Software Engineering Commons^™

Smart Contract Development: Challenges And Opportunities, Weiqin Zou, David Lo, Pavneet Singh Kochhar, Xuan-Bach D. Le, Xin Xia, Yang Feng, Zhenyu Chen, Baowen Xu

Research Collection School Of Computing and Information Systems

Smart contract, a term which was originally coined to refer to the automation of legal contracts in general, has recently seen much interest due to the advent of blockchain technology. Recently, the term is popularly used to refer to low-level code scripts running on a blockchain platform. Our study focuses exclusively on this subset of smart contracts. Such smart contracts have increasingly been gaining ground, finding numerous important applications (e.g., crowdfunding) in the real world. Despite the increasing popularity, smart contract development still remains somewhat a mystery to many developers largely due to its special design and applications. Are there …

Taxthemis: Interactive Mining And Exploration Of Suspicious Tax Evasion Group, Yating Lin, Kamkwai Wong, Yong Wang, Rong Zhang, Bo Dong, Huamin Qu, Qinghua Zheng

Research Collection School Of Computing and Information Systems

Tax evasion is a serious economic problem for many countries, as it can undermine the government’s tax system and lead to an unfair business competition environment. Recent research has applied data analytics techniques to analyze and detect tax evasion behaviors of individual taxpayers. However, they have failed to support the analysis and exploration of the related party transaction tax evasion (RPTTE) behaviors (e.g., transfer pricing), where a group of taxpayers is involved. In this paper, we present TaxThemis, an interactive visual analytics system to help tax officers mine and explore suspicious tax evasion groups through analyzing heterogeneous tax-related data. A …

Tradao: A Visual Analytics System For Trading Algorithm Optimization, Ka Wing Tsang, Haotian Li, Fuk Ming Lam, Yifan Mu, Yong Wang, Huamin Qu

Research Collection School Of Computing and Information Systems

With the wide applications of algorithmic trading, it has become critical for traders to build a winning trading algorithm to beat the market. However, due to the lack of efficient tools, traders mainly rely on their memory to manually compare the algorithm instances of a trading algorithm and further select the best trading algorithm instance for the real trading deployment. We work closely with industry practitioners to discover and consolidate user requirements and develop an interactive visual analytics system for trading algorithm optimization. Structured expert interviews are conducted to evaluateTradAOand a representative case study is documented for illustrating the system …

Analyzing Devops Teaching Strategies: An Initial Study, Samuel Ferino, Marcelo Fernandes, Anny K. Fernandes, Uirá Kulesza, Eduardo Aranha, Christoph Treude

Research Collection School Of Computing and Information Systems

DevOps refers to a set of practices that integrate software development and operations with the primary aim to enable the continuous delivery of high-quality software. DevOps has also promoted several challenges to software engineering teaching. In this paper, we present a preliminary study that analyzes existing teaching strategies reported in the literature. Our findings indicate a set of approaches highlighting the use of environments to support teaching. Our work also investigates how these environments can contribute to address existing challenges and recommendations of DevOps teaching.

On The Usability (In)Security Of In-App Browsing Interfaces In Mobile Apps, Zicheng Zhang, Daoyuan Wu, Lixiang Li, Debin Gao

Research Collection School Of Computing and Information Systems

Due to the frequent encountering of web URLs in various application scenarios (e.g., chatting and email reading), many mobile apps build their in-app browsing interfaces (IABIs) to provide a seamless user experience. Although this achieves user-friendliness by avoiding the constant switching between the subject app and the system built-in browser apps, we find that IABIs, if not well designed or customized, could result in usability security risks. In this paper, we conduct the first empirical study on the usability (in)security of in-app browsing interfaces in both Android and iOS apps. Specifically, we collect a dataset of 25 high-profile mobile apps …

Cloud, Edge And Fog Computing: Trends And Case Studies, Eng Lieh Ouh, Stanislaw Jarzabek, Geok Shan Lim, Masayoshi Ogawa

Research Collection School Of Computing and Information Systems

As it is done today, an informal – solely based on experts’ intuition – evaluation of profitability of adopting cloud services is undependable and not scalable as there are many conflicting factors and constraints such evaluation should account for. The revenue from service tenants and the cost of implementing the service architecture are the leading service factors that drive profitability. Cloud service architectures also need to handle a growing number of tenants with increasingly diverse requirements which must be weighed against the capabilities and costs of various service architectures, particularly single- versus multi-tenanted models. We believe a conceptual model enumerating …

