Software Engineering Commons^™

The Shifting Sands Of Motivation: Revisiting What Drives Contributors In Open Source, Marco Gerosa, Igor Wiese, Bianca Trinkenreich, Georg Link, Gregorio Robles, Christoph Treude, Igor Steinmacher, Anita Sarma

Research Collection School Of Computing and Information Systems

Open Source Software (OSS) has changed drastically over the last decade, with OSS projects now producing a large ecosystem of popular products, involving industry participation, and providing professional career opportunities. But our field's understanding of what motivates people to contribute to OSS is still fundamentally grounded in studies from the early 2000s. With the changed landscape of OSS, it is very likely that motivations to join OSS have also evolved. Through a survey of 242 OSS contributors, we investigate shifts in motivation from three perspectives: (1) the impact of the new OSS landscape, (2) the impact of individuals' personal growth …

Retrieval-Augmented Generation For Code Summarization Via Hybrid Gnn, Shangqing Liu, Yu Chen, Xiaofei Xie, Jingkai Siow, Yang Liu

Research Collection School Of Computing and Information Systems

Source code summarization aims to generate natural language summaries from structured code snippets for better understanding code functionalities. However, automatic code summarization is challenging due to the complexity of the source code and the language gap between the source code and natural language summaries. Most previous approaches either rely on retrieval-based (which can take advantage of similar examples seen from the retrieval database, but have low generalization performance) or generation-based methods (which have better generalization performance, but cannot take advantage of similar examples). This paper proposes a novel retrieval-augmented mechanism to combine the benefits of both worlds. Furthermore, to mitigate …

Automatic Web Testing Using Curiosity-Driven Reinforcement Learning, Yan Zheng, Yi Liu, Xiaofei Xie, Yepang Liu, Lei Ma, Jianye Hao, Yang Liu

Research Collection School Of Computing and Information Systems

Web testing has long been recognized as a notoriously difficult task. Even nowadays, web testing still heavily relies on manual efforts while automated web testing is far from achieving human-level performance. Key challenges in web testing include dynamic content update and deep bugs hiding under complicated user interactions and specific input values, which can only be triggered by certain action sequences in the huge search space. In this paper, we propose WebExplor, an automatic end-to-end web testing framework, to achieve an adaptive exploration of web applications. WebExplor adopts curiosity-driven reinforcement learning to generate high-quality action sequences (test cases) satisfying temporal …

Automated Query Reformulation For Efficient Search Based On Query Logs From Stack Overflow, Kaibo Cao, Chunyang Chen, Sebastian Baltes, Christoph Treude, Xiang Chen

Research Collection School Of Computing and Information Systems

As a popular Q&A site for programming, Stack Overflow is a treasure for developers. However, the amount of questions and answers on Stack Overflow make it difficult for developers to efficiently locate the information they are looking for. There are two gaps leading to poor search results: the gap between the user's intention and the textual query, and the semantic gap between the query and the post content. Therefore, developers have to constantly reformulate their queries by correcting misspelled words, adding limitations to certain programming languages or platforms, etc. As query reformulation is tedious for developers, especially for novices, we …

Research Artifact: The Potential Of Meta-Maintenance On Github, Hideaki Hata, Raula Kula, Takashi Ishio, Christoph Treude

Research Collection School Of Computing and Information Systems

This is a research artifact for the paper “Same File, Different Changes: The Potential of Meta-Maintenance on GitHub”. This artifact is a data repository including a list of studied 32,007 repositories on GitHub, a list of targeted 401,610,677 files, the results of the qualitative analysis for RQ2, RQ3, and RQ4, the results of the quantitative analysis for RQ5, and survey material for RQ6. The purpose of this artifact is enabling researchers to replicate our mixed-methods results of the paper, and to reuse the results of our exploratory study for further software engineering research. This research artifact is available at https://github.com/NAIST-SE/MetaMaintenancePotential …

Low-Power Downlink For The Internet Of Things Using Ieee 802.11-Compliant Wake-Up Receivers, Johannes Blobel, Vu Huy Tran, Archan Misra, Falko Dressler

