waashk/dblp huggingface dataset:
revel8or: model driven capacity planning tool suite. designing complex multi-tier applications that must meet strict performance requirements is a challenging software engineering problem. ideally, the application architect could derive accurate performance predictions early in the project life-cycle, leveraging initial application design-level models and a description of the target software and hardware platforms. to this end, we have developed a capacity planning tool suite for component-based applications, called revel8tor. the tool adheres to the model driven development paradigm and supports benchmarking and performance prediction for j2ee, .net and web services platforms. the suite is composed of three different tools: mdaperf, mdabench and dslbench. mdaperf allows annotation of design diagrams and derives performance analysis models. mdabench allows a customized benchmark application to be modeled in the uml 2.0 testing profile and automatically generates a deployable application, with measurement automatically conducted. dslbench allows the same benchmark modeling and generation to be conducted using a simple performance engineering domain specific language (dsl) in microsoft visual studio. dslbench integrates with visual studio and reuses its load testing infrastructure. together, the tool suite can assist capacity planning across platforms in an automated fashion.
refactoring-aware configuration management for object-oriented programs. current text based software configuration management (scm) systems have trouble with refactorings. refactorings result in global changes and lead to merge conflicts. a refactoring-aware scm system reduces merge conflicts, preserves program history better and makes it easier to understand program evolution. this paper describes molhadoref, a refactoring-aware scm system and the merge algorithm at its core. molhadoref records change operations (refactorings and edits) used to produce one version, and replays them when merging versions. since refactorings are change operations with well defined semantics, molhadoref treats them intelligently. a case-study shows that molhadoref solves automatically more merge conflicts than cvs while resulting in fewer merge errors.
when role models have flaws: static validation of enterprise security policies. modern multiuser software systems have adopted role- based access control (rbac) for authorization management. this paper presents a formal model for rbac policy validation and a static-analysis model for rbac systems that can be used to (i) identify the roles required by users to execute an enterprise application, (ii) detect potential inconsistencies caused by principal-delegation policies, which are used to override a user's role assignment, (iii) report if the roles assigned to a user by a given policy are redundant or insufficient, and (iv) report vulnerabilities that can result from unchecked intra-component accesses. the algorithms described in this paper have been implemented as part of ibm's enterprise security policy evaluator (espe) tool. experimental results show that the tool found numerous policy flaws, including ten previously unknown flaws from two production-level applications, with no false-positive reports.
tracking code clones in evolving software. code clones are generally considered harmful in software development, and the predominant approach is to try to eliminate them through refactoring. however, recent research has provided evidence that it may not always be practical, feasible, or cost-effective to eliminate certain clone groups. we propose a technique for tracking clones in evolving software. our technique relies on the concept of abstract clone region descriptors (crd), which describe clone regions within methods in a robust way that is independent from the exact text of the clone region or its location in a file. we present our definition of crds, and describe a complete clone tracking system capable of producing crds from the output of a clone detection tool, notify developers of modifications to clone regions, and support the simultaneous editing of clone regions. we report on two experiments and a case study conducted to assess the performance and usefulness of our approach
introducing accessibility requirements through external stakeholder utilization in an undergraduate requirements engineering course. undergraduate software engineering courses aim to prepare students to deliver software in a variety of domains. the manner in which these courses are conducted varies, though team projects with real or imaginary stakeholders are common. while the key course concepts vary from the entire lifecycle to specific aspects of design, concepts like accessibility are rare. this paper will present a study of team projects in a requirements engineering course. one group of students conducted projects with accessibility requirements while another group of students delivered projects without accessibility requirements. the course content was the same, including discussion of accessibility. to support the understanding of accessibility, stakeholders with disabilities were included in the requirements engineering process. both teams benefited from the experience as indirect knowledge acquisition occurred. students from a previous offering of the course, with no external stakeholder interaction, demonstrated lower levels of accessibility understanding.
