首页 > 最新文献

2013 35th International Conference on Software Engineering (ICSE)最新文献

英文 中文
Supporting application development with structured queries in the cloud 支持在云中使用结构化查询进行应用程序开发
Pub Date : 2013-05-18 DOI: 10.1109/ICSE.2013.6606681
Michael Smit, B. Simmons, Mark Shtern, Marin Litoiu
To facilitate software development for multiple, federated cloud systems, abstraction layers have been introduced to mask the differences in the offerings, APIs, and terminology of various cloud providers. Such layers rely on a common ontology, which a) is difficult to create, and b) requires developers to understand both the common ontology and how various providers deviate from it. In this paper we propose and describe a structured query language for the cloud, Cloud SQL, along with a system and methodology for acquiring and organizing information from cloud providers and other entities in the cloud ecosystem such that it can be queried. It allows developers to run queries on data organized based on their semantic understanding of the cloud. Like the original SQL, we believe the use of a declarative query language will reduce development costs and make the multi-cloud accessible to a broader set of developers.
为了促进针对多个联邦云系统的软件开发,引入了抽象层来掩盖各种云提供商的产品、api和术语之间的差异。这些层依赖于一个共同的本体,而这个本体a)很难创建,b)要求开发人员既要理解共同的本体,又要了解各种提供者是如何偏离它的。在本文中,我们提出并描述了一种用于云的结构化查询语言,cloud SQL,以及一种系统和方法,用于从云提供商和云生态系统中的其他实体获取和组织信息,以便对其进行查询。它允许开发人员对基于他们对云的语义理解组织的数据运行查询。与最初的SQL一样,我们相信使用声明式查询语言将降低开发成本,并使更多的开发人员可以访问多云。
{"title":"Supporting application development with structured queries in the cloud","authors":"Michael Smit, B. Simmons, Mark Shtern, Marin Litoiu","doi":"10.1109/ICSE.2013.6606681","DOIUrl":"https://doi.org/10.1109/ICSE.2013.6606681","url":null,"abstract":"To facilitate software development for multiple, federated cloud systems, abstraction layers have been introduced to mask the differences in the offerings, APIs, and terminology of various cloud providers. Such layers rely on a common ontology, which a) is difficult to create, and b) requires developers to understand both the common ontology and how various providers deviate from it. In this paper we propose and describe a structured query language for the cloud, Cloud SQL, along with a system and methodology for acquiring and organizing information from cloud providers and other entities in the cloud ecosystem such that it can be queried. It allows developers to run queries on data organized based on their semantic understanding of the cloud. Like the original SQL, we believe the use of a declarative query language will reduce development costs and make the multi-cloud accessible to a broader set of developers.","PeriodicalId":322423,"journal":{"name":"2013 35th International Conference on Software Engineering (ICSE)","volume":"573 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-05-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134268763","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 4
Human performance regression testing 人类行为回归测试
Pub Date : 2013-05-18 DOI: 10.5555/2486788.2486809
Amanda Swearngin, Myra B. Cohen, Bonnie E. John, R. Bellamy
As software systems evolve, new interface features such as keyboard shortcuts and toolbars are introduced. While it is common to regression test the new features for functional correctness, there has been less focus on systematic regression testing for usability, due to the effort and time involved in human studies. Cognitive modeling tools such as CogTool provide some help by computing predictions of user performance, but they still require manual effort to describe the user interface and tasks, limiting regression testing efforts. In recent work, we developed CogTool-Helper to reduce the effort required to generate human performance models of existing systems. We build on this work by providing task specific test case generation and present our vision for human performance regression testing (HPRT) that generates large numbers of test cases and evaluates a range of human performance predictions for the same task. We examine the feasibility of HPRT on four tasks in LibreOffice, find several regressions, and then discuss how a project team could use this information. We also illustrate that we can increase efficiency with sampling by leveraging an inference algorithm. Samples that take approximately 50% of the runtime lose at most 10% of the performance predictions.
