发布求助
文献互助 智能选刊 最新文献

2008 ACM/IEEE 30th International Conference on Software Engineering最新文献

筛选
英文 中文
Executable misuse cases for modeling security concerns 为安全问题建模的可执行误用案例
2008 ACM/IEEE 30th International Conference on Software Engineering Pub Date : 2008-05-10 DOI: 10.1145/1368088.1368106
J. Whittle, D. Wijesekera, M. Hartong
{"title":"Executable misuse cases for modeling security concerns","authors":"J. Whittle, D. Wijesekera, M. Hartong","doi":"10.1145/1368088.1368106","DOIUrl":"https://doi.org/10.1145/1368088.1368106","url":null,"abstract":"Misuse cases are a way of modeling negative requirements, that is, behaviors that should not occur in a system. In particular, they can be used to model attacks on a system as well as the security mechanisms needed to avoid them. However, like use cases, misuse cases describe requirements in a high-level and informal manner. This means that, whilst they are easy to understand, they do not lend themselves to testing or analysis. In this paper, we present an executable misuse case modeling language which allows modelers to specify misuse case scenarios in a formal yet intuitive way and to execute the misuse case model in tandem with a corresponding use case model. Misuse scenarios are given in executable form and mitigations are captured using aspect-oriented modeling. The technique is useful for brainstorming potential attacks and their mitigations. Furthermore, the use of aspects allows mitigations to be maintained separately from the core system model. The paper, supported by a UML-based modeling tool, describes an application to two case studies, providing evidence that the technique can support red-teaming of security requirements for realistic systems.","PeriodicalId":367697,"journal":{"name":"2008 ACM/IEEE 30th International Conference on Software Engineering","volume":"200 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-05-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114204578","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 68
A tale of four kernels 一个关于四粒核的故事
2008 ACM/IEEE 30th International Conference on Software Engineering Pub Date : 2008-05-10 DOI: 10.1145/1368088.1368140
D. Spinellis
{"title":"A tale of four kernels","authors":"D. Spinellis","doi":"10.1145/1368088.1368140","DOIUrl":"https://doi.org/10.1145/1368088.1368140","url":null,"abstract":"The FreeBSD, GNU/Linux, Solaris, and Windows operating systems have kernels that provide comparable facilities. Interestingly, their code bases share almost no common parts, while their development processes vary dramatically. We analyze the source code of the four systems by collecting metrics in the areas of file organization, code structure, code style, the use of the C preprocessor, and data organization. The aggregate results indicate that across various areas and many different metrics, four systems developed using wildly different processes score comparably. This allows us to posit that the structure and internal quality attributes of a working, non-trivial software artifact will represent first and foremost the engineering requirements of its construction, with the influence of process being marginal, if any.","PeriodicalId":367697,"journal":{"name":"2008 ACM/IEEE 30th International Conference on Software Engineering","volume":"57 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-05-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116499458","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 77
Impact analysis of database schema changes 数据库模式更改的影响分析
2008 ACM/IEEE 30th International Conference on Software Engineering Pub Date : 2008-05-10 DOI: 10.1145/1368088.1368150
Andy Maule
{"title":"Impact analysis of database schema changes","authors":"Andy Maule","doi":"10.1145/1368088.1368150","DOIUrl":"https://doi.org/10.1145/1368088.1368150","url":null,"abstract":"We propose static program analysis techniques for identifying the impact of relational database schema changes upon object-oriented applications. We use dataflow analysis to extract all possible database interactions that an application may make. We then use this information to predict the effects of schema change. We evaluate our approach with a case-study of a commercially available content management system, where we investigated 62 versions of between 70 k-127 k LoC and a schema size of up to 101 tables and 568 stored procedures. We demonstrate that the program analysis must be more precise, in terms of context-sensitivity than related work. However, increasing the precision of this analysis increases the computational cost. We use program slicing to reduce the size of the program that needs to be analyzed. Using this approach, we are able to analyse the case study in under 2 minutes on a standard desktop machine, with no false negatives and a low level of false positives.","PeriodicalId":367697,"journal":{"name":"2008 ACM/IEEE 30th International Conference on Software Engineering","volume":"13 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-05-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114835496","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 93
Static detection of cross-site scripting vulnerabilities 跨站点脚本漏洞的静态检测
2008 ACM/IEEE 30th International Conference on Software Engineering Pub Date : 2008-05-10 DOI: 10.1145/1368088.1368112
Gary Wassermann, Z. Su
