通常,它们会干预系统的malloc和free函数,并跟踪作为数据结构分配的每个内存块。但是,许多性能关键型应用程序实现了自己的自定义内存分配器。示例包括web服务器、数据库管理系统以及像gcc和clang这样的编译器。因此,当前用于跟踪数据结构的二进制分析技术无法处理此类二进制文件。MemBrush是一种新的工具,可以高精度地检测剥离二进制文件中的内存分配和释放函数。我们在大量使用自定义内存分配器的实际应用程序上评估了该技术。正如我们所展示的,我们可以为现有的反转工具提供有关内存管理API的详细信息,从而对程序员设计的特定于应用程序的实际数据结构进行分析。我们的系统使用动态分析,并通过搜索符合分配器和释放器的一组通用特征的函数来检测内存分配和释放例程。
{"title":"Who allocated my memory? Detecting custom memory allocators in C binaries","authors":"X. Chen, Asia Slowinska, H. Bos","doi":"10.1109/WCRE.2013.6671277","DOIUrl":"https://doi.org/10.1109/WCRE.2013.6671277","url":null,"abstract":"Many reversing techniques for data structures rely on the knowledge of memory allocation routines. Typically, they interpose on the system's malloc and free functions, and track each chunk of memory thus allocated as a data structure. However, many performance-critical applications implement their own custom memory allocators. Examples include webservers, database management systems, and compilers like gcc and clang. As a result, current binary analysis techniques for tracking data structures fail on such binaries. We present MemBrush, a new tool to detect memory allocation and deallocation functions in stripped binaries with high accuracy. We evaluated the technique on a large number of real world applications that use custom memory allocators. As we show, we can furnish existing reversing tools with detailed information about the memory management API, and as a result perform an analysis of the actual application specific data structures designed by the programmer. Our system uses dynamic analysis and detects memory allocation and deallocation routines by searching for functions that comply with a set of generic characteristics of allocators and deallocators.","PeriodicalId":275092,"journal":{"name":"2013 20th Working Conference on Reverse Engineering (WCRE)","volume":"8 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-11-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127516811","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 35
Reusing reused code 重用重用的代码
Pub Date : 2013-11-21 DOI: 10.1109/WCRE.2013.6671322
Tomoya Ishihara, Keisuke Hotta, Yoshiki Higo, S. Kusumoto
Although source code search systems are well known as being helpful to reuse source code, they have an issue that they often suggest larger code than what users actually need. This is because they suggest code based on the structure of programming languages such as files or classes. In this paper, we propose a new code search technique that considers past reuse. In the proposed technique, code are suggested at the unit of past reuse. The proposed technique detects reused code by using a fine-grained code clone detection technique. We conducted an experiment to compare the proposed technique with an existing technique. The result shows that the proposed technique helps more effectively to reuse code than the existing technique.
尽管众所周知,源代码搜索系统有助于重用源代码,但它们有一个问题,即它们经常建议比用户实际需要的更大的代码。这是因为它们建议基于编程语言(如文件或类)的结构编写代码。在本文中,我们提出了一种新的考虑过去重用的代码搜索技术。在建议的技术中,代码被建议在过去重用的单元。该技术通过使用细粒度的代码克隆检测技术来检测重用的代码。我们进行了一项实验,将提出的技术与现有技术进行比较。结果表明,该技术比现有技术更有效地实现了代码的重用。
{"title":"Reusing reused code","authors":"Tomoya Ishihara, Keisuke Hotta, Yoshiki Higo, S. Kusumoto","doi":"10.1109/WCRE.2013.6671322","DOIUrl":"https://doi.org/10.1109/WCRE.2013.6671322","url":null,"abstract":"Although source code search systems are well known as being helpful to reuse source code, they have an issue that they often suggest larger code than what users actually need. This is because they suggest code based on the structure of programming languages such as files or classes. In this paper, we propose a new code search technique that considers past reuse. In the proposed technique, code are suggested at the unit of past reuse. The proposed technique detects reused code by using a fine-grained code clone detection technique. We conducted an experiment to compare the proposed technique with an existing technique. The result shows that the proposed technique helps more effectively to reuse code than the existing technique.","PeriodicalId":275092,"journal":{"name":"2013 20th Working Conference on Reverse Engineering (WCRE)","volume":"142 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-11-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133736358","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 7
Distilling useful clones by contextual differencing 通过上下文差异提取有用的克隆
Pub Date : 2013-11-21 DOI: 10.1109/WCRE.2013.6671285
Zhenchang Xing, Yinxing Xue, S. Jarzabek
Clone detectors find similar code fragments and report large numbers of them for large systems. Textually similar clones may perform different computations, depending on the program context in which clones occur. Understanding these contextual differences is essential to distill useful clones for a specific maintenance task, such as refactoring. Manual analysis of contextual differences is time consuming and error-prone. To mitigate this problem, we present an automated approach to helping developers find and analyze contextual differences of clones. Our approach represents context of clones as program dependence graphs, and applies a graph differencing technique to identify required contextual differences of clones. We implemented a tool called CloneDifferentiator that identifies contextual differences of clones and allows developers to formulate queries to distill candidate clones that are useful for a given refactoring task. Two empirical studies show that CloneDifferentiator can reduce the efforts of post-detection analysis of clones for refactorings.
