Computer Sciences Commons^™

Out Of Sight, Out Of Mind: Better Automatic Vulnerability Repair By Broadening Input Ranges And Sources, Xin Zhou, Kisub Kim, Bowen Xu, Donggyun Han, David Lo

Research Collection School Of Computing and Information Systems

The advances of deep learning (DL) have paved the way for automatic software vulnerability repair approaches, which effectively learn the mapping from the vulnerable code to the fixed code. Nevertheless, existing DL-based vulnerability repair methods face notable limitations: 1) they struggle to handle lengthy vulnerable code, 2) they treat code as natural language texts, neglecting its inherent structure, and 3) they do not tap into the valuable expert knowledge present in the expert system. To address this, we propose VulMaster, a Transformer-based neural network model that excels at generating vulnerability repairs by comprehensively understanding the entire vulnerable code, irrespective of …

Greening Large Language Models Of Code, Jieke Shi, Zhou Yang, Hong Jin Kang, Bowen Xu, Junda He, David Lo

Research Collection School Of Computing and Information Systems

Large language models of code have shown remarkable effectiveness across various software engineering tasks. Despite the availability of many cloud services built upon these powerful models, there remain several scenarios where developers cannot take full advantage of them, stemming from factors such as restricted or unreliable internet access, institutional privacy policies that prohibit external transmission of code to third-party vendors, and more. Therefore, developing a compact, efficient, and yet energy-saving model for deployment on developers' devices becomes essential.To this aim, we propose Avatar, a novel approach that crafts a deployable model from a large language model of code by optimizing …

Ps3: Precise Patch Presence Test Based On Semantic Symbolic Signature, Qi Zhan, Xing Hu, Zhiyang Li, Xin Xia, David Lo, Shanping Li

Research Collection School Of Computing and Information Systems

During software development, vulnerabilities have posed a significant threat to users. Patches are the most effective way to combat vulnerabilities. In a large-scale software system, testing the presence of a security patch in every affected binary is crucial to ensure system security. Identifying whether a binary has been patched for a known vulnerability is challenging, as there may only be small differences between patched and vulnerable versions. Existing approaches mainly focus on detecting patches that are compiled in the same compiler options. However, it is common for developers to compile programs with very different compiler options in different situations, which …

Mut: Human-In-The-Loop Unit Test Migration, Yi Gao, Xing Hu, Tongtong Xu, Xin Xia, David Lo, Xiaohu Yang

Research Collection School Of Computing and Information Systems

Test migration, which enables the reuse of test cases crafted with knowledge and creativity by testers across various platforms and programming languages, has exhibited effectiveness in mobile app testing. However, unit test migration at the source code level has not garnered adequate attention and exploration. In this paper, we propose a novel cross-language and cross-platform test migration methodology, named MUT, which consists of four modules: code mapping, test case filtering, test case translation, and test case adaptation. MUT initially calculates code mappings to establish associations between source and target projects, and identifies suitable unit tests for migration from the source …

Curiosity-Driven Testing For Sequential Decision-Making Process, Junda He, Zhou Yang, Jieke Shi, Chengran Yang, Kisub Kim, Bowen Xu, Xin Zhou, David Lo

Research Collection School Of Computing and Information Systems

Sequential decision-making processes (SDPs) are fundamental for complex real-world challenges, such as autonomous driving, robotic control, and traffic management. While recent advances in Deep Learning (DL) have led to mature solutions for solving these complex problems, SDMs remain vulnerable to learning unsafe behaviors, posing significant risks in safety-critical applications. However, developing a testing framework for SDMs that can identify a diverse set of crash-triggering scenarios remains an open challenge. To address this, we propose CureFuzz, a novel curiosity-driven black-box fuzz testing approach for SDMs. CureFuzz proposes a curiosity mechanism that allows a fuzzer to effectively explore novel and diverse scenarios, …

Towards Speedy Permission-Based Debloating For Android Apps, Thung Ferdian, Jiakun Liu, Pattarakrit Rattanukul, Shahar Maoz, Eran Toch, Debin Gao, David Lo

Research Collection School Of Computing and Information Systems

Android apps typically include many functionalities that not all users require. These result in software bloat that increases possible attack surface and app size. Common functionalities that users may not require are related to permissions that they intend to disallow in the first place. As these permissions are disallowed, their related code would never be executed and therefore can be safely removed. Existing work has proposed a solution to debloat Android apps according to the disallowed permissions. However, for large and complex applications, the debloating process could take hours, typically due the long time that may be needed to construct …

