首页 > 最新文献

2015 30th IEEE/ACM International Conference on Automated Software Engineering (ASE)最新文献

英文 中文
Reverse Engineering Mobile Application User Interfaces with REMAUI (T) 用REMAUI (T)逆向工程移动应用程序用户界面
T. Nguyen, Christoph Csallner
When developing the user interface code of a mobile application, in practice a big gap exists between the digital conceptual drawings of graphic artists and working user interface code. Currently, programmers bridge this gap manually, by reimplementing the conceptual drawings in code, which is cumbersome and expensive. To bridge this gap, we introduce the first technique to automatically Reverse Engineer Mobile Application User Interfaces (REMAUI). On a given input bitmap REMAUI identifies user interface elements such as images, texts, containers, and lists, via computer vision and optical character recognition (OCR) techniques. In our experiments on 488 screenshots of over 100 popular third-party Android and iOS applications, REMAUI-generated user interfaces were similar to the originals, both pixel-by-pixel and in terms of their runtime user interface hierarchies. REMAUI's average overall runtime on a standard desktop computer was 9 seconds.
在开发移动应用程序的用户界面代码时,图形艺术家的数字概念图与实际用户界面代码之间存在很大差距。目前,程序员通过在代码中重新实现概念图来手动弥合这一差距,这既麻烦又昂贵。为了弥补这一差距,我们介绍了第一种自动逆向工程移动应用程序用户界面(REMAUI)的技术。在给定的输入位图上,REMAUI通过计算机视觉和光学字符识别(OCR)技术识别用户界面元素,如图像、文本、容器和列表。在我们对超过100个流行的第三方Android和iOS应用程序的488个截图进行的实验中,remaui生成的用户界面在像素和运行时用户界面层次上都与原始界面相似。REMAUI在标准台式计算机上的平均总运行时间为9秒。
{"title":"Reverse Engineering Mobile Application User Interfaces with REMAUI (T)","authors":"T. Nguyen, Christoph Csallner","doi":"10.1109/ASE.2015.32","DOIUrl":"https://doi.org/10.1109/ASE.2015.32","url":null,"abstract":"When developing the user interface code of a mobile application, in practice a big gap exists between the digital conceptual drawings of graphic artists and working user interface code. Currently, programmers bridge this gap manually, by reimplementing the conceptual drawings in code, which is cumbersome and expensive. To bridge this gap, we introduce the first technique to automatically Reverse Engineer Mobile Application User Interfaces (REMAUI). On a given input bitmap REMAUI identifies user interface elements such as images, texts, containers, and lists, via computer vision and optical character recognition (OCR) techniques. In our experiments on 488 screenshots of over 100 popular third-party Android and iOS applications, REMAUI-generated user interfaces were similar to the originals, both pixel-by-pixel and in terms of their runtime user interface hierarchies. REMAUI's average overall runtime on a standard desktop computer was 9 seconds.","PeriodicalId":6586,"journal":{"name":"2015 30th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"36 1","pages":"248-259"},"PeriodicalIF":0.0,"publicationDate":"2015-11-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"79349571","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 154
Have We Seen Enough Traces? (T) 我们发现了足够多的痕迹吗?(T)
Hila Cohen, S. Maoz
Dynamic specification mining extracts candidate specifications from logs of execution traces. Existing algorithms differ in the kinds of traces they take as input and in the kinds of candidate specification they present as output. One challenge common to all approaches relates to the faithfulness of the mining results: how can we be confident that the extracted specifications faithfully characterize the program we investigate? Since producing and analyzing traces is costly, how would we know we have seen enough traces? And, how would we know we have not wasted resources and seen too many of them?In this paper we address these important questions by presenting a novel, black box, probabilistic framework based on a notion of log completeness, and by applying it to three different well-known specification mining algorithms from the literature: k-Tails, Synoptic, and mining of scenario-based triggers and effects. Extensive evaluation over 24 models taken from 9 different sources shows the soundness, generalizability, and usefulness of the framework and its contribution to the state-of-the-art in dynamic specification mining.