top se: educating superarchitects who can apply software engineering tools to practical development in japan. this paper discusses the top se program established to bridge the industry-academia gap. the program features extensive use of software engineering tools, not only to introduce students to the tools, but also as a conduit for learning the techniques and guidelines needed to apply the tools to practical software development situations. the curriculum is organized around practical problems mainly from the area of digital home appliances and focuses on upper stream software development processes. the top se program is developed and operated by a close collaboration between industry and academia. we illustrate our discussion with examples from one of the courses, verification of design models, which takes up model checking technologies, including three specific tools: spin, smv, and ltsa.
soquet: query-based documentation of crosscutting concerns. understanding crosscutting concerns is difficult because their underlying relations remain hidden in a class-based decomposition of a system. based on an extensive investigation of crosscutting concerns in existing systems and literature, we identified a number of typical implementation idioms and relations that allow us to group such concerns around socalled .sorts.. in this paper, we present soquet, a tool that uses sorts to support the consistent description and documentation of crosscutting relations using pre-defined, sort-specific query templates.
information hiding and visibility in interface specifications. information hiding controls which parts of a class are visible to non-privileged and privileged clients (e.g., subclasses). this affects detailed design specifications in two ways. first, specifications should not expose hidden class members. as noted in previous work, this is important because such hidden members are not meaningful to all clients. but it also allows changes to hidden implementation details without invalidating correctness proofs for client code, which is important for maintaining verified programs. second, to enable sound modular reasoning, certain specifications must be visible to clients. we present rules for information hiding in specifications for java-like languages, and demonstrate their application to the specification language jml. these rules restrict proof obligations to only mention visible class members, but retain soundness. this allows maintenance of implementations and their specifications without affecting client reasoning.
precise memory leak detection for java software using container profiling. a memory leak in a java program occurs when object references that are no longer needed are unnecessarily maintained. such leaks are difficult to understand because static analyses typically cannot precisely identify these redundant references, and existing dynamic analyses for leak detection track and report fine-grained information about individual objects, producing results that are usually hard to interpret and lack precision. we introduce a novel container-based heap-tracking technique, based on the observation that many memory leaks in java programs occur due to containers that keep references to unused data entries. the novelty of the described work is two-fold: (1) instead of tracking arbitrary objects and finding leaks by analyzing references to unused objects, the technique tracks only containers and directly identifies the source of the leak, and (2) the approach computes a confidence value for each container based on a combination of its memory consumption and its elements' staleness (time since last retrieval), while previous approaches do not consider such combined metrics. our experimental results show that the reports generated by the proposed technique can be very precise: for two bugs reported by sun and for a known bug in specjbb, the top containers in the reports include the containers that leak memory.
behaviour model synthesis from properties and scenarios. synthesis of behaviour models from software development artifacts such as scenario-based descriptions or requirements specifications not only helps significantly reduce the effort of model construction, but also provides a bridge between approaches geared toward requirements analysis and those geared towards reasoning about system design at the architectural level. however, the models favoured by existing synthesis approaches are not sufficiently expressive to describe both universal constraints provided by requirements and existential statements provided by scenarios. in this paper, we propose a novel synthesis technique that constructs behaviour models in the form of modal transition systems (mts) from a combination of safety properties and scenarios. mtss distinguish required, possible and proscribed behaviour, and their elaboration not only guarantees the preservation of the properties and scenarios used for synthesis but also supports further elicitation of new requirements.
a constructivist approach to teaching software processes. recreating the context in which software processes are developed is difficult in the undergraduate classroom environment. as a result, traditional lecture-based teaching approaches do not necessarily translate into long-term understanding of software processes. to give students a deeper appreciation for the strengths and weaknesses of software process models, we designed the software process simulation game using constructivism as the underlying foundation. in this paper, we discuss the challenges associated with teaching software processes models, provide an overview of the game, detail its mechanics, and discuss the lessons learned from playing the game. since the game does not involve actual programming or design activities, it can be used effectively for teaching both novice and experienced software engineers.
