Software Engineering Commons^™

Satdbailiff- Mining And Tracking Self-Admitted Technical Debt, Mohamed Wiem Mkaouer, Eman Abdullah Alomar, Ben Christians, Mihal Busho, Ahmed Hamad Alkhalid, Christian D. Newman

Articles

Self-Admitted Technical Debt (SATD) is a metaphorical concept to describe the self-documented addition of technical debt to a software project in the form of source code comments. SATD can linger in projects and degrade source-code quality, but it can also be more visible than unintentionally added or undocumented technical debt. Understanding the implications of adding SATD to a software project is important because developers can benefit from a better understanding of the quality trade-offs they are making. However, empirical studies, analyzing the survivability and removal of SATD comments, are challenged by potential code changes or SATD comment updates that may …

Developing An Ios Game Application: Magnet Hockey, Trevor D. Wysong

The Graduate Review

Mobile application development requires mindful and meticulous planning. Application design should be responsive and intuitive so that navigation feels natural for the user. All targeted devices should be offered a relatively consistent experience. To ensure this, app performance needs to be closely monitored and different screen sizes and aspect ratios need to be considered when scaling. For an app to become attractive to many people, it should either be competitive with similar apps or be unique and interesting enough to entice people to download it. A unique app should couple familiar elements with new components or twists [8]. People are …

Design And Implementation Of An Automatic Word Generator For Word Matching Interactives, Evan Miles Gertis

College of Graduate Studies: Theses & Dissertations

An Automatic Word Match Generator is a software tool that can be used to generate word-matching interactives automatically. The purpose of a word-matching interactive is to provide students with the mechanism to learn new vocabulary and improve their reading comprehension skills. This thesis will present the design and implementation of an Automatic Word Match Generator, as well as the research and algorithms used in the program.

Efficacy Of Reported Issue Times As A Means For Effort Estimation, Paul Phillip Maclean

Graduate Theses, Dissertations, and Problem Reports (ETD)

Software effort is a measure of manpower dedicated to developing and maintaining and software. Effort estimation can help project managers monitor their software, teams, and timelines. Conversely, improper effort estimation can result in budget overruns, delays, lost contracts, and accumulated Technical Debt (TD). Issue Tracking Systems (ITS) have become mainstream project management tools, with over 65,000 companies using Jira alone. ITS are an untapped resource for issue resolution effort research. Related work investigates issue effort for specific issue types, usually Bugs or similar. They model their developer-documented issue resolution times using features from the issues themselves. This thesis explores a …

Advanced Full-Text Search Based On Synonyms In Postgres, Joey Bodoia

CMC Senior Theses

This paper discusses the advanced full-text search queries based on synonyms that are supported in Chajda, which is a postgres extension and corresponding python library for highly multi-lingual full-text search in postgres. This discussion will include the motivations for using advanced queries based on synonyms, examples of how to use these advanced queries in Chajda, current limitiations of the advanced queries, and performance testing of the advanced queries.

Enjoy Your Observability: An Industrial Survey Of Microservice Tracing And Analysis, Bowen Li, Xin Peng, Qilin Xiang, Hanzhang Wang, Tao Xie, Jun Sun, Xuanzhe Liu

Research Collection School Of Computing and Information Systems

Microservice systems are often deployed in complex cloud-based environments and may involve a large number of service instances being dynamically created and destroyed. It is thus essential to ensure observability to understand these microservice systems’ behaviors and troubleshoot their problems. As an important means to achieve the observability, distributed tracing and analysis is known to be challenging. While many companies have started implementing distributed tracing and analysis for microservice systems, it is not clear whether existing approaches fulfill the required observability. In this article, we present our industrial survey on microservice tracing and analysis through interviewing developers and operation engineers …

A Quantum Interpretation Of Separating Conjunction For Local Reasoning Of Quantum Programs Based On Separation Logic, Xuan Bach Le, Shang-Wei Lin, Jun Sun, David Sanan

Research Collection School Of Computing and Information Systems

It is well-known that quantum programs are not only complicated to design but also challenging to verify because the quantum states can have exponential size and require sophisticated mathematics to encode and manipulate. To tackle the state-space explosion problem for quantum reasoning, we propose a Hoare-style inference framework that supports local reasoning for quantum programs. By providing a quantum interpretation of the separating conjunction, we are able to infuse separation logic into our framework and apply local reasoning using a quantum frame rule that is similar to the classical frame rule. For evaluation, we apply our framework to verify various …

