Reviewerly/exHarmony huggingface dataset:
A First Look into Blockchain DAOs

Decentralized autonomous organizations (DAOs) are critical to the blockchain ecosystem as they enable decentralized decision-making and governance, and facilitate the creation of decentralized applications (DApps) and organizations. However, despite significant importance, there is currently a lack of a comprehensive overview and detailed understanding of DAOs. To address the gap, this work presents a primary investigation of DAOs (35+). We category, examine and evaluate existing DAOs regarding their operational features, (non-)functionalities and real-world performance. In addition, we provide a consolidated exploration of DAOs by conducting a literature review [1] and an empirical study on mainstream projects, particularly Snapshot [2]. Our research contributes to a better understanding of DAOs and their potential impact on the blockchain ecosystem.
An Error Estimation Method for Cooperative Detection Based on Bayesian Posterior

In cooperative detection, the error would be highly nonlinear because of the different characteristics of platforms and sensors' error, which makes it difficult to obtain the optimal coordinates based on detection results from multiple platform. In this paper, a Bayesian posterior error estimation method for cooperative detection is designed. Based on designed Bayesian method, a reasonable analysis of the detection error is carried out. The first detection result is taken as a priori for the second detection in order to improve the accuracy of error estimation. The simulation verified that the variance of cooperative detection error is significantly reduced and reaches sub-meter level.
Toward More Effective Deep Learning-based Automated Software Vulnerability Prediction, Classification, and Repair

Software vulnerabilities are prevalent in software systems and the unresolved vulnerable code may cause system failures or serious data breaches. To enhance security and prevent potential cyberattacks on software systems, it is critical to (1) early detect vulnerable code, (2) identify its vulnerability type, and (3) suggest corresponding repairs. Recently, deep learning-based approaches have been proposed to predict those tasks based on source code. In particular, software vulnerability prediction (SVP) detects vulnerable source code; software vulnerability clas-sification (SVC) identifies vulnerability types to explain detected vulnerable programs; neural machine translation (NMT)-based automated vulnerability repair (AVR) generates patches to repair detected vulnerable programs. However, existing SVPs require much effort to inspect their coarse-grained predictions; SVCs encounter an unresolved data imbalance issue; AVRs are still inaccurate. I hypothesize that by addressing the limitations of existing SVPs, SVCs and AVRs, we can improve the accuracy and effectiveness of DL-based approaches for the aforementioned three prediction tasks. To test this hypothesis, I will propose (1) a finer-grained SVP approach that can point out vulnerabilities at the line level; (2) an SVC approach that mitigates the data imbalance issue; (3) NMT-based AVR approaches to address limitations of previous NMT-based approaches. Finally, I propose integrating these novel approaches into an open-source software security framework to promote the adoption of the DL-powered security tool in the industry.
SoapOperaTG: A Tool for System Knowledge Graph Based Soap Opera Test Generation

Exploratory testing is an effective testing approach for the system-level testing from the end user's perspective, which is widely practiced and appreciated in the software industry. Although many concrete principles and guidelines for performing exploratory testing have been proposed, there are no effective tools for automatic generation of exploratory test scenarios (a.k.a soap opera tests). In this paper, we propose a tool named SoapOperaTG for automatic soap opera test generation by leveraging the scenario and oracle knowledge in bug reports. We first construct a system knowledge graph (KG) of user tasks and failures from the preconditions, steps to reproduce (S2Rs), expected behavior (EB) and observed behavior (OB) in bug reports. Then, we create soap opera tests by combining the scenarios of relevant bugs based on the system knowledge graph. SoapOperaTG is implemented as a web tool to present the generated test scenarios. In our user study,5 users find 18 bugs in Mozilla Firefox (a mature, well-maintained software system) in 2 hours using SoapOperaTG, while the control group finds only 5 bugs based on the recommended similar bugs. SoapOperaTG can be found at https://github.com/SuYanqi/SYS-KG. Demo video can be found at https://youtu.be/xcXmY8qGDSc
Detecting and Preventing Credential Misuse in OTP-Based Two and Half Factor Authentication Toward Centralized Services Utilizing Blockchain-Based Identity Management

This paper focuses on the problem of detection and prevention of stolen and misused secrets (such as private keys) for authentication toward centralized services. We propose a solution for this problem, based on SmartOTPs, the two-factor authentication scheme against the blockchain, which is intended for smart contract wallets and utilizes one-time passwords (OTPs). We modify SmartOTPs for our purposes and utilize them in the setting of two-and-a-half-factor authentication against a centralized service provider. Out of two and a half factors of our solution, the first factor stands for the private key, and the second and a half factor stands for OTPs and their precursors (a.k.a., pre-images), where OTPs are obtained from the precursors by cryptoaraphically secure hashing. We describe the protocol for bootstrapping our approach as well as the authentication procedure. In the case of stolen creden-tials from the client, we show that our solution enables the user to immediately detect it and proceed to re-initialization with fresh credentials. We utilize blockchain-based identity management and decentralized identities of users to simplify the overhead of the registration process and reinitialization.
ALT: Aggregate Liquidity Technology