动态规范挖掘从执行跟踪日志中提取候选规范。现有算法的不同之处在于它们作为输入的跟踪类型和它们作为输出呈现的候选规范类型。所有方法共同面临的一个挑战与挖掘结果的准确性有关:我们如何确信提取的规范忠实地描述了我们调查的程序?既然产生和分析痕迹是昂贵的,我们怎么知道我们已经看到了足够的痕迹呢?而且,我们怎么知道我们没有浪费资源,没有看到太多资源?在本文中,我们通过提出一个基于日志完整性概念的新颖的黑箱概率框架来解决这些重要问题,并将其应用于文献中三种不同的知名规范挖掘算法:k- tail, Synoptic和基于场景的触发器和效果的挖掘。对来自9个不同来源的24个模型进行了广泛的评估,显示了该框架的稳健性、通用性和实用性,以及它对动态规范挖掘的最新贡献。
{"title":"Have We Seen Enough Traces? (T)","authors":"Hila Cohen, S. Maoz","doi":"10.1109/ASE.2015.62","DOIUrl":"https://doi.org/10.1109/ASE.2015.62","url":null,"abstract":"Dynamic specification mining extracts candidate specifications from logs of execution traces. Existing algorithms differ in the kinds of traces they take as input and in the kinds of candidate specification they present as output. One challenge common to all approaches relates to the faithfulness of the mining results: how can we be confident that the extracted specifications faithfully characterize the program we investigate? Since producing and analyzing traces is costly, how would we know we have seen enough traces? And, how would we know we have not wasted resources and seen too many of them?In this paper we address these important questions by presenting a novel, black box, probabilistic framework based on a notion of log completeness, and by applying it to three different well-known specification mining algorithms from the literature: k-Tails, Synoptic, and mining of scenario-based triggers and effects. Extensive evaluation over 24 models taken from 9 different sources shows the soundness, generalizability, and usefulness of the framework and its contribution to the state-of-the-art in dynamic specification mining.","PeriodicalId":6586,"journal":{"name":"2015 30th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"2 1","pages":"93-103"},"PeriodicalIF":0.0,"publicationDate":"2015-11-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"76868846","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 12
Understanding, Refactoring, and Fixing Concurrency in C# 理解、重构和修复c#中的并发性
Semih Okur
Industry leaders provide concurrent libraries because asynchronous & parallel programming are increasingly in demand: responsiveness, scalability, and high-throughput are key elements of all modern applications. However, we know little about how developers use these concurrent libraries in practice and the developer's toolbox for concurrency is very limited. We present the first study that analyzes the usage of concurrent libraries in large codebases, such as 2258 open-source C# apps comprising 54M SLOC and 1378 open-source Windows Phone apps comprising 12M SLOC. Using this data, we find important problems about use and misuse of concurrency. Inspired by our findings, we designed, evaluated, and implemented several static analyses and refactoring tools.
行业领导者提供并发库是因为异步和并行编程的需求越来越大:响应性、可伸缩性和高吞吐量是所有现代应用程序的关键要素。然而,我们对开发人员在实践中如何使用这些并发库知之甚少,开发人员的并发工具箱也非常有限。我们提出了第一项研究,分析了并发库在大型代码库中的使用情况,例如包含54M SLOC的2258个开源c#应用程序和包含12M SLOC的1378个开源Windows Phone应用程序。通过使用这些数据,我们发现了有关并发使用和误用的重要问题。受这些发现的启发,我们设计、评估并实现了几个静态分析和重构工具。
{"title":"Understanding, Refactoring, and Fixing Concurrency in C#","authors":"Semih Okur","doi":"10.1109/ASE.2015.82","DOIUrl":"https://doi.org/10.1109/ASE.2015.82","url":null,"abstract":"Industry leaders provide concurrent libraries because asynchronous & parallel programming are increasingly in demand: responsiveness, scalability, and high-throughput are key elements of all modern applications. However, we know little about how developers use these concurrent libraries in practice and the developer's toolbox for concurrency is very limited. We present the first study that analyzes the usage of concurrent libraries in large codebases, such as 2258 open-source C# apps comprising 54M SLOC and 1378 open-source Windows Phone apps comprising 12M SLOC. Using this data, we find important problems about use and misuse of concurrency. Inspired by our findings, we designed, evaluated, and implemented several static analyses and refactoring tools.","PeriodicalId":6586,"journal":{"name":"2015 30th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"73 1","pages":"898-901"},"PeriodicalIF":0.0,"publicationDate":"2015-11-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"77322973","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 1
Configuration-Aware Change Impact Analysis (T) 配置感知变更影响分析(T)
Florian Angerer, Andreas Grimmer, Herbert Prähofer, P. Grünbacher
Understanding variability is essential to allow the configuration of software systems to diverse requirements. Variability-aware program analysis techniques have been proposed for analyzing the space of program variants. Such techniques are highly beneficial, e.g., to determine the potential impact of changes during maintenance. This paper presents an interprocedural and configuration-aware change impact analysis (CIA) approach for determining possibly impacted products when changing source code of a product family. The approach further supports engineers, who are adapting specific product variants after an initial pre-configuration. The approach can be adapted to work with different variability mechanism, it provides more precise results than existing CIA approaches, and it can be implemented using standard control flow and data flow analysis. Using an industrial product line we report evaluation results on the benefit and performance of the approach.
