首页 > 最新文献

2015 30th IEEE/ACM International Conference on Automated Software Engineering (ASE)最新文献

英文 中文
How do Developers Document Database Usages in Source Code? (N) 开发人员如何在源代码中记录数据库的使用?(N)
M. Vásquez, Boyang Li, Christopher Vendome, D. Poshyvanyk
Database-centric applications (DCAs) usually contain a large number of tables, attributes, and constraints describing the underlying data model. Understanding how database tables and attributes are used in the source code along with the constraints related to these usages is an important component of DCA maintenance. However, documenting database-related operations and their constraints in the source code is neither easy nor common in practice. In this paper, we present a two-fold empirical study aimed at identifying how developers document database usages at source code method level. In particular, (i) we surveyed open source developers to understand their practices on documenting database usages in source code, and (ii) we mined a large set of open source projects to measure to what extent database-related methods are commented and if these comments are updated during evolution. Although 58% of the developers claimed to find value in method comments describing database usages, our findings suggest that 77% of 33K+ methods in 3.1K+ open-source Java projects with database accesses were completely undocumented.
以数据库为中心的应用程序(dca)通常包含大量描述底层数据模型的表、属性和约束。了解如何在源代码中使用数据库表和属性以及与这些用法相关的约束是DCA维护的一个重要组成部分。然而,在源代码中记录与数据库相关的操作及其约束在实践中既不容易也不常见。在本文中,我们提出了一个双重的实证研究,旨在确定开发人员如何在源代码方法级别记录数据库的使用。特别是,(i)我们调查了开源开发人员,了解他们在源代码中记录数据库用法的做法,(ii)我们挖掘了大量的开源项目,以衡量与数据库相关的方法被注释到什么程度,以及这些注释在发展过程中是否被更新。尽管58%的开发人员声称在描述数据库用法的方法注释中发现了价值,但我们的研究结果表明,在3.1K以上具有数据库访问的开源Java项目中,有77%的33K以上方法完全没有文档记录。
{"title":"How do Developers Document Database Usages in Source Code? (N)","authors":"M. Vásquez, Boyang Li, Christopher Vendome, D. Poshyvanyk","doi":"10.1109/ASE.2015.67","DOIUrl":"https://doi.org/10.1109/ASE.2015.67","url":null,"abstract":"Database-centric applications (DCAs) usually contain a large number of tables, attributes, and constraints describing the underlying data model. Understanding how database tables and attributes are used in the source code along with the constraints related to these usages is an important component of DCA maintenance. However, documenting database-related operations and their constraints in the source code is neither easy nor common in practice. In this paper, we present a two-fold empirical study aimed at identifying how developers document database usages at source code method level. In particular, (i) we surveyed open source developers to understand their practices on documenting database usages in source code, and (ii) we mined a large set of open source projects to measure to what extent database-related methods are commented and if these comments are updated during evolution. Although 58% of the developers claimed to find value in method comments describing database usages, our findings suggest that 77% of 33K+ methods in 3.1K+ open-source Java projects with database accesses were completely undocumented.","PeriodicalId":6586,"journal":{"name":"2015 30th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"39 1","pages":"36-41"},"PeriodicalIF":0.0,"publicationDate":"2015-11-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"86642223","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 18
Measuring Object-Oriented Design Principles 测量面向对象设计原则
Johannes Bräuer
The idea of automatizing the assessment of object-oriented design is not new. Different approaches define and apply their own quality models, which are composed of single metrics or combinations thereof, to operationalize software design. However, single metrics are too fine-grained to identify core design flaws and they cannot provide hints for making design improvements. In order to deal with these weaknesses of metric-based models, rules-based approaches have proven successful in the realm of source-code quality. Moreover, for developing a well-designed software system, design principles play a key role, as they define fundamental guidelines and help to avoid pitfalls. Therefore, this thesis will enhance and complete a rule-based quality reference model for operationalizing design principles and will provide a measuring tool that implements these rules. The validation of the design quality model and the measurement tool will be based on various industrial projects. Additionally, quantitative and qualitative surveys will be conducted in order to get validated results on the value of object-oriented design principles for software development.