Decentralized exchanges often need to combine liquidity from multiple sources in order to provide the best prices to their users. However, combining liquidity from multiple sources into a single trade has not only required high transaction fees, but is also computationally expensive. Here, we propose a framework for combining liquidity from multiple sources, called Aggregate Liquidity Technology (ALT). ALT maps each liquidity source onto a 2-dimensional space as a curve or line segment, where the input token is on one axis and the output token is on the other. Once this is accomplished, liquidity sources can be combined by finding the points where the curves or lines intersect. Users can get the optimal liquidity on each trade by maximizing the number of output tokens returned. ALT is implemented into Polkaswap on the Parity Substrate-based SORA network, which has processed more than $1 billion worth of token swaps. While the current iteration of ALT works only on a single blockchain network, future work should explore ways to combine liquidity using this methodology across multiple blockchain networks and even centralized exchanges.
Enhancing Deep Reinforcement Learning with Executable Specifications

Deep reinforcement learning (DRL) has become a dominant paradigm for using deep learning to carry out tasks where complex policies are learned for reactive systems. However, these policies are “black-boxes”, e.g., opaque to humans and known to be susceptible to bugs. For example, it is hard - if not impossible - to guarantee that the trained DRL agent adheres to specific safety and fairness properties that may be required. This doctoral dissertation's first and primary contribution is a novel approach to developing DRL agents, which will improve the DRL training process by pushing the learned policy toward high performance on its main task and compliance with such safety and fairness properties, guaranteeing a high probability of compliance while not compromising the performance of the resulting agent. The approach is realized by incorporating domain-specific knowledge captured as key properties defined by domain experts directly into the DRL optimization process while leveraging behavioral languages that are natural to the domain experts. We have validated the proposed approach by extending the AI-Gym Python framework [1] for training DRL agents and integrating it with the BP-Py framework [2] for specifying scenario-based models [3] in a way that allows scenario objects to affect the training process through reward and cost functions, demonstrating dramatic improvement in the safety and performance of the agent. In addition, we have validated the resulting DRL agents using the Marabou verifier [4], confirming that the resulting agents indeed comply (in full) with the required safety and fairness properties. We have applied the approach, training DRL agents for use cases from network communication and robotic navigation domains, exhibiting strong results. A second contribution of this doctoral dissertation is to develop and leverage probabilistic verification methods for deep neural networks to overcome the current scalability limitations of neural network verification technology, limiting the applicability of verification to practical DRL agents. We carried out an initial validation of the concept in the domain of image classification, showing promising results.
ShellFusion: An Answer Generator for Shell Programming Tasks via Knowledge Fusion

Shell programming is widely used to accomplish various tasks in Unix and Linux platforms. However, the large number of shell commands available, e.g., 50,000+ commands are documented in the Ubuntu Manual Pages (MPs), makes it a big challenge for programmers to find appropriate commands for a task. Although there are some tutorials (e.g., TLDR) with examples manually created to address the challenge, the tutorials only cover a limited number of frequently used commands for shell beginners and provide limited support for users to search commands by a task. In this paper, we introduce a novel web-based tool, ShellFusion, which can automatically generate comprehensive answers (including relevant commands, scripts, and explanations) for shell programming tasks by fusing multisource knowledge mined from Q&A posts, Ubuntu MPs, and TLDR tutorials. Our evaluation on 434 shell programming tasks shows that ShellFusion significantly outperforms the state-of-the-art approaches by at least 179.6% in terms of MRR@K and MAP@K. A user study conducted with 20 shell programmers further shows that ShellFusion can help users address programming tasks more efficiently and accurately. ShellFusion Tool: http://shellfusion.cn/ Demo Video: https://youtu.be/P0YJzpKBmnA
Staking Pools with Arbitrary Stake Distribution

On certain blockchains that use the proof-of-stake consensus mechanism, agents who validate transactions can set up pools that allow other agents to delegate their stake to earn higher returns. We study a version of the standard staking pool formation game in the presence of malicious agents, with an arbitrary distribution of stakes of honest agents. We establish existence and uniqueness of equilibria, how blockchain security can be maximized and how a leverage constraint impacts the functioning of the blockchain.
A Novel Construction of Updatable Identity-Based Hash Proof System and Its Applications

