waashk/dblp huggingface dataset:
can we certify systems for freedom from malware. malicious code is any code that has been modified with the intention of harming its usage or the user. typical categories of malicious code include trojan horses, viruses, worms etc. with the growth in complexity of computing systems, detection of malicious code is becoming horrendously complex. for security of embedded devices it is important to ensure the integrity of software running in it. the general virus detection is undecidable. however, in the case of embedded systems or personal systems, the software and hardware configurations are known a priori. we are experimenting to see whether we can certify such systems for malware freedom. most of the current efforts on malware detection rely heavily on detection of syntactic patterns. malware writers are resorting to simple syntactic transformations (which preserve the program semantics) such as various compiler optimizations and program obfuscation techniques to evade detection. our work is based on semantic behaviour of programs. we are working towards developing a model of the behaviour of a program executing in an environment. our approach to detect tampering is based on benchmarking the behaviour of a program executing in an environment, and then matching the observed behaviour of the program in a similar environment with the benchmark (a la translation validation in a sense or bisimulation that is widely used in model checking). since execution behaviour remains the same in majority of obfuscations, our approach is resilient to such exploits. we have performed several experiments in this direction and obtained encouraging results. differences between the benchmarked behaviour and the observed behaviour quantifies the damage due to a virus. this enables us to arrive at refined notions of "harm" done by a virus and appropriate measures for protection.
analysis of execution log files. log analysis can be used to find problems, define operational profiles, and even pro-actively prevent issues. the goal of my dissertation research is to investigate log management and analysis techniques suited for very large and very complex logs, such as those we might expect in a computational cloud system.
the role of emergent knowledge structures in collaborative software development. many collaboration features in software development tools draw on lightweight technologies such as tagging and wikis. we propose to study the role of emergent knowledge structures created through these features. using a mixed-methods approach, we investigate which processes emergent knowledge structures support and how tool support can leverage them.
providing support for creating next generation software architecture languages. many languages for software architectures have been proposed, each dealing with different stakeholder concerns, operating at different levels of abstraction and with different degrees of formality. it is known that a universal architectural language cannot exist since the various concerns, requirements, and domains may change. moreover, stakeholder concerns and needs are various and ever evolving even while designing a single system. model-driven techniques may be used to answer the need for supporting the creation of extensible, customizable and stakeholder-oriented architectural languages (i.e., next generation architectural languages). part of this approach is developed in a framework called byadl. in this paper i present the big picture behind the approach, the research aspects considered in order to get byadl closer to an ideal architectural framework and future research issues.
flexible architecture conformance assessment with conqat. the architecture of software systems is known to decay if no counter-measures are taken. in order to prevent this architectural erosion, the conformance of the actual system architecture to its intended architecture needs to be assessed and controlled; ideally in a continuous manner. to support this, we present the architecture conformance assessment capabilities of our quality analysis framework conqat. in contrast to other tools, conqat is not limited to the assessment of use-dependencies between software components. its generic architectural model allows the assessment of various types of dependencies found between different kinds of artifacts. it thereby provides the necessary tool-support for flexible architecture conformance assessment in diverse contexts.
software architecture: foundations, theory, and practice. software architecture has become a centerpiece subject for software engineers, both researchers and practitioners alike. at the heart of every software system is its software architecture, i.e., "the set of principal design decisions about the system". architecture permeates all major facets of a software system, for principal design decisions may potentially be made at any time during a system's lifetime, and potentially by any stakeholder. such decisions encompass structural concerns, such as the system's high-level building blocks---components, connectors, and configurations; the system's deployment; the system's non-functional properties; and the system's evolution patterns, including runtime adaptation. software architectures found particularly useful for families of systems---product lines---are often codified into architectural patterns, architectural styles, and reusable, parameterized reference architectures. this tutorial affords the participant an extensive treatment of the field of software architecture, its foundation, principles, and elements, including those mentioned above. additionally, the tutorial introduces the participants to the state-of-the-art as well as the state-of-the-practice in software architecture, and looks at emerging and likely future trends in this field. the discussion is illustrated with numerous real-world examples. one example given prominent treatment is the architecture of the world wide web and its underlying architectural style, representational state transfer (rest).