随着软件系统的发展,新的界面特性,如键盘快捷键和工具栏被引入。虽然对新特性进行回归测试以确保功能的正确性是很常见的,但对可用性进行系统回归测试的关注较少,这是由于人类研究所涉及的精力和时间。认知建模工具(如CogTool)通过计算用户性能的预测提供了一些帮助,但是它们仍然需要人工来描述用户界面和任务,从而限制了回归测试的工作。在最近的工作中,我们开发了CogTool-Helper,以减少生成现有系统的人类性能模型所需的工作量。我们通过提供特定于任务的测试用例生成,并展示我们对人类性能回归测试(HPRT)的愿景,该测试用例生成大量测试用例,并评估同一任务的一系列人类性能预测。我们检查了HPRT在LibreOffice中的四个任务上的可行性,找到了几个回归,然后讨论了项目团队如何使用这些信息。我们还说明了我们可以通过利用推理算法来提高采样效率。占用大约50%运行时的样本最多会损失10%的性能预测。
{"title":"Human performance regression testing","authors":"Amanda Swearngin, Myra B. Cohen, Bonnie E. John, R. Bellamy","doi":"10.5555/2486788.2486809","DOIUrl":"https://doi.org/10.5555/2486788.2486809","url":null,"abstract":"As software systems evolve, new interface features such as keyboard shortcuts and toolbars are introduced. While it is common to regression test the new features for functional correctness, there has been less focus on systematic regression testing for usability, due to the effort and time involved in human studies. Cognitive modeling tools such as CogTool provide some help by computing predictions of user performance, but they still require manual effort to describe the user interface and tasks, limiting regression testing efforts. In recent work, we developed CogTool-Helper to reduce the effort required to generate human performance models of existing systems. We build on this work by providing task specific test case generation and present our vision for human performance regression testing (HPRT) that generates large numbers of test cases and evaluates a range of human performance predictions for the same task. We examine the feasibility of HPRT on four tasks in LibreOffice, find several regressions, and then discuss how a project team could use this information. We also illustrate that we can increase efficiency with sampling by leveraging an inference algorithm. Samples that take approximately 50% of the runtime lose at most 10% of the performance predictions.","PeriodicalId":322423,"journal":{"name":"2013 35th International Conference on Software Engineering (ICSE)","volume":"111 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-05-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134106612","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 18
Selecting checkpoints along the time line: A novel temporal checkpoint selection strategy for monitoring a batch of parallel business processes 沿着时间线选择检查点:一种新的临时检查点选择策略,用于监视一批并行业务流程
Pub Date : 2013-05-18 DOI: 10.1109/ICSE.2013.6606698
X. Liu, Yun Yang, Dahai Cao, Dong Yuan
Nowadays, most business processes are running in a parallel, distributed and time-constrained manner. How to guarantee their on-time completion is a challenging issue. In the past few years, temporal checkpoint selection which selects a subset of workflow activities for verification of temporal consistency has been proved to be very successful in monitoring single, complex and large size scientific workflows. An intuitive approach is to apply those strategies to individual business processes. However, in such a case, the total number of checkpoints will be enormous, namely the cost for system monitoring and exception handling could be excessive. To address such an issue, we propose a brand new idea which selects time points along the workflow execution time line as checkpoints to monitor a batch of parallel business processes simultaneously instead of individually. Based on such an idea, a set of new definitions as well as a time-point based checkpoint selection strategy are presented in this paper. Our preliminary results demonstrate that it can achieve an order of magnitude reduction in the number of checkpoints while maintaining satisfactory on-time completion rates compared with the state-of-the-art activity-point based checkpoint selection strategy.
