Open Access. Powered by Scholars. Published by Universities.®
- Discipline
- Institution
- Publication Year
Articles 31 - 47 of 47
Full-Text Articles in Software Engineering
Proactive Empirical Assessment Of New Language Feature Adoption Via Automated Refactoring: The Case Of Java 8 Default Methods, Raffi Khatchadourian, Hidehiko Masuhara
Proactive Empirical Assessment Of New Language Feature Adoption Via Automated Refactoring: The Case Of Java 8 Default Methods, Raffi Khatchadourian, Hidehiko Masuhara
Publications and Research
Programming languages and platforms improve over time, sometimes resulting in new language features that offer many benefits. However, despite these benefits, developers may not always be willing to adopt them in their projects for various reasons. In this paper, we describe an empirical study where we assess the adoption of a particular new language feature. Studying how developers use (or do not use) new language features is important in programming language research and engineering because it gives designers insight into the usability of the language to create meaning programs in that language. This knowledge, in turn, can drive future innovations …
What Do Developers Search For On The Web?, Xin Xia, Lingfeng Bao, David Lo, Pavneet Singh Kochhar, Ahmed E. Hassan, Zhenchang Xing
What Do Developers Search For On The Web?, Xin Xia, Lingfeng Bao, David Lo, Pavneet Singh Kochhar, Ahmed E. Hassan, Zhenchang Xing
Research Collection School Of Computing and Information Systems
Developers commonly make use of a web search engine such as Google to locate online resources to improve their productivity. A better understanding of what developers search for could help us understand their behaviors and the problems that they meet during the software development process. Unfortunately, we have a limited understanding of what developers frequently search for and of the search tasks that they often find challenging. To address this gap, we collected search queries from 60 developers, surveyed 235 software engineers from more than 21 countries across five continents. In particular, we asked our survey participants to rate the …
Bug Characteristics In Blockchain Systems: A Large-Scale Empirical Study, Zhiyuan Wan, David Lo, Xin Xia, Liang Cai
Bug Characteristics In Blockchain Systems: A Large-Scale Empirical Study, Zhiyuan Wan, David Lo, Xin Xia, Liang Cai
Research Collection School Of Computing and Information Systems
Bugs severely hurt blockchain system dependability. A thorough understanding of blockchain bug characteristics is required to design effective tools for preventing, detecting and mitigating bugs. We perform an empirical study on bug characteristics in eight representative open source blockchain systems. First, we manually examine 1,108 bug reports to understand the nature of the reported bugs. Second, we leverage card sorting to label the bug reports, and obtain ten bug categories in blockchain systems. We further investigate the frequency distribution of bug categories across projects and programming languages. Finally, we study the relationship between bug categories and bug fixing time. The …
Characterizing Malicious Android Apps By Mining Topic-Specific Data Flow Signatures, Xinli Yang, David Lo, Li Li, Xin Xia, Tegawendé F. Bissyande, Jacques Klein
Characterizing Malicious Android Apps By Mining Topic-Specific Data Flow Signatures, Xinli Yang, David Lo, Li Li, Xin Xia, Tegawendé F. Bissyande, Jacques Klein
Research Collection School Of Computing and Information Systems
Context: State-of-the-art works on automated detection of Android malware have leveraged app descriptions to spot anomalies w.r.t the functionality implemented, or have used data flow information as a feature to discriminate malicious from benign apps. Although these works have yielded promising performance,we hypothesize that these performances can be improved by a better understanding of malicious behavior. Objective: To characterize malicious apps, we take into account both information on app descriptions,which are indicative of apps’ topics, and information on sensitive data flow, which can be relevant todiscriminate malware from benign apps. Method: In this paper, we propose a topic-specific approach to …
What Security Questions Do Developers Ask? A Large-Scale Study Of Stack Overflow Posts, Xinli Yang, David Lo, Xin Xia, Zhi-Yuan Wan, Jian-Ling Sun
What Security Questions Do Developers Ask? A Large-Scale Study Of Stack Overflow Posts, Xinli Yang, David Lo, Xin Xia, Zhi-Yuan Wan, Jian-Ling Sun
Research Collection School Of Computing and Information Systems
Security has always been a popular and critical topic. With the rapid development of information technology, it is always attracting people’s attention. However, since security has a long history, it covers a wide range of topics which change a lot, from classic cryptography to recently popular mobile security. There is a need to investigate security-related topics and trends, which can be a guide for security researchers, security educators and security practitioners. To address the above-mentioned need, in this paper, we conduct a large-scale study on security-related questions on Stack Overflow. Stack Overflow is a popular on-line question and answer site …
Tasker: Behavioral Insights Via Campus-Based Experimental Mobile Crowd-Sourcing, Thivya Kandappu, Jaiman, Tandriansyah, Archan Misra, Shih-Fen Cheng, Chen, Hoong Chuin Lau, Deepthi Chander, Koustuv Dasgupta
Tasker: Behavioral Insights Via Campus-Based Experimental Mobile Crowd-Sourcing, Thivya Kandappu, Jaiman, Tandriansyah, Archan Misra, Shih-Fen Cheng, Chen, Hoong Chuin Lau, Deepthi Chander, Koustuv Dasgupta
Research Collection School Of Computing and Information Systems
