2016 23rd Asia-Pacific Software Engineering Conference (APSEC)最新文献_第3页

The Introduction of Technical Debt Tracking in Large Companies 在大公司引入技术债务跟踪

2016 23rd Asia-Pacific Software Engineering Conference (APSEC) Pub Date : 1900-01-01 DOI: 10.1109/APSEC.2016.032

A. Martini, Terese Besker, J. Bosch

{"title":"The Introduction of Technical Debt Tracking in Large Companies","authors":"A. Martini, Terese Besker, J. Bosch","doi":"10.1109/APSEC.2016.032","DOIUrl":"https://doi.org/10.1109/APSEC.2016.032","url":null,"abstract":"Large software companies need to support continuous and fast delivery of customer value both in the short and long term. However, this can be hindered if both evolution and maintenance of existing systems are hampered by Technical Debt. Although a lot of theoretical work on Technical Debt has been recently produced, its practical management lacks empirical studies. In this paper we investigate the state of practice in several companies in order to understand how they start tracking Technical Debt. We combined different methodologies: we conducted a survey, involving 226 respondents from 15 organizations and a more in-depth multiple case-study in three organizations, where Technical Debt was tracked: we involved 13 interviews and 79 Technical Debt issues analysis. We found that the development time dedicated to manage Technical Debt is substantial (around 25% of the overall development) but not systematic: only a few participants methodically track Technical Debt. By studying the approaches in the companies participating in the case-study, we understood how companies start tracking Technical Debt and what are the initial benefits and challenges. Finally, we propose a Strategic Adoption Model based to define and adopt a dedicated process for tracking Technical Debt","PeriodicalId":339123,"journal":{"name":"2016 23rd Asia-Pacific Software Engineering Conference (APSEC)","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133791959","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 19

Analytical Study of Cognitive Layered Approach for Understanding Security Requirements Using Problem Domain Ontology 基于问题领域本体的安全需求理解认知分层方法分析研究

2016 23rd Asia-Pacific Software Engineering Conference (APSEC) Pub Date : 1900-01-01 DOI: 10.1109/APSEC.2016.024

Bong-Jae Kim, Seok-Won Lee

{"title":"Analytical Study of Cognitive Layered Approach for Understanding Security Requirements Using Problem Domain Ontology","authors":"Bong-Jae Kim, Seok-Won Lee","doi":"10.1109/APSEC.2016.024","DOIUrl":"https://doi.org/10.1109/APSEC.2016.024","url":null,"abstract":"Socio-technical Systems (STS) consist of complicated requirements that consider a variety of stakeholders' viewpoints, and are inherently complex due to heterogeneity characteristics of STS components. However, security in STS is still a major issue, which can be explained by the resulting cost and the impact of the STS intrusion on the whole enterprise. However, research related to recommending security requirements for a target STS is insufficient. Firstly, systematic acquisition of understanding the problem with rich context-awareness is not provided to STS, since the knowledge for the development and execution of STS is scattered. Secondly, the majority of security analysis focuses on only the technical approach, although it is necessary to perform a holistic analysis of STS due to heterogeneity characteristics. In order to solve these problems, we conduct a study of the three-layered framework for recommending security requirements through goal-oriented risk assessment using a Problem Domain Ontology (PDO). By using this framework, we demonstrate how the PDO is built through collecting, analyzing, and categorizing different information and knowledge from various sources, and how security requirements are recommended from the threat analysis and the goal-oriented risk assessment based on PDO. In addition, we discuss the applicability of this framework with a case study based on a real threat scenario. This paper contributes to security requirements engineering research by proposing a methodology for systematically organizing knowledge with a security requirements recommendation framework using the PDO.","PeriodicalId":339123,"journal":{"name":"2016 23rd Asia-Pacific Software Engineering Conference (APSEC)","volume":"28 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123503512","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

Predictive Tool for Software Team Performance 软件团队绩效预测工具

2016 23rd Asia-Pacific Software Engineering Conference (APSEC) Pub Date : 1900-01-01 DOI: 10.1109/APSEC.2016.063

Tri Nguyen, C. Chua

引用次数: 7

A Model for Defining Coupling Metrics 定义耦合度量的模型

2016 23rd Asia-Pacific Software Engineering Conference (APSEC) Pub Date : 1900-01-01 DOI: 10.1109/APSEC.2016.030

E. Tempero, P. Ralph

引用次数: 5

Splitting Commits via Past Code Changes 通过过去的代码变更分割提交

2016 23rd Asia-Pacific Software Engineering Conference (APSEC) Pub Date : 1900-01-01 DOI: 10.1109/APSEC.2016.028

Hiroyuki Kirinuki, Yoshiki Higo, Keisuke Hotta, S. Kusumoto

引用次数: 12

LibSift: Automated Detection of Third-Party Libraries in Android Applications LibSift: Android应用程序中第三方库的自动检测

2016 23rd Asia-Pacific Software Engineering Conference (APSEC) Pub Date : 1900-01-01 DOI: 10.1109/APSEC.2016.017