自动化面向对象设计评估的想法并不新鲜。不同的方法定义并应用它们自己的质量模型,这些模型由单个度量标准或其组合组成,以实现软件设计的可操作性。然而,单个指标过于细粒度,无法识别核心设计缺陷,也无法提供改进设计的提示。为了处理这些基于度量的模型的弱点,基于规则的方法在源代码质量领域已经被证明是成功的。此外,为了开发一个设计良好的软件系统,设计原则扮演着关键的角色,因为它们定义了基本的指导方针,并帮助避免陷阱。因此,本文将加强和完善一个基于规则的质量参考模型,以实现设计原则的可操作性,并将提供一个实现这些规则的测量工具。设计质量模型和测量工具的验证将基于不同的工业项目。此外,将进行定量和定性的调查,以获得关于软件开发中面向对象设计原则价值的验证结果。
{"title":"Measuring Object-Oriented Design Principles","authors":"Johannes Bräuer","doi":"10.1109/ASE.2015.17","DOIUrl":"https://doi.org/10.1109/ASE.2015.17","url":null,"abstract":"The idea of automatizing the assessment of object-oriented design is not new. Different approaches define and apply their own quality models, which are composed of single metrics or combinations thereof, to operationalize software design. However, single metrics are too fine-grained to identify core design flaws and they cannot provide hints for making design improvements. In order to deal with these weaknesses of metric-based models, rules-based approaches have proven successful in the realm of source-code quality. Moreover, for developing a well-designed software system, design principles play a key role, as they define fundamental guidelines and help to avoid pitfalls. Therefore, this thesis will enhance and complete a rule-based quality reference model for operationalizing design principles and will provide a measuring tool that implements these rules. The validation of the design quality model and the measurement tool will be based on various industrial projects. Additionally, quantitative and qualitative surveys will be conducted in order to get validated results on the value of object-oriented design principles for software development.","PeriodicalId":6586,"journal":{"name":"2015 30th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"51 1","pages":"882-885"},"PeriodicalIF":0.0,"publicationDate":"2015-11-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"91075141","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
Understanding, Refactoring, and Fixing Concurrency in C# 理解、重构和修复c#中的并发性
Semih Okur
Industry leaders provide concurrent libraries because asynchronous & parallel programming are increasingly in demand: responsiveness, scalability, and high-throughput are key elements of all modern applications. However, we know little about how developers use these concurrent libraries in practice and the developer's toolbox for concurrency is very limited. We present the first study that analyzes the usage of concurrent libraries in large codebases, such as 2258 open-source C# apps comprising 54M SLOC and 1378 open-source Windows Phone apps comprising 12M SLOC. Using this data, we find important problems about use and misuse of concurrency. Inspired by our findings, we designed, evaluated, and implemented several static analyses and refactoring tools.
行业领导者提供并发库是因为异步和并行编程的需求越来越大:响应性、可伸缩性和高吞吐量是所有现代应用程序的关键要素。然而,我们对开发人员在实践中如何使用这些并发库知之甚少,开发人员的并发工具箱也非常有限。我们提出了第一项研究,分析了并发库在大型代码库中的使用情况,例如包含54M SLOC的2258个开源c#应用程序和包含12M SLOC的1378个开源Windows Phone应用程序。通过使用这些数据,我们发现了有关并发使用和误用的重要问题。受这些发现的启发,我们设计、评估并实现了几个静态分析和重构工具。
{"title":"Understanding, Refactoring, and Fixing Concurrency in C#","authors":"Semih Okur","doi":"10.1109/ASE.2015.82","DOIUrl":"https://doi.org/10.1109/ASE.2015.82","url":null,"abstract":"Industry leaders provide concurrent libraries because asynchronous & parallel programming are increasingly in demand: responsiveness, scalability, and high-throughput are key elements of all modern applications. However, we know little about how developers use these concurrent libraries in practice and the developer's toolbox for concurrency is very limited. We present the first study that analyzes the usage of concurrent libraries in large codebases, such as 2258 open-source C# apps comprising 54M SLOC and 1378 open-source Windows Phone apps comprising 12M SLOC. Using this data, we find important problems about use and misuse of concurrency. Inspired by our findings, we designed, evaluated, and implemented several static analyses and refactoring tools.","PeriodicalId":6586,"journal":{"name":"2015 30th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"73 1","pages":"898-901"},"PeriodicalIF":0.0,"publicationDate":"2015-11-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"77322973","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Configuration-Aware Change Impact Analysis (T) 配置感知变更影响分析(T)
Florian Angerer, Andreas Grimmer, Herbert Prähofer, P. Grünbacher
Understanding variability is essential to allow the configuration of software systems to diverse requirements. Variability-aware program analysis techniques have been proposed for analyzing the space of program variants. Such techniques are highly beneficial, e.g., to determine the potential impact of changes during maintenance. This paper presents an interprocedural and configuration-aware change impact analysis (CIA) approach for determining possibly impacted products when changing source code of a product family. The approach further supports engineers, who are adapting specific product variants after an initial pre-configuration. The approach can be adapted to work with different variability mechanism, it provides more precise results than existing CIA approaches, and it can be implemented using standard control flow and data flow analysis. Using an industrial product line we report evaluation results on the benefit and performance of the approach.