While mobile crowd-sourcing has become a game-changer for many urban operations, such as last mile logistics and municipal monitoring, we believe that the design of such crowdsourcing strategies must better accommodate the real-world behavioral preferences and characteristics of users. To provide a real-world testbed to study the impact of novel mobile crowd-sourcing strategies, we have designed, developed and experimented with a real-world mobile crowd-tasking platform on the SMU campus, called TA$Ker. We enhanced the TA$Ker platform to support several new features (e.g., task bundling, differential pricing and cheating analytics) and experimentally investigated these features via a two-month deployment of TA$Ker, …
Practitioners' Expectations On Automated Fault Localization, Pavneet Singh Kochhar, Xin Xia, David Lo, Shanping Li
Practitioners' Expectations On Automated Fault Localization, Pavneet Singh Kochhar, Xin Xia, David Lo, Shanping Li
Research Collection School Of Computing and Information Systems
Software engineering practitioners often spend significant amount of time and effort to debug. To help practitioners perform this crucial task, hundreds of papers have proposed various fault localization techniques. Fault localization helps practitioners to find the location of a defect given its symptoms (e.g., program failures). These localization techniques have pinpointed the locations of bugs of various systems of diverse sizes, with varying degrees of success, and for various usage scenarios. Unfortunately, it is unclear whether practitioners appreciate this line of research. To fill this gap, we performed an empirical study by surveying 386 practitioners from more than 30 countries …
Summarizing And Measuring Development Activity, Christoph Treude, Fernando Figueira Filho, Uirá Kulesza
Summarizing And Measuring Development Activity, Christoph Treude, Fernando Figueira Filho, Uirá Kulesza
Research Collection School Of Computing and Information Systems
Software developers pursue a wide range of activities as part of their work, and making sense of what they did in a given time frame is far from trivial as evidenced by the large number of awareness and coordination tools that have been developed in recent years. To inform tool design for making sense of the information available about a developer’s activity, we conducted an empirical study with 156 GitHub users to investigate what information they would expect in a summary of development activity, how they would measure development activity, and what factors influence how such activity can be condensed …
An Empirical Assessment Of Bellon's Clone Benchmark, Alan Charpentier, Jean-Rémy Falleri, David Lo, Laurent Reveillere
An Empirical Assessment Of Bellon's Clone Benchmark, Alan Charpentier, Jean-Rémy Falleri, David Lo, Laurent Reveillere
Research Collection School Of Computing and Information Systems
Context: Clone benchmarks are essential to the assessment and improvement of clone detection tools and algorithms. Among existing benchmarks, Bellon's benchmark is widely used by the research community. However, a serious threat to the validity of this benchmark is that reference clones it contains have been manually validated by Bellon alone. Other persons may disagree with Bellon's judgment. Objective: In this paper, we perform an empirical assessment of Bellon's benchmark. Method: We seek the opinion of eighteen participants on a subset of Bellon's benchmark to determine if researchers should trust the reference clones it contains. Results: Our experiment shows that …
To What Extent Could We Detect Field Defects? An Extended Empirical Study Of False Negatives In Static Bug Finding Tools, Ferdian Thung, Lucia Lucia, David Lo, Lingxiao Jiang, Foyzur Rahman, Premkumar Devanbu
To What Extent Could We Detect Field Defects? An Extended Empirical Study Of False Negatives In Static Bug Finding Tools, Ferdian Thung, Lucia Lucia, David Lo, Lingxiao Jiang, Foyzur Rahman, Premkumar Devanbu
Research Collection School Of Computing and Information Systems
Software defects can cause much loss. Static bug-finding tools are designed to detect and remove software defects and believed to be effective. However, do such tools in fact help prevent actual defects that occur in the field and reported by users? If these tools had been used, would they have detected these field defects, and generated warnings that would direct programmers to fix them? To answer these questions, we perform an empirical study that investigates the effectiveness of five state-of-the-art static bug-finding tools (FindBugs, JLint, PMD, CheckStyle, and JCSC) on hundreds of reported and fixed defects extracted from three open …
Improving Tool Support For Software Reverse Engineering In A Security Context, Brendan Cleary, Christoph Treude, Fernando Figueira Filho, Margaret-Anne Storey, Martin Salois
Improving Tool Support For Software Reverse Engineering In A Security Context, Brendan Cleary, Christoph Treude, Fernando Figueira Filho, Margaret-Anne Storey, Martin Salois
Research Collection School Of Computing and Information Systems
Illegal cyberspace activities are increasing rapidly and many software engineers are using reverse engineering methods to respond to attacks. The security-sensitive nature of these tasks, such as the understanding of malware or the decryption of encrypted content, brings unique challenges to reverse engineering: work has to be done offline, files can rarely be shared, time pressure is immense, and there is a lack of tool and process support for capturing and sharing the knowledge obtained while trying to understand assembly code. To help us gain an understanding of this reverse engineering work, we conducted an exploratory study at a government …
An Empirical Study Of Adoption Of Software Testing In Open Source Projects, Pavneet Singh Kochhar, Tegawende F. Bissyande, David Lo, Lingxiao Jiang
An Empirical Study Of Adoption Of Software Testing In Open Source Projects, Pavneet Singh Kochhar, Tegawende F. Bissyande, David Lo, Lingxiao Jiang