transparent combination of expert and measurement data for defect prediction: an industrial case study. defining strategies on how to perform quality assurance (qa) and how to control such activities is a challenging task for organizations developing or maintaining software and software-intensive systems. planning and adjusting qa activities could benefit from accurate estimations of the expected defect content of relevant artifacts and the effectiveness of important quality assurance activities. combining expert opinion with commonly available measurement data in a hybrid way promises to overcome the weaknesses of purely data-driven or purely expert-based estimation methods. this article presents a case study of the hybrid estimation method hydeep for estimating defect content and qa effectiveness in the telecommunication domain. the specific focus of this case study is the use of the method for gaining quantitative predictions. this aspect has not been empirically analyzed in previous work. among other things, the results show that for defect content estimation, the method performs significantly better statistically than purely data-based methods, with a relative error of 0.3 on average (mmre).
sesena 2010: workshop on software engineering for sensor network applications. this editorial preface describes the aims and motivation as well as some details of the reviewing process of sesena 2010, the first international workshop on software engineering for sensor network applications, which took place under the umbrella of icse 2010, the 32rd acm/ieee international conference on software engineering, in cape town, south africa, may 2010. see also our workshop's website at http://www.sesena.info/
slicing and dicing bugs in concurrent programs. a lack of scalable verification tools for concurrent programs has not allowed concurrent software development to keep abreast with hardware trends in multi-core technologies. the growing complexity of modern concurrent systems necessitates the use of abstractions in order to verify all the expected behaviors of the system. current abstraction refinement techniques are restricted to verifying mostly sequential and simpler concurrent programs. in this work, we present a novel incremental underapproximation technique that uses program slicing. based on a reachability property, an initial backward slice for a single thread is generated. the information in the program slice is coupled with a concrete execution to drive the lone thread; generating an underapproximation of the program behavior space. if the target location is reached in the underapproximation, then we have an actual concrete trace. otherwise, the initial single-thread slice is refined to include another thread that affects the reachability of the target location. in this case, the concrete execution only considers the two threads in the slice and preemption points between the threads only occur at locations in the slice. this refinement process is repeated until the target location is reached or is shown to be unreachable. initial results indicate that the incremental technique can potentially allow the discovery of errors in larger systems using fewer resources and produce a better reduction in systems that are correct.
can clone detection support quality assessments of requirements specifications? due to their pivotal role in software engineering, considerable effort is spent on the quality assurance of software requirements specifications. as they are mainly described in natural language, relatively few means of automated quality assessment exist. however, we found that clone detection, a technique widely applied to source code, is promising to assess one important quality aspect in an automated way, namely redundancy that stems from copy&paste operations. this paper describes a large-scale case study that applied clone detection to 28 requirements specifications with a total of 8,667 pages. we report on the amount of redundancy found in real-world specifications, discuss its nature as well as its consequences and evaluate in how far existing code clone detection approaches can be applied to assess the quality of requirements specifications in practice.
codesign: a highly extensible collaborative software modeling framework. large, multinational software development organizations face a number of issues in supporting software design and modeling by geographically distributed architects. to address these issues, we present codesign, an extensible, collaborative, event-based software modeling framework developed in a distributed, collaborative setting by our two organizations. codesign's core capabilities include real-time model synchronization between geographically distributed architects, as well as detection and resolution of a range of modeling conflicts via several off-the-shelf conflict detection engines.
umple: a model-oriented programming language. our research tool, umple, has the objective of raising the abstraction level of programming languages by including modeling abstractions such as uml associations, attributes and state machines. my research focuses on the syntax and semantics of state machines in umple and the empirical validation of umple as a whole.
