{"title":"Static analysis for computing escapability and mutability for Java components","authors":"Aiwu Shi, G. Naumovich","doi":"10.1109/SCAM.2005.24","DOIUrl":"https://doi.org/10.1109/SCAM.2005.24","url":null,"abstract":"A common theme in information security is protection of trusted software components against unauthorized access by untrusted users. In the context of distributed object technologies, such as Enterprise Java Beans, this means preventing leaks of sensitive information to untrusted users, as well as preventing untrusted users from modifying sensitive information. In this paper, we propose an approach for identification and classification of potentially sensitive information that can leak out of trusted software components to untrusted parties. Unlike the current approaches to securing information flow by extending the type system, our technique is based on static points-to, data- and control-dependence, and object mutability analyses.","PeriodicalId":394744,"journal":{"name":"Fifth IEEE International Workshop on Source Code Analysis and Manipulation (SCAM'05)","volume":"27 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-09-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125153561","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Specifying transformation sequences as computation on program fragments with an abstract attribute grammar","authors":"M. Schordan, D. Quinlan","doi":"10.1109/SCAM.2005.23","DOIUrl":"https://doi.org/10.1109/SCAM.2005.23","url":null,"abstract":"We present a grammar based approach for specifying a transformation as a sequence of transformation operations that operate on an intermediate representation. The transformation sequence is specified in the semantic actions of an abstract attribute grammar. The mapping between the object-oriented design of the intermediate representation and the abstract grammar directly reflects the object-oriented design in the structure of the grammar. It has properties that permit utilizing grammar based tools at arbitrary abstraction levels of the language representation. The program fragments can be both source strings and fragments of the intermediate representation that can be used interchangeably in the specification. We demonstrate the applicability of the approach by using available attribute grammar tools and the source-to-source infrastructure ROSE for specifying and performing transformations of C+ + programs. The results of data flow analysis tools using fixed point algorithms is integrated as available attributes that can be used for enabling or disabling transformation sequences. With the abstract attribute grammar the transformation is computed as an attribute value that represents a sequence of restructure operations. The composition of different transformation sequences permits the reuse of sub-transformation specifications. Eventually we discuss the correspondence to rewrite tools permitting a pattern based restructuring of the program representation.","PeriodicalId":394744,"journal":{"name":"Fifth IEEE International Workshop on Source Code Analysis and Manipulation (SCAM'05)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-09-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131211392","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Extending dynamic aspect mining with static information","authors":"S. Breu","doi":"10.1109/SCAM.2005.9","DOIUrl":"https://doi.org/10.1109/SCAM.2005.9","url":null,"abstract":"Aspect mining tries to identify crosscutting concerns in legacy systems and thus supports the refactoring into an aspect-oriented design. We briefly introduce DynAMiT, a dynamic aspect mining tool that detects crosscutting concerns based on tracing method executions. While the approach is generally fairly precise, further analysis revealed that some false positives were systematically caused by dynamic binding. Furthermore, some aspect candidates were blurred or not detected due to not-sufficient tracing mechanisms of method executions when using AspectJ's execution pointcuts for the trace generation. We enhanced the mining capabilities of DynAMiT by taking additional static type information into account and generating the traces using call pointcuts instead. In an initial case study with AnChoVis, a 1300 LOC Java program, the number of mined aspect candidates increased by a factor of three, while the number of false positives remained zero.","PeriodicalId":394744,"journal":{"name":"Fifth IEEE International Workshop on Source Code Analysis and Manipulation (SCAM'05)","volume":"7 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-09-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130372034","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Declassification: transforming Java programs to remove intermediate classes","authors":"B. Power, G. Hamilton","doi":"10.1109/SCAM.2005.7","DOIUrl":"https://doi.org/10.1109/SCAM.2005.7","url":null,"abstract":"This paper presents an optimisation technique which automatically inlines certain classes within their enclosing class. Inlining a class involves inserting the fields and methods of this class into the body of its enclosing class. The enclosing class is the class which declared an instance of the class. The declaration of the inlined class can then be removed from the program. This technique transforms Java programs into an equivalent form, which may be less readable, but is more efficient. The results of the empirical study showed that few classes were found suitable for inlining and that the declassification was not overly successful when optimizing the test programs. One of the advantages of declassification is that it does not result in code bloating. It is thought that further extensions to the declassification technique and an intrinsically object-oriented set of test programs could greatly improve its effectiveness.","PeriodicalId":394744,"journal":{"name":"Fifth IEEE International Workshop on Source Code Analysis and Manipulation (SCAM'05)","volume":"75 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-09-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130342442","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Pointer analysis for source-to-source transformations","authors":"M. Buss, S. Edwards, Bin Yao, D. Waddington","doi":"10.1109/SCAM.2005.20","DOIUrl":"https://doi.org/10.1109/SCAM.2005.20","url":null,"abstract":"We present a pointer analysis algorithm designed for source-to-source transformations. Existing techniques for pointer analysis apply a collection of inference rules to a dismantled intermediate form of the source program, making them difficult to apply to source-to-source tools that generally work on abstract syntax trees to preserve details of the source program. Our pointer analysis algorithm operates directly on the abstract syntax tree of a C program and uses a form of standard dataflow analysis to compute the desired points-to information. We have implemented our algorithm in a source-to-source translation framework and experimental results show that it is practical on real-world examples.","PeriodicalId":394744,"journal":{"name":"Fifth IEEE International Workshop on Source Code Analysis and Manipulation (SCAM'05)","volume":"75 