理解可变性对于配置软件系统以满足不同的需求是必不可少的。可变性感知程序分析技术被提出用于分析程序变体空间。这些技术是非常有益的,例如,在维护期间确定变更的潜在影响。本文提出了一种过程间和配置感知的变更影响分析(CIA)方法,用于在更改产品族的源代码时确定可能受影响的产品。该方法进一步支持工程师,他们在初始预配置后调整特定的产品变体。该方法可以适应不同的可变性机制,提供比现有CIA方法更精确的结果,并且可以使用标准控制流和数据流分析来实现。利用一条工业生产线,我们报告了该方法的效益和性能的评估结果。
{"title":"Configuration-Aware Change Impact Analysis (T)","authors":"Florian Angerer, Andreas Grimmer, Herbert Prähofer, P. Grünbacher","doi":"10.1109/ASE.2015.58","DOIUrl":"https://doi.org/10.1109/ASE.2015.58","url":null,"abstract":"Understanding variability is essential to allow the configuration of software systems to diverse requirements. Variability-aware program analysis techniques have been proposed for analyzing the space of program variants. Such techniques are highly beneficial, e.g., to determine the potential impact of changes during maintenance. This paper presents an interprocedural and configuration-aware change impact analysis (CIA) approach for determining possibly impacted products when changing source code of a product family. The approach further supports engineers, who are adapting specific product variants after an initial pre-configuration. The approach can be adapted to work with different variability mechanism, it provides more precise results than existing CIA approaches, and it can be implemented using standard control flow and data flow analysis. Using an industrial product line we report evaluation results on the benefit and performance of the approach.","PeriodicalId":6586,"journal":{"name":"2015 30th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"103 1","pages":"385-395"},"PeriodicalIF":0.0,"publicationDate":"2015-11-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"91301066","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 19
CIVL: Formal Verification of Parallel Programs CIVL:并行程序的正式验证
Manchun Zheng, Michael S. Rogers, Ziqing Luo, Matthew B. Dwyer, Stephen F. Siegel
CIVL is a framework for static analysis and verification of concurrent programs. One of the main challenges to practical application of these techniques is the large number of ways to express concurrency: MPI, OpenMP, CUDA, and Pthreads, for example, are just a few of many "concurrency dialects" in wide use today. These dialects are constantly evolving and it is increasingly common to use several of them in a single "hybrid" program. CIVL addresses these problems by providing a concurrency intermediate verification language, CIVL-C, as well as translators that consume C programs using these dialects and produce CIVL-C. Analysis and verification tools which operate on CIVL-C can then be applied easily to a wide variety of concurrent C programs. We demonstrate CIVL's error detection and verification capabilities on (1) an MPI+OpenMP program that estimates π and contains a subtle race condition, and (2) an MPI-based 1d-wave simulator that fails to conform to a simple sequential implementation.
