Software Engineering Commons^™

Lightweight And Non-Invasive User Authentication On Earables, Changshuo Hu, Xiao Ma, Dong Ma, Ting Dang

Research Collection School Of Computing and Information Systems

The widespread adoption of wireless earbuds has advanced the developments in earable-based sensing in various domains like entertainment, human-computer interaction, and health monitoring. Recently, researchers have shown an increased interest in user authentication using earables. Despite the successes witnessed in acoustic probing and speech based authentication systems, this paper proposed a lightweight and non-invasive ambient sound based user authentication scheme. It employs the difference between the in-ear and out-ear sounds to estimate the individual-specific occluded ear canal transfer function (OECTF). Specifically, the {out-ear, in-ear} scaling factors at different frequency bands are captured via linear regression and treated as the OECTF …

Fortifying The Seams Of Software Systems, Hong Jin Kang

Dissertations and Theses Collection (Open Access)

A seam in software is a place where two components within a software system meet. There are more seams in software now than ever before as modern software systems rely extensively on third-party software components, e.g., libraries. Due to the increasing complexity of software systems, understanding and improving the reliability of these components and their use is crucial. While the use of software components eases the development process, it also introduces challenges due to the interaction between the components.

This dissertation tackles problems associated with software reliability when using third-party software components. Developers write programs that interact with libraries through …

I Know What You Are Searching For: Code Snippet Recommendation From Stack Overflow Posts, Zhipeng Gao, Xin Xia, David Lo, John C. Grundy, Xindong Zhang, Zhenchang Xing

Research Collection School Of Computing and Information Systems

Stack Overflow has been heavily used by software developers to seek programming-related information. More and more developers use Community Question and Answer forums, such as Stack Overflow, to search for code examples of how to accomplish a certain coding task. This is often considered to be more efficient than working from source documentation, tutorials, or full worked examples. However, due to the complexity of these online Question and Answer forums and the very large volume of information they contain, developers can be overwhelmed by the sheer volume of available information. This makes it hard to find and/or even be aware …

Monadic Second-Order Incorrectness Logic For Gp 2, Christopher M. Poskitt, Detlef Plump

Research Collection School Of Computing and Information Systems

Program logics typically reason about an over-approximation of program behaviour to prove the absence of bugs. Recently, program logics have been proposed that instead prove the presence of bugs by means of under-approximate reasoning, which has the promise of better scalability. In this paper, we present an under-approximate program logic for GP 2, a rule-based programming language for manipulating graphs. We define the proof rules of this program logic extensionally, i.e. independently of fixed assertion languages, then instantiate them with a morphism-based assertion language able to specify monadic second-order properties on graphs (e.g. path properties). We show how these proof …

Sleepmore: Inferring Sleep Duration At Scale Via Multi-Device Wifi Sensing, Camellia Zakaria, Gizem Yilmaz, Priyanka Mammen, Michael Chee, Prashant Shenoy, Rajesh Krishna Balan

Research Collection School Of Computing and Information Systems

The availability of commercial wearable trackers equipped with features to monitor sleep duration and quality has enabled more useful sleep health monitoring applications and analyses. However, much research has reported the challenge of long-term user retention in sleep monitoring through these modalities. Since modern Internet users own multiple mobile devices, our work explores the possibility of employing ubiquitous mobile devices and passive WiFi sensing techniques to predict sleep duration as the fundamental measure for complementing long-term sleep monitoring initiatives. In this paper, we propose SleepMore, an accurate and easy-to-deploy sleep-tracking approach based on machine learning over the user's WiFi network …

Achieving High Map-Coverage Through Pattern Constraint Reduction, Yingquan Zhao, Zan Wang, Shuang Liu, Jun Sun, Junjie Chen, Xiang Chen

Research Collection School Of Computing and Information Systems

Testing multi-threaded programs is challenging due to the enormous space of thread interleavings. Recently, a code coverage criterion for multi-threaded programs called MAP-coverage has been proposed and shown to be effective for testing concurrent programs. Existing approaches for achieving high MAP-coverage are based on random testing with simple heuristics, which is ineffective in systematically triggering rare thread interleavings. In this study, we propose a novel approach called pattern constraint reduction (PCR), which employs optimized constraint solving to generate thread interleavings for high MAP-coverage. The idea is to iteratively encode and solve path conditions to generate thread interleavings which are guaranteed …

Demonstrating Multi-Modal Human Instruction Comprehension With Ar Smart Glass, Mudiyanselage Dulanga Kaveesha Weerakoon, Vigneshwaran Subbaraju, Tuan Tran, Archan Misra

Research Collection School Of Computing and Information Systems

We present a multi-modal human instruction comprehension prototype for object acquisition tasks that involve verbal, visual and pointing gesture cues. Our prototype includes an AR smart-glass for issuing the instructions and a Jetson TX2 pervasive device for executing comprehension algorithms. With this setup, we enable on-device, computationally efficient object acquisition task comprehension with an average latency in the range of 150-330msec.

