2011 IEEE 11th International Working Conference on Source Code Analysis and Manipulation最新文献_第2页

Counting Bugs is Harder Than You Think 数虫子比你想象的要难

2011 IEEE 11th International Working Conference on Source Code Analysis and Manipulation Pub Date : 2011-09-25 DOI: 10.1109/SCAM.2011.24

P. Black

{"title":"Counting Bugs is Harder Than You Think","authors":"P. Black","doi":"10.1109/SCAM.2011.24","DOIUrl":"https://doi.org/10.1109/SCAM.2011.24","url":null,"abstract":"Software Assurance Metrics and Tool Evaluation (SAMATE) is a broad, inclusive project at the U.S. National Institute of Standards and Technology (NIST) with the goal of improving software assurance by developing materials, specifications, and methods to test tools and techniques and measure their effectiveness. We review some SAMATE sub-projects: web application security scanners, malware research protocol, electronic voting systems, the SAMATE Reference Dataset, a public repository of thousands of example programs with known weaknesses, and the Static Analysis Tool Exposition (SATE). Along the way we list over two dozen possible research questions, which are also collaboration opportunities. Software metrics are incomplete without metrics of what is variously called bugs, flaws, or faults. We detail numerous critical research problems related to such metrics. For instance, is a warning from a source code scanner a real bug, a false positive, or something else? If a numeric overflow leads to buffer overflow, which leads to command injection, what is the error? How many bugs are there if two sources call two sinks: 1, 2, or 4? Where is a missing feature? We conclude with a list of concepts which may be a useful basis of bug metrics.","PeriodicalId":286433,"journal":{"name":"2011 IEEE 11th International Working Conference on Source Code Analysis and Manipulation","volume":"196 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-09-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121107902","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 15

I2SD: Reverse Engineering Sequence Diagrams from Enterprise Java Beans with Interceptors 从带有拦截器的企业Java bean中逆向工程序列图

2011 IEEE 11th International Working Conference on Source Code Analysis and Manipulation Pub Date : 2011-09-25 DOI: 10.1109/SCAM.2011.5

S. Roubtsov, Alexander Serebrenik, A. Mazoyer, M. Brand, Ella E. Roubtsova

{"title":"I2SD: Reverse Engineering Sequence Diagrams from Enterprise Java Beans with Interceptors","authors":"S. Roubtsov, Alexander Serebrenik, A. Mazoyer, M. Brand, Ella E. Roubtsova","doi":"10.1109/SCAM.2011.5","DOIUrl":"https://doi.org/10.1109/SCAM.2011.5","url":null,"abstract":"An Enterprise Java Beans (EJB) interceptor is a software mechanism that provides for introducing behavior implemented as separate code into the execution of a Java application. In this way EJB interceptors provide a clear separation of the core functionality of the bean and other concerns, such as logging or performance analysis. Despite the beauty of the idea behind the interceptors, developing, testing and managing dependencies introduced by the interceptors are considered to be daunting tasks. For example, the developers can specify interceptors at multiple locations and by multiple means. However, different locations and specification means influence the order of the interceptor invocation, which is governed by more than fifteen different intertwined rules according to the EJB standard. To facilitate development of EJB applications we have designed I2SD, Interceptors to Sequence Diagrams, a tool for reverse engineering EJB applications with interceptors to UML sequence diagrams. I2SD provides the developer with a visual feedback and can be used by quality managers to get a broader understanding of the way interceptors are used in their project.","PeriodicalId":286433,"journal":{"name":"2011 IEEE 11th International Working Conference on Source Code Analysis and Manipulation","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-09-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128935699","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 18

Are the Clients of Flawed Classes (Also) Defect Prone? 有缺陷类的客户端也有缺陷倾向吗?

2011 IEEE 11th International Working Conference on Source Code Analysis and Manipulation Pub Date : 2011-09-25 DOI: 10.1109/SCAM.2011.9

Radu Marinescu, C. Marinescu

{"title":"Are the Clients of Flawed Classes (Also) Defect Prone?","authors":"Radu Marinescu, C. Marinescu","doi":"10.1109/SCAM.2011.9","DOIUrl":"https://doi.org/10.1109/SCAM.2011.9","url":null,"abstract":"Design flaws are those characteristics of design entities (e.g., methods, classes) which make them harder to maintain. Existing studies show that classes revealing particular design flaws are more change and defect prone than the other classes. Since various collaborations are found among the instances of classes, classes are not isolated within the source code of object-oriented systems. In this paper we investigate if classes using classes revealing design flaws are more defect prone than classes which do not use classes revealing design flaws. We detect four design flaws in three releases of Eclipse and investigate the relation between classes that use/do not use flawed classes and defects. The results show that classes that use flawed classes are defect prone and this does not depend on the number of the used flawed classes. This findings show a new type of correlation between design flaws and defects, bringing evidence related to an increased likelihood of exhibiting defects for classes that use classes revealing design flaws. Based on the provided evidence, practitioners are advised once again about the negative impact design flaws have at a source code level.","PeriodicalId":286433,"journal":{"name":"2011 IEEE 11th International Working Conference on Source Code Analysis and Manipulation","volume":"191 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-09-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129570102","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 20

Program Analysis Too Loopy? Set the Loops Aside 程序分析太混乱?把循环放在一边

2011 IEEE 11th International Working Conference on Source Code Analysis and Manipulation Pub Date : 2011-09-25 DOI: 10.1109/SCAM.2011.22