Research Collection School Of Computing and Information Systems

Ultra-low power communication is critical for supporting the next generation of battery-operated or energy harvesting battery-less Internet of Things (IoT) devices. Duty cycling protocols and wake-up receiver (WuRx) technologies, and their combinations, have been investigated as energy-efficient mechanisms to support selective, event-driven activation of devices. In this paper, we go one step further and show how WuRx can be used for an efficient and multi-purpose low power downlink (LPD) communication channel. We demonstrate how to (a) extend the wake-up signal to support low-power flexible and extensible unicast, multicast, and broadcast downlink communication and (b) utilize the WuRx-based LPD to also …

Smart Contract Security: A Practitioners' Perspective, Zhiyuan Wan, Xin Xia, David Lo, Jiachi Chen, Xiapu Luo, Xiaohu Yang

Research Collection School Of Computing and Information Systems

Smart contracts have been plagued by security incidents, which resulted in substantial financial losses. Given numerous research efforts in addressing the security issues of smart contracts, we wondered how software practitioners build security into smart contracts in practice. We performed a mixture of qualitative and quantitative studies with 13 interviewees and 156 survey respondents from 35 countries across six continents to understand practitioners' perceptions and practices on smart contract security. Our study uncovers practitioners' motivations and deterrents of smart contract security, as well as how security efforts and strategies fit into the development lifecycle. We also find that blockchain platforms …

Oidpr: Optimized Insulin Dosage Via Privacy‐Preserving Reinforcement Learning, Zuobin Ying, Yun Zhang, Shuanglong Cao, Shengmin Xu, Maode Ma

Research Collection School Of Computing and Information Systems

The precision of insulin dosage is essential in the process of diabetes treatment. The fact is providing precise dosage is almost impossible for clinicians since blood sugar levels are dynamically affected by many factors. Even though some auxiliary dosing systems have been proposed, the required real‐time physical data about the health situation of diabetics is still hard to synchronize to the end‐devices instantly. The traditional personalized drug delivery frameworks for accurate dosing of insulin always collect and transmit medical data in cleartext, which raises privacy problems. In this article, we propose a framework for an optimized insulin dosage via privacy‐preserving …

Characterization And Prediction Of Questions Without Accepted Answers On Stack Overflow, Mohamad Yazdaninia, David Lo, Ashkan Sami

Research Collection School Of Computing and Information Systems

A fast and effective approach to obtain information regarding software development problems is to search them to find similar solved problems or post questions on community question answering (CQA) websites. Solving coding problems in a short time is important, so these CQAs have a considerable impact on the software development process. However, if developers do not get their expected answers, the websites will not be useful, and software development time will increase. Stack Overflow is the most popular CQA concerning programming problems. According to its rules, the only sign that shows a question poser has achieved the desired answer is …

Sguard: Towards Fixing Vulnerable Smart Contracts Automatically, Tai D. Nguyen, Long H. Pham, Jun Sun

Research Collection School Of Computing and Information Systems

Smart contracts are distributed, self-enforcing programs executing on top of blockchain networks. They have the potential to revolutionize many industries such as financial institutes and supply chains. However, smart contracts are subject to code-based vulnerabilities, which casts a shadow on its applications. As smart contracts are unpatchable (due to the immutability of blockchain), it is essential that smart contracts are guaranteed to be free of vulnerabilities. Unfortunately, smart contract languages such as Solidity are Turing-complete, which implies that verifying them statically is infeasible. Thus, alternative approaches must be developed to provide the guarantee. In this work, we develop an approach …

Taiger Ai: Saas Bundling And Unbundling, Singapore Management University

Perspectives@SMU

Software companies bundle support services with their products as standard practice. Is it possible to be different…and profitable?

Looking Back! Using Early Versions Of Android Apps As Attack Vectors, Yue Zhang, Jian Weng, Jia-Si Wneg, Lin Hou, Anjia Yang, Ming Li, Yang Xiang, Deng, Robert H.