Concretely Mapped Symbolic Memory Locations For Memory Error Detection, Haoxin Tu, Lingxiao Jiang, Jiaqi Hong, Xuhua Ding, He Jiang

Research Collection School Of Computing and Information Systems

Memory allocation is a fundamental operation for managing memory objects in many programming languages. Misusing allocated memory objects (e.g., buffer overflow and use-after-free) can lead to catastrophic consequences. Symbolic execution-based approaches are often used to detect such memory errors, leveraging their capabilities in automatic path exploration and test case generation. However, existing symbolic execution engines face significant limitations in modeling dynamic memory layouts. These engines either represent memory object locations as concrete addresses, limiting analyses to specific address layouts and missing errors that occur at special addresses, or represent locations as simple symbolic variables without sufficient constraints, resulting in memory …

The Social Pot: A Social Media Application, Reid Long

ASPIRE 2024

The Social Pot is a web application that allows a user to post to Instagram and X simultaneously from one place. The user creates a Social Pot Account and from there can set their Instagram username and password within the home page. Once the user attempts to post, it will redirect them to login to X which once successful will make the tweet. Used the API 'instagram-private-api'. User needed to give access to my X Project which in turn gave an Auth token (via X redirect URL). The auth token was then sent to my endpoint in order to get …

Terry Riley's "In C" For Mobile Ensemble, David B. Wetzel, Griffin Moe, George K. Thiruvathukal

Computer Science: Faculty Publications and Other Works

This workshop presents a mobile-friendly Web Audio application for a “technology ensemble play-along” of Terry Riley’s 1964 composition In C. Attendees will join in a reading of In C using available web-enabled devices as musical instruments. We hope to demonstrate an accessible music-technology experience that relies on face-to-face interaction within a shared space. In this all-electronic implementation, no special musical or technical expertise is required.

Fixing Your Own Smells: Adding A Mistake-Based Familiarization Step When Teaching Code Refactoring, Ivan Wei Han Tan, Christopher M. Poskitt

Research Collection School Of Computing and Information Systems

Programming problems can be solved in a multitude of functionally correct ways, but the quality of these solutions (e.g. readability, maintainability) can vary immensely. When code quality is poor, symptoms emerge in the form of 'code smells', which are specific negative characteristics (e.g. duplicate code) that can be resolved by applying refactoring patterns. Many undergraduate computing curricula train students on this software engineering practice, often doing so via exercises on unfamiliar instructor-provided code. Our observation, however, is that this makes it harder for novices to internalise refactoring as part of their own development practices. In this paper, we propose a …

Ur2m: Uncertainty And Resource-Aware Event Detection On Microcontrollers, Hong Jia, Young D. Kwon, Dong Ma, Nhat Pham, Lorena Qendro, Tam Vu, Cecilia Mascolo

Research Collection School Of Computing and Information Systems

Traditional machine learning techniques are prone to generating inaccurate predictions when confronted with shifts in the distribution of data between the training and testing phases. This vulnerability can lead to severe consequences, especially in applications such as mobile healthcare. Uncertainty estimation has the potential to mitigate this issue by assessing the reliability of a model's output. However, existing uncertainty estimation techniques often require substantial computational resources and memory, making them impractical for implementation on microcontrollers (MCUs). This limitation hinders the feasibility of many important on-device wearable event detection (WED) applications, such as heart attack detection. In this paper, we present …

Self-Admitted Technical Debts Identification: How Far Are We?, Hao Gu, Shichao Zhang, Qiao Huang, Zhifang Liao, Jiakun Liu, David Lo

Research Collection School Of Computing and Information Systems

Self-admitted technical debt (SATD) is a kind of technical debt that is already acknowledged by the developers and needs additional work or resources to address in the future. In recent years, though many methods have been proposed to detect SATDs, these methods have mainly focused on Java-type code comments published by Maldonado et al. It is unclear whether these methods trained on Maldonado's code comments dataset can find SATD in other programming languages or other software artifacts, such as issue trackers, pull requests, and commit messages effectively. In order to answer the above confusion and investigate how far our community …

Application Of Collaborative Learning Paradigms Within Software Engineering Education: A Systematic Mapping Study, Rita Garcia, Christoph Treude, Andrew Valentine