fifth workshop on software engineering for adaptive and self-managing systems (seams 2010). the software engineering for adaptive and self-managing systems (seams) workshop has consolidated the interest in the software engineering community on self-adaptive and self-managing systems. seams provides a forum for researchers and practitioners to share new results, discuss challenging issues, raise awareness, and promote collaboration within the community. the seams 2010 workshop aims to continue the success of previous icse seams workshops: in shanghai in 2006, in minneapolis in 2007, in leipzig in 2008, and in vancouver in 2009.
end-user requirements blogging with irequire. end-user involvement in software engineering is an ambivalent topic. however, novel paradigms such as service-oriented computing suggest more active end-user involvement to gather individual needs for software personalization. in this paper, we present a mobile requirements elicitation tool which enables end-users to blog needs in situ without analysts' facilitation.
engineering safety- and security-related requirements for software-intensive systems: tutorial summary. this full-day tutorial introduces the attendee to the engineering of safety- and security-related requirements for software-intensive systems. it provides a consistent, effective, and efficient method for identifying, analyzing, specifying, verifying, and validating the four different types of safety- and security-related requirements.
enhancing collaboration of multi-developer projects with synchronous changes. in a multi-developer project, team collaboration is essential for the success of the project. when team members are spread across different locations, informal interactions are lost, having an impact on individual awareness of the activity of others. in this scenario, collaboration becomes a challenge. a number of works have tried to reestablish team awareness by sharing change information across developers' workspaces. the main challenge of these approaches is to balance the tradeoff between offering useful information about the activity of others and avoiding information overload. in this work, we address the challenge of enhancing group awareness and stimulating collaboration by providing relevant information to developers in a non-intrusive manner. the novelty of our approach is that we model changes as first-class entities to deliver precise change information to targeted developers.
making program refactoring safer. automated refactorings may change the program behavior. we propose an approach and its implementation called saferefactor for making program refactoring safer. we applied 10 eclipse refactorings in a number of automatically generated programs, and used saferefactor to identify 50 bugs that lead to behavioral changes or compilation errors.
behavioural validation of software engineering artefacts. software engineering artefacts that define behaviour tend to be of a fragmented nature in order to facilitate their construction, modification, and modular reasoning (e.g. modular code, pre/post-conditions specifications). however, fragmentation makes the validation of global behaviour difficult. typically synthesis techniques that yield global representations of large or infinite states are used in combination with simulation or partial explorations, techniques which necessarily lose the global view of system behaviour. i am working on the development of abstraction-for-validation techniques that automatically produce finite state abstractions that are sufficiently small to support validating the emergent behaviour of a fragmented description "at a glance".
a flexible tool suite for change-aware test-driven development of web applications. though web applications development fits well with test-driven development, there are some problems that hinder its success. in this demo we present a tool suite to improve tdd; the suite supports the representation of web requirements using a domain-specific language and the automatic generation of interaction tests among others.
improving throughput via slowdowns. many service-oriented systems are not well equipped to guarantee that service time is optimized. we have specifically examined two industrial systems which implement service-oriented architectures in real, field environments. we discovered that both were not engineered to properly address surges in service request rate. in the absence of an integral solution, it is difficult and costly to (re-) engineer such a solution in the field. the challenge faced by this study was to deliver a low cost solution, without re-engineering the target systems. this paper introduces such a generic solution. the solution slows-down some components to deliver improvement in request service time. it was implemented, tested, and successfully applied to two industrial systems with no need to modify their logic or architecture. experiments with those systems exhibited significant improvement in performance. these results have validated our solution and its industrial applicability across systems and environments.
managing iterations with unicase. planning iterations in software projects requires considering artifacts from different aspects such as requirements, specifications, tasks or even bug reports. unicase is a unified case tool integrating these relevant artifacts into one model. we demonstrate how the tool supports planning and executing iterations.
comprehending module dependencies and sharing. software often lives in a complex software eco-system with complex interactions and dependencies between different modules or components. in windows, this problem is exacerbated both by the overall system complexity and its closed source nature. even when source is available, there are still interactions with modules which are only in binary form. this paper proposes two visualizations for investigating the dependencies between programs and other binaries, such as, dynamically linked libraries on windows. our visualizations are based on run-time traces obtained either from the windows kernel or through binary instrumentation. thus, our techniques do not need to rely on source code. we use the following scenarios to explain how our visualizations can be used to investigate various aspects of software dependencies: (i) visualizing whole system software dependencies; (ii) visualizing the interactions between selected modules of some software; (iii) discovering unexpected module interactions; and (iv) understanding the source of the modules being used.