Research Collection School Of Computing and Information Systems

Android platform is gaining explosive popularity. This leads developers to invest resources to maintain the upward trajectory of the demand. Unfortunately, as the profit potential grows higher, the chances of these Apps getting attacked also get higher. Therefore, developers improved the security of their Apps, which limits attackers ability to compromise upgraded versions of the Apps. However, developers cannot enhance the security of earlier versions that have been released on the Play Store. The earlier versions of the App can be subject to reverse engineering and other attacks. In this paper, we find that attackers can use these earlier versions …

Machine Learning Based Approaches Towards Robust Android Malware Detection, Jiayun Xu

Dissertations and Theses Collection (Open Access)

The Android platform is becoming increasingly popular and numerous applications (apps) have been developed by organizations to meet the ever increasing market demand over years. Naturally, security and privacy concerns on Android apps have grabbed considerable attention from both academic and industrial
communities. Many approaches have been proposed to detect Android malware in different ways so far, and most of them produce satisfactory performance under the given Android environment settings and labelled samples. However, existing approaches suffer the following robustness problems:

In many Android malware detection approaches, specific API calls are used to build the feature sets, and their feature …

Tour: Dynamic Topic And Sentiment Analysis Of User Reviews For Assisting App Release, Tianyi Yang, Cuiyun Gao, Jingya Zang, David Lo, Michael R. Lyu

Research Collection School Of Computing and Information Systems

App reviews deliver user opinions and emerging issues (e.g., new bugs) about the app releases. Due to the dynamic nature of app reviews, topics and sentiment of the reviews would change along with app release versions. Although several studies have focused on summarizing user opinions by analyzing user sentiment towards app features, no practical tool is released. The large quantity of reviews and noise words also necessitates an automated tool for monitoring user reviews. In this paper, we introduce TOUR for dynamic TOpic and sentiment analysis of User Reviews. TOUR is able to (i) detect and summarize emerging app issues …

Do Users Care About Ad's Performance Costs? Exploring The Effects Of The Performance Costs Of In-App Ads On User Experience, Cuiyun Gao, Jichuan Zeng, Federica Sarro, David Lo, Irwin King, Michael R. Lyu

Research Collection School Of Computing and Information Systems

Context: In-app advertising is the primary source of revenue for many mobile apps. The cost of advertising (ad cost) is non-negligible for app developers to ensure a good user experience and continuous profits. Previous studies mainly focus on addressing the hidden performance costs generated by ads, including consumption of memory, CPU, data traffic, and battery. However, there is no research on analyzing users’ perceptions of ads’ performance costs to our knowledge.Objective: To fill this gap and better understand the effects of performance costs of in-app ads on user experience, we conduct a study on analyzing user concerns about ads’ performance …

How Successful Are Open Source Contributions From Countries With Different Levels Of Human Development?, Leonardo Furtado, Bruno Cartaxo, Christoph Treude, Gustavo Pinto

Research Collection School Of Computing and Information Systems

In this article we studied whether developers? locations relate to the outcome of a pull request (PR). Our results suggest that developers from countries with low human development indexes perform a small fraction of the overall PRs and are the ones that face rejection the most.

Spectest: Specification-Based Compiler Testing, Richard Schumi, Jun Sun

Research Collection School Of Computing and Information Systems

Compilers are error-prone due to their high complexity. They are relevant for not only general purpose programming languages, but also for many domain specific languages. Bugs in compilers can potentially render all programs at risk. It is thus crucial that compilers are systematically tested, if not verified. Recently, a number of efforts have been made to formalise and standardise programming language semantics, which can be applied to verify the correctness of the respective compilers. In this work, we present a novel specification-based testing method named SpecTest to better utilise these semantics for testing. By applying an executable semantics as test …

Breaking Neural Reasoning Architectures With Metamorphic Relation-Based Adversarial Examples, Alvin Chan, Lei Ma, Felix Juefei-Xu, Yew-Soon Ong, Xiaofei Xie, Minhui Xue, Yang Liu

Research Collection School Of Computing and Information Systems

The ability to read, reason, and infer lies at the heart of neural reasoning architectures. After all, the ability to perform logical reasoning over language remains a coveted goal of Artificial Intelligence. To this end, models such as the Turing-complete differentiable neural computer (DNC) boast of real logical reasoning capabilities, along with the ability to reason beyond simple surface-level matching. In this brief, we propose the first probe into DNC's logical reasoning capabilities with a focus on text-based question answering (QA). More concretely, we propose a conceptually simple but effective adversarial attack based on metamorphic relations. Our proposed adversarial attack …

Practical Server-Side Wifi-Based Indoor Localization: Addressing Cardinality & Outlier Challenges For Improved Occupancy Estimation, Anuradha Ravi, Archan Misra