克隆检测器发现类似的代码片段,并报告大型系统的大量代码片段。文本相似的克隆可能执行不同的计算,这取决于发生克隆的程序上下文。理解这些上下文差异对于为特定的维护任务(如重构)提取有用的克隆非常重要。手工分析上下文差异既耗时又容易出错。为了缓解这个问题,我们提出了一种自动化的方法来帮助开发人员发现和分析克隆的上下文差异。我们的方法将克隆的上下文表示为程序依赖图,并应用图差分技术来识别所需的克隆的上下文差异。我们实现了一个名为CloneDifferentiator的工具,它可以识别克隆的上下文差异,并允许开发人员制定查询,以提取对给定重构任务有用的候选克隆。两项实证研究表明,CloneDifferentiator可以减少克隆检测后的重构分析工作量。
{"title":"Distilling useful clones by contextual differencing","authors":"Zhenchang Xing, Yinxing Xue, S. Jarzabek","doi":"10.1109/WCRE.2013.6671285","DOIUrl":"https://doi.org/10.1109/WCRE.2013.6671285","url":null,"abstract":"Clone detectors find similar code fragments and report large numbers of them for large systems. Textually similar clones may perform different computations, depending on the program context in which clones occur. Understanding these contextual differences is essential to distill useful clones for a specific maintenance task, such as refactoring. Manual analysis of contextual differences is time consuming and error-prone. To mitigate this problem, we present an automated approach to helping developers find and analyze contextual differences of clones. Our approach represents context of clones as program dependence graphs, and applies a graph differencing technique to identify required contextual differences of clones. We implemented a tool called CloneDifferentiator that identifies contextual differences of clones and allows developers to formulate queries to distill candidate clones that are useful for a given refactoring task. Two empirical studies show that CloneDifferentiator can reduce the efforts of post-detection analysis of clones for refactorings.","PeriodicalId":275092,"journal":{"name":"2013 20th Working Conference on Reverse Engineering (WCRE)","volume":"82 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-11-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132568380","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 3
MemPick: High-level data structure detection in C/C++ binaries MemPick: C/ c++二进制文件中的高级数据结构检测
Pub Date : 2013-11-21 DOI: 10.1109/WCRE.2013.6671278
I. Haller, Asia Slowinska, H. Bos
Many existing techniques for reversing data structures in C/C++ binaries are limited to low-level programming constructs, such as individual variables or structs. Unfortunately, without detailed information about a program's pointer structures, forensics and reverse engineering are exceedingly hard. To fill this gap, we propose MemPick, a tool that detects and classifies high-level data structures used in stripped binaries. By analyzing how links between memory objects evolve throughout the program execution, it distinguishes between many commonly used data structures, such as singly- or doubly-linked lists, many types of trees (e.g., AVL, red-black trees, B-trees), and graphs. We evaluate the technique on 10 real world applications and 16 popular libraries. The results show that MemPick can identify the data structures with high accuracy.
C/ c++二进制文件中用于反转数据结构的许多现有技术仅限于低级编程结构,例如单个变量或结构体。不幸的是,如果没有关于程序指针结构的详细信息,取证和逆向工程是非常困难的。为了填补这一空白,我们提出了MemPick,这是一个检测和分类剥离二进制文件中使用的高级数据结构的工具。通过分析内存对象之间的链接在整个程序执行过程中是如何演变的,它可以区分许多常用的数据结构,例如单链表或双链表、许多类型的树(例如,AVL、红黑树、b树)和图。我们在10个真实世界的应用程序和16个流行的库中评估了该技术。结果表明,MemPick能够以较高的准确率识别数据结构。
{"title":"MemPick: High-level data structure detection in C/C++ binaries","authors":"I. Haller, Asia Slowinska, H. Bos","doi":"10.1109/WCRE.2013.6671278","DOIUrl":"https://doi.org/10.1109/WCRE.2013.6671278","url":null,"abstract":"Many existing techniques for reversing data structures in C/C++ binaries are limited to low-level programming constructs, such as individual variables or structs. Unfortunately, without detailed information about a program's pointer structures, forensics and reverse engineering are exceedingly hard. To fill this gap, we propose MemPick, a tool that detects and classifies high-level data structures used in stripped binaries. By analyzing how links between memory objects evolve throughout the program execution, it distinguishes between many commonly used data structures, such as singly- or doubly-linked lists, many types of trees (e.g., AVL, red-black trees, B-trees), and graphs. We evaluate the technique on 10 real world applications and 16 popular libraries. The results show that MemPick can identify the data structures with high accuracy.","PeriodicalId":275092,"journal":{"name":"2013 20th Working Conference on Reverse Engineering (WCRE)","volume":"40 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-11-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133004072","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 24
Recommending Move Method refactorings using dependency sets 建议使用依赖集移动方法重构
Pub Date : 2013-11-21 DOI: 10.1109/WCRE.2013.6671298
Vitor Sales, Ricardo Terra, L. F. Miranda, M. T. Valente
Methods implemented in incorrect classes are common bad smells in object-oriented systems, especially in the case of systems maintained and evolved for years. To tackle this design flaw, we propose a novel approach that recommends Move Method refactorings based on the set of static dependencies established by a method. More specifically, our approach compares the similarity of the dependencies established by a source method with the dependencies established by the methods in possible target classes. We evaluated our approach using systems from a compiled version of the Qualitas Corpus. We report that our approach provides an average precision of 60.63% and an average recall of 81.07%. Such results are, respectively, 129% and 49% better than the results achieved by JDeodorant, a well-known move method recommendation system.