Translations To Support Loop Invariant Generation In Jml, Kohei Koja

Electronic Theses and Dissertations, 2020-2023

Software is used in many critical systems in the real world such as autonomous cars and medical devices. Such software must be reliable to protect the general public. One standard way to make reliable software is to use Hoare-style verification techniques. However, for Hoare-style verification of loop correctness, loop invariants are necessary but are difficult for people to write themselves. Since Java is one of the most popular programming languages in the world, it is useful to have a tool to generate loop invariants for Java programs. OpenJML is a widely used program verification tool for Java. However, it does …

Reflecting On Recurring Failures In Iot Development, Dharun Anandayuvaraj, James C. Davis

Department of Electrical and Computer Engineering Faculty Publications

As IoT systems are given more responsibility and autonomy, they offer greater benefits, but also carry greater risks. We believe this trend invigorates an old challenge of software engineering: how to develop high-risk software-intensive systems safely and securely under market pressures? As a first step, we conducted a systematic analysis of recent IoT failures to identify engineering challenges. We collected and analyzed 22 news reports and studied the sources, impacts, and repair strategies of failures in IoT systems. We observed failure trends both within and across application domains. We also observed that failure themes have persisted over time. To alleviate …

Reflections On Software Failure Analysis, Paschal C. Amusuo, Aishwarya Sharma, Siddharth R. Rao, Abbey Vincent, James C. Davis

Department of Electrical and Computer Engineering Faculty Publications

Failure studies are important in revealing the root causes, behaviors, and life cycle of defects in software systems. These studies either focus on understanding the characteristics of defects in specific classes of systems or the characteristics of a specific type of defect in the systems it manifests in. Failure studies have influenced various software engineering research directions, especially in the area of software evolution, defect detection, and program repair.

In this paper, we reflect on the conduct of failure studies in software engineering. We reviewed a sample of 52 failure study papers. We identified several recurring problems in these studies, …

Sok: Analysis Of Software Supply Chain Security By Establishing Secure Design Properties, Chinenye Okafor, Taylor R. Schorlemmer, Santiao Torres-Arias, James C. Davis

Department of Electrical and Computer Engineering Faculty Publications

This paper systematizes knowledge about secure software supply chain patterns. It identifies four stages of a software supply chain attack and proposes three security properties crucial for a secured supply chain: transparency, validity, and separation. The paper describes current security approaches and maps them to the proposed security properties, including research ideas and case studies of supply chains in practice. It discusses the strengths and weaknesses of current approaches relative to known attacks and details the various security frameworks put out to ensure the security of the software supply chain. Finally, the paper highlights potential gaps in actor and operation-centered …

Exploiting Input Sanitization For Regex Denial Of Service, Efe Barlas, Xin Du, James C. Davis

Department of Electrical and Computer Engineering Faculty Publications

Web services use server-side input sanitization to guard against harmful input. Some web services publish their sanitization logic to make their client interface more usable, e.g., allowing clients to debug invalid requests locally. However, this usability practice poses a security risk. Specifically, services may share the regexes they use to sanitize input strings — and regex-based denial of service (ReDoS) is an emerging threat. Although prominent service outages caused by ReDoS have spurred interest in this topic, we know little about the degree to which live web services are vulnerable to ReDoS.

In this paper, we conduct the first black-box …

Discrepancies Among Pre-Trained Deep Neural Networks: A New Threat To Model Zoo Reliability, Diego Montes, Pongpatapee Peerapatanapokin, Jeff Schultz, Chengjun Guo, Wenxin Jiang, James C. Davis

Department of Electrical and Computer Engineering Faculty Publications

Training deep neural networks (DNNs) takes significant time and resources. A practice for expedited deployment is to use pre-trained deep neural networks (PTNNs), often from model zoos.collections of PTNNs; yet, the reliability of model zoos remains unexamined. In the absence of an industry standard for the implementation and performance of PTNNs, engineers cannot confidently incorporate them into production systems. As a first step, discovering potential discrepancies between PTNNs across model zoos would reveal a threat to model zoo reliability. Prior works indicated existing variances in deep learning systems in terms of accuracy. However, broader measures of reliability for PTNNs from …

