waashk/dblp huggingface dataset:
the 6 international workshop on software engineering for secure systems (sess'10). the 6th edition of the sess workshop aims at providing a venue for software engineers and security researchers to exchange ideas and techniques. in fact, software is at core of most of the business transactions and its smart integration in an industrial setting may be the competitive advantage even when the core competence is outside the ict field. as a result, the revenues of a firm depend directly on several complex software-based systems. thus, stakeholders and users should be able to trust these systems to provide data and elaborations with a degree of confidentiality, integrity, and availability compatible with their needs. moreover, the pervasiveness of software products in the creation of critical infrastructures has raised the value of trustworthiness and new efforts should be dedicated to achieve it. however, nowadays almost every application has some kind of security requirement even if its use is not to be considered critical.
penalty policies in professional software development practice: a multi-method field study. organizational punishment/penalty is a pervasive phenomenon in many professional organizations. in some software development organizations, punishment measures have been adopted in an attempt to improve software developers' performance, reduce the software defects, and hence ensure software quality. it is unclear whether these measures are effective. this article presents the results of a multi-method field study that analyzes software engineers' perception towards penalty policies in relation to software quality in a software development process. the results were generated via both qualitative and quantitative methods. through interviews, we collected the individuals' perception towards the penalty policy. by extracting data in a software configuration management system, we identified several patterns of defects change. we found that while a penalty mechanism does help to reduce software defects in daily coding activity, it fails in achieving programmers' maximum work potential. meanwhile, experienced software programmers require less time to adapt to penalty policies and benefit from exist of less experienced developers. some additional findings and implications are also discussed.
a cost-benefit framework for making architectural decisions in a business context. in any it-intensive organization, it is useful to have a model to associate a value with software and system architecture decisions. more generally, any effort---a project undertaken by a team---needs to have an associated value to offset its labor and capital costs. unfortunately, it is extremely difficult to precisely evaluate the benefit of "architecture projects"---those that aim to improve one or more quality attributes of a system via a structural transformation without (generally) changing its behavior. we often resort to anecdotal and informal "hand-waving" arguments of risk reduction or increased developer productivity. these arguments are typically unsatisfying to the management of organizations accustomed to decision-making based on concrete metrics. this paper will discuss research done to address this long-standing dilemma. specifically, we will present a model derived from analyzing actual projects undertaken at vistaprint corporation. the model presented is derived from an analysis of effort tracked against modifications to specific software components before and after a significant architectural transformation to the subsystem housing those components. in this paper, we will discuss the development, implementation, and iteration of the model and the results that we have obtained.
domain-specific tailoring of code smells: an empirical study. code smells refer to commonly occurring patterns in source code that indicate poor programming practices or code decay. detecting code smells helps developers find design problems that can cause trouble in future maintenance. detection rules for code smells, based on software metrics, have been proposed, but they do not take domain-specific characteristics into consideration. in this study we investigate whether such generic heuristics can be tailored to include domain-specific factors. input into these domain-specific heuristics comes from an iterative empirical field study in a software maintenance project. the results yield valuable insight into code smell detection.
using invariant functions and invariant relations to compute loop functions. in this short paper we discuss the design, implementation and operation of an automated tool that computes the function of while loops written in c-like programming languages.
visualizing the java heap. many of the problems that occur in long-running systems involve the way that the system uses memory. we have developed a framework for extracting and building a model of the heap from a running java system. such a model is only useful if programmers can extract from it the information they need to understand, find, and eventually fix memory-related problems in their system. we demonstrate the tool in action, showing how it works dynamically on running processes and how it is designed to address a variety of specific memory issues.
code clone detection in practice. due to the negative impact of code cloning on software maintenance efforts as well as on program correctness [4--6], the duplication of code is generally viewed as problematic. however, the techniques and tools developed by the research community in the last decade have not found broad acceptance in software engineering practice yet. this tutorial contributes to a more widespread application of existing approaches by illustrating where cloning comes from, what its consequences are, and how it can be detected.