E. Larson

引用次数: 7

Assumption Hierarchy for a CHA Call Graph Construction Algorithm CHA调用图构建算法的假设层次

2011 IEEE 11th International Working Conference on Source Code Analysis and Manipulation Pub Date : 2011-09-25 DOI: 10.1109/SCAM.2011.20

Jason Sawin, A. Rountev

{"title":"Assumption Hierarchy for a CHA Call Graph Construction Algorithm","authors":"Jason Sawin, A. Rountev","doi":"10.1109/SCAM.2011.20","DOIUrl":"https://doi.org/10.1109/SCAM.2011.20","url":null,"abstract":"Method call graphs are integral components of many interprocedural static analyses which are widely used to aid in the development and maintenance of software. Unfortunately, the existences of certain dynamic features in modern programming languages, such as Java or C++, can lead to either unsoundness or imprecision in statically constructed call graphs. We investigate a hierarchy of assumptions that a Class Hierarchy Analysis (CHA) call graph construction algorithm can make about dynamic features in Java. Each successive level of the assumption hierarchy introduces new relaxations of suppositions. These relaxations allow the call graph algorithm to treat some uses of dynamic features more precisely and still remain sound. The hierarchy includes a novel assumption that dynamic features will respect encapsulation. We present an empirical study in which a unique call graph algorithm is implemented for each level of the assumption hierarchy. This study shows that assuming that dynamic features will respect encapsulation can lead to a call graph with 44% fewer edges than the fully conservative graph. By incorporating assumptions about casting operations and string values, it is possible to remain conservative and reduce the number of graph edges by 54% and graph nodes by 10% through the use of various resolution techniques. This work demonstrates that even a slight relaxation of assumptions can greatly improve the precision of a call graph. It further articulates the exact assumptions that a CHA call graph construction algorithm must make in order to use advanced resolution techniques.","PeriodicalId":286433,"journal":{"name":"2011 IEEE 11th International Working Conference on Source Code Analysis and Manipulation","volume":"41 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-09-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116944125","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 6

Computation of Alias Sets from Shape Graphs for Comparison of Shape Analysis Precision 形状图混叠集的计算及其形状分析精度的比较

2011 IEEE 11th International Working Conference on Source Code Analysis and Manipulation Pub Date : 2011-09-25 DOI: 10.1109/SCAM.2011.11

Viktor Pavlu, M. Schordan, A. Krall

{"title":"Computation of Alias Sets from Shape Graphs for Comparison of Shape Analysis Precision","authors":"Viktor Pavlu, M. Schordan, A. Krall","doi":"10.1109/SCAM.2011.11","DOIUrl":"https://doi.org/10.1109/SCAM.2011.11","url":null,"abstract":"Various shape analysis algorithms have been introduced but their relation in terms of precision often remains unclear as different analyses use different representations of analysis results. The aim of our work is to extract alias sets from shape analysis results to compute a relative precision factor that expresses for a given program how much more precise one analysis is than the other. We present a significant improvement over an existing algorithm based on 3-valued logic to compute alias sets from shape graphs. Instead of looking only at the final nodes in pointer access paths, our common tail algorithm takes sequences of selectors into account. The common tail algorithm is strictly more precise than the existing algorithm by Reps, Sagiv, and Wilhelm, for our benchmarks we can reduce the number of conservative results by a factor of up to 5 in the best case while incurring an additional analysis overhead that is below 10% even in the worst case of our benchmarks. We selected two well-known graph-based shape analyses that use different representations of analysis results to demonstrate the usefulness of our approach. The shape analysis proposed by Nielson, Nielson & Hankin (NNH) and the analysis by Sagiv, Reps & Wilhelm (SRW) were implemented for a subset of C++ in the SATIrE program analysis framework. We are thus able to determine that NNH is more precise than SRW by a factor of 1.62 on average for our set of benchmarks.","PeriodicalId":286433,"journal":{"name":"2011 IEEE 11th International Working Conference on Source Code Analysis and Manipulation","volume":"36 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-09-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131910813","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Tuning Static Data Race Analysis for Automotive Control Software 汽车控制软件的静态数据竞争分析调优

2011 IEEE 11th International Working Conference on Source Code Analysis and Manipulation Pub Date : 2011-09-25 DOI: 10.1109/SCAM.2011.16

Steffen Keul

引用次数: 12

A Constraint Programming Approach to Conflict-Aware Optimal Scheduling of Prioritized Code Clone Refactoring 优先代码克隆重构中冲突感知最优调度的约束规划方法

2011 IEEE 11th International Working Conference on Source Code Analysis and Manipulation Pub Date : 2011-09-25 DOI: 10.1109/SCAM.2011.21

M. Zibran, C. Roy

引用次数: 52

Recovering a Balanced Overview of Topics in a Software Domain 恢复软件领域主题的平衡概述

2011 IEEE 11th International Working Conference on Source Code Analysis and Manipulation Pub Date : 2011-09-25 DOI: 10.1109/SCAM.2011.23

Matthew B. Kelly, Jason S. Alexander, Bram Adams, A. Hassan

引用次数: 11

A Study of Cloning in the Linux SCSI Drivers Linux SCSI驱动程序克隆的研究

2011 IEEE 11th International Working Conference on Source Code Analysis and Manipulation Pub Date : 2011-09-25 DOI: 10.1109/SCAM.2011.17

Wei Wang, Michael W. Godfrey

引用次数: 13