首页 > 最新文献

2022 IEEE/ACM 44th International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)最新文献

英文 中文
Expressing the Adaptation Intent as a Sustainability Goal 将适应意向表达为可持续发展目标
I. Gerostathopoulos, C. Raibulet, P. Lago
Adaptation and sustainability are two key challenges leading the development of software-systems nowadays. Adaptation denotes the capacity of a system to cope with variations and uncertainties at runtime in order to continue providing its functionalities with certain quality levels, notwithstanding change. But how can adaptation and its intent be expressed at design time so that to analyze its possible impact at runtime over a long period of time? To answer this question we look at adaptation from the sustainability point of view. Sustainability denotes the capacity of a system to both endure and preserve its function over time. We propose an approach which uses decision maps to make sustainability-driven decisions for adaptation in a systematic way. The proposed approach is illustrated through two self-adaptive exemplars as illustrative cases.
适应性和可持续性是当今软件系统开发面临的两个关键挑战。适应性是指系统在运行时处理变化和不确定性的能力,以便在发生变化的情况下继续以一定的质量水平提供其功能。但是,如何在设计时表达适应性及其意图,以便在长时间运行时分析其可能的影响?为了回答这个问题,我们从可持续性的角度来看适应。可持续性是指一个系统在一段时间内保持和维持其功能的能力。我们提出了一种利用决策地图系统地做出可持续发展驱动的适应决策的方法。通过两个自适应的例子说明了所提出的方法。
{"title":"Expressing the Adaptation Intent as a Sustainability Goal","authors":"I. Gerostathopoulos, C. Raibulet, P. Lago","doi":"10.1145/3510455.3512776","DOIUrl":"https://doi.org/10.1145/3510455.3512776","url":null,"abstract":"Adaptation and sustainability are two key challenges leading the development of software-systems nowadays. Adaptation denotes the capacity of a system to cope with variations and uncertainties at runtime in order to continue providing its functionalities with certain quality levels, notwithstanding change. But how can adaptation and its intent be expressed at design time so that to analyze its possible impact at runtime over a long period of time? To answer this question we look at adaptation from the sustainability point of view. Sustainability denotes the capacity of a system to both endure and preserve its function over time. We propose an approach which uses decision maps to make sustainability-driven decisions for adaptation in a systematic way. The proposed approach is illustrated through two self-adaptive exemplars as illustrative cases.","PeriodicalId":416186,"journal":{"name":"2022 IEEE/ACM 44th International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)","volume":"141 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123225220","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Investigating User Perceptions of Conversational Agents for Software-related ExploratoryWeb Search 调查用户对与软件相关的探索性网络搜索会话代理的感知
Matthew M. Frazier, Shaayal Kumar, Kostadin Damevski, L. Pollock
Conversational agents that respond to user information requests through a natural conversation have the potential to revolutionize how we acquire new information on the Web (i.e., perform exploratory Web searches). Recent advances to conversational search agents use popular Web search engines as a back-end and sophisticated AI algorithms to maintain context, automatically generate search queries, and summarize results into utterances. While showing impressive results on general topics, the potential of this technology for software engineering is unclear. In this paper, we study the potential of conversational search agents to aid software developers as they acquire new knowledge. We also obtain user perceptions of how far the most recent generation of such systems (e.g., Facebook’s BlenderBot2) has come in its ability to serve software developers. Our study indicates that users find conversational agents helpful in gaining useful information for software-related exploratory search; however, their perceptions also indicate a large gap between expectations and current state of the art tools, especially in providing high-quality information. Participant responses provide directions for future work. CCS CONCEPTS• General and reference $rightarrow$Empirical studies.