如今,大多数业务流程以并行、分布式和时间受限的方式运行。如何保证它们按时完成是一个具有挑战性的问题。在过去的几年中,选择工作流活动子集来验证时间一致性的时间检查点选择在监控单个、复杂和大型科学工作流方面被证明是非常成功的。一种直观的方法是将这些策略应用于单个业务流程。但是,在这种情况下,检查点的总数将是巨大的,即系统监视和异常处理的成本可能过高。为了解决这一问题,我们提出了一个全新的想法,即在工作流执行时间线上选择时间点作为检查点,同时监视一批并行业务流程,而不是单独监视一批并行业务流程。基于这一思想,本文提出了一套新的定义和基于时间点的检查点选择策略。我们的初步结果表明,与最先进的基于活动点的检查点选择策略相比,它可以实现检查点数量的数量级减少,同时保持令人满意的准时完成率。
{"title":"Selecting checkpoints along the time line: A novel temporal checkpoint selection strategy for monitoring a batch of parallel business processes","authors":"X. Liu, Yun Yang, Dahai Cao, Dong Yuan","doi":"10.1109/ICSE.2013.6606698","DOIUrl":"https://doi.org/10.1109/ICSE.2013.6606698","url":null,"abstract":"Nowadays, most business processes are running in a parallel, distributed and time-constrained manner. How to guarantee their on-time completion is a challenging issue. In the past few years, temporal checkpoint selection which selects a subset of workflow activities for verification of temporal consistency has been proved to be very successful in monitoring single, complex and large size scientific workflows. An intuitive approach is to apply those strategies to individual business processes. However, in such a case, the total number of checkpoints will be enormous, namely the cost for system monitoring and exception handling could be excessive. To address such an issue, we propose a brand new idea which selects time points along the workflow execution time line as checkpoints to monitor a batch of parallel business processes simultaneously instead of individually. Based on such an idea, a set of new definitions as well as a time-point based checkpoint selection strategy are presented in this paper. Our preliminary results demonstrate that it can achieve an order of magnitude reduction in the number of checkpoints while maintaining satisfactory on-time completion rates compared with the state-of-the-art activity-point based checkpoint selection strategy.","PeriodicalId":322423,"journal":{"name":"2013 35th International Conference on Software Engineering (ICSE)","volume":"94 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-05-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133383362","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 15
Aluminum: Principled scenario exploration through minimality 铝:通过最小化原则场景探索
Pub Date : 2013-05-18 DOI: 10.1109/ICSE.2013.6606569
Tim Nelson, Salman Saghafi, Daniel J. Dougherty, Kathi Fisler, S. Krishnamurthi
Scenario-finding tools such as Alloy are widely used to understand the consequences of specifications, with applications to software modeling, security analysis, and verification. This paper focuses on the exploration of scenarios: which scenarios are presented first, and how to traverse them in a well-defined way. We present Aluminum, a modification of Alloy that presents only minimal scenarios: those that contain no more than is necessary. Aluminum lets users explore the scenario space by adding to scenarios and backtracking. It also provides the ability to find what can consistently be used to extend each scenario. We describe the semantic basis of Aluminum in terms of minimal models of first-order logic formulas. We show how this theory can be implemented atop existing SAT-solvers and quantify both the benefits of minimality and its small computational overhead. Finally, we offer some qualitative observations about scenario exploration in Aluminum.
像Alloy这样的场景查找工具被广泛用于理解规范的结果,以及软件建模、安全性分析和验证的应用程序。本文的重点是对场景的探索:首先呈现哪些场景,以及如何以良好定义的方式遍历它们。我们将介绍铝合金,它是Alloy的一种修改,只展示最小的场景:那些包含不超过必要的场景。Aluminum允许用户通过添加场景和回溯来探索场景空间。它还提供了查找可以一致地用于扩展每个场景的内容的能力。我们用一阶逻辑公式的最小模型描述了铝的语义基础。我们展示了如何在现有的sat求解器上实现这一理论,并量化了最小化的好处和它的小计算开销。最后,我们对铝的情景探索提出了一些定性的观察。
{"title":"Aluminum: Principled scenario exploration through minimality","authors":"Tim Nelson, Salman Saghafi, Daniel J. Dougherty, Kathi Fisler, S. Krishnamurthi","doi":"10.1109/ICSE.2013.6606569","DOIUrl":"https://doi.org/10.1109/ICSE.2013.6606569","url":null,"abstract":"Scenario-finding tools such as Alloy are widely used to understand the consequences of specifications, with applications to software modeling, security analysis, and verification. This paper focuses on the exploration of scenarios: which scenarios are presented first, and how to traverse them in a well-defined way. We present Aluminum, a modification of Alloy that presents only minimal scenarios: those that contain no more than is necessary. Aluminum lets users explore the scenario space by adding to scenarios and backtracking. It also provides the ability to find what can consistently be used to extend each scenario. We describe the semantic basis of Aluminum in terms of minimal models of first-order logic formulas. We show how this theory can be implemented atop existing SAT-solvers and quantify both the benefits of minimality and its small computational overhead. Finally, we offer some qualitative observations about scenario exploration in Aluminum.","PeriodicalId":322423,"journal":{"name":"2013 35th International Conference on Software Engineering (ICSE)","volume":"141 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-05-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115778555","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 70