In the previous works, to further provide the continuous leakage resilience for the identity-based encryption scheme, a new cryptography primitive, called updatable identity-based hash proof system (U-IB-HPS), was proposed. However, most of the existing constructions have some deficiencies, they either do not have perfect key update function or the corresponding security with tight reduction relies on a non-static complexity assumption. To address the above problems, a new construction of U-IB-HPS is created, and the corresponding security of our system is proved based on the static complexity assumption. Also, the corresponding comparisons and analysis of performances show that our proposal not only achieves the perfect key update function and the anonymity, but also has the tight security reduction. In additional, our proposal achieves the same computational efficiency as other previous systems. To further illustrate the practical function of U-IB-HPS, a generic method of non-interactive data authorization protocol with continuous leakage resilience is designed by employing U-IB-HPS as an underlying tool, which can provide continuous leakage-resilient data authorization function for the cloud computing. Hence, the application field of U-IB-HPS is further extended through our study.
Implementing Secure Bridges: Learnings from the Secure Asset Transfer Protocol

Securely transferring tokenised assets between largely non-interoperable blockchain networks is a great challenge to take on. Implementations must coordinate transactions on multiple blockchain networks which have inherently different characteristics and functionality. Moreover, implementations must coordinate transactions in strict order, in an atomic, synchronised way so that owners do not risk their assets becoming lost, while also mitigating the age-old problem of “avoiding double spend”. Several protocols for cross-network asset transfer, i.e. the bridging of assets, exist, and several production bridge implementations exist. However, frequent high-profile security breaches have arguably given bridges a bad reputation. Therefore, there is a clear need for standardised bridge protocols to re-establish trust. One initiative for standardising cross-network bridges is the Secure Asset Transfer Protocol (SATP) developed by the Internet Engineering Task Force (IETF). This protocol establishes four distinctive phases for the asset transfer process, driven by a standardised messaging cycle between specialised bridge orchestration applications, known as gateways. In this paper, we demonstrate a reference framework with functions needed to implement SATP. We describe our implementation of this reference framework, why SATP is unique and why SATP is likely to be an important contribution to powering future bridges.
Technical Briefing on Socio-Technical Grounded Theory for Qualitative Data Analysis

Analysis of qualitative data as part of qualitative and mixed-method research studies is becoming increasingly common. Deriving rich and robust findings from qualitative data analysis requires a good understanding of the nature of qualitative data, relevant collection techniques, and the application of robust and systematic qualitative data analysis. This technical briefing will cover these, and work through real examples of qualitative data analysis using socio-technical grounded theory (STGT) in software engineering research studies.
TECHSUMBOT: A Stack Overflow Answer Summarization Tool for Technical Query

Stack Overflow is a popular platform for developers to seek solutions to programming-related problems. However, prior studies identified that developers may suffer from the redundant, useless, and incomplete information retrieved by the Stack Overflow search engine. To help developers better utilize the Stack Overflow knowledge, researchers proposed tools to summarize answers to a Stack Overflow question. However, existing tools use hand-craft features to assess the usefulness of each answer sentence and fail to remove semantically redundant information in the result. Besides, existing tools only focus on a certain programming language and cannot retrieve up-to-date new posted knowledge from Stack Overflow. In this paper, we propose TECHSUMBOT, an automatic answer summary generation tool for a technical problem. Given a question, TECH-SUMBOT first retrieves answers using the Stack Overflow search engine, then TECHSUMBOT 1) ranks each answers sentence based on the sentence's usefulness, 2) estimates the centrality of each sentence to all candidates, and 3) removes the semantic redundant information. Finally, TECHSUMBOT returns the top 5 ranked answer sentences as the answer summary. We implement TECHSUMBOT in the form of a search engine website. To evalu-ate TECHSUMBOT in both automatic and manual manners, we construct the first Stack Overflow multi-answer summarization benchmark and design a manual evaluation study to assess the effectiveness of TECHSUMBOT and state-of-the-art baselines from the NLP and SE domain. Both results indicate that the summaries generated by TECHSUMBOT are more diverse, useful, and similar to the ground truth summaries. Tool Link: www.techsumbot.com Video Link: https://youtube.com/watchvozuJOp_vILMReplicationPackage: https://github.com/TechSumBot/TechSumBot
An Automated Policy Verification and Enforcement Framework for Ethereum Applications