通过自然对话响应用户信息请求的会话代理有可能彻底改变我们在Web上获取新信息的方式(即执行探索性Web搜索)。会话搜索代理的最新进展使用流行的Web搜索引擎作为后端和复杂的人工智能算法来维护上下文,自动生成搜索查询,并将结果总结为话语。虽然在一般主题上显示了令人印象深刻的结果,但该技术在软件工程方面的潜力尚不清楚。在本文中,我们研究了对话搜索代理在软件开发人员获取新知识时帮助他们的潜力。我们还获得了用户对最新一代此类系统(例如Facebook的BlenderBot2)为软件开发人员提供服务的能力的看法。我们的研究表明,用户发现会话代理有助于获得与软件相关的探索性搜索的有用信息;然而,他们的看法也表明,期望与最先进工具的现状之间存在很大差距,特别是在提供高质量信息方面。参与者的回答为未来的工作提供了方向。CCS概念•一般和参考$右箭头$实证研究。
{"title":"Investigating User Perceptions of Conversational Agents for Software-related ExploratoryWeb Search","authors":"Matthew M. Frazier, Shaayal Kumar, Kostadin Damevski, L. Pollock","doi":"10.1145/3510455.3512778","DOIUrl":"https://doi.org/10.1145/3510455.3512778","url":null,"abstract":"Conversational agents that respond to user information requests through a natural conversation have the potential to revolutionize how we acquire new information on the Web (i.e., perform exploratory Web searches). Recent advances to conversational search agents use popular Web search engines as a back-end and sophisticated AI algorithms to maintain context, automatically generate search queries, and summarize results into utterances. While showing impressive results on general topics, the potential of this technology for software engineering is unclear. In this paper, we study the potential of conversational search agents to aid software developers as they acquire new knowledge. We also obtain user perceptions of how far the most recent generation of such systems (e.g., Facebook’s BlenderBot2) has come in its ability to serve software developers. Our study indicates that users find conversational agents helpful in gaining useful information for software-related exploratory search; however, their perceptions also indicate a large gap between expectations and current state of the art tools, especially in providing high-quality information. Participant responses provide directions for future work. CCS CONCEPTS• General and reference $rightarrow$Empirical studies.","PeriodicalId":416186,"journal":{"name":"2022 IEEE/ACM 44th International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)","volume":"108 9","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114023304","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
What Do You Want From Me? Adapting Systems to the Uncertainty of Human Preferences 你想从我这里得到什么?使系统适应人类偏好的不确定性
Carlos Gavidia-Calderon, A. Bennaceur, Anastasia Kordoni, Mark Levine, B. Nuseibeh
Autonomous systems, like drones and self-driving cars, are becoming part of our daily lives. Multiple people interact with them, each with their own expectations regarding system behaviour. To adapt system behaviour to human preferences, we propose and explore a game-theoretic approach. In our architecture, autonomous systems use sensor data to build game-theoretic models of their interaction with humans. In these models, we represent human preferences with types and a probability distribution over them. Game-theoretic analysis then outputs a strategy, that determines how the system should act to maximise utility, given its beliefs over human types. We showcase our approach in a search-and-rescue (SAR) scenario, with a robot in charge of locating victims. According to social psychology, depending on their identity some people are keen to help others, while some prioritise their personal safety. These social identities define what a person favours, so we can map them directly to game-theoretic types. We show that our approach enables a SAR robot to take advantage of human collaboration, outperforming non-adaptive configurations in average number of successful evacuations. CCS CONCEPTS • Computer systems organization $rightarrow$Robotics; • Human- centered computing $rightarrow$Collaborative interaction. ACM Reference Format: Carlos Gavidia-Calderon, Amel Bennaceur, Anastasia Kordoni, Mark Levine, and Bashar Nuseibeh. 2022. What Do You Want From Me? Adapting Systems to the Uncertainty of Human Preferences. In New Ideas and Emerging Results (ICSE-NIER’22), May 21-29, 2022, Pittsburgh, PA, USA. ACM, New York, NY, USA, 5 pages. https://doi.org/10.1145/3510455.3512791