Just-In-Time Obsolete Comment Detection And Update, Zhongxin Liu, Xin Xia, David Lo, Meng Yan, Shangping Li

Research Collection School Of Computing and Information Systems

Comments are valuable resources for the development, comprehension and maintenance of software. However, while changing code, developers sometimes neglect the evolution of the corresponding comments, resulting in obsolete comments. Such obsolete comments can mislead developers and introduce bugs in the future, and are therefore detrimental. We notice that by detecting and updating obsolete comments in time with code changes, obsolete comments can be effectively reduced and even avoided. We refer to this task as Just-In-Time (JIT) Obsolete Comment Detection and Update. In this work, we propose a two-stage framework named CUP2 (Two-stage Comment UPdater) to automate this task. CUP2 consists …

Opportunities And Challenges In Code Search Tools, Chao Liu, Xin Xia, David Lo, Cuiying Gao, Xiaohu Yang, John Grundy

Research Collection School Of Computing and Information Systems

Code search is a core software engineering task. Effective code search tools can help developers substantially improve their software development efficiency and effectiveness. In recent years, many code search studies have leveraged different techniques, such as deep learning and information retrieval approaches, to retrieve expected code from a large-scale codebase. However, there is a lack of a comprehensive comparative summary of existing code search approaches. To understand the research trends in existing code search studies, we systematically reviewed 81 relevant studies. We investigated the publication trends of code search studies, analyzed key components, such as codebase, query, and modeling technique …

Differentiated Security Architecture For Secure And Efficient Infotainment Data Communication In Iov Networks, Jiani Fan, Lwin Khin Shar, Jiale Guo, Wenzhuo Yang, Dusit Niyato, Kwok-Yan Lam

Research Collection School Of Computing and Information Systems

This paper aims to provide differentiated security protection for infotainment data commu- nication in Internet-of-Vehicle (IoV) networks. The IoV is a network of vehicles that uses various sensors, software, built-in hardware, and communication technologies to enable information exchange between pedestrians, cars, and urban infrastructure. Negligence on the security of infotainment data commu- nication in IoV networks can unintentionally open an easy access point for social engineering attacks. The attacker can spread false information about traffic conditions, mislead drivers in their directions, and interfere with traffic management. Such attacks can also cause distractions to the driver, which has a potential implication …

Biasfinder: Metamorphic Test Generation To Uncover Bias For Sentiment Analysis Systems, Muhammad Hilmi Asyrofi, Zhou Yang, Imam Nur Bani Yusuf, Hong Jin Kang, Thung Ferdian, David Lo

Research Collection School Of Computing and Information Systems

Artificial intelligence systems, such as Sentiment Analysis (SA) systems, typically learn from large amounts of data that may reflect human bias. Consequently, such systems may exhibit unintended demographic bias against specific characteristics (e.g., gender, occupation, country-of-origin, etc.). Such bias manifests in an SA system when it predicts different sentiments for similar texts that differ only in the characteristic of individuals described. To automatically uncover bias in SA systems, this paper presents BiasFinder, an approach that can discover biased predictions in SA systems via metamorphic testing. A key feature of BiasFinder is the automatic curation of suitable templates from any given …

Deep Just-In-Time Defect Localization, Fangcheng Qiu, Zhipeng Gao, Xin Xia, David Lo, John Grundy, Xinyu Wang

Research Collection School Of Computing and Information Systems

During software development and maintenance, defect localization is an essential part of software quality assurance. Even though different techniques have been proposed for defect localization, i.e., information retrieval (IR)-based techniques and spectrum-based techniques, they can only work after the defect has been exposed, which can be too late and costly to adapt to the newly introduced bugs in the daily development. There are also many JIT defect prediction tools that have been proposed to predict the buggy commit. But these tools do not locate the suspicious buggy positions in the buggy commit. To assist developers to detect bugs in time …

Quote: Quality-Oriented Testing For Deep Learning Systems, Jialuo Chen, Jingyi Wang, Xingjun Ma, Youcheng Sun, Jun Sun, Peixin Zhang, Peng Cheng