理解可变性对于配置软件系统以满足不同的需求是必不可少的。可变性感知程序分析技术被提出用于分析程序变体空间。这些技术是非常有益的,例如,在维护期间确定变更的潜在影响。本文提出了一种过程间和配置感知的变更影响分析(CIA)方法,用于在更改产品族的源代码时确定可能受影响的产品。该方法进一步支持工程师,他们在初始预配置后调整特定的产品变体。该方法可以适应不同的可变性机制,提供比现有CIA方法更精确的结果,并且可以使用标准控制流和数据流分析来实现。利用一条工业生产线,我们报告了该方法的效益和性能的评估结果。
{"title":"Configuration-Aware Change Impact Analysis (T)","authors":"Florian Angerer, Andreas Grimmer, Herbert Prähofer, P. Grünbacher","doi":"10.1109/ASE.2015.58","DOIUrl":"https://doi.org/10.1109/ASE.2015.58","url":null,"abstract":"Understanding variability is essential to allow the configuration of software systems to diverse requirements. Variability-aware program analysis techniques have been proposed for analyzing the space of program variants. Such techniques are highly beneficial, e.g., to determine the potential impact of changes during maintenance. This paper presents an interprocedural and configuration-aware change impact analysis (CIA) approach for determining possibly impacted products when changing source code of a product family. The approach further supports engineers, who are adapting specific product variants after an initial pre-configuration. The approach can be adapted to work with different variability mechanism, it provides more precise results than existing CIA approaches, and it can be implemented using standard control flow and data flow analysis. Using an industrial product line we report evaluation results on the benefit and performance of the approach.","PeriodicalId":6586,"journal":{"name":"2015 30th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"103 1","pages":"385-395"},"PeriodicalIF":0.0,"publicationDate":"2015-11-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"91301066","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 19
CIVL: Formal Verification of Parallel Programs CIVL:并行程序的正式验证
Manchun Zheng, Michael S. Rogers, Ziqing Luo, Matthew B. Dwyer, Stephen F. Siegel
CIVL is a framework for static analysis and verification of concurrent programs. One of the main challenges to practical application of these techniques is the large number of ways to express concurrency: MPI, OpenMP, CUDA, and Pthreads, for example, are just a few of many "concurrency dialects" in wide use today. These dialects are constantly evolving and it is increasingly common to use several of them in a single "hybrid" program. CIVL addresses these problems by providing a concurrency intermediate verification language, CIVL-C, as well as translators that consume C programs using these dialects and produce CIVL-C. Analysis and verification tools which operate on CIVL-C can then be applied easily to a wide variety of concurrent C programs. We demonstrate CIVL's error detection and verification capabilities on (1) an MPI+OpenMP program that estimates π and contains a subtle race condition, and (2) an MPI-based 1d-wave simulator that fails to conform to a simple sequential implementation.