无人机和自动驾驶汽车等自主系统正在成为我们日常生活的一部分。许多人与它们交互,每个人对系统行为都有自己的期望。为了使系统行为适应人类的偏好,我们提出并探索了一种博弈论方法。在我们的架构中,自主系统使用传感器数据来建立它们与人类互动的博弈论模型。在这些模型中,我们用类型和它们的概率分布来表示人类偏好。博弈论分析然后输出一个策略,该策略决定了系统应该如何行动以最大化效用,考虑到它对人类类型的信念。我们在一个搜索与救援(SAR)场景中展示了我们的方法,其中一个机器人负责定位受害者。根据社会心理学,根据他们的身份,有些人热衷于帮助别人,而有些人则优先考虑自己的人身安全。这些社会身份定义了一个人的喜好,因此我们可以将它们直接映射为博弈论类型。我们表明,我们的方法使SAR机器人能够利用人类协作,在平均成功疏散次数方面优于非自适应配置。CCS CONCEPTS•计算机系统组织$right row$Robotics;•以人为本的计算$右箭头$协作交互。ACM参考格式:Carlos Gavidia-Calderon, Amel Bennaceur, Anastasia Kordoni, Mark Levine和Bashar Nuseibeh。2022。你想从我这里得到什么?使系统适应人类偏好的不确定性。新思想和新成果(ICSE-NIER ' 22), 2022年5月21-29日,美国宾夕法尼亚州匹兹堡。ACM,纽约,美国,5页。https://doi.org/10.1145/3510455.3512791
{"title":"What Do You Want From Me? Adapting Systems to the Uncertainty of Human Preferences","authors":"Carlos Gavidia-Calderon, A. Bennaceur, Anastasia Kordoni, Mark Levine, B. Nuseibeh","doi":"10.1145/3510455.3512791","DOIUrl":"https://doi.org/10.1145/3510455.3512791","url":null,"abstract":"Autonomous systems, like drones and self-driving cars, are becoming part of our daily lives. Multiple people interact with them, each with their own expectations regarding system behaviour. To adapt system behaviour to human preferences, we propose and explore a game-theoretic approach. In our architecture, autonomous systems use sensor data to build game-theoretic models of their interaction with humans. In these models, we represent human preferences with types and a probability distribution over them. Game-theoretic analysis then outputs a strategy, that determines how the system should act to maximise utility, given its beliefs over human types. We showcase our approach in a search-and-rescue (SAR) scenario, with a robot in charge of locating victims. According to social psychology, depending on their identity some people are keen to help others, while some prioritise their personal safety. These social identities define what a person favours, so we can map them directly to game-theoretic types. We show that our approach enables a SAR robot to take advantage of human collaboration, outperforming non-adaptive configurations in average number of successful evacuations. CCS CONCEPTS • Computer systems organization $rightarrow$Robotics; • Human- centered computing $rightarrow$Collaborative interaction. ACM Reference Format: Carlos Gavidia-Calderon, Amel Bennaceur, Anastasia Kordoni, Mark Levine, and Bashar Nuseibeh. 2022. What Do You Want From Me? Adapting Systems to the Uncertainty of Human Preferences. In New Ideas and Emerging Results (ICSE-NIER’22), May 21-29, 2022, Pittsburgh, PA, USA. ACM, New York, NY, USA, 5 pages. https://doi.org/10.1145/3510455.3512791","PeriodicalId":416186,"journal":{"name":"2022 IEEE/ACM 44th International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)","volume":"81 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126005558","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 4
Statistical Reasoning About Programs 关于程序的统计推理
Marcel Böhme
We discuss the advent of a new program analysis paradigm that allows anyone to make precise statements about the behavior of programs as they run in production across hundreds and millions of machines or devices. The scale-oblivious, in vivo program analysis leverages an almost inconceivable rate of user-generated program executions across large fleets to analyze programs of arbitrary size and composition with negligible performance overhead. In this paper, we reflect on the program analysis problem, the prevalent paradigm, and the practical reality of program analysis at large software companies. We illustrate the new paradigm using several success stories and suggest a number of exciting new research directions.