Counter play-out: Executing unrealizable scenario-based specifications Counter play-out:执行无法实现的基于场景的规范
Pub Date : 2013-05-18 DOI: 10.1109/ICSE.2013.6606570
S. Maoz, Yaniv Sa'ar
The scenario-based approach to the specification and simulation of reactive systems has attracted much research efforts in recent years. While the problem of synthesizing a controller or a transition system from a scenario-based specification has been studied extensively, no work has yet effectively addressed the case where the specification is unrealizable and a controller cannot be synthesized. This has limited the effectiveness of using scenario-based specifications in requirements analysis and simulation. In this paper we present counter play-out, an interactive debugging method for unrealizable scenario-based specifications. When we identify an unrealizable specification, we generate a controller that plays the role of the environment and lets the engineer play the role of the system. During execution, the former chooses environment's moves such that the latter is forced to eventually fail in satisfying the system's requirements. This results in an interactive, guided execution, leading to the root causes of unrealizability. The generated controller constitutes a proof that the specification is conflicting and cannot be realized. Counter play-out is based on a counter strategy, which we compute by solving a Rabin game using a symbolic, BDD-based algorithm. The work is implemented and integrated with PlayGo, an IDE for scenario-based programming developed at the Weizmann Institute of Science. Case studies show the contribution of our work to the state-of-the-art in the scenario-based approach to specification and simulation.
基于场景的方法来规范和模拟反应系统近年来吸引了大量的研究工作。虽然从基于场景的规范合成控制器或转换系统的问题已经得到了广泛的研究,但还没有工作有效地解决规范无法实现且控制器无法合成的情况。这限制了在需求分析和模拟中使用基于场景的规范的有效性。在本文中,我们提出了计数器播放,这是一种针对无法实现的基于场景的规范的交互式调试方法。当我们确定一个无法实现的规范时,我们生成一个控制器,它扮演环境的角色,而让工程师扮演系统的角色。在执行过程中,前者选择环境的移动,使得后者最终被迫无法满足系统的需求。这将导致交互式的、有指导的执行,从而导致无法实现的根本原因。生成的控制器构成了规范冲突和无法实现的证明。反击是基于反击策略的,我们通过使用符号的、基于bdd的算法来解决Rabin游戏来计算。这项工作与PlayGo (Weizmann Institute of Science开发的基于场景编程的IDE)实现并集成在一起。案例研究显示了我们的工作对基于场景的规范和模拟方法的最新技术的贡献。
{"title":"Counter play-out: Executing unrealizable scenario-based specifications","authors":"S. Maoz, Yaniv Sa'ar","doi":"10.1109/ICSE.2013.6606570","DOIUrl":"https://doi.org/10.1109/ICSE.2013.6606570","url":null,"abstract":"The scenario-based approach to the specification and simulation of reactive systems has attracted much research efforts in recent years. While the problem of synthesizing a controller or a transition system from a scenario-based specification has been studied extensively, no work has yet effectively addressed the case where the specification is unrealizable and a controller cannot be synthesized. This has limited the effectiveness of using scenario-based specifications in requirements analysis and simulation. In this paper we present counter play-out, an interactive debugging method for unrealizable scenario-based specifications. When we identify an unrealizable specification, we generate a controller that plays the role of the environment and lets the engineer play the role of the system. During execution, the former chooses environment's moves such that the latter is forced to eventually fail in satisfying the system's requirements. This results in an interactive, guided execution, leading to the root causes of unrealizability. The generated controller constitutes a proof that the specification is conflicting and cannot be realized. Counter play-out is based on a counter strategy, which we compute by solving a Rabin game using a symbolic, BDD-based algorithm. The work is implemented and integrated with PlayGo, an IDE for scenario-based programming developed at the Weizmann Institute of Science. Case studies show the contribution of our work to the state-of-the-art in the scenario-based approach to specification and simulation.","PeriodicalId":322423,"journal":{"name":"2013 35th International Conference on Software Engineering (ICSE)","volume":"296 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-05-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124251419","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 20
Transfer defect learning 迁移缺陷学习
Pub Date : 2013-05-18 DOI: 10.1109/ICSE.2013.6606584
Jaechang Nam, Sinno Jialin Pan, Sunghun Kim
Many software defect prediction approaches have been proposed and most are effective in within-project prediction settings. However, for new projects or projects with limited training data, it is desirable to learn a prediction model by using sufficient training data from existing source projects and then apply the model to some target projects (cross-project defect prediction). Unfortunately, the performance of cross-project defect prediction is generally poor, largely because of feature distribution differences between the source and target projects. In this paper, we apply a state-of-the-art transfer learning approach, TCA, to make feature distributions in source and target projects similar. In addition, we propose a novel transfer defect learning approach, TCA+, by extending TCA. Our experimental results for eight open-source projects show that TCA+ significantly improves cross-project prediction performance.