overview and evaluation of constraint validation approaches in java. integrity is a dependability attribute partially ensured through runtime validation of integrity constraints. a wide range of different constraint validation approaches exists--ranging from simple if conditions over explicit constraint validation methods and contract specifications to constraints as first class runtime entities of an application. however, increased support for explicitness and flexibility often comes at the price of increased performance costs. to address this issue, we contribute with an overview and evaluation of different constraint validation approaches for the java programming language with respect to implementation, maintainability and performance. our results show that the benefits of some of the more advanced approaches are certainly worth their costs by introducing a runtime overhead of only two to ten times the runtime of the fastest approach while other approaches introduce runtime overheads of more than 100, which might be simply too slow in certain applications.
ajaxifying classic web applications. recently, a new web development technique for creating interactive web applications, dubbed ajax, has emerged in response to the limited degree of interactivity in large-grain stateless web interactions. in this new model, the web interface is composed of individual components which can be updated/replaced independently, and the client/server communication is based on a delta-communication style of interaction. with the rise of ajax web applications classical multi-page web applications are becoming legacy systems. this research seeks to explore how software engineering techniques can assist in comprehending, analyzing, and restructuring classic web applications towards ajax.
ownership and immutability inference for uml-based object access control. we propose a mechanism for object access control which is based on the uml. specifically, we propose use of ownership and immutability constraints on uml associations and verification of these constraints through reverse engineering. these constraints inherently support software design principles, and impose requirements on the implementation that may help prevent serious program flaws. we propose implementation-level models for ownership and immutability that capture well the meaning of these concepts in design, and we develop novel static ownership and immutability inference analyses. we perform an empirical investigation on several small-to-large java programs. the results indicate that the inference analyses are precise and practical. therefore, the analyses can be integrated in reverse engineering tools and can help support effective reasoning about software quality and security.
the factory pattern in api design: a usability evaluation. the usability of software apis is an important and infrequently researched topic. a user study comparing the usability of the factory pattern and constructors in api designs found highly significant results indicating that factories are detrimental to api usability in several varied situations. the results showed that users require significantly more time (p = 0.005) to construct an object with a factory than with a constructor while performing both context-sensitive and context-free tasks. these results suggest that the use of factories can and should be avoided in many cases where other techniques, such as constructors or class clusters, can be used instead.
performance evaluation and prediction for legacy information systems. database-centric information systems are critical to the operations of large organisations. in particular, they often process a large amount of data with stringent performance requirements. currently, however, there is a lack of systematic approaches to evaluating and predicting their performance when they are subject to an exorbitant growth of workload. in this paper, we introduce such a systematic approach that combines benchmarking, production system monitoring, and performance modelling (bmm) to address this issue. the approach helps the performance analyst to understand the system's operating environment and quantify its performance characteristics under varying load conditions via monitoring and benchmarking. based on such realistic measurements, modelling techniques are used to predict the system performance. our experience of applying bmm to a real-world system demonstrates the capability of bmm in predicting the performance of existing and enhanced software architectures in planning for its capacity growth.
the impact of research on middleware technology. various commercial trends have led to an increasing demand for distributed systems. distributed systems can integrate legacy components, thus preserving investment, they can decrease the time to market, they can be scalable and tolerant against failures. the caveat, however, is that the construction of a truly distributed systems is considerably more difficult than building a centralized or client/server system. this is because there are multiple points of failure in a distributed system, system components need to communicate with each other through a network, which complicates communication and opens the door for security attacks. middleware has been devised in order to conceal these difficulties from application engineers as much as possible; middleware is commonly defined as a software layer between applications and operating systems that provides application programmers with higher level of abstractions, such as remote procedure invocation, reliable message exchange or transactions. these abstractions considerably simplify distributed system construction and as a result middleware products are rapidly being adopted in industry and middleware is generally perceived as a success technology.
maturity status within front-end support organisations. it may not be enough to develop mature processes at the back-end support level. other strongly collaborating front-end support processes may substantially undermine them. for this reason, we have created cm3: front-end problem management - a detailed problem management process model to be utilised at the front-end support level. in this paper, we present the cm3 maturity levels at the front-end support and match them against the industrial state of practice within 15 software organisations. our goal is to establish the current status of support maturity using cm3: front-end problem management. our results show that the industrial processes studied suffice to provide basic problem management support at the front-end support level. however, only two out of 15 organisations studied have almost achieved the highest maturity level.