CIVL是一个用于并发程序的静态分析和验证的框架。这些技术的实际应用面临的主要挑战之一是表示并发性的方法很多:例如,MPI、OpenMP、CUDA和Pthreads只是目前广泛使用的许多“并发方言”中的一小部分。这些方言不断发展,在一个“混合”节目中使用几种方言越来越普遍。CIVL解决了这些问题,它提供了一种并发的中间验证语言,CIVL-C,以及使用这些方言消费C程序并生成CIVL-C的翻译器。在CIVL-C上运行的分析和验证工具可以很容易地应用于各种并发的C程序。我们在(1)估计π并包含微妙竞争条件的MPI+OpenMP程序上演示了CIVL的错误检测和验证功能,以及(2)基于MPI的一维波模拟器,该模拟器无法符合简单的顺序实现。
{"title":"CIVL: Formal Verification of Parallel Programs","authors":"Manchun Zheng, Michael S. Rogers, Ziqing Luo, Matthew B. Dwyer, Stephen F. Siegel","doi":"10.1109/ASE.2015.99","DOIUrl":"https://doi.org/10.1109/ASE.2015.99","url":null,"abstract":"CIVL is a framework for static analysis and verification of concurrent programs. One of the main challenges to practical application of these techniques is the large number of ways to express concurrency: MPI, OpenMP, CUDA, and Pthreads, for example, are just a few of many \"concurrency dialects\" in wide use today. These dialects are constantly evolving and it is increasingly common to use several of them in a single \"hybrid\" program. CIVL addresses these problems by providing a concurrency intermediate verification language, CIVL-C, as well as translators that consume C programs using these dialects and produce CIVL-C. Analysis and verification tools which operate on CIVL-C can then be applied easily to a wide variety of concurrent C programs. We demonstrate CIVL's error detection and verification capabilities on (1) an MPI+OpenMP program that estimates π and contains a subtle race condition, and (2) an MPI-based 1d-wave simulator that fails to conform to a simple sequential implementation.","PeriodicalId":6586,"journal":{"name":"2015 30th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"107 1","pages":"830-835"},"PeriodicalIF":0.0,"publicationDate":"2015-11-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"81318707","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 29
General LTL Specification Mining (T) 通用LTL规范挖掘(T)
Caroline Lemieux, Dennis Park, Ivan Beschastnikh
Temporal properties are useful for describing and reasoning about software behavior, but developers rarely write down temporal specifications of their systems. Prior work on inferring specifications developed tools to extract likely program specifications that fit particular kinds of tool-specific templates. This paper introduces Texada, a new temporal specification mining tool for extracting specifications in linear temporal logic (LTL) of arbitrary length and complexity. Texada takes a user-defined LTL property type template and a log of traces as input and outputs a set of instantiations of the property type (i.e., LTL formulas) that are true on the traces in the log. Texada also supports mining of almost invariants: properties with imperfect confidence. We formally describe Texada's algorithms and evaluate the tool's performance and utility.
时间属性对于描述和推理软件行为很有用,但是开发人员很少写下他们系统的时间规范。先前在推断规范方面的工作开发了工具来提取适合特定工具模板的程序规范。本文介绍了一种新的时间规范挖掘工具Texada,用于从任意长度和复杂度的线性时间逻辑(LTL)中提取规范。Texada采用用户定义的LTL属性类型模板和跟踪日志作为输入,并输出属性类型(即LTL公式)的一组实例,这些实例在日志中的跟踪中为真。Texada还支持挖掘几乎不变量:具有不完全置信度的属性。我们正式描述了Texada的算法,并评估了该工具的性能和实用性。
{"title":"General LTL Specification Mining (T)","authors":"Caroline Lemieux, Dennis Park, Ivan Beschastnikh","doi":"10.1109/ASE.2015.71","DOIUrl":"https://doi.org/10.1109/ASE.2015.71","url":null,"abstract":"Temporal properties are useful for describing and reasoning about software behavior, but developers rarely write down temporal specifications of their systems. Prior work on inferring specifications developed tools to extract likely program specifications that fit particular kinds of tool-specific templates. This paper introduces Texada, a new temporal specification mining tool for extracting specifications in linear temporal logic (LTL) of arbitrary length and complexity. Texada takes a user-defined LTL property type template and a log of traces as input and outputs a set of instantiations of the property type (i.e., LTL formulas) that are true on the traces in the log. Texada also supports mining of almost invariants: properties with imperfect confidence. We formally describe Texada's algorithms and evaluate the tool's performance and utility.","PeriodicalId":6586,"journal":{"name":"2015 30th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"41 1","pages":"81-92"},"PeriodicalIF":0.0,"publicationDate":"2015-11-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"79839554","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 103
Developing a DSL-Based Approach for Event-Based Monitoring of Systems of Systems: Experiences and Lessons Learned (E) 为基于事件的系统的系统监控开发基于dsl的方法:经验和教训(E)
Michael Vierhauser, Rick Rabiser, P. Grünbacher, Alexander Egyed
Complex software-intensive systems are often described as systems of systems (SoS) comprising heterogeneous architectural elements. As SoS behavior fully emerges during operation only, runtime monitoring is needed to detect deviations from requirements. Today, diverse approaches exist to define and check runtime behavior and performance characteristics. However, existing approaches often focus on specific types of systems and address certain kinds of checks, thus impeding their use in industrial SoS. Furthermore, as many SoS need to run continuously for long periods, the dynamic definition and deployment of constraints needs to be supported. In this paper we describe experiences of developing and applying a DSL-based approach for monitoring an SoS in the domain of industrial automation software. We evaluate both the expressiveness of our DSL as well as the scalability of the constraint checker. We also describe lessons learned.