Assessing Generalizability Of Codebert, Xin Zhou, Donggyun Han, David Lo

Research Collection School Of Computing and Information Systems

Pre-trained models like BERT have achieved strong improvements on many natural language processing (NLP) tasks, showing their great generalizability. The success of pre-trained models in NLP inspires pre-trained models for programming language. Recently, CodeBERT, a model for both natural language (NL) and programming language (PL), pre-trained on code search dataset, is proposed. Although promising, CodeBERT has not been evaluated beyond its pre-trained dataset for NL-PL tasks. Also, it has only been shown effective on two tasks that are close in nature to its pre-trained data. This raises two questions: Can CodeBERT generalize beyond its pre-trained data? Can it generalize to …

Learning To Adversarially Blur Visual Object Tracking, Qing Guo, Ziyi Cheng, Felix Juefei-Xu, Lei Ma, Xiaofei Xie, Yang Liu, Jianjun Zhao

Research Collection School Of Computing and Information Systems

Motion blur caused by the moving of the object or camera during the exposure can be a key challenge for visual object tracking, affecting tracking accuracy significantly. In this work, we explore the robustness of visual object trackers against motion blur from a new angle, i.e., adversarial blur attack (ABA). Our main objective is to online transfer input frames to their natural motion-blurred counterparts while misleading the state-of-the-art trackers during the tracking process. To this end, we first design the motion blur synthesizing method for visual tracking based on the generation principle of motion blur, considering the motion information and …

Covid-19 One Year On: Security And Privacy Review Of Contact Tracing Mobile Apps, Wei Yang Ang, Lwin Khin Shar

Research Collection School Of Computing and Information Systems

The ongoing COVID-19 pandemic caused 3.8 million deaths since December 2019. At the current vaccination pace, this global pandemic could persist for several years. Throughout the world, contact tracing (CT) apps were developed, which play a significant role in mitigating the spread of COVID-19. This work examines the current state of security and privacy landscape of mobile CT apps. Our work is the first attempt, to our knowledge, which provides a comprehensive analysis of 70 CT apps used worldwide as of year Q1 2021. Among other findings, we observed that 80% of them may have handled sensitive data without adequate …

Contrasting Third-Party Package Management User Experience, Syful Islam, Raula Kula, Christoph Treude, Takashi Ishio, Kenichi Matsumoto

Research Collection School Of Computing and Information Systems

The management of third-party package dependencies is crucial to most technology stacks, with package managers acting as brokers to ensure that a verified package is correctly installed, configured, or removed from an application. Diversity in technology stacks has led to dozens of package ecosystems with their own management features. While recent studies have shown that developers struggle to migrate their dependencies, the common assumption is that package ecosystems are used without any issue. In this study, we explore 13 package ecosystems to understand whether their features correlate with the experience of their users. By studying experience through the questions that …

Uncovering Patterns In Reviewers' Feedback To Scene Description Authors, Rosiana Natalie, Jolene Kar Inn Loh, Huei Suen Tan, Joshua Shi-Hao Tseng, Hernisa Kacorri, Kotaro Hara

Research Collection School Of Computing and Information Systems

Audio descriptions (ADs) can increase access to videos for blind people. Researchers have explored different mechanisms for generating ADs, with some of the most recent studies involving paid novices; to improve the quality of their ADs, novices receive feedback from reviewers. However, reviewer feedback is not instantaneous. To explore the potential for real-time feedback through automation, in this paper, we analyze 1,120 comments that 40 sighted novices received from a sighted or a blind reviewer. We find that feedback patterns tend to fall under four themes: (i) Quality; commenting on different AD quality variables, (ii) Speech Act; the utterance or …

The Empathetic Car: Exploring Emotion Inference Via Driver Behaviour And Traffic Context, Shu Liu, Kevin Koch, Zimu Zhou, Simon Foll, Xiaoxi He, Tina Menke, Elgar Fleisch, Felix Wortmann

Research Collection School Of Computing and Information Systems

An empathetic car that is capable of reading the driver’s emotions has been envisioned by many car manufacturers. Emotion inference enables in-vehicle applications to improve driver comfort, well-being, and safety. Available emotion inference approaches use physiological, facial, and speech-related data to infer emotions during driving trips. However, existing solutions have two major limitations: Relying on sensors that are not built into the vehicle restricts emotion inference to those people leveraging corresponding devices (e.g., smartwatches). Relying on modalities such as facial expressions and speech raises privacy concerns. By contrast, researchers in mobile health have been able to infer affective states (e.g., …