rsse 2010: second international workshop on recommendation systems for software engineering. the goal of this one-day workshop is to bring together researchers and practitioners with interest and experience in the theory, elaboration, and evaluation of concepts, techniques, and tools for providing recommendations to developers, managers, and other stakeholders involved in software engineering tasks.
test-driven roles for pair programming. pair programming is the practice of having two programmers work together on the same code in a single development environment. the goals of pair programming are to improve communication and the sharing of knowledge within a team; to increase productivity; to improve developer process and help team members stay productive; and ultimately to strengthen the quality of the resulting software [1].
assessments in global software development: a tailorable framework for industrial projects. assessments are an effective technique for software quality assurance. as global software development (gsd) becomes the standard, an assessment framework must be flexible to support different sourcing and shoring models. although much work exists on inspections and reviews, an assessment framework which addresses these challenges is missing. we present a systematic yet flexible assessment framework. the paper contributes: i) the description of our assessment framework which addresses four challenges: appropriateness of a software requirements specification (srs), viability of software architectures and srs, wholeness of work packages, and compliance of results with predefined quality objectives. ii) a detailed explanation how the assessment framework can be tailored to support offshore and outsourcing scenarios. this paper describes the result of a two years research initiative at capgemini sd&m and serves the practitioner to implement assessment frameworks according to his needs. we also discuss open research questions of high relevance for the software industry.
a methodology to support load test analysis. performance analysts rely heavily on load testing to measure the performance of their applications under a given load. during the load test, analyst strictly monitor and record thousands of performance counters to measure the run time system properties such as cpu utilization, disk i/o, memory consumption, network traffic etc. the most frustrating problem faced by analysts is the time spent and complexity involved in analysing these huge counter logs and finding relevant information distributed across thousands of counters. we present our methodology to help analysts by automatically identifying important performance counters for load test and comparing them across tests to find performance gain/loss. further, our methodology help analysts to understand the root cause of a load test failure by finding previously solved problems in test repositories. a case study on load test data of a large enterprise application shows that our methodology can effectively guide performance analysts to identify and compare top performance counters across tests in limited time thereby archiving 88% counter data reduction.
software engineering abstractions for the multi-touch revolution. multi-touch interfaces allow users to use multiple fingers to provide input to a graphical user interface. the idea of allowing users to touch and manipulate digital information with their hands has been subject of research for more than 25 years [5, 4]. recently several of these research artifacts have found their way to industry, with examples like the iphone and the microsoft surface. mainstream programming languages do not offer support to deal with the complexity of these new devices. unlike the evolution in the hardware technology, the complexity of these new devices has not yet been addressed by adequate software engineering abstractions.
social computing networks: a new paradigm for engineering self-adaptive pervasive software systems. software systems are increasingly permeating a variety of domains including medical, industrial automation, and emergency response. the advances in portable and embedded computing devices and the recent advances in wireless network connectivity have paved the way for the proliferation of smart spaces in such domains. at the same time, the emergence of service-oriented technology (e.g., web services [10]) and interoperability standards (e.g., wsdl [11], uddi [5]) has made it possible to develop pervasive software systems intended for execution in smart spaces that were not even conceivable a few years back.
a role-based qualification and certification program for software architects: an experience report from siemens. in this experience report, we describe the motivation, experience, lessons learned, and future directions of a software engineering curriculum used at a large international company. the "curriculum for software engineers" project, which developed the content and a role-based qualification and certification program, was started at siemens in 2006. this paper includes an overview of various kinds of certification in the software engineering area and why we chose the knowledge- and experience-based type of certification. the experience report part focuses mainly on the "certified senior software architect" role, as this role has the longest history and participants from many different business units and countries.