复杂的软件密集型系统通常被描述为包含异构架构元素的系统的系统(so)。由于SoS行为仅在操作期间完全出现,因此需要运行时监控来检测与需求的偏差。今天,存在多种方法来定义和检查运行时行为和性能特征。然而,现有的方法通常侧重于特定类型的系统并处理某些类型的检查,从而阻碍了它们在工业SoS中的使用。此外,由于许多so需要长时间连续运行,因此需要支持约束的动态定义和部署。在本文中,我们描述了开发和应用基于dsl的方法来监控工业自动化软件领域的SoS的经验。我们评估了DSL的表达性以及约束检查器的可伸缩性。我们还描述了吸取的教训。
{"title":"Developing a DSL-Based Approach for Event-Based Monitoring of Systems of Systems: Experiences and Lessons Learned (E)","authors":"Michael Vierhauser, Rick Rabiser, P. Grünbacher, Alexander Egyed","doi":"10.1109/ASE.2015.25","DOIUrl":"https://doi.org/10.1109/ASE.2015.25","url":null,"abstract":"Complex software-intensive systems are often described as systems of systems (SoS) comprising heterogeneous architectural elements. As SoS behavior fully emerges during operation only, runtime monitoring is needed to detect deviations from requirements. Today, diverse approaches exist to define and check runtime behavior and performance characteristics. However, existing approaches often focus on specific types of systems and address certain kinds of checks, thus impeding their use in industrial SoS. Furthermore, as many SoS need to run continuously for long periods, the dynamic definition and deployment of constraints needs to be supported. In this paper we describe experiences of developing and applying a DSL-based approach for monitoring an SoS in the domain of industrial automation software. We evaluate both the expressiveness of our DSL as well as the scalability of the constraint checker. We also describe lessons learned.","PeriodicalId":6586,"journal":{"name":"2015 30th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"5 1","pages":"715-725"},"PeriodicalIF":0.0,"publicationDate":"2015-11-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"85599009","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 22
Covert Communication in Mobile Applications (T) 移动应用中的隐蔽通信(T)
J. Rubin, Michael I. Gordon, Nguyen Nguyen, M. Rinard
This paper studies communication patterns in mobile applications. Our analysis shows that 63% of the external communication made by top-popular free Android applications from Google Play has no effect on the user-observable application functionality. To detect such covert communication in an efficient manner, we propose a highly precise and scalable static analysis technique: it achieves 93% precision and 61% recall compared to the empirically determined "ground truth", and runs in a matter of a few minutes. Furthermore, according to human evaluators, in 42 out of 47 cases, disabling connections deemed covert by our analysis leaves the delivered application experience either completely intact or with only insignificant interference. We conclude that our technique is effective for identifying and disabling covert communication. We then use it to investigate communication patterns in the 500 top-popular applications from Google Play.