generative software development. generation of software from modeling languages such as uml and domain specific languages (dsls) has become an important paradigm in software engineering. in this contribution, we present some positions on software development in a model based, generative manner based on home grown dsls as well as the uml. this includes development of dsls as well as development of models in these languages in order to generate executable code, test cases or models in different languages. development of formal dsls contains concepts of metamodels or grammars (syntax), context conditions (static analysis and quality assurance) as well as possibilities to define the semantics of a language. the growing number and complexity of dsls is addressed by concepts for the modular and compositional development of languages and their tools. moreover, we introduce approaches to code generation and model transformation. finally, we give an overview of the relevance of dsls for various steps of software development processes.
smt-based bounded model checking for multi-threaded software in embedded systems. the transition from single-core to multi-core processors has made multi-threaded software an important subject over the last years in computer-aided verification. model checkers have been successfully applied to discover subtle errors, but they suffer from combinatorial state space explosion when verifying multi-threaded software. in our previous work, we have extended the encodings from smt-based bounded model checking (bmc) to provide more accurate support for program verification and to use different background theories and solvers in order to improve scalability and precision in a completely automatic way. we now focus on extending this work to support an smt-based bmc formulation of multithreaded software which allows the state space to be reduced by abstracting the number of state variables and interleavings from the proof of unsatisfiability generated by the smt solvers. the core idea of our approach aims to extract the proof objects produced by the smt solvers in order to control the number of interleavings and to remove logic that is not relevant to a given property. this work aims to develop a new algorithmic method and corresponding tools based on smt to verify embedded software in multi-core systems.
soabench: performance evaluation of service-oriented middleware made easy. soabench is a framework for the automatic generation, execution and analysis of testbeds for evaluating the performance of service-oriented middleware. testbeds can be characterized in terms of the composite services to execute, the workload to generate, the deployment configuration to use, the performance metrics to gather, the data analyses to perform on them, and the reports to produce.
exploratory study of a uml metric for fault prediction. this paper describes the use of a uml metric, an approximation of the ck-rfc metric, for predicting faulty classes before their implementation. we built a code-based prediction model of faulty classes using logistic regression. then, we tested it in different projects, using on the one hand their uml metrics, and on the other hand their code metrics. to decrease the difference of values between uml and code measures, we normalized them using linear scaling to unit variance. our results indicate that the proposed uml rfc metric can predict faulty code as well as its corresponding code metric does. moreover, the normalization procedure used was of great utility, not just for enabling our uml metric to predict faulty code, using a code-based prediction model, but also for improving the prediction results across different packages and projects, using the same model.
software architecture for systems of software intensive systems (s3): the concepts and detection of inter-system relationships. key to software architecture is the description of relationships between software components [10] supported by commonly understood semantic definitions [9][8]. however, the definitions do not adequately capture the inter-system level software relationships. this leaves software architects either unaware of critical relationships or, to 'roll their own' based on aggregations of code-level call/use structures. this leads to critical gaps in the architectural description and communication problems within distributed development environments - as poorly understood relationships can inadvertently propagate changes and break system interoperability [2]. the solution requires a description of new system level relationships and a new systematic, repeatable technique to detect both immediate and linked system level relationships. the solution will be developed through the mining of existing software ecosystems and industry systems of software intensive systems (s3) architectures. validation will be performed through case studies from industry collaborations.
bridging the gap between the theory and practice of software test automation. in software development practice, testing often accounts for as much as 50% of the total development effort. it is therefore imperative to reduce the cost and improve the effectiveness of software testing by automating the testing process. in the past decades, a substantial amount of research effort has been invested into the development and study of automatic test case generation, automatic test oracles, and other (semi-)automated testing techniques. as the theory and practice of software testing becomes more mature, a deeper and more meaningful automation of the testing process is possible. therefore, the automation of various testing activities is now becoming an integral part of industrial practice. in response to and in support of these exciting developments, the 5th workshop on the automation of software test provides a publication forum that bridges the gap between the theory and practice of automated testing.