CIVL是一个用于并发程序的静态分析和验证的框架。这些技术的实际应用面临的主要挑战之一是表示并发性的方法很多:例如,MPI、OpenMP、CUDA和Pthreads只是目前广泛使用的许多“并发方言”中的一小部分。这些方言不断发展,在一个“混合”节目中使用几种方言越来越普遍。CIVL解决了这些问题,它提供了一种并发的中间验证语言,CIVL-C,以及使用这些方言消费C程序并生成CIVL-C的翻译器。在CIVL-C上运行的分析和验证工具可以很容易地应用于各种并发的C程序。我们在(1)估计π并包含微妙竞争条件的MPI+OpenMP程序上演示了CIVL的错误检测和验证功能,以及(2)基于MPI的一维波模拟器,该模拟器无法符合简单的顺序实现。
{"title":"CIVL: Formal Verification of Parallel Programs","authors":"Manchun Zheng, Michael S. Rogers, Ziqing Luo, Matthew B. Dwyer, Stephen F. Siegel","doi":"10.1109/ASE.2015.99","DOIUrl":"https://doi.org/10.1109/ASE.2015.99","url":null,"abstract":"CIVL is a framework for static analysis and verification of concurrent programs. One of the main challenges to practical application of these techniques is the large number of ways to express concurrency: MPI, OpenMP, CUDA, and Pthreads, for example, are just a few of many \"concurrency dialects\" in wide use today. These dialects are constantly evolving and it is increasingly common to use several of them in a single \"hybrid\" program. CIVL addresses these problems by providing a concurrency intermediate verification language, CIVL-C, as well as translators that consume C programs using these dialects and produce CIVL-C. Analysis and verification tools which operate on CIVL-C can then be applied easily to a wide variety of concurrent C programs. We demonstrate CIVL's error detection and verification capabilities on (1) an MPI+OpenMP program that estimates π and contains a subtle race condition, and (2) an MPI-based 1d-wave simulator that fails to conform to a simple sequential implementation.","PeriodicalId":6586,"journal":{"name":"2015 30th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"107 1","pages":"830-835"},"PeriodicalIF":0.0,"publicationDate":"2015-11-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"81318707","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 29
General LTL Specification Mining (T) 通用LTL规范挖掘(T)
Caroline Lemieux, Dennis Park, Ivan Beschastnikh
Temporal properties are useful for describing and reasoning about software behavior, but developers rarely write down temporal specifications of their systems. Prior work on inferring specifications developed tools to extract likely program specifications that fit particular kinds of tool-specific templates. This paper introduces Texada, a new temporal specification mining tool for extracting specifications in linear temporal logic (LTL) of arbitrary length and complexity. Texada takes a user-defined LTL property type template and a log of traces as input and outputs a set of instantiations of the property type (i.e., LTL formulas) that are true on the traces in the log. Texada also supports mining of almost invariants: properties with imperfect confidence. We formally describe Texada's algorithms and evaluate the tool's performance and utility.
时间属性对于描述和推理软件行为很有用,但是开发人员很少写下他们系统的时间规范。先前在推断规范方面的工作开发了工具来提取适合特定工具模板的程序规范。本文介绍了一种新的时间规范挖掘工具Texada,用于从任意长度和复杂度的线性时间逻辑(LTL)中提取规范。Texada采用用户定义的LTL属性类型模板和跟踪日志作为输入,并输出属性类型(即LTL公式)的一组实例,这些实例在日志中的跟踪中为真。Texada还支持挖掘几乎不变量:具有不完全置信度的属性。我们正式描述了Texada的算法,并评估了该工具的性能和实用性。
{"title":"General LTL Specification Mining (T)","authors":"Caroline Lemieux, Dennis Park, Ivan Beschastnikh","doi":"10.1109/ASE.2015.71","DOIUrl":"https://doi.org/10.1109/ASE.2015.71","url":null,"abstract":"Temporal properties are useful for describing and reasoning about software behavior, but developers rarely write down temporal specifications of their systems. Prior work on inferring specifications developed tools to extract likely program specifications that fit particular kinds of tool-specific templates. This paper introduces Texada, a new temporal specification mining tool for extracting specifications in linear temporal logic (LTL) of arbitrary length and complexity. Texada takes a user-defined LTL property type template and a log of traces as input and outputs a set of instantiations of the property type (i.e., LTL formulas) that are true on the traces in the log. Texada also supports mining of almost invariants: properties with imperfect confidence. We formally describe Texada's algorithms and evaluate the tool's performance and utility.","PeriodicalId":6586,"journal":{"name":"2015 30th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"41 1","pages":"81-92"},"PeriodicalIF":0.0,"publicationDate":"2015-11-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"79839554","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 103
Developing a DSL-Based Approach for Event-Based Monitoring of Systems of Systems: Experiences and Lessons Learned (E) 为基于事件的系统的系统监控开发基于dsl的方法:经验和教训(E)
Michael Vierhauser, Rick Rabiser, P. Grünbacher, Alexander Egyed
Complex software-intensive systems are often described as systems of systems (SoS) comprising heterogeneous architectural elements. As SoS behavior fully emerges during operation only, runtime monitoring is needed to detect deviations from requirements. Today, diverse approaches exist to define and check runtime behavior and performance characteristics. However, existing approaches often focus on specific types of systems and address certain kinds of checks, thus impeding their use in industrial SoS. Furthermore, as many SoS need to run continuously for long periods, the dynamic definition and deployment of constraints needs to be supported. In this paper we describe experiences of developing and applying a DSL-based approach for monitoring an SoS in the domain of industrial automation software. We evaluate both the expressiveness of our DSL as well as the scalability of the constraint checker. We also describe lessons learned.