在不正确的类中实现的方法在面向对象系统中很常见,特别是在系统维护和发展多年的情况下。为了解决这个设计缺陷,我们提出了一种新颖的方法,建议基于方法建立的静态依赖集对Move Method进行重构。更具体地说,我们的方法比较了源方法建立的依赖关系与可能的目标类中的方法建立的依赖关系的相似性。我们使用来自Qualitas语料库的编译版本的系统来评估我们的方法。我们报告我们的方法提供了60.63%的平均精度和81.07%的平均召回率。这样的结果分别比知名的移动方法推荐系统JDeodorant的结果好129%和49%。
{"title":"Recommending Move Method refactorings using dependency sets","authors":"Vitor Sales, Ricardo Terra, L. F. Miranda, M. T. Valente","doi":"10.1109/WCRE.2013.6671298","DOIUrl":"https://doi.org/10.1109/WCRE.2013.6671298","url":null,"abstract":"Methods implemented in incorrect classes are common bad smells in object-oriented systems, especially in the case of systems maintained and evolved for years. To tackle this design flaw, we propose a novel approach that recommends Move Method refactorings based on the set of static dependencies established by a method. More specifically, our approach compares the similarity of the dependencies established by a source method with the dependencies established by the methods in possible target classes. We evaluated our approach using systems from a compiled version of the Qualitas Corpus. We report that our approach provides an average precision of 60.63% and an average recall of 81.07%. Such results are, respectively, 129% and 49% better than the results achieved by JDeodorant, a well-known move method recommendation system.","PeriodicalId":275092,"journal":{"name":"2013 20th Working Conference on Reverse Engineering (WCRE)","volume":"24 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-11-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133355418","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 65
LigRE: Reverse-engineering of control and data flow models for black-box XSS detection 用于黑盒XSS检测的控制和数据流模型的逆向工程
Pub Date : 2013-11-21 DOI: 10.1109/WCRE.2013.6671300
F. Duchene, Sanjay Rawat, J. Richier, Roland Groz
Fuzz testing consists of automatically generating and sending malicious inputs to an application in order to hopefully trigger a vulnerability. In order to be efficient, the fuzzing should answer questions such as: Where to send a malicious value? Where to observe its effects? How to position the system in such states? Answering such questions is a matter of understanding precisely enough the application. Reverseengineering is a possible way to gain this knowledge, especially in a black-box harness. In fact, given the complexity of modern web applications, automated black-box scanners alternatively reverse-engineer and fuzz web applications to detect vulnerabilities. We present an approach, named as LigRE, which improves the reverse engineering to guide the fuzzing. We adapt a method to automatically learn a control flow model of web applications, and annotate this model with inferred data flows. Afterwards, we generate slices of the model for guiding the scope of a fuzzer. Empirical experiments show that LigRE increases detection capabilities of Cross Site Scripting (XSS), a particular case of web command injection vulnerabilities.