Research Collection School Of Computing and Information Systems

Server-side WiFi-based indoor localization offers a compelling approach for passive occupancy estimation (i.e., without requiring active participation by client devices, such as smartphones carried by visitors), but is known to suffer from median error of 6–8 meters. By analyzing the characteristics of an operationally-deployed, WiFi-based passive indoor location system, based on the classical RADAR algorithm, we identify and tackle 2 practical challenges for accurate individual device localization. The first challenge is the low-cardinality issue, whereby only the associated AP generates sufficiently frequent RSSI reports, causing a client to experience large localization error due to the absence of sufficient measurements from …

Out Of Sight, Out Of Mind? How Vulnerable Dependencies Affect Open-Source Projects, Gede Artha Azriadi Prana, Abhishek Sharma, Lwin Khin Shar, Darius Foo, Andrew E. Santosa, Asankhaya Sharma, David Lo

Research Collection School Of Computing and Information Systems

Context: Software developers often use open-source libraries in their project to improve development speed. However, such libraries may contain security vulnerabilities, and this has resulted in several high-profile incidents in re- cent years. As usage of open-source libraries grows, understanding of these dependency vulnerabilities becomes increasingly important. Objective: In this work, we analyze vulnerabilities in open-source libraries used by 450 software projects written in Java, Python, and Ruby. Our goal is to examine types, distribution, severity, and persistence of the vulnerabili- ties, along with relationships between their prevalence and project as well as commit attributes. Method: Our data is obtained …

Detection Of Social Identification In Workgroups From A Passively-Sensed Wifi Infrastructure, Camelia Zakaria, Youngki Lee, Rajesh Krishna Balan

Research Collection School Of Computing and Information Systems

Social identification: how much individuals psychologically associate themselves with a group has been posited as an essential construct to measure individual and group dynamics. Studies have shown that individuals who identify very differently from their workgroup provides critical cues to the lack of social support or work overloads. However, measuring identification is typically achieved through time-consuming and privacy invasive surveys. We hypothesize that the extremitized in-group norm affects individuals' behaviors, thus more likely to give rise to negative appraisals. As a more convenient and less-invasive technique, we propose a method to predict individuals who are increasingly different in identifying themselves …

Improving Neural Network Verification Through Spurious Region Guided Refinement, Pengfei Yang, Renjue Li, Jianlin Li, Cheng Chao Huang, Jingyi Wang, Jun Sun, Bai Xue, Lijun Zhang

Research Collection School Of Computing and Information Systems

We propose a spurious region guided refinement approach for robustness verification of deep neural networks. Our method starts with applying the DeepPoly abstract domain to analyze the network. If the robustness property cannot be verified, the result is inconclusive. Due to the over-approximation, the computed region in the abstraction may be spurious in the sense that it does not contain any true counterexample. Our goal is to identify such spurious regions and use them to guide the abstraction refinement. The core idea is to make use of the obtained constraints of the abstraction to infer new bounds for the neurons. …

Combining Query Reduction And Expansion For Text-Retrieval-Based Bug Localization, Juan Manuel Florez, Oscar Chaparro, Christoph Treude, Andrian Marcus

Research Collection School Of Computing and Information Systems

Automated text-retrieval-based bug localization (TRBL) techniques normally use the full text of a bug report to formulate a query and retrieve parts of the code that are buggy. Previous research has shown that reducing the size of the query increases the effectiveness of TRBL. On the other hand, researchers also found improvements when expanding the query (i.e., adding more terms). In this paper, we bring these two views together to reformulate queries for TRBL. Specifically, we improve discourse-based query reduction strategies, by adopting a combinatorial approach and using task phrases from bug reports, and combine them with a state-of-the-art query …

Adaptive Simultaneous Pervasive Visible Light Communication And Sensing, Ila Nitin Gokarn, Archan Misra

Research Collection School Of Computing and Information Systems

Driven by the rapid growth in the proliferation of low-cost LED luminaries, visible light is being increasingly explored as both a high-speed communication and sensing channel for a variety of IoT applications. Visible Light Communication (VLC) exploits the high-frequency modulation of an optical source while ensuring imperceptibility to the human eye. In parallel, recent approaches in Visible Light Sensing (VLS) have demonstrated how high frequency optical strobing can be used to perform vision-based remote sensing of mechanical vibrations (e.g., of factory equipment). To date, exemplars of VLC and VLS have, however, been explored in isolation, without consideration of their mutual …