我们讨论了一种新的程序分析范式的出现,它允许任何人对程序在数亿台机器或设备上运行时的行为做出精确的陈述。与规模无关的活体程序分析利用几乎不可思议的用户生成程序执行率,在大型机群中分析任意大小和组成的程序,而性能开销可以忽略不计。在本文中,我们对大型软件公司的程序分析问题、流行的范式和实际情况进行了反思。我们用几个成功的案例来说明新的范式,并提出了一些令人兴奋的新的研究方向。
{"title":"Statistical Reasoning About Programs","authors":"Marcel Böhme","doi":"10.1145/3510455.3512796","DOIUrl":"https://doi.org/10.1145/3510455.3512796","url":null,"abstract":"We discuss the advent of a new program analysis paradigm that allows anyone to make precise statements about the behavior of programs as they run in production across hundreds and millions of machines or devices. The scale-oblivious, in vivo program analysis leverages an almost inconceivable rate of user-generated program executions across large fleets to analyze programs of arbitrary size and composition with negligible performance overhead. In this paper, we reflect on the program analysis problem, the prevalent paradigm, and the practical reality of program analysis at large software companies. We illustrate the new paradigm using several success stories and suggest a number of exciting new research directions.","PeriodicalId":416186,"journal":{"name":"2022 IEEE/ACM 44th International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)","volume":"189 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134177287","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Terminals All the Way Down 终点站一路向下
Michael MacInnis, Olga Baysal, Michele Lanza
The terminal is a remarkably resilient interface for many programming activities. From its humble beginnings as a teletypewriter more than half a century ago, through video terminals like the VT100, to present-day windowed terminal emulators, it has remained a relevant and productive, albeit very gaunt, interface. This is in stark contrast with feature-rich integrated development environments (IDEs), which on top of their innate complexity allow for the creation of custom extensions. Indeed, researchers have been prolific in proposing innumerable, but often ignored, plug-ins. We propose using inter-connected windowed terminal emulators as the foundation for a new type of distributed and language-agnostic development environment. By delegating the handling of a system’s source code to a set of dedicated windowed terminal emulators we aim at complementing existing visual tools and leveraging the large body of existing command-line and terminal-based development tools. We present the architecture of the terminal-based development environment that we envision, outline our future implementation plans, and discuss how such an environment can be evaluated both in terms of its usefulness and usability.
对于许多编程活动来说,终端是一个非常灵活的接口。从半个多世纪前的电传打字机开始,到VT100这样的视频终端,再到今天的窗口终端模拟器,它一直是一个相关的、富有成效的接口,尽管非常陈旧。这与特性丰富的集成开发环境(ide)形成鲜明对比,后者在其固有的复杂性之上允许创建自定义扩展。事实上,研究人员已经提出了无数的插件,但往往被忽视。我们提出使用互连的窗口终端仿真器作为一种新型的分布式和语言无关的开发环境的基础。通过将系统源代码的处理委托给一组专用的窗口终端模拟器,我们的目标是补充现有的可视化工具,并利用现有的大量命令行和基于终端的开发工具。我们展示了我们设想的基于终端的开发环境的体系结构,概述了我们未来的实现计划,并讨论了如何从有用性和可用性两方面评估这样一个环境。
{"title":"Terminals All the Way Down","authors":"Michael MacInnis, Olga Baysal, Michele Lanza","doi":"10.1145/3510455.3512784","DOIUrl":"https://doi.org/10.1145/3510455.3512784","url":null,"abstract":"The terminal is a remarkably resilient interface for many programming activities. From its humble beginnings as a teletypewriter more than half a century ago, through video terminals like the VT100, to present-day windowed terminal emulators, it has remained a relevant and productive, albeit very gaunt, interface. This is in stark contrast with feature-rich integrated development environments (IDEs), which on top of their innate complexity allow for the creation of custom extensions. Indeed, researchers have been prolific in proposing innumerable, but often ignored, plug-ins. We propose using inter-connected windowed terminal emulators as the foundation for a new type of distributed and language-agnostic development environment. By