using ethnographic methods in software engineering research. this tutorial provides an overview of the role of ethnography in software engineering research. it describes the use of ethnographic methods as a means to provide an in-depth understanding of the socio-technological realities surrounding everyday software development practice. the knowledge gained can be used to improve processes, methods and tools as well as develop observed industrial practices. the tutorial begins with a brief historical account of ethnography in the fields of software engineering, cscw, information systems and other related areas. this sets the stage for a more in-depth discussion of methods for data collection and analysis used in ethnographic studies. it then describes how these methods can be and have been used by software engineering researchers to understand developers' work practices, to inform the development of processes, methods and tools and to evaluate the applicability of current processes, methods and tools. finally, some practical issues concerning the selection and use of ethnographic methods by software engineers are discussed. throughout the tutorial, examples from the presenters' experience illustrate the points made.
software architecture and agile software development: a clash of two cultures? software architecture is taking a bad rap with the agilists---proponents of agile and lean software development approaches: "bufd big up-front design", "yagni you ain't gonna need it", "massive documentation", "smells of waterfall", it is pictured as a typical non-agile practice. however, certain classes of system, ignoring architectural issues too long "hit a wall" and collapse by lack of an architectural focus. 'agile architecture': a paradox, an oxymoron, two totally incompatible approaches? in this tutorial, we examine the real issues at stake, beyond the rhetoric and posturing, and show that the two cultures can coexist and support each other, where appropriate. we define heuristics to scope how much architecture a project really needs, to assign actual value to an otherwise invisible architecture; and we review management and development practices that do work in the circumstances where some significant architectural effort is needed, when you are actually going to need it.
lm: a miner for scenario-based specifications. we present lm, a tool for mining scenario-based specifications in the form of live sequence charts, a visual language that extends sequence diagrams with modalities. lm comes with a project management component, a wizard-like interface to the mining algorithm, a set of pre- and post-processing extensions, and a visualization module.
formal methods for web services: a taxonomic approach. formal methods can be used to verify different perspective of a web service. an ensemble of specific techniques is not supported by a general approach to the problem. to understand which formal method should be combined and used is a challenge. this paper outlines our approach to address this problem.
improving wide-area distributed system availability. the software-as-a-service (saas) paradigm and corresponding service-oriented technologies have simplified the development of larger, more complex software systems that routinely span administrative and organisational boundaries. these systems inhabit a complex operating environment with numerous threats to the dependability of service compositions. these threats include many system-level failures whose causes are difficult and time-consuming to determine. it is difficult to detect vulnerabilities to these failures prior to deployment of an application into production and applications are currently not well-equipped to handle them effectively. this results in lengthy downtimes of production systems and hence low availability. the goal of this phd is to increase the availability of such systems by eliminating as many failures as possible before deployment and by assisting administrators to diagnose their causes more efficiently. we propose a novel monitoring technique and apply failure injection techniques that target these difficult failures and enable separate administrative domains to cooperate in handling them. furthermore, we investigate the extent to which we can equip these systems to be self-diagnosing.
requirements reflection: requirements as runtime entities. computational reflection is a well-established technique that gives a program the ability to dynamically observe and possibly modify its behaviour. to date, however, reflection is mainly applied either to the software architecture or its implementation. we know of no approach that fully supports requirements reflection- that is, making requirements available as runtime objects. although there is a body of literature on requirements monitoring, such work typically generates runtime artefacts from requirements and so the requirements themselves are not directly accessible at runtime. in this paper, we define requirements reflection and a set of research challenges. requirements reflection is important because software systems of the future will be self-managing and will need to adapt continuously to changing environmental conditions. we argue requirements reflection can support such self-adaptive systems by making requirements first-class runtime entities, thus endowing software systems with the ability to reason about, understand, explain and modify requirements at runtime.