本文研究了移动应用程序中的通信模式。我们的分析显示,Google Play上最受欢迎的免费Android应用所进行的63%的外部交流对用户可观察到的应用功能没有影响。为了有效地检测这种隐蔽通信,我们提出了一种高精度和可扩展的静态分析技术:与经验确定的“地面真相”相比,它达到了93%的精度和61%的召回率,并且在几分钟内运行。此外,根据人类评估人员的说法,在47个案例中,有42个案例中,我们的分析认为禁用连接是隐蔽的,这使得交付的应用程序体验要么完全完好无损,要么只有微不足道的干扰。我们的结论是,我们的技术是有效的识别和禁用秘密通信。然后我们用它来调查Google Play上500款最受欢迎应用的交流模式。
{"title":"Covert Communication in Mobile Applications (T)","authors":"J. Rubin, Michael I. Gordon, Nguyen Nguyen, M. Rinard","doi":"10.1109/ASE.2015.66","DOIUrl":"https://doi.org/10.1109/ASE.2015.66","url":null,"abstract":"This paper studies communication patterns in mobile applications. Our analysis shows that 63% of the external communication made by top-popular free Android applications from Google Play has no effect on the user-observable application functionality. To detect such covert communication in an efficient manner, we propose a highly precise and scalable static analysis technique: it achieves 93% precision and 61% recall compared to the empirically determined \"ground truth\", and runs in a matter of a few minutes. Furthermore, according to human evaluators, in 42 out of 47 cases, disabling connections deemed covert by our analysis leaves the delivered application experience either completely intact or with only insignificant interference. We conclude that our technique is effective for identifying and disabling covert communication. We then use it to investigate communication patterns in the 500 top-popular applications from Google Play.","PeriodicalId":6586,"journal":{"name":"2015 30th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"154 1","pages":"647-657"},"PeriodicalIF":0.0,"publicationDate":"2015-11-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"83431784","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 24
Static Analysis of Implicit Control Flow: Resolving Java Reflection and Android Intents (T) 隐式控制流的静态分析:解析Java反射和Android意图(T)
Paulo Barros, René Just, Suzanne Millstein, Paul Vines, Werner Dietl, Marcelo d’Amorim, Michael D. Ernst
Implicit or indirect control flow is a transfer of control between procedures using some mechanism other than an explicit procedure call. Implicit control flow is a staple design pattern that adds flexibility to system design. However, it is challenging for a static analysis to compute or verify properties about a system that uses implicit control flow. This paper presents static analyses for two types of implicit control flow that frequently appear in Android apps: Java reflection and Android intents. Our analyses help to resolve where control flows and what data is passed. This information improves the precision of downstream analyses, which no longer need to make conservative assumptions about implicit control flow. We have implemented our techniques for Java. We enhanced an existing security analysis with a more precise treatment of reflection and intents. In a case study involving ten real-world Android apps that use both intents and reflection, the precision of the security analysis was increased on average by two orders of magnitude. The precision of two other downstream analyses was also improved.
隐式或间接控制流是使用某种机制(而不是显式过程调用)在过程之间进行的控制转移。隐式控制流是增加系统设计灵活性的主要设计模式。然而,对于静态分析来说,计算或验证使用隐式控制流的系统的属性是具有挑战性的。本文对Android应用中经常出现的两种类型的隐式控制流进行了静态分析:Java反射和Android意图。我们的分析有助于解决控制流的位置和传递的数据。这些信息提高了下游分析的精度,不再需要对隐式控制流做出保守的假设。我们已经为Java实现了我们的技术。我们通过更精确地处理反射和意图来增强现有的安全性分析。在一个涉及十个真实世界的Android应用程序的案例研究中,同时使用意图和反射,安全分析的精度平均提高了两个数量级。另外两个下游分析的精度也得到了提高。
{"title":"Static Analysis of Implicit Control Flow: Resolving Java Reflection and Android Intents (T)","authors":"Paulo Barros, René Just, Suzanne Millstein, Paul Vines, Werner Dietl, Marcelo d’Amorim, Michael D. Ernst","doi":"10.1109/ASE.2015.69","DOIUrl":"https://doi.org/10.1109/ASE.2015.69","url":null,"abstract":"Implicit or indirect control flow is a transfer of control between procedures using some mechanism other than an explicit procedure call. Implicit control flow is a staple design pattern that adds flexibility to system design. However, it is challenging for a static analysis to compute or verify properties about a system that uses implicit control flow. This paper presents static analyses for two types of implicit control flow that frequently appear in