Research Collection School Of Computing and Information Systems

Collaboration is used in Software Engineering (SE) to develop software. Industry seeks SE graduates with collaboration skills to contribute to productive software development. SE educators can use Collaborative Learning (CL) to help students develop collaboration skills. This paper uses a Systematic Mapping Study (SMS) to examine the application of the CL educational theory in SE Education. The SMS identified 14 papers published between 2011 and 2022. We used qualitative analysis to classify the papers into four CL paradigms: Conditions, Effect, Interactions, and Computer-Supported Collaborative Learning (CSCL). We found a high interest in CSCL, with a shift in student interaction research …

Understanding Newcomers' Onboarding Process In Deep Learning Projects, Junxiao Han, Jiahao Zhang, David Lo, Xin Xia, Shuigang Deng, Minghui Wu

Research Collection School Of Computing and Information Systems

Attracting and retaining newcomers are critical for the sustainable development of Open Source Software (OSS) projects. Considerable efforts have been made to help newcomers identify and overcome barriers in the onboarding process. However, fewer studies focus on newcomers’ activities before their successful onboarding. Given the rising popularity of deep learning (DL) techniques, we wonder what the onboarding process of DL newcomers is, and if there exist commonalities or differences in the onboarding process for DL and non-DL newcomers. Therefore, we reported a study to understand the growth trends of DL and non-DL newcomers, mine DL and non-DL newcomers’ activities before …

Ditmos: Delving Into Diverse Tiny-Model Selection On Microcontrollers, Xiao Ma, Shengfeng He, Hezhe Qiao, Dong Ma

Research Collection School Of Computing and Information Systems

Enabling efficient and accurate deep neural network (DNN) inference on microcontrollers is non-trivial due to the constrained on-chip resources. Current methodologies primarily focus on compressing larger models yet at the expense of model accuracy. In this paper, we rethink the problem from the inverse perspective by constructing small/weak models directly and improving their accuracy. Thus, we introduce DiTMoS, a novel DNN training and inference framework with a selectorclassifiers architecture, where the selector routes each input sample to the appropriate classifier for classification. DiTMoS is grounded on a key insight: a composition of weak models can exhibit high diversity and the …

Attack As Detection: Using Adversarial Attack Methods To Detect Abnormal Examples, Zhe Zhao, Guangke Chen, Tong Liu, Taishan Li, Fu Song, Jingyi Wang, Jun Sun

Research Collection School Of Computing and Information Systems

As a new programming paradigm, deep learning (DL) has achieved impressive performance in areas such as image processing and speech recognition, and has expanded its application to solve many real-world problems. However, neural networks and DL are normally black-box systems; even worse, DL-based software are vulnerable to threats from abnormal examples, such as adversarial and backdoored examples constructed by attackers with malicious intentions as well as unintentionally mislabeled samples. Therefore, it is important and urgent to detect such abnormal examples. Although various detection approaches have been proposed respectively addressing some specific types of abnormal examples, they suffer from some limitations; …

Xfuzz: Machine Learning Guided Cross-Contract Fuzzing, Yinxing Xue, Jiaming Ye, Wei Zhang, Jun Sun, Lei Ma, Haijun Wang, Jianjun Zhao

Research Collection School Of Computing and Information Systems

Smart contract transactions are increasingly interleaved by cross-contract calls. While many tools have been developed to identify a common set of vulnerabilities, the cross-contract vulnerability is overlooked by existing tools. Cross-contract vulnerabilities are exploitable bugs that manifest in the presence of more than two interacting contracts. Existing methods are however limited to analyze a maximum of two contracts at the same time. Detecting cross-contract vulnerabilities is highly non-trivial. With multiple interacting contracts, the search space is much larger than that of a single contract. To address this problem, we present xFuzz , a machine learning guided smart contract fuzzing framework. …

Pa2blo: Low-Power, Personalized Audio Badge, Hemanth Sabbella, Dulaj Sanjaya Weerakoon, Manoj Gulati, Archan Misra

Research Collection School Of Computing and Information Systems

We present the hardware design and software pipeline for an ultra-low power device, in the form factor of a wearable badge, that supports energy efficient sensing, processing and wireless transfer of human voice commands and interactions. The proposed system, called PA2BLO, is envisioned to support both: (a) real-time, scalable, authorized voice based interaction and control of devices and appliances, and (b) longitudinal, low-power logging of natural voice interactions. PA2BLO in-troduces two key novel capabilities. First, it includes a low power, low-complexity voice authentication module that is able to reliably authenticate an authorized user only using low sampling rate (500 Hz) …