{"title":"Static detection of cross-site scripting vulnerabilities","authors":"Gary Wassermann, Z. Su","doi":"10.1145/1368088.1368112","DOIUrl":"https://doi.org/10.1145/1368088.1368112","url":null,"abstract":"Web applications support many of our daily activities, but they often have security problems, and their accessibility makes them easy to exploit. In cross-site scripting (XSS), an attacker exploits the trust a Web client (browser) has for a trusted server and executes injected script on the browser with the server's privileges. In 2006, XSS constituted the largest class of newly reported vulnerabilities making it the most prevalent class of attacks today. Web applications have XSS vulnerabilities because the validation they perform on untrusted input does not suffice to prevent that input from invoking a browser's JavaScript interpreter, and this validation is particularly difficult to get right if it must admit some HTML mark-up. Most existing approaches to finding XSS vulnerabilities are taint-based and assume input validation functions to be adequate, so they either miss real vulnerabilities or report many false positives. This paper presents a static analysis for finding XSS vulnerabilities that directly addresses weak or absent input validation. Our approach combines work on tainted information flow with string analysis. Proper input validation is difficult largely because of the many ways to invoke the JavaScript interpreter; we face the same obstacle checking for vulnerabilities statically, and we address it by formalizing a policy based on the W3C recommendation, the Firefox source code, and online tutorials about closed-source browsers. We provide effective checking algorithms based on our policy. We implement our approach and provide an extensive evaluation that finds both known and unknown vulnerabilities in real-world web applications.","PeriodicalId":367697,"journal":{"name":"2008 ACM/IEEE 30th International Conference on Software Engineering","volume":"134 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-05-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134321970","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 409
Dynamic round-trip GUI maintenance 动态往返GUI维护
2008 ACM/IEEE 30th International Conference on Software Engineering Pub Date : 2008-05-10 DOI: 10.1145/1368088.1368220
Peng Li, Eric Wohlstadter
{"title":"Dynamic round-trip GUI maintenance","authors":"Peng Li, Eric Wohlstadter","doi":"10.1145/1368088.1368220","DOIUrl":"https://doi.org/10.1145/1368088.1368220","url":null,"abstract":"One difficulty in software maintenance is that the relationship between observed program behavior and source code is not always clear. This is true for the maintenance of graphical user interfaces (GUIs), because user interface code can be scattered across the decomposition of applications. A popular approach to develop and maintain GUIs is to use \"What you see is what you get\" editors. They allow developers to work directly with a graphical design view instead of scattered source elements. Unfortunately GUI editors are limited by their ability to statically reconstruct dynamic collaborations between objects. In our research we investigate the combination of a hybrid dynamic and static approach to allow for round-trip maintenance of GUIs. Dynamic analysis reconstructs object relationships, providing a concrete context in which maintenance can be performed. Static checking guides the reconciliation between the GUI editors' design view and source. We implemented a prototype IDE plugin and evaluate our approach by applying it to five open source projects.","PeriodicalId":367697,"journal":{"name":"2008 ACM/IEEE 30th International Conference on Software Engineering","volume":"411 ","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-05-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133287225","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
Applying model-based testing to healthcare products 将基于模型的测试应用于医疗保健产品
2008 ACM/IEEE 30th International Conference on Software Engineering Pub Date : 2008-05-10 DOI: 10.1145/1368088.1368183
M. Vieira, Xiping Song, Gilberto Matos, S. Storck, Rajanikanth Tanikella, W. Hasling
{"title":"Applying model-based testing to healthcare products","authors":"M. Vieira, Xiping Song, Gilberto Matos, S. Storck, Rajanikanth Tanikella, W. Hasling","doi":"10.1145/1368088.1368183","DOIUrl":"https://doi.org/10.1145/1368088.1368183","url":null,"abstract":"Healthcare software systems are becoming more and more complex since they will be highly integrated to support a wide variety of healthcare workflows (e.g., financial, administration, diagnosis, and treatment). In addition, healthcare software systems will be more safety-critical as they will provide medical decision support for doctors. All of those require systematic and thorough testing of the systems before they are put into use or upgraded. Model-Based Testing (MBT) is an approach to apply formal, explicit system use-models to generate the test cases for testing the system behaviors under different input data sets. This paper describes our experiences in applying this approach to testing some Siemens healthcare software systems. We will report the benefits and challenges in using MBT for testing healthcare software systems.","PeriodicalId":367697,"journal":{"name":"2008 ACM/IEEE 30th International Conference on Software Engineering","volume":"40 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-05-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116807662","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 25
Tool support for data validation by end-user programmers 最终用户程序员对数据验证的工具支持
2008 ACM/IEEE 30th International Conference on Software Engineering Pub Date : 2008-05-10 DOI: 10.1145/1368088.1368226
Christopher Scaffidi, B. Myers, M. Shaw
{"title":"Tool support for data validation by end-user programmers","authors":"Christopher Scaffidi, B. Myers, M. Shaw","doi":"10.1145/1368088.1368226","DOIUrl":"https://doi.org/10.1145/1368088.1368226","url":null,"abstract":"End-user programming tools for creating spreadsheets and webforms offer no data types except \"string\" for storing many kinds of data, such as person names and street addresses. Consequently, these tools cannot automatically validate these data. To address this problem, we have developed a new userextensible model for string-like data. Each \"tope\" in this model is a user-defined abstraction that guides the interpretation of strings as a particular kind of data, such as a mailing address. Specifically, each tope implementation contains software functions for recognizing and reformatting that tope's kind of data. With our tools, end-user programmers define new topes and associate them with fields in spreadsheets, webforms, and other programs. This makes it possible at runtime to distinguish between invalid data, valid data, and questionable data that could be valid or invalid. Once identified, questionable and/or invalid data can be double-checked and possibly corrected, thereby increasing the overall reliability of the data.","PeriodicalId":367697,"journal":{"name":"2008 ACM/IEEE 30th International Conference on Software Engineering","volume":"3 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-05-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123927874","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 4