已经提出了许多软件缺陷预测方法,并且大多数方法在项目内预测设置中是有效的。然而,对于新项目或训练数据有限的项目,最好是通过使用现有源项目中足够的训练数据来学习预测模型,然后将该模型应用于一些目标项目(跨项目缺陷预测)。不幸的是,跨项目缺陷预测的性能通常很差,很大程度上是因为源项目和目标项目之间的特征分布差异。在本文中,我们应用最先进的迁移学习方法,TCA,使源项目和目标项目中的特征分布相似。此外,我们提出了一种新的迁移缺陷学习方法——TCA+。我们对8个开源项目的实验结果表明,TCA+显著提高了跨项目的预测性能。
{"title":"Transfer defect learning","authors":"Jaechang Nam, Sinno Jialin Pan, Sunghun Kim","doi":"10.1109/ICSE.2013.6606584","DOIUrl":"https://doi.org/10.1109/ICSE.2013.6606584","url":null,"abstract":"Many software defect prediction approaches have been proposed and most are effective in within-project prediction settings. However, for new projects or projects with limited training data, it is desirable to learn a prediction model by using sufficient training data from existing source projects and then apply the model to some target projects (cross-project defect prediction). Unfortunately, the performance of cross-project defect prediction is generally poor, largely because of feature distribution differences between the source and target projects. In this paper, we apply a state-of-the-art transfer learning approach, TCA, to make feature distributions in source and target projects similar. In addition, we propose a novel transfer defect learning approach, TCA+, by extending TCA. Our experimental results for eight open-source projects show that TCA+ significantly improves cross-project prediction performance.","PeriodicalId":322423,"journal":{"name":"2013 35th International Conference on Software Engineering (ICSE)","volume":"21 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-05-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124305055","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 451
Path sensitive static analysis of web applications for remote code execution vulnerability detection 路径敏感静态分析web应用程序的远程代码执行漏洞检测
Pub Date : 2013-05-18 DOI: 10.1109/ICSE.2013.6606611
Yunhui Zheng, X. Zhang
Remote code execution (RCE) attacks are one of the most prominent security threats for web applications. It is a special kind of cross-site-scripting (XSS) attack that allows client inputs to be stored and executed as server side scripts. RCE attacks often require coordination of multiple requests and manipulation of string and non-string inputs from the client side to nullify the access control protocol and induce unusual execution paths on the server side. We propose a path- and context-sensitive interprocedural analysis to detect RCE vulnerabilities. The analysis features a novel way of analyzing both the string and non-string behavior of a web application in a path sensitive fashion. It thoroughly handles the practical challenges entailed by modeling RCE attacks. We develop a prototype system and evaluate it on ten real-world PHP applications. We have identified 21 true RCE vulnerabilities, with 8 unreported before.