Representation Learning For Stack Overflow Posts: How Far Are We?, Junda He, Xin Zhou, Bowen Xu, Ting Zhang, Kisub Kim, Zhou Yang, Thung Ferdian, Ivana Clairine Irsan, David Lo

Research Collection School Of Computing and Information Systems

The tremendous success of Stack Overflow has accumulated an extensive corpus of software engineering knowledge, thus motivating researchers to propose various solutions for analyzing its content. The performance of such solutions hinges significantly on the selection of representation models for Stack Overflow posts. As the volume of literature on Stack Overflow continues to burgeon, it highlights the need for a powerful Stack Overflow post representation model and drives researchers’ interest in developing specialized representation models that can adeptly capture the intricacies of Stack Overflow posts. The state-of-the-art (SOTA) Stack Overflow post representation models are Post2Vec and BERTOverflow, which are built …

Demystifying Faulty Code: Step-By-Step Reasoning For Explainable Fault Localization, Ratnadira Widyasari, Jia Wei Ang, Truong Giang Nguyen, Neil Sharma, David Lo

Research Collection School Of Computing and Information Systems

Fault localization is a critical process that involves identifying specific program elements responsible for program failures. Manually pinpointing these elements, such as classes, methods, or statements, which are associated with a fault is laborious and time-consuming. To overcome this challenge, various fault localization tools have been developed. These tools typically generate a ranked list of suspicious program elements. However, this information alone is insufficient. A prior study emphasized that automated fault localization should offer a rationale. In this study, we investigate the step-by-step reasoning for explainable fault localization. We explore the potential of Large Language Models (LLM) in assisting developers …

Sustainability Forecasting For Deep Learning Packages, Junxiao Han, Yunkun Wang, Zhongxin Liu, Lingfeng Bao, Jiakun Liu, David Lo, Shuiguang Deng

Research Collection School Of Computing and Information Systems

Deep Learning (DL) technologies have been widely adopted to tackle various tasks. In this process, through software dependencies, a multi-layer DL supply chain (SC) is formed, with DL frameworks acting as the root, DL packages acting as the bridge nodes, and downstream DL projects acting as the periphery. However, most Open Source Software (OSS) projects may fail. Considering the crucial position of DL packages in the DL SC, to foster the sustainable development of DL SCs and DL packages, we aim to forecast the long-term sustainability of DL packages. Here, sustained activity is adopted as the main proxy of sustainability, …

Improving Automatic Transcription Using Natural Language Processing, Anna Kiefer

Master's Theses

Digital Democracy is a CalMatters and California Polytechnic State University initia-
tive to promote transparency in state government by increasing access to the Califor-
nia legislature. While Digital Democracy is made up of many resources, one founda-
tional step of the project is obtaining accurate, timely transcripts of California Senate
and Assembly hearings. The information extracted from these transcripts provides
crucial data for subsequent steps in the pipeline. In the context of Digital Democracy,
upleveling is when humans verify, correct, and annotate the transcript results after
the legislative hearings have been automatically transcribed. The upleveling process
is done with the …

Delving Into Multimodal Prompting For Fine-Grained Visual Classification, Xin Jiang, Hao Tang, Junyao Gao, Xiaoyu Du, Shengfeng He, Zechao Li

Research Collection School Of Computing and Information Systems

Fine-grained visual classification (FGVC) involves categorizing fine subdivisions within a broader category, which poses challenges due to subtle inter-class discrepancies and large intra-class variations. However, prevailing approaches primarily focus on uni-modal visual concepts. Recent advancements in pre-trained vision-language models have demonstrated remarkable performance in various high-level vision tasks, yet the applicability of such models to FGVC tasks remains uncertain. In this paper, we aim to fully exploit the capabilities of cross-modal description to tackle FGVC tasks and propose a novel multimodal prompting solution, denoted as MP-FGVC, based on the contrastive language-image pertaining (CLIP) model. Our MP-FGVC comprises a multimodal prompts …

Broadening Participation Of Teachers In Computing: Examining Postsecondary Educational Experiences And Prospective Educators’ Cs Teaching Interests, Robert Schwarzhaupt, Alexsandra Galanis, Joanna Goode, Kate Blanchard, Jill Bowdon, Joseph P. Wilson