Characterization And Automatic Updates Of Deprecated Machine-Learning Api Usages, Stefanus Agus Haryono, Thung Ferdian, David Lo, Julia Lawall, Lingxiao Jiang

Research Collection School Of Computing and Information Systems

Due to the rise of AI applications, machine learning (ML) libraries, often written in Python, have become far more accessible. ML libraries tend to be updated periodically, which may deprecate existing APIs, making it necessary for application developers to update their usages. In this paper, we build a tool to automate deprecated API usage updates. We first present an empirical study to better understand how updates of deprecated ML API usages in Python can be done. The study involves a dataset of 112 deprecated APIs from Scikit-Learn, TensorFlow, and PyTorch. Guided by the findings of our empirical study, we propose …

Biasheal: On-The-Fly Black-Box Healing Of Bias In Sentiment Analysis Systems, Zhou Yang, Harshit Jain, Jieke Shi, Muhammad Hilmi Asyrofi, David Lo

Research Collection School Of Computing and Information Systems

Although Sentiment Analysis (SA) is widely applied in many domains, existing research has revealed that the unfairness in SA systems can be harmful to the welfare of less privileged people. Several works propose pre-processing and in-processing methods to eliminate bias in SA systems, but little attention is paid to utilizing post-processing methods to heal bias. Postprocessing methods are particularly important for systems that use third-party SA services. Systems that use such services have no access to the SA engine or its training data and thus cannot apply pre-processing nor in-processing methods. Therefore, this paper proposes a black-box post-processing method to …

Which Variables Should I Log?, Zhongxin Liu, Xin Xia, David Lo, Zhenchang Xing, Ahmed E. Hassan, Shanping Li

Research Collection School Of Computing and Information Systems

Developers usually depend on inserting logging statements into the source code to collect system runtime information. Such logged information is valuable for software maintenance. A logging statement usually prints one or more variables to record vital system status. However, due to the lack of rigorous logging guidance and the requirement of domain-specific knowledge, it is not easy for developers to make proper decisions about which variables to log. To address this need, in this work, we propose an approach to recommend logging variables for developers during development by learning from existing logging statements. Different from other prediction tasks in software …

Injecting Descriptive Meta-Information Into Pre-Trained Language Models With Hypernetworks, Wenying Duan, Xiaoxi He, Zimu Zhou, Hong Rao, Lothar Thiele

Research Collection School Of Computing and Information Systems

Pre-trained language models have been widely adopted as backbones in various natural language processing tasks. However, existing pre-trained language models ignore the descriptive meta-information in the text such as the distinction between the title and the mainbody, leading to over-weighted attention to insignificant text. In this paper, we propose a hypernetwork-based architecture to model the descriptive meta-information and integrate it into pre-trained language models. Evaluations on three natural language processing tasks show that our method notably improves the performance of pre-trained language models and achieves the state-of-the-art results on keyphrase extraction.

W8-Scope: Fine-Grained, Practical Monitoring Of Weight Stack-Based Exercises, Meera Radhakrishnan, Archan Misra, Rajesh K. Balan

Research Collection School Of Computing and Information Systems

Fine-grained, unobtrusive monitoring of gym exercises can help users track their own exercise routines and also provide corrective feedback. We propose W8-Scope, a system that uses a simple magnetic-cum-accelerometer sensor, mounted on the weight stack of gym exercise machines, to infer various attributes of gym exercise behavior. More specifically, using multiple machine learning models, W8-Scope helps identify who is exercising, what exercise she is doing, how much weight she is lifting, and whether she is committing any common mistakes. Real world studies, conducted with 50 subjects performing 14 different exercises over 103 distinct sessions in two gyms, show that W8-Scope …

Learning To Interpret Knowledge From Software Q&A Sites, Bowen Xu

Dissertations and Theses Collection (Open Access)

Nowadays, software question and answer (SQA) data has become a treasure for software engineering as it contains a huge volume of programming knowledge. That knowledge can be interpreted in many different ways to support various software activities, such as code recommendation, program repair, and so on. In this dissertation, we interpret SQA data by addressing three novel research problems.