远程代码执行(RCE)攻击是web应用程序最突出的安全威胁之一。这是一种特殊的跨站点脚本(XSS)攻击,它允许将客户机输入作为服务器端脚本存储和执行。RCE攻击通常需要协调来自客户端的多个请求和对字符串和非字符串输入的操作,以使访问控制协议无效,并在服务器端引发异常的执行路径。我们提出了一种路径和上下文敏感的过程间分析来检测RCE漏洞。该分析的特点是一种新颖的方法,以路径敏感的方式分析web应用程序的字符串和非字符串行为。它彻底处理了建模RCE攻击所带来的实际挑战。我们开发了一个原型系统,并在十个实际的PHP应用程序上对其进行了评估。我们已经确定了21个真正的RCE漏洞,其中8个以前未报告过。
{"title":"Path sensitive static analysis of web applications for remote code execution vulnerability detection","authors":"Yunhui Zheng, X. Zhang","doi":"10.1109/ICSE.2013.6606611","DOIUrl":"https://doi.org/10.1109/ICSE.2013.6606611","url":null,"abstract":"Remote code execution (RCE) attacks are one of the most prominent security threats for web applications. It is a special kind of cross-site-scripting (XSS) attack that allows client inputs to be stored and executed as server side scripts. RCE attacks often require coordination of multiple requests and manipulation of string and non-string inputs from the client side to nullify the access control protocol and induce unusual execution paths on the server side. We propose a path- and context-sensitive interprocedural analysis to detect RCE vulnerabilities. The analysis features a novel way of analyzing both the string and non-string behavior of a web application in a path sensitive fashion. It thoroughly handles the practical challenges entailed by modeling RCE attacks. We develop a prototype system and evaluate it on ten real-world PHP applications. We have identified 21 true RCE vulnerabilities, with 8 unreported before.","PeriodicalId":322423,"journal":{"name":"2013 35th International Conference on Software Engineering (ICSE)","volume":"117 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-05-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124317411","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 69
MCT: A tool for commenting programs by multimedia comments MCT:通过多媒体注释来注释程序的工具
Pub Date : 2013-05-18 DOI: 10.5555/2486788.2487000
Yiyang Hao, Ge Li, Lili Mou, Lu Zhang, Zhi Jin
Program comments have always been the key to understanding code. However, typical text comments can easily become verbose or evasive. Thus sometimes code reviewers find an audio or video code narration quite helpful. In this paper, we present our tool, called MCT (Multimedia Commenting Tool), which is an integrated development environment-based tool that enables programmers to easily explain their code by voice, video and mouse movement in the form of comments. With this tool, programmers can replay the audio or video when they feel like. A demonstration video can be accessed at: http://www.youtube.com/watch?v=tHEHqZme4VE.
程序注释一直是理解代码的关键。然而,典型的文本注释很容易变得冗长或含糊其辞。因此,有时代码审阅者会发现音频或视频代码叙述非常有帮助。在本文中,我们介绍了我们的工具,称为MCT(多媒体注释工具),这是一个基于集成开发环境的工具,使程序员能够通过语音、视频和鼠标移动以注释的形式轻松地解释他们的代码。有了这个工具,程序员可以随心所欲地重放音频或视频。演示视频可以在http://www.youtube.com/watch?v=tHEHqZme4VE上观看。
{"title":"MCT: A tool for commenting programs by multimedia comments","authors":"Yiyang Hao, Ge Li, Lili Mou, Lu Zhang, Zhi Jin","doi":"10.5555/2486788.2487000","DOIUrl":"https://doi.org/10.5555/2486788.2487000","url":null,"abstract":"Program comments have always been the key to understanding code. However, typical text comments can easily become verbose or evasive. Thus sometimes code reviewers find an audio or video code narration quite helpful. In this paper, we present our tool, called MCT (Multimedia Commenting Tool), which is an integrated development environment-based tool that enables programmers to easily explain their code by voice, video and mouse movement in the form of comments. With this tool, programmers can replay the audio or video when they feel like. A demonstration video can be accessed at: http://www.youtube.com/watch?v=tHEHqZme4VE.","PeriodicalId":322423,"journal":{"name":"2013 35th International Conference on Software Engineering (ICSE)","volume":"26 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-05-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123563037","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 8
On the value of user preferences in search-based software engineering: A case study in software product lines 基于搜索的软件工程中用户偏好的价值:一个软件产品线的案例研究
Pub Date : 2013-05-18 DOI: 10.1109/ICSE.2013.6606595
Abdel Salam Sayyad, T. Menzies, H. Ammar
Software design is a process of trading off competing objectives. If the user objective space is rich, then we should use optimizers that can fully exploit that richness. For example, this study configures software product lines (expressed as feature maps) using various search-based software engineering methods. As we increase the number of optimization objectives, we find that methods in widespread use (e.g. NSGA-II, SPEA2) perform much worse than IBEA (Indicator-Based Evolutionary Algorithm). IBEA works best since it makes most use of user preference knowledge. Hence it does better on the standard measures (hypervolume and spread) but it also generates far more products with 0% violations of domain constraints. Our conclusion is that we need to change our methods for search-based software engineering, particularly when studying complex decision spaces.