creating a computer security curriculum in a software engineering program. this paper discusses our experiences developing and delivering a computer security curriculum in a graduate software engineering program. it describes our program and student backgrounds, our approach to teaching computer security aimed towards a software engineering audience with disparate backgrounds, other challenges and solutions, course contents with emphasis on our core course, and additional venues and future plans.
automated generation of context-aware tests. the incorporation of context-awareness capabilities into pervasive applications allows them to leverage contextual information to provide additional services while maintaining an acceptable quality of service. these added capabilities, however, introduce a distinct input space that can affect the behavior of these applications at any point during their execution, making their validation quite challenging. in this paper, we introduce an approach to improve the test suite of a context-aware application by identifying context-aware program points where context changes may affect the application's behavior, and by systematically manipulating the context data fed into the application to increase its exposure to potentially valuable context variations. preliminary results indicate that the approach is more powerful than existing testing approaches used on this type of application.
opium: optimal package install/uninstall manager. linux distributions often include package management tools such as apt-get in debian or yum in redhat. using information about package dependencies and conflicts, such tools can determine how to install a new package (and its dependencies) on a system of already installed packages. using off-the-shelf sat solvers, pseudo-boolean solvers, and integer linear programming solvers, we have developed a new package-management tool, called opium, that improves on current tools in two ways: (1) opium is complete, in that if there is a solution, opium is guaranteed to find it, and (2) opium can optimize a user-provided objective function, which could for example state that smaller packages should be preferred over larger ones. we performed a comparative study of our tool against debian's apt-get on 600 traces of real-world package installations. we show that opium runs fast enough to be usable, and that its completeness and optimality guarantees provide concrete benefits to end users.
dynamic round-trip gui maintenance. one difficulty in software maintenance is that the relationship between observed program behavior and source code is not always clear. this is true for the maintenance of graphical user interfaces (guis), because user interface code can be scattered across the decomposition of applications. a popular approach to develop and maintain guis is to use "what you see is what you get" editors. they allow developers to work directly with a graphical design view instead of scattered source elements. unfortunately gui editors are limited by their ability to statically reconstruct dynamic collaborations between objects. in our research we investigate the combination of a hybrid dynamic and static approach to allow for round-trip maintenance of guis. dynamic analysis reconstructs object relationships, providing a concrete context in which maintenance can be performed. static checking guides the reconciliation between the gui editors' design view and source. we implemented a prototype ide plugin and evaluate our approach by applying it to five open source projects.
polus: a powerful live updating system. this paper presents polus, a software maintenance tool capable of iteratively evolving running software into newer versions. polus's primary goal is to increase the dependability of contemporary server software, which is frequently disrupted either by external attacks or by scheduled upgrades. to render polus both practical and powerful, we design and implement polus aiming to retain backward binary compatibility, support for multithreaded software and recover already tainted state of running software, yet with good usability and very low runtime overhead. to demonstrate the applicability of polus, we report our experience in using polus to dynamically update three prevalent server applications: vsftpd, sshd and apache http server. performance measurements show that polus incurs negligible runtime overhead: a less than 1% performance degradation (but 5% for one case). the time to apply an update is also minimal.
deckard: scalable and accurate tree-based detection of code clones. detecting code clones has many software engineering applications. existing approaches either do not scale to large code bases or are not robust against minor code modifications. in this paper, we present an efficient algorithm for identifying similar subtrees and apply it to tree representations of source code. our algorithm is based on a novel characterization of subtrees with numerical vectors in the euclidean space \mathbb{r}^n and an efficient algorithm to cluster these vectors w.r.t. the euclidean distance metric. subtrees with vectors in one cluster are considered similar. we have implemented our tree similarity algorithm as a clone detection tool called deckard and evaluated it on large code bases written in c and java including the linux kernel and jdk. our experiments show that deckard is both scalable and accurate. it is also language independent, applicable to any language with a formally specified grammar.