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-09-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132865116","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"The performance penalty of XML for program intermediate representations","authors":"P. Anderson","doi":"10.1109/SCAM.2005.25","DOIUrl":"https://doi.org/10.1109/SCAM.2005.25","url":null,"abstract":"XML has been proposed as a file format for representing program intermediate forms such as abstract syntax trees (ASTs), and dependence graphs. Although XML offers many advantages over custom binary representations of the same information, there is an associated performance cost. This paper reports on the results of experiments aimed at quantifying this cost. Two representations are studied: the abstract syntax tree, and the system dependence graph (SDG). The performance penalty for using XML is found to be very significant for ASTs, and crippling for the SDG. The tradeoff between the performance and flexibility is discussed.","PeriodicalId":394744,"journal":{"name":"Fifth IEEE International Workshop on Source Code Analysis and Manipulation (SCAM'05)","volume":"28 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-09-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125976508","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Forward slices are smaller than backward slices","authors":"D. Binkley, M. Harman","doi":"10.1109/SCAM.2005.28","DOIUrl":"https://doi.org/10.1109/SCAM.2005.28","url":null,"abstract":"This paper presents evidence from two empirical studies which show that forward slices will tend to be smaller than backward slices and discusses the importance of this result for work on source code analysis and manipulation. The difference in forward and backward slice size distributions stems from the way in which control dependence and data dependence affect slice size. The paper explains this claim in detail and supports it with empirical evidence. The empirical evidence comes from a further study which uses a restricted form of slicing that isolates the effects due to control and data dependence. This study shows that it is the inherent difference between forward and backward control dependence that leads to the difference in slice size distributions for forward and backward slicing. The results from all three empirical studies are shown to be strongly statistically significant.","PeriodicalId":394744,"journal":{"name":"Fifth IEEE International Workshop on Source Code Analysis and Manipulation (SCAM'05)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-09-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129032551","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Fine-grained analysis of change couplings","authors":"B. Fluri, H. Gall, M. Pinzger","doi":"10.1109/SCAM.2005.14","DOIUrl":"https://doi.org/10.1109/SCAM.2005.14","url":null,"abstract":"In software evolution analysis, many approaches analyze release history data available through versioning systems. The recent investigations of CVS data have shown that commonly committed files highlight their change couplings. However, CVS stores modifications on the basis of text but does not track structural changes, such as the insertion, removing, or modification of methods or classes. A detailed analysis whether change couplings are caused by source code couplings or by other textual modifications, such as updates in license terms, is not performed by current approaches. The focus of this paper is on adding structural change information to existing release history data. We present an approach that uses the structure compare services shipped with the Eclipse IDE to obtain the corresponding finegrained changes between two subsequent versions of any Java class. This information supports filtering those change couplings which result from structural changes. So we can distill the causes for change couplings along releases and filter out those that are structurally relevant. The first validation of our approach with a medium-sized open source software system showed that a reasonable amount of change couplings are not caused by source code changes.","PeriodicalId":394744,"journal":{"name":"Fifth IEEE International Workshop on Source Code Analysis and Manipulation (SCAM'05)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-09-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128681188","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Abstract slicing: a new approach to program slicing based on abstract interpretation and model checking","authors":"Hyoung Seok Hong, Insup Lee, O. Sokolsky","doi":"10.1109/SCAM.2005.2","DOIUrl":"https://doi.org/10.1109/SCAM.2005.2","url":null,"abstract":"This paper proposes a new approach to program slicing based on abstract interpretation and model checking. First, the notion of abstract slicing is introduced. Abstract slicing extends static slicing with predicates and constraints by using as the program model an abstract state graph, which is obtained by applying predicate abstraction to a program, rather than a flow graph. This leads to a program slice that is more precise and smaller than its static counterpart. Second, a method for performing abstract slicing is developed. It is shown that abstract slicing can be reduced to a least fixpoint computation over formulas in the branching time temporal logic CTL. This enables one to use symbolic model checkers for CTL as an efficient computation engine for abstract slicing. A prototype implementation and experimental results are reported demonstrating the feasibility of the approach.","PeriodicalId":394744,"journal":{"name":"Fifth IEEE International Workshop on Source Code Analysis and Manipulation (SCAM'05)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-09-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129034583","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Dynamic slicing of Java bytecode programs","authors":"A. Szegedi, T. Gyimóthy","doi":"10.1109/SCAM.2005.8","DOIUrl":"https://doi.org/10.1109/SCAM.2005.8","url":null,"abstract":"A forward global method for obtaining backward dynamic slices of Java bytecode programs is presented. In contrast with existing published techniques that require either a customized Java compiler (which also implies access to the source code) or bytecode instrumentation and eventual manual dependency specifications, our approach was to produce an instrumented virtual machine for Java. This approach works with programs compiled with arbitrary third party compilers and does not require access to the source code during the slicing process. However, we still retain the ability to express the slicing criterion and the resulting slice in terms of source code locations using the supplemental information present in the compiled code. Our technique also handles advanced aspects of the Java environment, such as exception handling, multithreaded execution and, to a certain degree, the execution of native machine code linked with the Java classes.","PeriodicalId":394744,"journal":{"name":"Fifth IEEE International Workshop on Source Code Analysis and Manipulation (SCAM'05)","volume":"31 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2005-09-30","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125707920","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}