A teamwork-based approach to programming fundamentals with scheme, smalltalk & java 基于团队合作的编程基础方法，包括scheme、smalltalk和java
2008 ACM/IEEE 30th International Conference on Software Engineering Pub Date : 2008-05-10 DOI: 10.1145/1368088.1368199
Michele Lanza, A. Murphy, R. Robbes, M. Lungu, Paolo Bonzini
{"title":"A teamwork-based approach to programming fundamentals with scheme, smalltalk & java","authors":"Michele Lanza, A. Murphy, R. Robbes, M. Lungu, Paolo Bonzini","doi":"10.1145/1368088.1368199","DOIUrl":"https://doi.org/10.1145/1368088.1368199","url":null,"abstract":"In October 2004 the University of Lugano in southern Switzerland established a new faculty of informatics. Its founding principles are innovation in teaching and faculty participation in the research community. With respect to teaching, students spend mornings attending lectures and afternoons in an Atelier designed to support interaction both among students and with the instructors. In teaching the first year \"Programming Fundamentals\" courses, we took advantage of the clean slate nature of the faculty to introduce innovative teaching elements. The novel aspects include our use of Scheme, Smalltalk, and Java, our combination of individual, pair and group projects and the integration of expert lectures to introduce useful, but slightly orthogonal elements at key points in the semester. Our very positive experience is reported along with a discussion of aspects to improve in the future.","PeriodicalId":367697,"journal":{"name":"2008 ACM/IEEE 30th International Conference on Software Engineering","volume":"92 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-05-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126160360","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 2
Clonetracker
2008 ACM/IEEE 30th International Conference on Software Engineering Pub Date : 2008-05-10 DOI: 10.1145/1368088.1368218
Ekwa Duala-Ekoko, M. Robillard
{"title":"Clonetracker","authors":"Ekwa Duala-Ekoko, M. Robillard","doi":"10.1145/1368088.1368218","DOIUrl":"https://doi.org/10.1145/1368088.1368218","url":null,"abstract":"Code clones are generally considered to be an obstacle to software maintenance. Research has provided evidence that it may not always be practical, feasible, or cost-effective to eliminate certain clone groups through refactoring. This paper describes CloneTracker, an Eclipse plug-in that provides support for tracking code clones in evolving software. With CloneTracker, developers can specify clone groups they wish to track, and the tool will automatically generate a clone model that is robust to changes to the source code, and can be shared with other collaborators of the project. When future modifications intersect with tracked clones, CloneTracker will notify the developer, provide support to consistently apply changes to a corresponding clone region, and provide support for updating the clone model. CloneTracker complements existing techniques by providing support for reusing knowledge about the location of clones in source code, and support for keeping track of clones when refactoring is not desirable.","PeriodicalId":367697,"journal":{"name":"2008 ACM/IEEE 30th International Conference on Software Engineering","volume":"73 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-05-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127089294","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 87
Metamodel-based tool integration with moflon 与moflon集成基于元模型的工具
2008 ACM/IEEE 30th International Conference on Software Engineering Pub Date : 2008-05-10 DOI: 10.1145/1368088.1368206
C. Amelunxen, Felix Klar, Alexander Königs, T. Rötschke, Andy Schürr
{"title":"Metamodel-based tool integration with moflon","authors":"C. Amelunxen, Felix Klar, Alexander Königs, T. Rötschke, Andy Schürr","doi":"10.1145/1368088.1368206","DOIUrl":"https://doi.org/10.1145/1368088.1368206","url":null,"abstract":"Nowadays, a typical software development process involves many developers which participate in the development process by using a wide variety of development tools. As a consequence, the data representing the project as a whole is distributed over different development tools. For the purpose of consistency, maintainability, and traceability it is an essential task to be aware of the relationships between semantic equivalent data in different tool repositories. The real-time systems Lab at the Technische Universitat Darmstadt performs research in the area of tool and metamodel integration to provide solutions to overcome this gap. In this demonstration we present the metamodeling framework MOFLON that addresses these issues by bringing together the latest OMG standards with graph transformations and triple graph grammars. Using MOFLON, developers can generate code for specific tools needed to perform analysis and transformation on one development tool or to incrementally integrate data of different modeling tools.","PeriodicalId":367697,"journal":{"name":"2008 ACM/IEEE 30th International Conference on Software Engineering","volume":"82 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2008-05-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127129677","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 70
首页 上一页 下一页 尾页
0
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
提示
您的信息不完整，为了账户安全，请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
请完成安全验证×
相关产品
×
本文献相关产品
联系我们：info@booksci.cn Book学术提供免费学术资源搜索服务，方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。 Copyright © 2023 布克学术 All rights reserved.
京ICP备2023020795号-1
ghs 京公网安备 11010802042870号
Book学术文献互助
Book学术文献互助群
群 号：604180095
Book学术官方微信
小红书