Interactional Motifs: Leveraging Risks In Large And Distributed Software Development Teams, Subhajit Datta, Amrita Bhattacharjee, Subhashis Majumder

Research Collection School Of Computing and Information Systems

DeMarco and Lister begin their classic Peopleware with an air of ominous inevitability “somewhere today, a project is failing” (DeMarco and Lister, 2013). They are talking about software projects, and as the book so brilliantly establishes, software is peopleware. A failed project is the dreaded culmination of all the perceptible and imperceptible risks that are associated with the project. For software projects, a large majority of such risks originate in the interactions of people who are involved in the project. People who build the software are the most valued and the most vulnerable asset of any software project, something that …

Recent Advances On Intelligent Mobility And Edge Computing, Xun Shao, Zhi Liu, Xianfu Chen, Seng W. Loke, Hwee-Pink Tan

Research Collection School Of Computing and Information Systems

In recent years, we have seen fast development of wireless communications, networking, and cloud computing: 4G, 5G and multiaccess networks greatly enhance the quality of service (QoS) of wireless access networks; software-defined networking, network function virtualization, and information-centric networking largely reduce the cost of network service providers and improve the quality of experience (QoE) of end-users; the development of mobile devices and mobile cloud computing lead to explosive deployment of mobile services and applications; the recent development of advanced algorithms such as Deep Learning has shown great potential in resource allocation and service orchestration. Deep integration of the above technologies …

Assessing Code Clone Harmfulness: Indicators, Factors, And Counter Measures, Bin Hu, Yijian Wu, Xin Peng, Jun Sun, Nanjie Zhan, Jun Wu

Research Collection School Of Computing and Information Systems

Code clones are identical or similar code in software projects. On one hand, developers clone code to achieve higher productivity and thus clones inherently exist; on the other hand, code clones demand extra effort to maintain the consistency between clone instances and may introduce bugs, and thus are often considered harmful for software maintenance and quality. We believe that not all code clones have the same level of harmfulness. A systematic way of assessing the harmfulness level of cloned code would facilitate informed decisions on how to deal with clones. We propose a model for clone harmfulness level assessment with …

Treecaps: Tree-Based Capsule Networks For Source Code Processing, Duy Quoc Nghi Bui, Yijun Yu, Lingxiao Jiang

Research Collection School Of Computing and Information Systems

Recently program learning techniques have been proposed to process source code based on syntactical structures (e.g., Abstract Syntax Trees) and/or semantic information (e.g., Dependency Graphs). While graphs may be better at capturing various viewpoints of code semantics than trees, constructing graph inputs from code need static code semantic analysis that may not be accurate and introduces noise during learning. On the other hand, syntax trees are precisely defined according to the language grammar and easier to construct and process than graphs. We propose a new tree-based learning technique, named TreeCaps, by fusing capsule networks with tree-based convolutional neural networks, to …

Revman: Revenue-Aware Multi-Task Online Insurance Recommendation, Yu Li, Yi Zhang, Lu Gan, Gengwei Hong, Zimu Zhou, Qiang Li

Research Collection School Of Computing and Information Systems

Online insurance is a new type of e-commerce with exponential growth. An effective recommendation model that maximizes the total revenue of insurance products listed in multiple customized sales scenarios is crucial for the success of online insurance business. Prior recommendation models are ineffective because they fail to characterize the complex relatedness of insurance products in multiple sales scenarios and maximize the overall conversion rate rather than the total revenue. Even worse, it is impractical to collect training data online for total revenue maximization due to the business logic of online insurance. We propose RevMan, a Revenue-aware Multi-task Network for online …

An Exploratory Study On The Introduction And Removal Of Different Types Of Technical Debt In Deep Learning Frameworks, Jiakun Liu, Qiao Huang, Xin Xia, Emad Shihab, David Lo, Shanping Li

Research Collection School Of Computing and Information Systems

To complete tasks faster, developers often have to sacrifice the quality of the software. Such compromised practice results in the increasing burden to developers in future development. The metaphor, technical debt, describes such practice. Prior research has illustrated the negative impact of technical debt, and many researchers investigated how developers deal with a certain type of technical debt. However, few studies focused on the removal of different types of technical debt in practice. To fill this gap, we use the introduction and removal of different types of self-admitted technical debt (i.e., SATD) in 7 deep learning frameworks as an example. …