2009 3rd International Symposium on Empirical Software Engineering and Measurement最新文献

Improving CVSS-based vulnerability prioritization and response with context information 使用上下文信息改进基于cvss的漏洞优先级和响应

2009 3rd International Symposium on Empirical Software Engineering and Measurement Pub Date : 2009-10-15 DOI: 10.1109/ESEM.2009.5314230

C. Frühwirth, T. Männistö

{"title":"Improving CVSS-based vulnerability prioritization and response with context information","authors":"C. Frühwirth, T. Männistö","doi":"10.1109/ESEM.2009.5314230","DOIUrl":"https://doi.org/10.1109/ESEM.2009.5314230","url":null,"abstract":"The growing number of software security vulnerabilities is an ever-increasing challenge for organizations. As security managers in the industry have to operate within limited budgets they also have to prioritize their vulnerability responses. The Common Vulnerability Scoring System (CVSS) aids in such prioritization by providing a metric for the severity of vulnerabilities. In its most prominent application, as the severity metric in the U.S. National Vulnerability Database (NVD), CVSS scores omit information pertaining the potential exploit victims' context. Researchers and managers in the industry have long understood that the severity of vulnerabilities varies greatly among different organizational contexts. Therefore the CVSS scores provided by the NVD alone are of limited use for vulnerability prioritization in practice. Security managers could address this limitation by adding the missing context information themselves to improve the quality of their CVSS-based vulnerability prioritization. It is unclear for them, however, whether the potential improvements are worth the additional effort. We present a method that enables practitioners to estimate these improvements. Our method is of particular use to practitioners who do not have the resources to gather large amounts of empirical data, because it allows them to simulate the improvement potential using only publicly available data in the NVD and distribution models from the literature. We applied the method on a sample set of 720 vulnerability announcements from the NVD and found that adding context information significantly improved the prioritization and selection of vulnerability response process. Our findings contribute to the discourse on returns on security investment, measurement of security processes and quantitative security management.","PeriodicalId":128479,"journal":{"name":"2009 3rd International Symposium on Empirical Software Engineering and Measurement","volume":"100 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-10-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115154413","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 89

Does aspect-oriented programming increase the development speed for crosscutting code? An empirical study 面向方面的编程是否提高了横切代码的开发速度?实证研究

2009 3rd International Symposium on Empirical Software Engineering and Measurement Pub Date : 2009-10-15 DOI: 10.1109/ESEM.2009.5316028

Stefan Hanenberg, Sebastian Kleinschmager, Manuel Josupeit-Walter

引用次数: 49

What do we know about perspective-based reading? An approach for quantitative aggregation in software engineering 我们对基于视角的阅读了解多少?软件工程中的一种定量聚合方法

2009 3rd International Symposium on Empirical Software Engineering and Measurement Pub Date : 2009-10-15 DOI: 10.1109/ESEM.2009.5316026

M. Ciolkowski

{"title":"What do we know about perspective-based reading? An approach for quantitative aggregation in software engineering","authors":"M. Ciolkowski","doi":"10.1109/ESEM.2009.5316026","DOIUrl":"https://doi.org/10.1109/ESEM.2009.5316026","url":null,"abstract":"One of the main challenges in empirical software engineering today lies in the aggregation of evidence. Existing summaries often use qualitative narrative approaches or ad-hoc quantitative methods, such as box plots. With these, information important for decision makers, such as existence and magnitude of a technology's effect, is hard to obtain objectively. Meta-analysis addresses this issue by providing objective quantitative information about a set of studies; however, its usefulness for software engineering studies suffers from high heterogeneity of the studies and missing information. In this paper, we describe an approach for quantitative aggregation of controlled experiments that reduces these two problems. We demonstrate the approach by aggregating available experiments to investigate whether Perspective-Based reading (PBR) improves team effectiveness compared to alternative reading approaches. We then compare the results of our aggregation to previous summaries addressing PBR's team effectiveness. Although the findings are similar, our approach is able to provide the required quantitative information objectively. Our aggregation showed that there is no clear positive effect of PBR: Inspection teams using PBR on requirements documents are more effective when compared to ad-hoc approaches, but are less effective when compared to checklists. In addition, we found strong indicators of researcher bias.","PeriodicalId":128479,"journal":{"name":"2009 3rd International Symposium on Empirical Software Engineering and Measurement","volume":"104 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-10-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122557547","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 45