复杂的软件密集型系统通常被描述为包含异构架构元素的系统的系统(so)。由于SoS行为仅在操作期间完全出现,因此需要运行时监控来检测与需求的偏差。今天,存在多种方法来定义和检查运行时行为和性能特征。然而,现有的方法通常侧重于特定类型的系统并处理某些类型的检查,从而阻碍了它们在工业SoS中的使用。此外,由于许多so需要长时间连续运行,因此需要支持约束的动态定义和部署。在本文中,我们描述了开发和应用基于dsl的方法来监控工业自动化软件领域的SoS的经验。我们评估了DSL的表达性以及约束检查器的可伸缩性。我们还描述了吸取的教训。
{"title":"Developing a DSL-Based Approach for Event-Based Monitoring of Systems of Systems: Experiences and Lessons Learned (E)","authors":"Michael Vierhauser, Rick Rabiser, P. Grünbacher, Alexander Egyed","doi":"10.1109/ASE.2015.25","DOIUrl":"https://doi.org/10.1109/ASE.2015.25","url":null,"abstract":"Complex software-intensive systems are often described as systems of systems (SoS) comprising heterogeneous architectural elements. As SoS behavior fully emerges during operation only, runtime monitoring is needed to detect deviations from requirements. Today, diverse approaches exist to define and check runtime behavior and performance characteristics. However, existing approaches often focus on specific types of systems and address certain kinds of checks, thus impeding their use in industrial SoS. Furthermore, as many SoS need to run continuously for long periods, the dynamic definition and deployment of constraints needs to be supported. In this paper we describe experiences of developing and applying a DSL-based approach for monitoring an SoS in the domain of industrial automation software. We evaluate both the expressiveness of our DSL as well as the scalability of the constraint checker. We also describe lessons learned.","PeriodicalId":6586,"journal":{"name":"2015 30th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"5 1","pages":"715-725"},"PeriodicalIF":0.0,"publicationDate":"2015-11-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"85599009","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 22
Covert Communication in Mobile Applications (T) 移动应用中的隐蔽通信(T)
J. Rubin, Michael I. Gordon, Nguyen Nguyen, M. Rinard
This paper studies communication patterns in mobile applications. Our analysis shows that 63% of the external communication made by top-popular free Android applications from Google Play has no effect on the user-observable application functionality. To detect such covert communication in an efficient manner, we propose a highly precise and scalable static analysis technique: it achieves 93% precision and 61% recall compared to the empirically determined "ground truth", and runs in a matter of a few minutes. Furthermore, according to human evaluators, in 42 out of 47 cases, disabling connections deemed covert by our analysis leaves the delivered application experience either completely intact or with only insignificant interference. We conclude that our technique is effective for identifying and disabling covert communication. We then use it to investigate communication patterns in the 500 top-popular applications from Google Play.