delegating the handling of a system’s source code to a set of dedicated windowed terminal emulators we aim at complementing existing visual tools and leveraging the large body of existing command-line and terminal-based development tools. We present the architecture of the terminal-based development environment that we envision, outline our future implementation plans, and discuss how such an environment can be evaluated both in terms of its usefulness and usability.","PeriodicalId":416186,"journal":{"name":"2022 IEEE/ACM 44th International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)","volume":"120 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134324746","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Kind Computing 这种计算
Faeq Alrimawi, B. Nuseibeh
Kindness can boost happiness and wellbeing. It can benefit individuals (e.g., increasing resilience) as well as society (e.g., increasing trust). With digital technology permeating our daily lives, there are increasing opportunities for such technology to enable, mediate, and amplify kindness in society. In this paper, we propose kind computing, a new computing paradigm that explicitly incorporates kindness into the development and use of digital technology. We envisage software engineering as a discipline that can deliver such technology. However, software engineering techniques do not provide explicit abstractions, formalisms, and tools to consider, analyse, and implement software that delivers such technology. With reference to related work, we elaborate on kind computing and the role of software engineering in enabling it, identify open research challenges, elicit three categories of kind computing requirements, and sketch a research agenda for future work. CCS CONCEPTS • Human-centered computing; • Software and its engineering;
善良可以提升幸福感和幸福感。它可以使个人(例如,增加弹性)和社会(例如,增加信任)受益。随着数字技术渗透到我们的日常生活中,这种技术有越来越多的机会来实现、调解和扩大社会中的善意。在本文中,我们提出了善良计算,这是一种新的计算范式,明确地将善良纳入数字技术的发展和使用。我们设想软件工程是一门能够提供这种技术的学科。然而,软件工程技术并没有提供明确的抽象、形式化和工具来考虑、分析和实现交付这种技术的软件。参考相关工作,我们详细阐述了类计算和软件工程在实现它方面的作用,确定了开放的研究挑战,引出了三类类计算需求,并概述了未来工作的研究议程。CCS概念•以人为中心的计算;•软件及其工程;
{"title":"Kind Computing","authors":"Faeq Alrimawi, B. Nuseibeh","doi":"10.1145/3510455.3512794","DOIUrl":"https://doi.org/10.1145/3510455.3512794","url":null,"abstract":"Kindness can boost happiness and wellbeing. It can benefit individuals (e.g., increasing resilience) as well as society (e.g., increasing trust). With digital technology permeating our daily lives, there are increasing opportunities for such technology to enable, mediate, and amplify kindness in society. In this paper, we propose kind computing, a new computing paradigm that explicitly incorporates kindness into the development and use of digital technology. We envisage software engineering as a discipline that can deliver such technology. However, software engineering techniques do not provide explicit abstractions, formalisms, and tools to consider, analyse, and implement software that delivers such technology. With reference to related work, we elaborate on kind computing and the role of software engineering in enabling it, identify open research challenges, elicit three categories of kind computing requirements, and sketch a research agenda for future work. CCS CONCEPTS • Human-centered computing; • Software and its engineering;","PeriodicalId":416186,"journal":{"name":"2022 IEEE/ACM 44th International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)","volume":"114 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-05-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132592966","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Runtime Prevention of Deserialization Attacks 反序列化攻击的运行时防护
François Gauthier, Sora Bae