Research Collection School Of Computing and Information Systems

Recently, there has been a significant growth of interest in applying software engineering techniques for the quality assurance of deep learning (DL) systems. One popular direction is deep learning testing, i.e., given a property of test, defects of DL systems are found either by fuzzing or guided search with the help of certain testing metrics. However, recent studies have revealed that the neuron coverage metrics, commonly used by most existing DL testing approaches, are not necessarily correlated with model quality (e.g., robustness, the most studied model property), and are also not an effective measurement on the confidence of the model …

How Developers Engineer Test Cases: An Observational Study, Maurício Aniche, Christoph Treude, Andy Zaidman

Research Collection School Of Computing and Information Systems

One of the main challenges that developers face when testing their systems lies in engineering test cases that are good enough to reveal bugs. And while our body of knowledge on software testing and automated test case generation is already quite significant, in practice, developers are still the ones responsible for engineering test cases manually. Therefore, understanding the developers’ thought- and decision-making processes while engineering test cases is a fundamental step in making developers better at testing software. In this paper, we observe 13 developers thinking-aloud while testing different real-world open-source methods, and use these observations to explain how developers …

Dronlomaly: Runtime Detection Of Anomalous Drone Behaviors Via Log Analysis And Deep Learning, Lwin Khin Shar, Wei Minn, Nguyen Binh Duong Ta, Jianli Fan, Lingxiao Jiang, Daniel Wai Kiat Lim

Research Collection School Of Computing and Information Systems

Drones are increasingly popular and getting used in a variety of missions such as area surveillance, pipeline inspection, cinematography, etc. While the drone is conducting a mission, anomalies such as sensor fault, actuator fault, configuration errors, bugs in controller program, remote cyber- attack, etc., may affect the drone’s physical stability and cause serious safety violations such as crashing into the public. During a flight mission, drones typically log flight status and state units such as GPS coordinates, actuator outputs, accelerator readings, gyroscopic readings, etc. These log data may reflect the above-mentioned anomalies. In this paper, we propose a novel, deep …

How To Formulate Specific How-To Questions In Software Development?, Mingwei Liu, Xin Peng, Andrian Marcus, Christoph Treude, Jiazhan Xie, Huanjun Xu, Yanjun Yang

Research Collection School Of Computing and Information Systems

Developers often ask how-to questions using search engines, technical Q&A communities, and interactive Q&A systems to seek help for specific programming tasks. However, they often do not formulate the questions in a specific way, making it hard for the systems to return the best answers. We propose an approach (TaskKG4Q) that interactively helps developers formulate a programming related how-to question. TaskKG4Q is using a programming task knowledge graph (task KG in short) mined from Stack Overflow questions, which provides a hierarchical conceptual structure for tasks in terms of [actions], [objects], and [constraints]. An empirical evaluation of the intrinsic quality of …

Real World Projects, Real Faults: Evaluating Spectrum Based Fault Localization Techniques On Python Projects, Ratnadira Widyasari, Gede Artha Azriadi Prana, Stefanus Agus Haryono, Shaowei Wang, David Lo

Research Collection School Of Computing and Information Systems

Spectrum Based Fault Localization (SBFL) is a statistical approach to identify faulty code within a program given a program spectra (i.e., records of program elements executed by passing and failing test cases). Several SBFL techniques have been proposed over the years, but most evaluations of those techniques were done only on Java and C programs, and frequently involve artificial faults. Considering the current popularity of Python, indicated by the results of the Stack Overflow survey among developers in 2020, it becomes increasingly important to understand how SBFL techniques perform on Python projects. However, this remains an understudied topic. In this …

Itiger: An Automatic Issue Title Generation Tool, Ting Zhang, Ivana Clairine Irsan, Thung Ferdian, Donggyun Han, David Lo, Lingxiao Jiang

Research Collection School Of Computing and Information Systems

In both commercial and open-source software, bug reports or issues are used to track bugs or feature requests. However, the quality of issues can differ a lot. Prior research has found that bug reports with good quality tend to gain more attention than the ones with poor quality. As an essential component of an issue, title quality is an important aspect of issue quality. Moreover, issues are usually presented in a list view, where only the issue title and some metadata are present. In this case, a concise and accurate title is crucial for readers to grasp the general concept …

An Empirical Study Of Blockchain System Vulnerabilities: Modules, Types, And Patterns, Xiao Yi, Daoyuan Wu, Lingxiao Jiang, Yuzhou Fang, Kehuan Zhang, Wei Zhang