portable secure identity management for software engineering. identity management refers to authentication, sharing of personally identifiable information (pii) and provision of mechanisms protecting the privacy thereof. the most commonly implemented is federated authentication, permitting users to maintain a single set of credentials to access many services. specifications exist for profile exchange between a service provider (sp) and the identity provider (idp), but are rarely used. most frequently, local storage of profile data is utilised due to security and privacy concerns. key work in this area includes that of the prime project, which provides privacy enhancing identity management [1]. their work utilises local data stores and/or trusted third parties.
first international workshop on product line approaches in software engineering (please 2010). please is a new workshop series that focuses on exploring the present and the future of software product line engineering (sple) techniques. the goal of the workshop is to bring together researchers and practitioners with special interest in sple in order to discuss ongoing research and new ideas for advancing the field. the workshop's main theme, beyond product lines, focuses on the adaptation of sple to dynamic settings in which neither the goal nor the organizational structure is stable. we seek to foster exchange of ideas, techniques, and approaches with the broader software engineering community. in a special session of this year's edition, we examine how to leverage existing research by discussing synergy opportunities with members of the software clones community. the first edition of please is held in conjunction with the 32st international conference in software engineering (may 2--8, 2010. cape town, south africa).
supporting program comprehension with source code summarization. one of the main challenges faced by today's developers is keeping up with the staggering amount of source code that needs to be read and understood. in order to help developers with this problem and reduce the costs associated with it, one solution is to use simple textual descriptions of source code entities that developers can grasp easily, while capturing the code semantics precisely. we propose an approach to automatically determine such descriptions, based on automated text summarization technology.
2nd international workshop on software engineering in health care (sehc 2010). society faces increasing reliance on software-intensive systems to manage health services, from scheduling, billing, and patient records to the control of life-critical devices and procedures. there are important concerns about software quality, security, and privacy, user interfaces, system interoperability, process automation and improvement, and many other issues of current concern to software engineering practitioners and researchers. it is widely recognized that information and communication technologies (icts) will transform healthcare of the future, being a driving force for improving care and access, while reducing the overall cost when broadly calculated based on overall productivity and quality of life.
experiences in initiating concurrency software research efforts. multi-core cpus are now common in modern computers. to get access to effectively an unlimited supply of compute resources, software programs that have been highly optimized to use a single cpu need to be converted where possible to use concurrency. we have initiated our concurrency software research for performance enhancement on a large-scale system with high throughput and low latency transactions. in this paper, we report our experience, experiments, and results in various aspects of concurrency design and programming, including multi-threaded prototypes, static and dynamic concurrency analysis, future techniques and trends, concurrency experiments, and concurrency design patterns. based on the concurrency experiments, we achieved at least 80 percent overall performance increases as measured by transaction throughput. as a result, capital expenditures for large scale deployments can be significantly reduced.
improved social trustability of code search results. search is a fundamental activity in software development. however, to search source code efficiently, it is not sufficient to implement a traditional full text search over a base of source code, human factors have to be taken into account as well. we looked into ways of increasing the search results code trustability by providing and analysing a range of meta data alongside the actual search results.
performance modeling in industry: a case study on storage virtualization. in software engineering, performance and the integration of performance analysis methodologies gain increasing importance, especially for complex systems. well-developed methods and tools can predict non-functional performance properties like response time or resource utilization in early design stages, thus promising time and cost savings. however, as performance modeling and performance prediction is still a young research area, the methods are not yet well-established and in wide-spread industrial use. this work is a case study of the applicability of the palladio component model as a performance prediction method in an industrial environment. we model and analyze different design alternatives for storage virtualization on an ibm* system. the model calibration, validation and evaluation is based on data measured on a system z9* as a proof of concept. the results show that performance predictions can identify performance bottlenecks and evaluate design alternatives in early stages of system development. the experiences gained were that performance modeling helps to understand and analyze a system. hence, this case study substantiates that performance modeling is applicable in industry and a valuable method for evaluating design decisions.
ssg: a model-based development environment for smart, security-aware guis. we present a development environment for automatically building smart, security-aware guis following a model-based approach. our environment consists of a number of plugins that have been developed using the eclipse framework and includes three model editors, a model-transformation tool, and a code generator.