Untrusted deserialization exploits, where a serialised object graph is used to achieve denial-of-service or arbitrary code execution, have become so prominent that they were introduced in the 2017 OWASP Top 10. In this paper, we present a novel and lightweight approach for runtime prevention of deserialization attacks using Markov chains. The intuition behind our work is that the features and ordering of classes in malicious object graphs make them distinguishable from benign ones. Preliminary results indeed show that our approach achieves an Fl-score of 0.94 on a dataset of 264 serialised payloads, collected from an industrial Java BE application server and a repository of deserialization exploits. ACM Reference Format: François Gauthier and Sora Bae. 2022. Runtime Prevention of Deserialization Attacks. In New Ideas and Emerging Results (ICSE-NIER’22), May 21–29, 2022, Pittsburgh, PA, USA. ACM, New York, NY, USA, 5 pages. https://doi.org/10.1145/3510455.3512786
不受信任的反序列化漏洞,即使用序列化对象图来实现拒绝服务或任意代码执行,已经变得如此突出,以至于它们被引入了2017年OWASP十大漏洞。在本文中,我们提出了一种新颖的轻量级方法,用于使用马尔可夫链来防止运行时反序列化攻击。我们工作背后的直觉是,恶意对象图中的类的特征和顺序使它们与良性对象图区分开来。初步结果确实表明,我们的方法在264个序列化有效负载的数据集上实现了0.94的fl分数,这些数据集来自工业Java BE应用服务器和反序列化漏洞存储库。ACM参考格式:franois Gauthier and Sora Bae。2022。反序列化攻击的运行时防护。新思想和新成果(ICSE-NIER ' 22), 2022年5月21-29日,美国宾夕法尼亚州匹兹堡。ACM,纽约,美国,5页。https://doi.org/10.1145/3510455.3512786
{"title":"Runtime Prevention of Deserialization Attacks","authors":"François Gauthier, Sora Bae","doi":"10.1145/3510455.3512786","DOIUrl":"https://doi.org/10.1145/3510455.3512786","url":null,"abstract":"Untrusted deserialization exploits, where a serialised object graph is used to achieve denial-of-service or arbitrary code execution, have become so prominent that they were introduced in the 2017 OWASP Top 10. In this paper, we present a novel and lightweight approach for runtime prevention of deserialization attacks using Markov chains. The intuition behind our work is that the features and ordering of classes in malicious object graphs make them distinguishable from benign ones. Preliminary results indeed show that our approach achieves an Fl-score of 0.94 on a dataset of 264 serialised payloads, collected from an industrial Java BE application server and a repository of deserialization exploits. ACM Reference Format: François Gauthier and Sora Bae. 2022. Runtime Prevention of Deserialization Attacks. In New Ideas and Emerging Results (ICSE-NIER’22), May 21–29, 2022, Pittsburgh, PA, USA. ACM, New York, NY, USA, 5 pages. https://doi.org/10.1145/3510455.3512786","PeriodicalId":416186,"journal":{"name":"2022 IEEE/ACM 44th International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)","volume":"42 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-04-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130734345","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Evaluating Commit Message Generation: To BLEU Or Not To BLEU? 评估提交消息的生成:去BLEU还是不去BLEU?
Samanta Dey, Venkatesh Vinayakarao, Monika Gupta, Sampath Dechu
Commit messages play an important role in several software engineering tasks such as program comprehension and understanding program evolution. However, programmers neglect to write good commit messages. Hence, several Commit Message Generation (CMG) tools have been proposed. We observe that the recent state of the art CMG tools use simple and easy to compute automated evaluation metrics such as BLEU4 or its variants. The advances in the field of Machine Translation (MT) indicate several weaknesses of BLEU4 and its variants. They also propose several other metrics for evaluating Natural Language Generation (NLG) tools. In this work, we discuss the suitability of various MT metrics for the CMG task. Based on the insights from our experiments, we propose a new variant specifically for evaluating the CMG task. We re-evaluate the state of the art CMG tools on our new metric. We believe that our work fixes an important gap that exists in the understanding of evaluation metrics for CMG research. CCS CONCEPTS• Software and its engineering $rightarrow$Software verification and validation.