软件设计是一个权衡相互竞争的目标的过程。如果用户目标空间丰富,那么我们应该使用能够充分利用这种丰富的优化器。例如,本研究使用各种基于搜索的软件工程方法配置软件产品线(表示为特征图)。随着优化目标数量的增加,我们发现广泛使用的方法(如NSGA-II, SPEA2)的性能远不如IBEA(基于指标的进化算法)。IBEA效果最好,因为它充分利用了用户偏好知识。因此,它在标准度量(hypervolume和spread)上做得更好,但它也产生了更多的产品,且不违反领域约束。我们的结论是,我们需要改变基于搜索的软件工程的方法,特别是在研究复杂的决策空间时。
{"title":"On the value of user preferences in search-based software engineering: A case study in software product lines","authors":"Abdel Salam Sayyad, T. Menzies, H. Ammar","doi":"10.1109/ICSE.2013.6606595","DOIUrl":"https://doi.org/10.1109/ICSE.2013.6606595","url":null,"abstract":"Software design is a process of trading off competing objectives. If the user objective space is rich, then we should use optimizers that can fully exploit that richness. For example, this study configures software product lines (expressed as feature maps) using various search-based software engineering methods. As we increase the number of optimization objectives, we find that methods in widespread use (e.g. NSGA-II, SPEA2) perform much worse than IBEA (Indicator-Based Evolutionary Algorithm). IBEA works best since it makes most use of user preference knowledge. Hence it does better on the standard measures (hypervolume and spread) but it also generates far more products with 0% violations of domain constraints. Our conclusion is that we need to change our methods for search-based software engineering, particularly when studying complex decision spaces.","PeriodicalId":322423,"journal":{"name":"2013 35th International Conference on Software Engineering (ICSE)","volume":"17 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-05-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123592639","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 235
Robust reconfigurations of component assemblies 组件组件的鲁棒重新配置
Pub Date : 2013-05-18 DOI: 10.1109/ICSE.2013.6606547
F. Boyer, O. Gruber, D. Pous
In this paper, we propose a reconfiguration protocol that can handle any number of failures during a reconfiguration, always producing an architecturally-consistent assembly of components that can be safely introspected and further reconfigured. Our protocol is based on the concept of Incrementally Consistent Sequences (ICS), ensuring that any reconfiguration incrementally respects the reconfiguration contract given to component developers: reconfiguration grammar and architectural invariants. We also propose two recovery policies, one rolls back the failed reconfiguration and the other rolls it forward, both going as far as possible, failure permitting. We specified and proved the reconfiguration contract, the protocol, and recovery policies in Coq.
在本文中,我们提出了一种重新配置协议,它可以在重新配置期间处理任意数量的故障,始终生成架构一致的组件组装,这些组件可以安全地自省和进一步重新配置。我们的协议基于增量一致序列(ICS)的概念,确保任何重新配置都以增量方式尊重给予组件开发人员的重新配置契约:重新配置语法和体系结构不变量。我们还提出了两种恢复策略,一种是回滚失败的重新配置,另一种是向前回滚,在允许故障的情况下,两者都尽可能地向前回滚。我们在Coq中指定并证明了重构契约、协议和恢复策略。
{"title":"Robust reconfigurations of component assemblies","authors":"F. Boyer, O. Gruber, D. Pous","doi":"10.1109/ICSE.2013.6606547","DOIUrl":"https://doi.org/10.1109/ICSE.2013.6606547","url":null,"abstract":"In this paper, we propose a reconfiguration protocol that can handle any number of failures during a reconfiguration, always producing an architecturally-consistent assembly of components that can be safely introspected and further reconfigured. Our protocol is based on the concept of Incrementally Consistent Sequences (ICS), ensuring that any reconfiguration incrementally respects the reconfiguration contract given to component developers: reconfiguration grammar and architectural invariants. We also propose two recovery policies, one rolls back the failed reconfiguration and the other rolls it forward, both going as far as possible, failure permitting. We specified and proved the reconfiguration contract, the protocol, and recovery policies in Coq.","PeriodicalId":322423,"journal":{"name":"2013 35th International Conference on Software Engineering (ICSE)","volume":"14 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-05-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128325701","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 42
期刊
2013 35th International Conference on Software Engineering (ICSE)
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1