本文研究了移动应用程序中的通信模式。我们的分析显示,Google Play上最受欢迎的免费Android应用所进行的63%的外部交流对用户可观察到的应用功能没有影响。为了有效地检测这种隐蔽通信,我们提出了一种高精度和可扩展的静态分析技术:与经验确定的“地面真相”相比,它达到了93%的精度和61%的召回率,并且在几分钟内运行。此外,根据人类评估人员的说法,在47个案例中,有42个案例中,我们的分析认为禁用连接是隐蔽的,这使得交付的应用程序体验要么完全完好无损,要么只有微不足道的干扰。我们的结论是,我们的技术是有效的识别和禁用秘密通信。然后我们用它来调查Google Play上500款最受欢迎应用的交流模式。
{"title":"Covert Communication in Mobile Applications (T)","authors":"J. Rubin, Michael I. Gordon, Nguyen Nguyen, M. Rinard","doi":"10.1109/ASE.2015.66","DOIUrl":"https://doi.org/10.1109/ASE.2015.66","url":null,"abstract":"This paper studies communication patterns in mobile applications. Our analysis shows that 63% of the external communication made by top-popular free Android applications from Google Play has no effect on the user-observable application functionality. To detect such covert communication in an efficient manner, we propose a highly precise and scalable static analysis technique: it achieves 93% precision and 61% recall compared to the empirically determined \"ground truth\", and runs in a matter of a few minutes. Furthermore, according to human evaluators, in 42 out of 47 cases, disabling connections deemed covert by our analysis leaves the delivered application experience either completely intact or with only insignificant interference. We conclude that our technique is effective for identifying and disabling covert communication. We then use it to investigate communication patterns in the 500 top-popular applications from Google Play.","PeriodicalId":6586,"journal":{"name":"2015 30th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"154 1","pages":"647-657"},"PeriodicalIF":0.0,"publicationDate":"2015-11-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"83431784","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 24
Static Analysis of Implicit Control Flow: Resolving Java Reflection and Android Intents (T) 隐式控制流的静态分析:解析Java反射和Android意图(T)
Paulo Barros, René Just, Suzanne Millstein, Paul Vines, Werner Dietl, Marcelo d’Amorim, Michael D. Ernst
Implicit or indirect control flow is a transfer of control between procedures using some mechanism other than an explicit procedure call. Implicit control flow is a staple design pattern that adds flexibility to system design. However, it is challenging for a static analysis to compute or verify properties about a system that uses implicit control flow. This paper presents static analyses for two types of implicit control flow that frequently appear in Android apps: Java reflection and Android intents. Our analyses help to resolve where control flows and what data is passed. This information improves the precision of downstream analyses, which no longer need to make conservative assumptions about implicit control flow. We have implemented our techniques for Java. We enhanced an existing security analysis with a more precise treatment of reflection and intents. In a case study involving ten real-world Android apps that use both intents and reflection, the precision of the security analysis was increased on average by two orders of magnitude. The precision of two other downstream analyses was also improved.
隐式或间接控制流是使用某种机制(而不是显式过程调用)在过程之间进行的控制转移。隐式控制流是增加系统设计灵活性的主要设计模式。然而,对于静态分析来说,计算或验证使用隐式控制流的系统的属性是具有挑战性的。本文对Android应用中经常出现的两种类型的隐式控制流进行了静态分析:Java反射和Android意图。我们的分析有助于解决控制流的位置和传递的数据。这些信息提高了下游分析的精度,不再需要对隐式控制流做出保守的假设。我们已经为Java实现了我们的技术。我们通过更精确地处理反射和意图来增强现有的安全性分析。在一个涉及十个真实世界的Android应用程序的案例研究中,同时使用意图和反射,安全分析的精度平均提高了两个数量级。另外两个下游分析的精度也得到了提高。
{"title":"Static Analysis of Implicit Control Flow: Resolving Java Reflection and Android Intents (T)","authors":"Paulo Barros, René Just, Suzanne Millstein, Paul Vines, Werner Dietl, Marcelo d’Amorim, Michael D. Ernst","doi":"10.1109/ASE.2015.69","DOIUrl":"https://doi.org/10.1109/ASE.2015.69","url":null,"abstract":"Implicit or indirect control flow is a transfer of control between procedures using some mechanism other than an explicit procedure call. Implicit control flow is a staple design pattern that adds flexibility to system design. However, it is challenging for a static analysis to compute or verify properties about a system that uses implicit control flow. This paper presents static analyses for two types of implicit control flow that frequently appear in Android apps: Java