提交消息在一些软件工程任务中扮演着重要的角色,例如程序理解和理解程序演化。然而,程序员忽略了编写好的提交消息。因此,提出了几种提交消息生成(Commit Message Generation, CMG)工具。我们观察到,最新的最先进的CMG工具使用简单和容易的方法来计算自动评估指标,如BLEU4或它的变体。机器翻译(MT)领域的进步表明了BLEU4及其变体的一些弱点。他们还提出了评估自然语言生成(NLG)工具的其他几个指标。在这项工作中,我们讨论了各种MT指标对CMG任务的适用性。基于我们实验的见解,我们提出了一个新的变体,专门用于评估CMG任务。我们根据新指标重新评估CMG工具的现状。我们认为,我们的工作弥补了对CMG研究评估指标理解上的一个重要空白。CCS CONCEPTS•软件及其工程$右箭头$软件验证和确认。
{"title":"Evaluating Commit Message Generation: To BLEU Or Not To BLEU?","authors":"Samanta Dey, Venkatesh Vinayakarao, Monika Gupta, Sampath Dechu","doi":"10.1145/3510455.3512790","DOIUrl":"https://doi.org/10.1145/3510455.3512790","url":null,"abstract":"Commit messages play an important role in several software engineering tasks such as program comprehension and understanding program evolution. However, programmers neglect to write good commit messages. Hence, several Commit Message Generation (CMG) tools have been proposed. We observe that the recent state of the art CMG tools use simple and easy to compute automated evaluation metrics such as BLEU4 or its variants. The advances in the field of Machine Translation (MT) indicate several weaknesses of BLEU4 and its variants. They also propose several other metrics for evaluating Natural Language Generation (NLG) tools. In this work, we discuss the suitability of various MT metrics for the CMG task. Based on the insights from our experiments, we propose a new variant specifically for evaluating the CMG task. We re-evaluate the state of the art CMG tools on our new metric. We believe that our work fixes an important gap that exists in the understanding of evaluation metrics for CMG research. CCS CONCEPTS• Software and its engineering $rightarrow$Software verification and validation.","PeriodicalId":416186,"journal":{"name":"2022 IEEE/ACM 44th International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)","volume":"12 6 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-04-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114936213","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Case for Microservices Orchestration Using Workflow Engines 使用工作流引擎的微服务编排案例
Anas Nadeem, Muhammad Zubair Malik
Microservices have become the de-facto software architecture for cloud-native applications. A contentious architectural decision in microservices is to compose them using choreography or orchestration. In choreography, every service works independently, whereas, in orchestration, there is a controller that coordinates service interactions. This paper makes a case for orchestration. The promise of microservices is that each microservice can be independently developed, deployed, tested, upgraded, and scaled. This makes them suitable for systems running on cloud infrastructures. However, microservice-based systems become complicated due to the complex interactions of various services, concurrent events, failing components, developers’ lack of global view, and configurations of the environment. This makes maintaining and debugging such systems very challenging. We hypothesize that orchestrated services are easier to debug and to test this we ported the largest publicly available microservices’ benchmark TrainTicket [24], which is implemented using choreography, to a fault-oblivious stateful workflow framework Temporal [19]. We report our experience in porting the code from traditional choreographed microservice architecture to one orchestrated by Temporal and present our initial findings of time to debug the 22 bugs present in the benchmark. Our findings suggest that an effort towards making a transition to orchestrated approach is worthwhile, making the ported code easier to debug.
