{"title":"Software Reliability Evaluation Method Based on a Software Network","authors":"J. Ai, Wenzhu Su, Fei Wang","doi":"10.1109/ISSREW.2018.00-15","DOIUrl":"https://doi.org/10.1109/ISSREW.2018.00-15","url":null,"abstract":"This paper proposes a method for the comprehensive measurement of software quality and reliability based on the complex network theory. The quality of the overall network structure of software is evaluated in terms of modularity, hierarchy, complexity, and fault propagation. The importance and reliability risks of the software module are combined to evaluate the overall reliability risk of software. According to the historical defect information of software, the characteristics of the defect node are analyzed to predict the software's current version of the high defect risk module. The software reliability level is comprehensively evaluated by combining the software's overall structural quality, reliability risk and defect risk.","PeriodicalId":321448,"journal":{"name":"2018 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"48 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122362681","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"The DevSecOps and Agency Theory","authors":"Jong Seok Lee","doi":"10.1109/ISSREW.2018.00013","DOIUrl":"https://doi.org/10.1109/ISSREW.2018.00013","url":null,"abstract":"An effective implementation of DevSecOps requires an increased focus on collaborations between different work groups or disciplines within IT (development, security, and operations/implementation). Nonetheless, different groups are still too often reluctant to trust each other, or inter-group conflicts tend to commonly occur. Against this backdrop, in this research I develop a framework based on Agency Theory that sheds light on the role of goal incongruency and information asymmetry in the DevSecOps context.","PeriodicalId":321448,"journal":{"name":"2018 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"65 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124750709","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
A. Hoorn, A. Aleti, Thomas F. Düllmann, Teerat Pitakrat
{"title":"ORCAS: Efficient Resilience Benchmarking of Microservice Architectures","authors":"A. Hoorn, A. Aleti, Thomas F. Düllmann, Teerat Pitakrat","doi":"10.1109/ISSREW.2018.00-10","DOIUrl":"https://doi.org/10.1109/ISSREW.2018.00-10","url":null,"abstract":"Resilience benchmarking aims to assess a software system's and an organization's ability to cope with failures, e.g., by injecting faults and observing their effects in both, testing and production environments. However, existing resilience benchmarks are ad-hoc and based on randomly injected faults. In this paper, we give an overview of the vision and the current state of our ORCAS approach for a more efficient resilience benchmarking for microservice architectures. ORCAS leverages the following characteristics: i) relationship between resilience patterns, antipatterns, and fault injections; ii) automatically extracted architectural knowledge to generate and refine resilience benchmarks; iii) use of simulations to further reduce the number of benchmarks to execute in testing and production systems.","PeriodicalId":321448,"journal":{"name":"2018 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"45 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123057759","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Sung-Hoon Lee, Seung-Hyun Kim, Soohyung Kim, Seunghun Jin
{"title":"AppWrapper: Patching Security Functions with Dynamic Policy on Your Insecure Android Apps","authors":"Sung-Hoon Lee, Seung-Hyun Kim, Soohyung Kim, Seunghun Jin","doi":"10.1109/ISSREW.2018.00-34","DOIUrl":"https://doi.org/10.1109/ISSREW.2018.00-34","url":null,"abstract":"Android provides a security system with permission control, but there are a number of vulnerabilities that have excessive permission rights and a large number of per-permission related APIs. To address these vulnerabilities, permission control studies have been conducted on APIs that are at risk of compromising user privacy. However, it is impossible to add a new security function to an insecure application, and there is a disadvantage that an overhead occurs in the progress of the app because the user is required to permit permission in real time and the users' convenience is decreased. In this paper, we propose an AppWrapper toolkit. The toolkit can add security functions to the user/administrator's desired locations (method level in activities) of an insecure app using the appwrapping technique. And, using dynamic policy management, it is easy to apply secure policies without adding security functions again. In addition, by providing a real-time app log function that considers the convenience of users, it is possible to confirm the location where the security function is required according to the progress flow of the insecure app, and to create a policy file by setting the policy. Experiments on commercial apps have shown 100% success rate, except for apps with built-in security and Android apps. On the average, it took 1.86 seconds to add the security function through the proposed framework, and the file size increased by about 2.11%, indicating that the security function can be added in a short time with the increase of the minimum file size.","PeriodicalId":321448,"journal":{"name":"2018 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"295 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127559734","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Evaluation and Construction of Covering Arrays Utilizing Prior Information","authors":"R. Lekivetz, Joseph Morgan","doi":"10.1109/ISSREW.2018.00-17","DOIUrl":"https://doi.org/10.1109/ISSREW.2018.00-17","url":null,"abstract":"Covering arrays are being increasingly used as a tool to determine test cases for testing complex engineered systems. The primary appeal of using covering arrays for this purpose is that they are an efficient way to construct test cases that are effective at precipitating failures that are due to the combination of several inputs. Test engineers often have prior knowledge about the system under test. We propose a method for evaluating and constructing covering arrays that utilizes prior information on the inputs. As a result, the resulting test suite can potentially increase the likelihood of precipitating a failure.","PeriodicalId":321448,"journal":{"name":"2018 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"2017 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-10-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128562886","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"CFAAR: Control Flow Alteration to Assist Repair","authors":"Chadi Trad, R. A. Assi, Wes Masri, F. Zaraket","doi":"10.1109/ISSREW.2018.00008","DOIUrl":"https://doi.org/10.1109/ISSREW.2018.00008","url":null,"abstract":"We present CFAAR, a program repair assistance technique that operates by selectively altering the outcome of suspicious predicates in order to yield expected behavior. CFAAR is applicable to defects that are repairable by negating predicates under specific conditions. CFAAR proceeds as follows: 1) It identifies predicates such that negating them at given instances would make the failing tests exhibit correct behavior. 2) For each candidate predicate, it uses the program's state information to build a classifier that dictates when the predicate should be negated. 3) For each classifier, it leverages a Decision Tree to synthesize a patch to be presented to the developer. We evaluated our toolset using 149 defects from the IntroClass and Siemens benchmarks. CFAAR identified 91 potential candidate defects and generated plausible patches for 41 of them. Twelve of the patches are believed to be correct, whereas the rest provide repair assistance to the developer.","PeriodicalId":321448,"journal":{"name":"2018 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW)","volume":"36 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2018-08-28","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124960105","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}