The first research problem is about linkable knowledge unit prediction. In this problem, a question and its answers within a post in Stack Overflow are considered as a knowledge unit (KU). KUs often contain semantically relevant knowledge, and thus linkable for …

Maintenance-Related Concerns For Post-Deployed Ethereum Smart Contract Development: Issues, Techniques, And Future Challenges, Jiachi Chen, Xin Xia, David Lo, John Grundy, Xiaohu Yang

Research Collection School Of Computing and Information Systems

Software development is a very broad activity that captures the entire life cycle of a software, which includes designing, programming, maintenance and so on. In this study, we focus on the maintenance-related concerns of the post-deployment of smart contracts. Smart contracts are self-executed programs that run on a blockchain. They cannot be modified once deployed and hence they bring unique maintenance challenges compared to conventional software. According to the definition of ISO/IEC 14764, there are four kinds of software maintenance, i.e., corrective, adaptive, perfective, and preventive maintenance. This study aims to answer (i) What kinds of issues will smart contract …

Code Integrity Attestation For Plcs Using Black Box Neural Network Predictions, Yuqi Chen, Christopher M. Poskitt, Jun Sun

Research Collection School Of Computing and Information Systems

Cyber-physical systems (CPSs) are widespread in critical domains, and significant damage can be caused if an attacker is able to modify the code of their programmable logic controllers (PLCs). Unfortunately, traditional techniques for attesting code integrity (i.e. verifying that it has not been modified) rely on firmware access or roots-of-trust, neither of which proprietary or legacy PLCs are likely to provide. In this paper, we propose a practical code integrity checking solution based on privacy-preserving black box models that instead attest the input/output behaviour of PLC programs. Using faithful offline copies of the PLC programs, we identify their most important …

Automating The Removal Of Obsolete Todo Comments, Zhipeng Gao, Xin Xia, David Lo, John C. Grundy, Thomas Zimmermann

Research Collection School Of Computing and Information Systems

TODO comments are very widely used by software developers to describe their pending tasks during software development. However, after performing the task developers sometimes neglect or simply forget to remove the TODO comment, resulting in obsolete TODO comments. These obsolete TODO comments can confuse development teams and may cause the introduction of bugs in the future, decreasing the software’s quality and maintainability. Manually identifying obsolete TODO comments is time-consuming and expensive. It is thus necessary to detect obsolete TODO comments and remove them automatically before they cause any unwanted side effects. In this work, we propose a novel model, named …

Pruning-Aware Merging For Efficient Multitask Inference, Dawei Gao, Xiaoxi He, Zimu Zhou, Yongxin Tong, Lothar Thiele

Research Collection School Of Computing and Information Systems

Many mobile applications demand selective execution of multiple correlated deep learning inference tasks on resource-constrained platforms. Given a set of deep neural networks, each pre-trained for a single task, it is desired that executing arbitrary combinations of tasks yields minimal computation cost. Pruning each network separately yields suboptimal computation cost due to task relatedness. A promising remedy is to merge the networks into a multitask network to eliminate redundancy across tasks before network pruning. However, pruning a multitask network combined by existing network merging schemes cannot minimise the computation cost of every task combination because they do not consider such …

Code2que: A Tool For Improving Question Titles From Mined Code Snippets In Stack Overflow, Zhipeng Gao, Xin Xia, David Lo, John C. Grundy, Yuan-Fang Li

Research Collection School Of Computing and Information Systems

Stack Overflow is one of the most popular technical Q&A sites used by software developers. Seeking help from Stack Overflow has become an essential part of software developers' daily work for solving programming-related questions. Although the Stack Overflow community has provided quality assurance guidelines to help users write better questions, we observed that a significant number of questions submitted to Stack Overflow are of low quality. In this paper, we introduce a new web-based tool, Code2Que, which can help developers in writing higher quality questions for a given code snippet. Code2Que consists of two main stages: offline learning and online …

Learning-Based Extraction Of First-Order Logic Representations Of Api Directives, Mingwei Liu, Xin Peng, Andrian Marcus, Christoph Treude, Xuefang Bai, Gang Lyu, Jiazhen Xie, Xiaoxin Zhang

Research Collection School Of Computing and Information Systems

Developers often rely on API documentation to learn API directives, i.e., constraints and guidelines related to API usage. Failing to follow API directives may cause defects or improper implementations. Since there are no industry-wide standards on how to document API directives, they take many forms and are often hard to understand by developers or challenging to parse with tools. In this paper, we propose a learning based approach for extracting first-order logic representations of API directives (FOL directives for short). The approach, called LeadFOL, uses a joint learning method to extract atomic formulas by identifying the predicates and arguments involved …