Research Collection School Of Computing and Information Systems

Blockchain, as a distributed ledger technology, becomes increasingly popular, especially for enabling valuable cryptocurrencies and smart contracts. However, the blockchain software systems inevitably have many bugs. Although bugs in smart contracts have been extensively investigated, security bugs of the underlying blockchain systems are much less explored. In this paper, we conduct an empirical study on blockchain’s system vulnerabilities from four representative blockchains, Bitcoin, Ethereum, Monero, and Stellar. Specifically, we first design a systematic filtering process to effectively identify 1,037 vulnerabilities and their 2,317 patches from 34,245 issues/PRs (pull requests) and 85,164 commits on GitHub. We thus build the first blockchain …

Context-Aware Code Recommendation In Intellij Idea, Shamsa Abid, Hamid Abdul Basit, Shafay Shamail

Research Collection School Of Computing and Information Systems

Developers spend a lot of time online, searching for code to help them implement their desired features. While code recommenders help improve developers’ productivity, there is currently no support for context-aware code recommendation for opportunistic code reuse on-the-go. Typical code recommendation systems provide recommendations against a search query, whereas a code recommender that supports opportunistic reuse can recommend related code snippets that represent features that the developer may want to implement next. In this paper, we present a novel Context-aware Feature-driven API usage-based Code Recommender (CA-FACER) tool, which is an Intellij IDEA plugin that leverages a developer’s development context to …

Predictive Self-Organizing Neural Networks For In-Home Detection Of Mild Cognitive Impairment, Seng Khoon Teh, Iris Rawtaer, Ah-Hwee Tan

Research Collection School Of Computing and Information Systems

In-home sensing of daily living patterns from older adults coupled with machine learning is a promisingapproach to detect Mild Cognitive Impairment (MCI), a potentially reversible condition with early detectionand appropriate intervention. However, the number of subjects involved in such real-world studies istypically limited, posing the so-called small data problem to most predictive models which rely on a sizablenumber of labeled data. In this work, a predictive self-organizing neural network known as fuzzy AdaptiveResonance Associate Map (fuzzy ARAM) is proposed to detect MCI using in-home sensor data collected from aunique Singapore cross-sectional study. Specifically, mean and standard deviation of nine in-home …

Adaptive Fairness Improvement Based Causality Analysis, Mengdi Zhang, Jun Sun

Research Collection School Of Computing and Information Systems

Given a discriminating neural network, the problem of fairness improvement is to systematically reduce discrimination without significantly scarifies its performance (i.e., accuracy). Multiple categories of fairness improving methods have been proposed for neural networks, including pre-processing, in-processing and postprocessing. Our empirical study however shows that these methods are not always effective (e.g., they may improve fairness by paying the price of huge accuracy drop) or even not helpful (e.g., they may even worsen both fairness and accuracy). In this work, we propose an approach which adaptively chooses the fairness improving method based on causality analysis. That is, we choose the …

Large-Scale Analysis Of Non-Termination Bugs In Real-World Oss Projects, Xiuhan Shi, Xiaofei Xie, Yi Li, Yao Zhang, Sen Chen, Xiaohong Li

Research Collection School Of Computing and Information Systems

Termination is a crucial program property. Non-termination bugs can be subtle to detect and may remain hidden for long before they take effect. Many real-world programs still suffer from vast consequences (e.g., no response) caused by non-termination bugs. As a classic problem, termination proving has been studied for many years. Many termination checking tools and techniques have been developed and demonstrated effectiveness on existing wellestablished benchmarks. However, the capability of these tools in finding practical non-termination bugs has yet to be tested on real-world projects. To fill in this gap, in this paper, we conducted the first large-scale empirical study …

Mando-Guru: Vulnerability Detection For Smart Contract Source Code By Heterogeneous Graph Embeddings, Huu Hoang Nguyen, Nhat Minh Nguyen, Hong-Phuc Doan, Zahrai Ahmadi, Thanh Nam Doan, Lingxiao Jiang

Research Collection School Of Computing and Information Systems

Smart contracts are increasingly used with blockchain systems for high-value applications. It is highly desired to ensure the quality of smart contract source code before they are deployed. This paper proposes a new deep learning-based tool, MANDO-GURU, that aims to accurately detect vulnerabilities in smart contracts at both coarse-grained contract-level and fine-grained line-level. Using a combination of control-flow graphs and call graphs of Solidity code, we design new heterogeneous graph attention neural networks to encode more structural and potentially semantic relations among different types of nodes and edges of such graphs and use the encoded embeddings of the graphs and …