模糊测试包括自动生成和发送恶意输入到应用程序,以便触发漏洞。为了提高效率,模糊测试应该回答以下问题:向哪里发送恶意值?在哪里观察它的效果?在这种状态下如何定位系统?回答这些问题需要对应用程序有足够的理解。逆向工程是获得这种知识的一种可能的方法,特别是在黑盒控制中。事实上,考虑到现代web应用程序的复杂性,自动黑盒扫描程序可以对web应用程序进行逆向工程和模糊处理,以检测漏洞。我们提出了一种称为LigRE的方法,它改进了逆向工程来指导模糊测试。我们采用了一种自动学习web应用程序控制流模型的方法,并用推断的数据流对该模型进行注释。然后,我们生成用于指导模糊器范围的模型切片。经验实验表明,LigRE提高了跨站脚本(XSS)的检测能力,这是web命令注入漏洞的一个特殊案例。
{"title":"LigRE: Reverse-engineering of control and data flow models for black-box XSS detection","authors":"F. Duchene, Sanjay Rawat, J. Richier, Roland Groz","doi":"10.1109/WCRE.2013.6671300","DOIUrl":"https://doi.org/10.1109/WCRE.2013.6671300","url":null,"abstract":"Fuzz testing consists of automatically generating and sending malicious inputs to an application in order to hopefully trigger a vulnerability. In order to be efficient, the fuzzing should answer questions such as: Where to send a malicious value? Where to observe its effects? How to position the system in such states? Answering such questions is a matter of understanding precisely enough the application. Reverseengineering is a possible way to gain this knowledge, especially in a black-box harness. In fact, given the complexity of modern web applications, automated black-box scanners alternatively reverse-engineer and fuzz web applications to detect vulnerabilities. We present an approach, named as LigRE, which improves the reverse engineering to guide the fuzzing. We adapt a method to automatically learn a control flow model of web applications, and annotate this model with inferred data flows. Afterwards, we generate slices of the model for guiding the scope of a fuzzer. Empirical experiments show that LigRE increases detection capabilities of Cross Site Scripting (XSS), a particular case of web command injection vulnerabilities.","PeriodicalId":275092,"journal":{"name":"2013 20th Working Conference on Reverse Engineering (WCRE)","volume":"201 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-11-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134179090","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 24
Do developers care about code smells? An exploratory survey 开发人员关心代码气味吗?探索性调查
Pub Date : 2013-11-21 DOI: 10.1109/WCRE.2013.6671299
A. Yamashita, L. Moonen
Code smells are a well-known metaphor to describe symptoms of code decay or other issues with code quality which can lead to a variety of maintenance problems. Even though code smell detection and removal has been well-researched over the last decade, it remains open to debate whether or not code smells should be considered meaningful conceptualizations of code quality issues from the developer's perspective. To some extent, this question applies as well to the results provided by current code smell detection tools. Are code smells really important for developers? If they are not, is this due to the lack of relevance of the underlying concepts, due to the lack of awareness about code smells on the developers' side, or due to the lack of appropriate tools for code smell analysis or removal? In order to align and direct research efforts to address actual needs and problems of professional developers, we need to better understand the knowledge about, and interest in code smells, together with their perceived criticality. This paper reports on the results obtained from an exploratory survey involving 85 professional software developers.
代码气味是一个众所周知的比喻,用来描述代码衰减的症状或其他可能导致各种维护问题的代码质量问题。尽管在过去的十年中,代码气味检测和去除已经得到了很好的研究,但是从开发人员的角度来看,是否应该将代码气味视为代码质量问题的有意义的概念化,仍然存在争议。在某种程度上,这个问题也适用于当前代码气味检测工具提供的结果。代码气味对开发人员来说真的很重要吗?如果不是,这是因为底层概念缺乏相关性,是因为开发人员缺乏对代码气味的认识,还是因为缺乏适当的工具来分析或删除代码气味?为了协调和指导研究工作,以解决专业开发人员的实际需求和问题,我们需要更好地理解关于代码气味的知识和兴趣,以及它们感知到的临界性。本文报告了一项涉及85名专业软件开发人员的探索性调查的结果。
{"title":"Do developers care about code smells? An exploratory survey","authors":"A. Yamashita, L. Moonen","doi":"10.1109/WCRE.2013.6671299","DOIUrl":"https://doi.org/10.1109/WCRE.2013.6671299","url":null,"abstract":"Code smells are a well-known metaphor to describe symptoms of code decay or other issues with code quality which can lead to a variety of maintenance problems. Even though code smell detection and removal has been well-researched over the last decade, it remains open to debate whether or not code smells should be considered meaningful conceptualizations of code quality issues from the developer's perspective. To some extent, this question applies as well to the results provided by current code smell detection tools. Are code smells really important for developers? If they are not, is this due to the lack of relevance of the underlying concepts, due to the lack of awareness about code smells on the developers' side, or due to the lack of appropriate tools for code smell analysis or removal? In order to align and direct research efforts to address actual needs and problems of professional developers, we need to better understand the knowledge about, and interest in code smells, together with their perceived criticality. This paper reports on the results obtained from an exploratory survey involving 85 professional software developers.","PeriodicalId":275092,"journal":{"name":"2013 20th Working Conference on Reverse Engineering (WCRE)","volume":"19 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-11-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114297829","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 198
期刊
2013 20th Working Conference on Reverse Engineering (WCRE)
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1