In recent years, with the support of appropriate smart contract-based access control policies, blockchain technology has proven to be a compelling solution for providing a unified, trusted platform for resource sharing. However, due to the immutability property of blockchain, it can be challenging to patch or fix bugs after the deployment of a smart contract. Therefore, it is critical to ensure that the smart contract access control policies adhere to all specifications prior to their deployment, and the presence of anomalies within policies is not desirable. Thus, this paper proposes an automated policy verification and enforcement framework for Ethereum decentralized applications, which supports an automated off-chain policy verification before its deployment to the underlying blockchain. We integrate a verification engine within the off-chain module paired with a translator to convert XACML policies into Solidity smart contracts and vice-versa. Additionally, the experiments performed on benchmark XACML policies further reinforce the pragmatism of our proposal.
A Ripple for Change: Analysis of Frontrunning in the XRP Ledger

Blockchains are disrupting traditional finance by reducing the number of intermediaries and providing transparency. Blockchains, however, come with their own set of prominent issues. One such challenge is frontrunning. Attackers try to influence the transaction order so that their transaction executes before their victims' transaction. While frontrunning is a well-studied topic on Ethereum, it is unknown whether other blockchains are also susceptible to such attacks. One proposed defence strategy against frontrunning attacks is to randomize the transaction execution order. XRP Ledger is the highest-value blockchain to use such a strategy. Furthermore, it runs a Decentralized Exchange, which provides ample frontrunning opportunities. Therefore, in the context of XRP Ledger, we examine whether randomized transaction order provides sufficient protection against frontrunning. Our results show that the mechanism embedded in the XRP Ledger protocol is insufficient to prevent these attacks. We showcase two strategies to perform frontrunning attacks. The first, “naive” strategy, uses randomly generated accounts, whereas the second uses carefully selected accounts to improve the attack's success. Based on our analysis of the XRP Ledgers' historical data, we estimate that attackers could generate up to approx. 1.4M USD profit over two months, provided they succeeded to frontrun every opportunity.
Towards Utilizing Natural Language Processing Techniques to Assist in Software Engineering Tasks

Machine learning-based approaches have been widely used to address natural language processing (NLP) problems. Considering the similarity between natural language text and source code, researchers have been working on applying techniques from NLP to deal with code. On the other hand, source code and natural language are by nature different. For example, code is highly structured and executable. Thus, directly applying the NLP techniques may not be optimal, and how to effectively optimize these NLP techniques to adapt to software engineering (SE) tasks remains a challenge. Therefore, to tackle the challenge, in this dissertation, we focus on two research directions: 1) distributed code representations, and 2) logging statements, which are two important intersections between the natural language and source code. For distributed code representations, we first discuss the limitations of existing code embedding techniques, and then, we propose a novel approach to learn more generalizable code embeddings in a task-agnostic manner. For logging statements, we first propose an automated deep learning-based approach to automatically generate accurate logging texts by translating the related source code into short textual descriptions. Then, we make the first attempt to comprehensively study the temporal relations between logging and its corresponding source code, which is later used to detect issues in logging statements. We anticipate that our study can provide useful suggestions and support to developers in utilizing NLP techniques to assist in SE tasks.
Conducting Eye Tracking Studies in Software Engineering - Methodology and Pipeline

This ICSE 2023 technical briefing is on state-of-the-art techniques to conduct eye tracking studies in software engineering. It is organized as a hands-on 180-minute briefing broken up into two 85-minute modules with a short break in between. The first module will teach participants the terminology and theories needed to understand eye tracking. The second will engage participants in hands-on groupwork to collect and analyze eye tracking data through a software pipeline. Our goal is to help participants one-on-one learn how to get starting using eye tracking to support their own research goals. Our team has been working with eye tracking for over 15 years. The briefing will be targeted towards researchers, practitioners, and educators. Our eye tracking software infrastructure, iTrace, will be demonstrated in person with several state-of-the-art eye trackers. Eye tracking is gaining a lot of traction in the community. We want to use the ICSE platform to communicate the current state-of-the-art (including limitations and workarounds) in a highly interactive setting starting from the theory, data collection, and processing pipeline. Sample data and scripts will be made available.
Enhancing XCMP Interoperability Across Polkadot Paraverse

The first blockchain projects were not built with interoperability in mind. This idea became more popular later as development progressed, and there was a need for the ability to share assets and messages with other blockchain networks. Some of the blockchains that were not made with an interoperability focus started realizing that it was where the future was headed and implemented interoperability that existed, or they created their own way of communicating with other networks. To this day, many protocols are being built that enhance interoperability. Blockchain interoperability refers to the ability of different blockchain systems to work together and communicate with each other. This is an important concept for the future of blockchain technology, as it enables different blockchain networks to exchange information and assets seamlessly. This paper focuses on enhancing the interoperability between Paraverse and the specific network called Polkadot. This is achieved by using the network-specific native protocol for interoperability, called XCMP. The results show that not only is ParaSpell SDK a useful contribution to the Polkadot ecosystem, but it also makes interoperable transactions easier and more user-friendly.