Codematcher: A Tool For Large-Scale Code Search Based On Query Semantics Matching, Chao Liu, Xuanlin Bao, Xin Xia, Meng Yan, David Lo, Ting Zhang

Research Collection School Of Computing and Information Systems

Due to the emergence of large-scale codebases, such as GitHub and Gitee, searching and reusing existing code can help developers substantially improve software development productivity. Over the years, many code search tools have been developed. Early tools leveraged the information retrieval (IR) technique to perform an efficient code search for a frequently changed large-scale codebase. However, the search accuracy was low due to the semantic mismatch between query and code. In the recent years, many tools leveraged Deep Learning (DL) technique to address this issue. But the DL-based tools are slow and the search accuracy is unstable.In this paper, we …

Autopruner: Transformer-Based Call Graph Pruning, Cong Thanh Le, Hong Jin Kang, Truong Giang Nguyen, Stefanus Agus Haryono, David Lo, Xuan-Bach D. Le, Huynh Quyet Thang

Research Collection School Of Computing and Information Systems

Constructing a static call graph requires trade-offs between soundness and precision. Program analysis techniques for constructing call graphs are unfortunately usually imprecise. To address this problem, researchers have recently proposed call graph pruning empowered by machine learning to post-process call graphs constructed by static analysis. A machine learning model is built to capture information from the call graph by extracting structural features for use in a random forest classifier. It then removes edges that are predicted to be false positives. Despite the improvements shown by machine learning models, they are still limited as they do not consider the source code …

In War And Peace: The Impact Of World Politics On Software Ecosystems, Raula Kula, Christoph Treude

Research Collection School Of Computing and Information Systems

Reliance on third-party libraries is now commonplace in contemporary software engineering. Being open source in nature, these libraries should advocate for a world where the freedoms and opportunities of open source software can be enjoyed by all. Yet, there is a growing concern related to maintainers using their influence to make political stances (i.e., referred to as protestware). In this paper, we reflect on the impact of world politics on software ecosystems, especially in the context of the ongoing War in Ukraine. We show three cases where world politics has had an impact on a software ecosystem, and how these …

A Fine-Grained Data Set And Analysis Of Tangling In Bug Fixing Commits, Steffen Herbold, Alexander Trautsch, Benjamin Ledel, Alireza Aghamohammadi, Taher Ahmed Ghaleb, Kuljit Kaur Chahal, Tim Bossenmaier, Bhaveet Nagaria, Philip Makedonski, Matin Nili Ahmadabadi, Kristóf Szabados, Helge Spieker, Matej Madeja, Nathaniel G. Hoy, Christoph Treude, Shangwen Wang, Gema Rodríguez-Pérez, Ricardo Colomo-Palacios, Roberto Verdecchia, Paramvir Singh

Research Collection School Of Computing and Information Systems

Context: Tangled commits are changes to software that address multiple concerns at once. For researchers interested in bugs, tangled commits mean that they actually study not only bugs, but also other concerns irrelevant for the study of bugs.Objective: We want to improve our understanding of the prevalence of tangling and the types of changes that are tangled within bug fixing commits.Methods: We use a crowd sourcing approach for manual labeling to validate which changes contribute to bug fixes for each line in bug fixing commits. Each line is labeled by four participants. If at least three participants agree on the …

Which Neural Network Makes More Explainable Decisions? An Approach Towards Measuring Explainability, Mengdi Zhang, Jun Sun, Jingyi Wang

Research Collection School Of Computing and Information Systems

Neural networks are getting increasingly popular thanks to their exceptional performance in solving many real-world problems. At the same time, they are shown to be vulnerable to attacks, difficult to debug and subject to fairness issues. To improve people’s trust in the technology, it is often necessary to provide some human-understandable explanation of neural networks’ decisions, e.g., why is that my loan application is rejected whereas hers is approved? That is, the stakeholder would be interested to minimize the chances of not being able to explain the decision consistently and would like to know how often and how easy it …

Api-Related Developer Information Needs In Stack Overflow, Mingwei Liu, Xin Peng, Andrian Marcus, Shuangshuang Xing, Christoph Treude, Chengyuan Zhao

Research Collection School Of Computing and Information Systems

Stack Overflow (SO) provides informal documentation for APIs in response to questions that express API related developer needs. Navigating the information available on SO and getting information related to a particular API and need is challenging due to the vast amount of questions and answers and the tag-driven structure of SO. In this paper we focus on identifying and classifying fine-grained developer needs expressed in sentences of API-related SO questions, as well as the specific information types used to express such needs, and the different roles APIs play in these questions and their answers. We derive a taxonomy, complementing existing …