微服务已经成为云原生应用程序事实上的软件架构。微服务中一个有争议的架构决策是使用编排或编排来组合它们。在编排中,每个服务独立工作,而在编排中,有一个协调服务交互的控制器。本文为编配提供了一个案例。微服务的承诺是每个微服务都可以独立开发、部署、测试、升级和扩展。这使得它们适合运行在云基础设施上的系统。然而,由于各种服务的复杂交互、并发事件、故障组件、开发人员缺乏全局视图和环境配置,基于微服务的系统变得复杂。这使得维护和调试这样的系统非常具有挑战性。我们假设编排的服务更容易调试,为了测试这一点,我们将最大的公开可用的微服务的基准TrainTicket[24]移植到一个无故障的有状态工作流框架Temporal[19],该框架使用编排实现。我们报告了将代码从传统编排的微服务体系结构移植到由Temporal编排的微服务体系结构中的经验,并介绍了我们调试基准测试中出现的22个错误的初步发现。我们的发现表明,向编排方法过渡的努力是值得的,这使得移植的代码更容易调试。
{"title":"Case for Microservices Orchestration Using Workflow Engines","authors":"Anas Nadeem, Muhammad Zubair Malik","doi":"10.1145/3510455.3512777","DOIUrl":"https://doi.org/10.1145/3510455.3512777","url":null,"abstract":"Microservices have become the de-facto software architecture for cloud-native applications. A contentious architectural decision in microservices is to compose them using choreography or orchestration. In choreography, every service works independently, whereas, in orchestration, there is a controller that coordinates service interactions. This paper makes a case for orchestration. The promise of microservices is that each microservice can be independently developed, deployed, tested, upgraded, and scaled. This makes them suitable for systems running on cloud infrastructures. However, microservice-based systems become complicated due to the complex interactions of various services, concurrent events, failing components, developers’ lack of global view, and configurations of the environment. This makes maintaining and debugging such systems very challenging. We hypothesize that orchestrated services are easier to debug and to test this we ported the largest publicly available microservices’ benchmark TrainTicket [24], which is implemented using choreography, to a fault-oblivious stateful workflow framework Temporal [19]. We report our experience in porting the code from traditional choreographed microservice architecture to one orchestrated by Temporal and present our initial findings of time to debug the 22 bugs present in the benchmark. Our findings suggest that an effort towards making a transition to orchestrated approach is worthwhile, making the ported code easier to debug.","PeriodicalId":416186,"journal":{"name":"2022 IEEE/ACM 44th International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)","volume":"32 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-04-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116400113","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Automating Staged Rollout with Reinforcement Learning 使用强化学习自动化分阶段推出
Shadow Pritchard, V. Nagaraju, L. Fiondella
Staged rollout is a strategy of incrementally releasing software updates to portions of the user population in order to accelerate defect discovery without incurring catastrophic outcomes such as system wide outages. Some past studies have examined how to quantify and automate staged rollout, but stop short of simultaneously considering multiple product or process metrics explicitly. This paper demonstrates the potential to automate staged rollout with multi-objective reinforcement learning in order to dynamically balance stakeholder needs such as time to deliver new features and downtime incurred by failures due to latent defects. CCS CONCEPTS • Software and its engineering → Software testing and debugging.
分阶段推出是一种增量地向部分用户发布软件更新的策略,目的是加速缺陷发现,而不会导致灾难性的结果,比如系统范围的中断。过去的一些研究已经研究了如何量化和自动化分阶段的推出,但没有同时明确地考虑多个产品或过程度量。本文展示了用多目标强化学习自动化分阶段推出的潜力,以便动态平衡利益相关者的需求,例如交付新功能的时间和由于潜在缺陷导致的故障引起的停机时间。•软件及其工程→软件测试和调试。
{"title":"Automating Staged Rollout with Reinforcement Learning","authors":"Shadow Pritchard, V. Nagaraju, L. Fiondella","doi":"10.1145/3510455.3512782","DOIUrl":"https://doi.org/10.1145/3510455.3512782","url":null,"abstract":"Staged rollout is a strategy of incrementally releasing software updates to portions of the user population in order to accelerate defect discovery without incurring catastrophic outcomes such as system wide outages. Some past studies have examined how to quantify and automate staged rollout, but stop short of simultaneously considering multiple product or process metrics explicitly. This paper demonstrates the potential to automate staged rollout with multi-objective reinforcement learning in order to dynamically balance stakeholder needs such as time to deliver new features and downtime incurred by failures due to latent defects. CCS CONCEPTS • Software and its engineering → Software testing and debugging.","PeriodicalId":416186,"journal":{"name":"2022 IEEE/ACM 44th International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)","volume":"70 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2022-04-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129023111","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
期刊
2022 IEEE/ACM 44th International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER)
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1