reflection and Android intents. Our analyses help to resolve where control flows and what data is passed. This information improves the precision of downstream analyses, which no longer need to make conservative assumptions about implicit control flow. We have implemented our techniques for Java. We enhanced an existing security analysis with a more precise treatment of reflection and intents. In a case study involving ten real-world Android apps that use both intents and reflection, the precision of the security analysis was increased on average by two orders of magnitude. The precision of two other downstream analyses was also improved.","PeriodicalId":6586,"journal":{"name":"2015 30th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"17 1","pages":"669-679"},"PeriodicalIF":0.0,"publicationDate":"2015-11-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"74471914","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 84
"What Parts of Your Apps are Loved by Users?" (T) “你的应用程序的哪些部分受到用户的喜爱?”(T)
Xiaodong Gu, Sunghun Kim
Recently, Begel et al. found that one of the most important questions software developers ask is "what parts of software are used/loved by users." User reviews provide an effective channel to address this question. However, most existing review summarization tools treat reviews as bags-of-words (i.e., mixed review categories) and are limited to extract software aspects and user preferences. We present a novel review summarization framework, SUR-Miner. Instead of a bags-of-words assumption, it classifies reviews into five categories and extracts aspects for sentences which include aspect evaluation using a pattern-based parser. Then, SUR-Miner visualizes the summaries using two interactive diagrams. Our evaluation on seventeen popular apps shows that SUR-Miner summarizes more accurate and clearer aspects than state-of-the-art techniques, with an F1-score of 0.81, significantly greater than that of ReviewSpotlight (0.56) and Guzmans' method (0.55). Feedback from developers shows that 88% developers agreed with the usefulness of the summaries from SUR-Miner.
最近,Begel等人发现软件开发人员问的最重要的问题之一是“用户使用/喜爱软件的哪些部分”。用户评论提供了一个解决这个问题的有效渠道。然而,大多数现有的评审总结工具将评审视为词包(即混合评审类别),并且仅限于提取软件方面和用户偏好。我们提出了一个新颖的综述总结框架,SUR-Miner。它没有使用“词袋”假设,而是将评论分为五类,并使用基于模式的解析器提取句子的方面,其中包括方面评估。然后,SUR-Miner使用两个交互式图表将摘要可视化。我们对17个流行应用程序的评估表明,与最先进的技术相比,su - miner总结了更准确、更清晰的方面,f1得分为0.81,显著高于ReviewSpotlight(0.56)和Guzmans的方法(0.55)。来自开发人员的反馈显示,88%的开发人员同意su - miner总结的有用性。
{"title":"\"What Parts of Your Apps are Loved by Users?\" (T)","authors":"Xiaodong Gu, Sunghun Kim","doi":"10.1109/ASE.2015.57","DOIUrl":"https://doi.org/10.1109/ASE.2015.57","url":null,"abstract":"Recently, Begel et al. found that one of the most important questions software developers ask is \"what parts of software are used/loved by users.\" User reviews provide an effective channel to address this question. However, most existing review summarization tools treat reviews as bags-of-words (i.e., mixed review categories) and are limited to extract software aspects and user preferences. We present a novel review summarization framework, SUR-Miner. Instead of a bags-of-words assumption, it classifies reviews into five categories and extracts aspects for sentences which include aspect evaluation using a pattern-based parser. Then, SUR-Miner visualizes the summaries using two interactive diagrams. Our evaluation on seventeen popular apps shows that SUR-Miner summarizes more accurate and clearer aspects than state-of-the-art techniques, with an F1-score of 0.81, significantly greater than that of ReviewSpotlight (0.56) and Guzmans' method (0.55). Feedback from developers shows that 88% developers agreed with the usefulness of the summaries from SUR-Miner.","PeriodicalId":6586,"journal":{"name":"2015 30th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"51 1","pages":"760-770"},"PeriodicalIF":0.0,"publicationDate":"2015-11-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"75995659","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 151
期刊
2015 30th IEEE/ACM International Conference on Automated Software Engineering (ASE)
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:604180095
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1