An Empirical Study On The Impact Of Deep Parameters On Mobile App Energy Usage, Qiang Xu, James C. Davis, Y Charlie Hu, Abhilash Jindal

Department of Electrical and Computer Engineering Faculty Publications

Improving software performance through configuration parameter tuning is a common activity during software maintenance. Beyond traditional performance metrics like latency, mobile app developers are interested in reducing app energy usage. Some mobile apps have centralized locations for parameter tuning, similar to databases and operating systems, but it is common for mobile apps to have hundreds of parameters scattered around the source code. The correlation between these "deep" parameters and app energy usage is unclear. Researchers have studied the energy effects of deep parameters in specific modules, but we lack a systematic understanding of the energy impact of mobile deep parameters. …

Learn Programming In Virtual Reality? A Project For Computer Science Students, Benjamin Alexander

Electronic Theses, Projects, and Dissertations

This paper presents the development of a new learning platform in Virtual Reality to create a more immersive and intuitive learning experience for introduction of programming courses at an intermediate level. This platform is designed to create a central hub for interactive courseware and facilitate distance learning in our post COVID world. Utilizing Virtual Reality, the application teaches specific topics in Computer Science using scripted animations, tutorials, and interactive games. A pilot study was conducted to evaluate the user experience and learning outcomes. Participants of this study reported they were more engaged and motivated in learning programing concepts. We found …

Canvas Autoquiz, Archit Jain

Master's Projects

Online learning management platforms such as Canvas are thriving and quickly replacing traditional classrooms, especially during these pandemic-struck times. As more and more quizzes are administered online, we need tools that make the quiz creation process easier and faster. Canvas Autoquiz is a command-line tool that allows instructors to automatically create and upload quizzes of varying difficulty levels. It also allows instructors to export quizzes from one LMS platform to another. This project explores the need, design, and implementation of the tool, and prospective future work.

Just-In-Time Defect Identification And Localization: A Two-Phase Framework, Meng Yan, Xin Xia, Yuanrui Fan, Ahmed E. Hassan, David Lo, Shanping Li

Research Collection School Of Computing and Information Systems

Defect localization aims to locate buggy program elements (e.g., buggy files, methods or lines of code) based on defect symptoms, e.g., bug reports or program spectrum. However, when we receive the defect symptoms, the defect has been exposed and negative impacts have been introduced. Thus, one challenging task is: whether we can locate buggy program prior to appearance of the defect symptom at an early time (e.g., when buggy program elements are being checked-in). We refer to this type of defect localization as “Just-In-Time (JIT) Defect localization”. Although many prior studies have proposed various JIT defect identification methods to identify …

"More Than Deep Learning": Post-Processing For Api Sequence Recommendation, Chi Chen, Xin Peng, Bihuan Chen, Jun Sun, Zhenchang Xing, Xin Wang, Wenyun Zhao

Research Collection School Of Computing and Information Systems

In the daily development process, developers often need assistance in finding a sequence of APIs to accomplish their development tasks. Existing deep learning models, which have recently been developed for recommending one single API, can be adapted by using encoder-decoder models together with beam search to generate API sequence recommendations. However, the generated API sequence recommendations heavily rely on the probabilities of API suggestions at each decoding step, which do not take into account other domain-specific factors (e.g., whether an API suggestion satisfies the program syntax and how diverse the API sequence recommendations are). Moreover, it is difficult for developers …

Defining Smart Contract Defects On Ethereum, Jiachi Chen, Xin Xia, David Lo, John Grundy, Xiapu Luo, Ting Chen

Research Collection School Of Computing and Information Systems

Smart contracts are programs running on a blockchain. They are immutable to change, and hence can not be patched for bugs once deployed. Thus it is critical to ensure they are bug-free and well-designed before deployment. A Contract defect is an error, flaw or fault in a smart contract that causes it to produce an incorrect or unexpected result, or to behave in unintended ways. The detection of contract defects is a method to avoid potential bugs and improve the design of existing code. Since smart contracts contain numerous distinctive features, such as the gas system. decentralized, it is important …