Journal of Computer Science Integration

Teacher shortages in K–12 computer science (CS) education negatively impact students’ access to CS courses, exposure to CS concepts, and interest in CS-related careers. To address CS teacher shortages, this study seeks to understand factors related to expressing a preference to teach CS among prospective teachers. The study team analyzed data from 27,700 prospective teacher applications accepted into the 2016–2020 Teach For America (TFA) corps (cohorts). The TFA corps is an alternative teacher development program that recruits and prepares participants to obtain their teaching certification while they work for at least two years in underserved communities on a temporary teaching …

Better Pay Attention Whilst Fuzzing, Shunkai Zhu, Jingyi Wang, Jun Sun, Jie Yang, Xingwei Lin, Tianyi Wang, Liyi Zhang, Peng Cheng

Research Collection School Of Computing and Information Systems

Fuzzing is one of the prevailing methods for vulnerability detection. However, even state-of-the-art fuzzing methods become ineffective after some period of time, i.e., the coverage hardly improves as existing methods are ineffective to focus the attention of fuzzing on covering the hard-to-trigger program paths. In other words, they cannot generate inputs that can break the bottleneck due to the fundamental difficulty in capturing the complex relations between the test inputs and program coverage. In particular, existing fuzzers suffer from the following main limitations: 1) lacking an overall analysis of the program to identify the most “rewarding” seeds, and 2) lacking …

Detecting Outdated Code Element References In Software Repository Documentation, Wen Siang Tan, Markus Wagner, Christoph Treude

Research Collection School Of Computing and Information Systems

Outdated documentation is a pervasive problem in software development, preventing effective use of software, and misleading users and developers alike. We posit that one possible reason why documentation becomes out of sync so easily is that developers are unaware of when their source code modifications render the documentation obsolete. Ensuring that the documentation is always in sync with the source code takes considerable effort, especially for large codebases. To address this situation, we propose an approach that can automatically detect code element references that survive in the documentation after all source code instances have been deleted. In this work, we …

Mutation Analysis For Evaluating Code Translation, Giovani Guizzo, Jie M. Zhang, Federica Sarro, Christoph Treude, Mark Harman

Research Collection School Of Computing and Information Systems

Source-to-source code translation automatically translates a program from one programming language to another. The existing research on code translation evaluates the effectiveness of their approaches by using either syntactic similarities (e.g., BLEU score), or test execution results. The former does not consider semantics, the latter considers semantics but falls short on the problem of insufficient data and tests. In this paper, we propose MBTA (Mutation-based Code Translation Analysis), a novel application of mutation analysis for code translation assessment. We also introduce MTS (Mutation-based Translation Score), a measure to compute the level of trustworthiness of a translator. If a mutant of …

The Aim To Decentralize Economic Systems With Blockchains And Crypto, Mary Lacity

Arkansas Law Review

As an information systems (“IS”) professor, I wrote this Article for legal professionals new to blockchains and crypto. This target audience likely is most interested in crypto for its legal implications—depending on whether it functions as currencies, securities, commodities, or properties; however, legal professionals also need to understand crypto’s origin, how transactions work, and how they are governed.

Piecing Together Performance: Collaborative, Participatory Research-Through-Design For Better Diversity In Games, Daniel L. Gardner, Louanne Boyd, Reginald T. Gardner

Engineering Faculty Articles and Research

Digital games are a multi-billion-dollar industry whose production and consumption extend globally. Representation in games is an increasingly important topic. As those who create and consume the medium grow ever more diverse, it is essential that player or user-experience research, usability, and any consideration of how people interface with their technology is exercised through inclusive and intersectional lenses. Previous research has identified how character configuration interfaces preface white-male defaults [39, 40, 67]. This study relies on 1-on-1 play-interviews where diverse participants attempt to create “themselves” in a series of games and on group design activities to explore how participants may …

Weed Seed Wizard Case Study - An Early Harvest Versus A Late Harvest, Department Of Primary Industries And Regional Development, Western Australia

Biosecurity research reports

The Weed Seed Wizard is a national collaborative project that uses paddock management information to predict weed emergence and crop losses now and in the future.

The Weed Seed Wizard is a computer simulation tool that:

• applies to all Australian grain growing areas

• helps growers understand and manage weed seedbanks on their farms

• uses farm management records to simulate how different crop rotations, weed control techniques, irrigation, grazing and harvest management tactics can affect weed numbers, the weed seedbank and yields

• uses farm-specific management and site-specific weather

• is multi-species

See www.dpird.wa.gov.au for further information on Weed Seed Wizard.

This case …