C. Soh, Hee Beng Kuan Tan, Y. Arnatovich, A. Narayanan, Lipo Wang

{"title":"LibSift: Automated Detection of Third-Party Libraries in Android Applications","authors":"C. Soh, Hee Beng Kuan Tan, Y. Arnatovich, A. Narayanan, Lipo Wang","doi":"10.1109/APSEC.2016.017","DOIUrl":"https://doi.org/10.1109/APSEC.2016.017","url":null,"abstract":"Android applications typically contain multiple third-party libraries and recent studies have shown that the presence of third-party libraries may introduce privacy risks and security threats. Furthermore, researchers have reported the importance of considering the third-party libraries for their program analysis tasks. A reason being that the presence of third-party libraries may dilute the features and affect the accuracy of their results. Existing literature typically employs a whitelist to exclude the third-party libraries from their analysis in order to achieve accurate results. However, these whitelists are generally incomplete and weak against the renaming obfuscation technique that is commonly employed in Android applications. In this paper, we propose LibSift, a tool to automatically detect third-party libraries in Android applications. LibSift detects third-party libraries based on package dependencies that are resilient to most common obfuscations. The evaluation results not only indicate that LibSift can detect third-party libraries accurately and effectively, but also show that LibSift can detect even the less popular libraries that are not detected by two of the state-of-the-art approaches.","PeriodicalId":339123,"journal":{"name":"2016 23rd Asia-Pacific Software Engineering Conference (APSEC)","volume":"45 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121957382","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 11

Projected Control Graph for Accurate and Efficient Analysis of Safety and Security Vulnerabilities 投影控制图用于准确有效地分析安全和安全漏洞

2016 23rd Asia-Pacific Software Engineering Conference (APSEC) Pub Date : 1900-01-01 DOI: 10.1109/APSEC.2016.026

Ahmed Tamrawi, S. Kothari

{"title":"Projected Control Graph for Accurate and Efficient Analysis of Safety and Security Vulnerabilities","authors":"Ahmed Tamrawi, S. Kothari","doi":"10.1109/APSEC.2016.026","DOIUrl":"https://doi.org/10.1109/APSEC.2016.026","url":null,"abstract":"The goal of path-sensitive analysis (PSA) is to achieve accuracy by accounting precisely for the execution behavior along each path of a control flow graph (CFG). A practical adoption of PSA is hampered by two roadblocks: (a) the exponential growth of the number of CFG paths, and (b) the exponential complexity of a path feasibility check. We introduce projected control graph (PCG) as an optimal mathematical abstraction to address these roadblocks.The PCG follows from the simple observation that for any given analysis problem, the number of distinct relevant execution behaviors may be much smaller than the number of CFG paths. The PCG is a projection of the CFG to retain only the relevant execution behaviors and elide duplicate paths with identical execution behavior. A mathematical definition of PCG and an efficient algorithm to transform CFG to PCG are presented.We present an empirical study for three major versions of the Linux kernel to assess the practical benefit of using the optimal mathematical abstraction. As a measure of the efficiency gain, the study reports the reduction from CFG to PCG graphs for all relevant functions for pairing Lock and Unlock on all feasible execution paths. We built a tool to compute these graphs for 66,609 Lock instances. The CFG and PCG graphs with their source correspondence are posted on a website. We used these PCG graphs in a classroom project to audit the results of Lock and Unlock pairing done by the Linux Driver Verification (LDV) tool, the top-rated formal verification tool for the Linux kernel. Our audit has revealed complex Linux bugs missed by LDV.","PeriodicalId":339123,"journal":{"name":"2016 23rd Asia-Pacific Software Engineering Conference (APSEC)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128685607","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 13

Detecting and Localizing Visual Inconsistencies in Web Applications 检测和定位Web应用程序中的视觉不一致

2016 23rd Asia-Pacific Software Engineering Conference (APSEC) Pub Date : 1900-01-01 DOI: 10.1109/APSEC.2016.060

Sonal Mahajan, K.B. Gadde, A. Pasala, William G. J. Halfond

引用次数: 8

Minimalist Qualitative Models for Model Checking Cyber-Physical Feature Coordination 用于模型检验的网络物理特征协调的极简定性模型

2016 23rd Asia-Pacific Software Engineering Conference (APSEC) Pub Date : 1900-01-01 DOI: 10.1109/APSEC.2016.041

Michael Rathmair, Christoph Luckeneder, H. Kaindl

{"title":"Minimalist Qualitative Models for Model Checking Cyber-Physical Feature Coordination","authors":"Michael Rathmair, Christoph Luckeneder, H. Kaindl","doi":"10.1109/APSEC.2016.041","DOIUrl":"https://doi.org/10.1109/APSEC.2016.041","url":null,"abstract":"Feature-based systems may have interacting features, where undesired feature interaction(s) may even lead to safety-critical behavior in cyber-physical systems. Automotive systems are such systems, where more and more features are currently being integrated, which have to be coordinated. Automated and formal verification of the resulting behavior against safetyrelevant properties is important, and it should not be restricted to the cyber-part (inside the software implementing the features.)In order to address this problem, we investigate coordination of physical feature interactions in this context using model checking. In particular, we created and used a qualitative model for formal verification against a property in time logic. This model is intended to be minimalist, in particular the logical model based on a physical model (including speed and distance). This logical model defines the essence of operations in the dedicated environment. As a result, we formally verified the high-level logic of a composite feature to be used in automotive systems against a formalized accident property. In summary, we employ minimalist qualitative models for model checking (safety-critical) cyberphysical feature coordination. Such a verified qualitative model may provide a reference model for both quantitative models and real software implementations.","PeriodicalId":339123,"journal":{"name":"2016 23rd Asia-Pacific Software Engineering Conference (APSEC)","volume":"11 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115255633","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 9

CURE: Automated Patch Generation for Dynamic Software Update CURE:自动补丁生成动态软件更新

2016 23rd Asia-Pacific Software Engineering Conference (APSEC) Pub Date : 1900-01-01 DOI: 10.1109/APSEC.2016.043

Ze-Yi Zhao, Tianxiao Gu, Xiaoxing Ma, Chang Xu, Jian Lu

引用次数: 4