Android apps: Java reflection and Android intents. Our analyses help to resolve where control flows and what data is passed. This information improves the precision of downstream analyses, which no longer need to make conservative assumptions about implicit control flow. We have implemented our techniques for Java. We enhanced an existing security analysis with a more precise treatment of reflection and intents. In a case study involving ten real-world Android apps that use both intents and reflection, the precision of the security analysis was increased on average by two orders of magnitude. The precision of two other downstream analyses was also improved.","PeriodicalId":6586,"journal":{"name":"2015 30th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"17 1","pages":"669-679"},"PeriodicalIF":0.0,"publicationDate":"2015-11-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"74471914","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 84
"What Parts of Your Apps are Loved by Users?" (T) “你的应用程序的哪些部分受到用户的喜爱?”(T)
Xiaodong Gu, Sunghun Kim
Recently, Begel et al. found that one of the most important questions software developers ask is "what parts of software are used/loved by users." User reviews provide an effective channel to address this question. However, most existing review summarization tools treat reviews as bags-of-words (i.e., mixed review categories) and are limited to extract software aspects and user preferences. We present a novel review summarization framework, SUR-Miner. Instead of a bags-of-words assumption, it classifies reviews into five categories and extracts aspects for sentences which include aspect evaluation using a pattern-based parser. Then, SUR-Miner visualizes the summaries using two interactive diagrams. Our evaluation on seventeen popular apps shows that SUR-Miner summarizes more accurate and clearer aspects than state-of-the-art techniques, with an F1-score of 0.81, significantly greater than that of ReviewSpotlight (0.56) and Guzmans' method (0.55). Feedback from developers shows that 88% developers agreed with the usefulness of the summaries from SUR-Miner.
最近,Begel等人发现软件开发人员问的最重要的问题之一是“用户使用/喜爱软件的哪些部分”。用户评论提供了一个解决这个问题的有效渠道。然而,大多数现有的评审总结工具将评审视为词包(即混合评审类别),并且仅限于提取软件方面和用户偏好。我们提出了一个新颖的综述总结框架,SUR-Miner。它没有使用“词袋”假设,而是将评论分为五类,并使用基于模式的解析器提取句子的方面,其中包括方面评估。然后,SUR-Miner使用两个交互式图表将摘要可视化。我们对17个流行应用程序的评估表明,与最先进的技术相比,su - miner总结了更准确、更清晰的方面,f1得分为0.81,显著高于ReviewSpotlight(0.56)和Guzmans的方法(0.55)。来自开发人员的反馈显示,88%的开发人员同意su - miner总结的有用性。
{"title":"\"What Parts of Your Apps are Loved by Users?\" (T)","authors":"Xiaodong Gu, Sunghun Kim","doi":"10.1109/ASE.2015.57","DOIUrl":"https://doi.org/10.1109/ASE.2015.57","url":null,"abstract":"Recently, Begel et al. found that one of the most important questions software developers ask is \"what parts of software are used/loved by users.\" User reviews provide an effective channel to address this question. However, most existing review summarization tools treat reviews as bags-of-words (i.e., mixed review categories) and are limited to extract software aspects and user preferences. We present a novel review summarization framework, SUR-Miner. Instead of a bags-of-words assumption, it classifies reviews into five categories and extracts aspects for sentences which include aspect evaluation using a pattern-based parser. Then, SUR-Miner visualizes the summaries using two interactive diagrams. Our evaluation on seventeen popular apps shows that SUR-Miner summarizes more accurate and clearer aspects than state-of-the-art techniques, with an F1-score of 0.81, significantly greater than that of ReviewSpotlight (0.56) and Guzmans' method (0.55). Feedback from developers shows that 88% developers agreed with the usefulness of the summaries from SUR-Miner.","PeriodicalId":6586,"journal":{"name":"2015 30th IEEE/ACM International Conference on Automated Software Engineering (ASE)","volume":"51 1","pages":"760-770"},"PeriodicalIF":0.0,"publicationDate":"2015-11-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"75995659","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 151
期刊
2015 30th IEEE/ACM International Conference on Automated Software Engineering (ASE)
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1