Research Collection School Of Computing and Information Systems
In software engineering, testing is a crucial activity that is designed to ensure the quality of program code. For this activity, software teams spend substantial resources constructing test cases to thoroughly assess the correctness of software functionality. What is the proportion of open source projects that include test cases? What is the effect of number of developers on the number of test cases? In this study, we explore open source projects and investigate the correlation between the presence of test cases and various project development characteristics, including the number of lines of code, the size of development teams and the …
Mining Sql Injection And Cross Site Scripting Vulnerabilities Using Hybrid Program Analysis, Lwin Khin Shar, Hee Beng Kuan Tan, Lionel C. Briand
Mining Sql Injection And Cross Site Scripting Vulnerabilities Using Hybrid Program Analysis, Lwin Khin Shar, Hee Beng Kuan Tan, Lionel C. Briand
Research Collection School Of Computing and Information Systems
In previous work, we proposed a set of static attributes that characterize input validation and input sanitization code patterns. We showed that some of the proposed static attributes are significant predictors of SQL injection and cross site scripting vulnerabilities. Static attributes have the advantage of reflecting general properties of a program. Yet, dynamic attributes collected from execution traces may reflect more specific code characteristics that are complementary to static attributes. Hence, to improve our initial work, in this paper, we propose the use of dynamic attributes to complement static attributes in vulnerability prediction. Furthermore, since existing work relies on supervised …
Predicting Sql Injection And Cross Site Scripting Vulnerabilities Through Mining Input Sanitization Patterns, Lwin Khin Shar, Hee Beng Kuan Tan
Predicting Sql Injection And Cross Site Scripting Vulnerabilities Through Mining Input Sanitization Patterns, Lwin Khin Shar, Hee Beng Kuan Tan
Research Collection School Of Computing and Information Systems
ContextSQL injection (SQLI) and cross site scripting (XSS) are the two most common and serious web application vulnerabilities for the past decade. To mitigate these two security threats, many vulnerability detection approaches based on static and dynamic taint analysis techniques have been proposed. Alternatively, there are also vulnerability prediction approaches based on machine learning techniques, which showed that static code attributes such as code complexity measures are cheap and useful predictors. However, current prediction approaches target general vulnerabilities. And most of these approaches locate vulnerable code only at software component or file levels. Some approaches also involve process attributes that …
Adoption Of Software Testing In Open Source Projects: A Preliminary Study On 50,000 Projects, Pavneet Singh Kochhar, Tegawende F. Bissyande, David Lo, Lingxiao Jiang
Adoption Of Software Testing In Open Source Projects: A Preliminary Study On 50,000 Projects, Pavneet Singh Kochhar, Tegawende F. Bissyande, David Lo, Lingxiao Jiang
Research Collection School Of Computing and Information Systems
In software engineering, testing is a crucial activity that is designed to ensure the quality of program code. For this activity, development teams spend substantial resources constructing test cases to thoroughly assess the correctness of software functionality. What is however the proportion of open source projects that include test cases? What kind of projects are more likely to include test cases? In this study, we explore 50,000 projects and investigate the correlation between the presence of test cases and various project development characteristics, including the lines of code and the size of development teams.
A Conceptual Framework For Measuring The Quality Aspect Of Mobile Learning, Luiz Fernando Capretz, Abdalha Ali, Abdelkader Ouda
A Conceptual Framework For Measuring The Quality Aspect Of Mobile Learning, Luiz Fernando Capretz, Abdalha Ali, Abdelkader Ouda
Electrical and Computer Engineering Publications
With the continuing growth of mobile phones outpacing that of desktops and laptops, mobile phones are the new personal computer. These devices started becoming increasingly sophisticated and extremely powerful. In addition to making phone calls it have the capabilities to perform variety functions, one of the most important functions using it as a classroom tool. However, mobile phone applications must be designed and developed with respect to different technologies skills, learning capabilities and language proficiency in order to be accepted by wide audiences (e.g., students, instructors). However, there is much work that has been done to measure the quality of …
Predicting Common Web Application Vulnerabilities From Input Validation And Sanitization Code Patterns, Lwin Khin Shar, Hee Beng Kuan Tan
Predicting Common Web Application Vulnerabilities From Input Validation And Sanitization Code Patterns, Lwin Khin Shar, Hee Beng Kuan Tan
Research Collection School Of Computing and Information Systems
Software defect prediction studies have shown that defect predictors built from static code attributes are useful and effective. On the other hand, to mitigate the threats posed by common web application vulnerabilities, many vulnerability detection approaches have been proposed. However, finding alternative solutions to address these risks remains an important research problem. As web applications generally adopt input validation and sanitization routines to prevent web security risks, in this paper, we propose a set of static code attributes that represent the characteristics of these routines for predicting the two most common web application vulnerabilities—SQL injection and cross site scripting. In …