Deeprepair: Style-Guided Repairing For Deep Neural Networks In The Real-World Operational Environment, Bing Yu, Hua Qi, Guo Qing, Felix Juefei-Xu, Xiaofei Xie, Lei Ma, Jianjun Zhao

Research Collection School Of Computing and Information Systems

Deep neural networks (DNNs) are continuously expanding their application to various domains due to their high performance. Nevertheless, a well-trained DNN after deployment could oftentimes raise errors during practical use in the operational environment due to the mismatching between distributions of the training dataset and the potential unknown noise factors in the operational environment, e.g., weather, blur, noise, etc. Hence, it poses a rather important problem for the DNNs' real-world applications: how to repair the deployed DNNs for correcting the failure samples under the deployed operational environment while not harming their capability of handling normal or clean data with limited …

Independent Reinforcement Learning For Weakly Cooperative Multiagent Traffic Control Problem, Chengwei Zhang, Shan Jin, Wanli Xue, Xiaofei Xie, Shengyong Chen, Rong Chen

Research Collection School Of Computing and Information Systems

The adaptive traffic signal control (ATSC) problem can be modeled as a multiagent cooperative game among urban intersections, where intersections cooperate to counter the city's traffic conditions. Recently, reinforcement learning (RL) has achieved marked successes in managing sequential decision making problems, which motivates us to apply RL in the ATSC problem. One of the largest challenges of this problem is that the observation of intersection is typically partially observable, which limits the learning performance of RL algorithms. Considering the large scale of intersections in an urban traffic environment, we use independent RL to solve ATSC problem in this study. We …

An Empirical Study Of Gui Widget Detection For Industrial Mobile Games, Jiaming Ye, Ke Chen, Xiaofei Xie, Lei Ma, Ruochen Huang, Yingfeng Chen, Yinxing Xue, Jianjun Zhao

Research Collection School Of Computing and Information Systems

With the widespread adoption of smartphones in our daily life, mobile games experienced increasing demand over the past years. Meanwhile, the quality of mobile games has been continuously drawing more and more attention, which can greatly affect the player experience. For better quality assurance, general-purpose testing has been extensively studied for mobile apps. However, due to the unique characteristic of mobile games, existing mobile testing techniques may not be directly suitable and applicable. To better understand the challenges in mobile game testing, in this paper, we first initiate an early step to conduct an empirical study towards understanding the challenges …

Ava: Adversarial Vignetting Attack Against Visual Recognition, Binyu Tian, Felix Juefei-Xu, Qing Guo, Xiaofei Xie, Xiaohong Li, Yang Liu

Research Collection School Of Computing and Information Systems

Vignetting is an inherent imaging phenomenon within almost all optical systems, showing as a radial intensity darkening toward the corners of an image. Since it is a common effect for photography and usually appears as a slight intensity variation, people usually regard it as a part of a photo and would not even want to post-process it. Due to this natural advantage, in this work, we study the vignetting from a new viewpoint, i.e., adversarial vignetting attack (AVA), which aims to embed intentionally misleading information into the vignetting and produce a natural adversarial example without noise patterns. This example can …

Graph-Based Seed Object Synthesis For Search-Based Unit Testing, Yun Lin, You Seng Ong, Jun Sun, Gordon Fraser, Jin Song Dong

Research Collection School Of Computing and Information Systems

Search-based software testing (SBST) generates tests using search algorithms guided by measurements gauging how far a test case is away from exercising a coverage goal. The effectiveness of SBST largely depends on the continuity and monotonicity of the fitness landscape decided by these measurements and the search operators. Unfortunately, the fitness landscape is challenging when the function under test takes object inputs, as classical measurements hardly provide guidance for constructing legitimate object inputs. To overcome this problem, we propose test seeds, i.e., test code skeletons of legitimate objects which enable the use of classical measurements. Given a target branch in …

Type And Interval Aware Array Constraint Solving For Symbolic Execution, Ziqi Shuai, Zhenbang Chen, Yufeng Zhang, Jun Sun, Ji Wang

Research Collection School Of Computing and Information Systems

Array constraints are prevalent in analyzing a program with symbolic execution. Solving array constraints is challenging due to the complexity of the precise encoding for arrays. In this work, we propose to synergize symbolic execution and array constraint solving. Our method addresses the difficulties in solving array constraints with novel ideas. First, we propose a lightweight method for pre-checking the unsatisfiability of array constraints based on integer linear programming. Second, observing that encoding arrays at the byte-level introduces many redundant axioms that reduce the effectiveness of constraint solving, we propose type and interval aware axiom generation. Note that the type …