Using concept mapping for maintainability assessments 使用概念映射进行可维护性评估

2009 3rd International Symposium on Empirical Software Engineering and Measurement Pub Date : 2009-10-15 DOI: 10.1109/ESEM.2009.5314234

A. Yamashita, Hans Christian Benestad, Bente Anda, Per Einar Arnstad, Dag I.K. Sjøberg, L. Moonen

{"title":"Using concept mapping for maintainability assessments","authors":"A. Yamashita, Hans Christian Benestad, Bente Anda, Per Einar Arnstad, Dag I.K. Sjøberg, L. Moonen","doi":"10.1109/ESEM.2009.5314234","DOIUrl":"https://doi.org/10.1109/ESEM.2009.5314234","url":null,"abstract":"Many important phenomena within software engineering are difficult to define and measure. One example is software maintainability, which has been the subject of considerable research and is believed to be a critical determinant of total software costs. We propose using concept mapping, a well-grounded method used in social research, to operationalize the concept of software maintainability according to a given goal and perspective in a concrete setting. We apply this method to describe four systems that were developed as part of an industrial multiple-case study. The outcome is a conceptual map that displays an arrangement of maintainability constructs, their interrelations, and corresponding measures. Our experience is that concept mapping (1) provides a structured way of combining static code analysis and expert judgment; (2) helps in the tailoring of the choice of measures to a particular system context; and (3) supports the mapping between software measures and aspects of software maintainability. As such, it constitutes a useful addition to existing frameworks for evaluating quality, such as ISO/IEC 9126 and GQM, and tools for static measurement of software code. Overall, concept mapping provides a systematic, structured, and repeatable method for developing constructs and measures, not only of maintainability, but also of software engineering phenomena in general.","PeriodicalId":128479,"journal":{"name":"2009 3rd International Symposium on Empirical Software Engineering and Measurement","volume":"123 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2009-10-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128412348","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 10

Impact of the visitor pattern on program comprehension and maintenance 访问者模式对程序理解和维护的影响

2009 3rd International Symposium on Empirical Software Engineering and Measurement Pub Date : 2009-10-15 DOI: 10.1109/ESEM.2009.5316015

Sebastien Jeanmart, Yann-Gaël Guéhéneuc, H. Sahraoui, N. Habra

引用次数: 66

The curse of copy&paste — Cloning in requirements specifications 复制和粘贴的诅咒——需求规范中的克隆

2009 3rd International Symposium on Empirical Software Engineering and Measurement Pub Date : 2009-10-15 DOI: 10.1109/ESEM.2009.5315992

Christoph Domann, Elmar Jürgens, Jonathan Streit

引用次数: 11

A systematic mapping study on empirical evaluation of software requirements specifications techniques 软件需求规格说明技术经验评价的系统映射研究

2009 3rd International Symposium on Empirical Software Engineering and Measurement Pub Date : 2009-10-15 DOI: 10.1109/ESEM.2009.5314232

Nelly Condori-Fernández, M. Daneva, K. Sikkel, R. Wieringa, Óscar Dieste Tubío, Ó. Pastor

引用次数: 103

Effect of staffing pattern on software project: An empirical analysis 人员配置模式对软件项目影响的实证分析

2009 3rd International Symposium on Empirical Software Engineering and Measurement Pub Date : 2009-10-15 DOI: 10.1109/ESEM.2009.5316046

Fei Dong, Mingshu Li, Juan Li, Ye Yang, Qing Wang

引用次数: 2

Exploring language in software process elicitation: A grounded theory approach 探索软件过程启发中的语言:一种扎根的理论方法

2009 3rd International Symposium on Empirical Software Engineering and Measurement Pub Date : 2009-10-15 DOI: 10.1109/ESEM.2009.5315984

Carlton A. Crabtree, C. Seaman, A. F. Norcio

引用次数: 28

The evolution and impact of code smells: A case study of two open source systems 代码气味的演变和影响:两个开源系统的案例研究

2009 3rd International Symposium on Empirical Software Engineering and Measurement Pub Date : 2009-10-15 DOI: 10.1109/ESEM.2009.5314231

Steffen M. Olbrich, D. Cruzes, V. Basili, N. Zazworka

引用次数: 229