On The Reproducibility And Replicability Of Deep Learning In Software Engineering, Chao Liu, Cuiyun Gao, Xin Xia, David Lo, John C. Grundy, Xiaohu Yang

Research Collection School Of Computing and Information Systems

Context: Deep learning (DL) techniques have gained significant popularity among software engineering (SE) researchers in recent years. This is because they can often solve many SE challenges without enormous manual feature engineering effort and complex domain knowledge.Objective: Although many DL studies have reported substantial advantages over other state-of-the-art models on effectiveness, they often ignore two factors: (1) reproducibility—whether the reported experimental results can be obtained by other researchers using authors’ artifacts (i.e., source code and datasets) with the same experimental setup; and (2) replicability—whether the reported experimental result can be obtained by other researchers using their re-implemented artifacts with a …

Predictive Models In Software Engineering: Challenges And Opportunities, Yanming Yang, Xin Xia, David Lo, Tingting Bi, John C. Grundy, Xiaohu Yang

Research Collection School Of Computing and Information Systems

Predictive models are one of the most important techniques that are widely applied in many areas of software engineering. There have been a large number of primary studies that apply predictive models and that present well-performed studies in various research domains, including software requirements, software design and development, testing and debugging, and software maintenance. This article is a first attempt to systematically organize knowledge in this area by surveying a body of 421 papers on predictive models published between 2009 and 2020. We describe the key models and approaches used, classify the different models, summarize the range of key application …

Codematcher: Searching Code Based On Sequential Semantics Of Important Query Words, Chao Liu, Xin Xia, David Lo, Zhiwei Liu, Ahmed E. Hassan, Shanping Li

Research Collection School Of Computing and Information Systems

To accelerate software development, developers frequently search and reuse existing code snippets from a large-scale codebase, e.g., GitHub. Over the years, researchers proposed many information retrieval (IR)-based models for code search, but they fail to connect the semantic gap between query and code. An early successful deep learning (DL)-based model DeepCS solved this issue by learning the relationship between pairs of code methods and corresponding natural language descriptions. Two major advantages of DeepCS are the capability of understanding irrelevant/noisy keywords and capturing sequential relationships between words in query and code. In this article, we proposed an IR-based model CodeMatcher that …

Just-In-Time Defect Prediction On Javascript Projects: A Replication Study, Chao Ni, Xin Xia, David Lo, Xiaohu Yang, Ahmed E. Hassan

Research Collection School Of Computing and Information Systems

Change-level defect prediction is widely referred to as just-in-time (JIT) defect prediction since it identifies a defect-inducing change at the check-in time, and researchers have proposed many approaches based on the language-independent change-level features. These approaches can be divided into two types: supervised approaches and unsupervised approaches, and their effectiveness has been verified on Java or C++ projects. However, whether the language-independent change-level features can effectively identify the defects of JavaScript projects is still unknown. Additionally, many researches have confirmed that supervised approaches outperform unsupervised approaches on Java or C++ projects when considering inspection effort. However, whether supervised JIT defect …

Correlating Automated And Human Evaluation Of Code Documentation Generation Quality, Xing Hu, Qiuyuan Chen, Haoye Wang, Xin Xia, David Lo, Thomas Zimmermann

Research Collection School Of Computing and Information Systems

Automatic code documentation generation has been a crucial task in the field of software engineering. It not only relieves developers from writing code documentation but also helps them to understand programs better. Specifically, deep-learning-based techniques that leverage large-scale source code corpora have been widely used in code documentation generation. These works tend to use automatic metrics (such as BLEU, METEOR, ROUGE, CIDEr, and SPICE) to evaluate different models. These metrics compare generated documentation to reference texts by measuring the overlapping words. Unfortunately, there is no evidence demonstrating the correlation between these metrics and human judgment. We conduct experiments on two …

A Survey On Deep Learning For Software Engineering, Yanming Yang, Xin Xia, David Lo

Research Collection School Of Computing and Information Systems

In 2006, Geoffrey Hinton proposed the concept of training "Deep Neural Networks (DNNs)" and an improved model training method to break the bottleneck of neural network development. More recently, the introduction of AlphaGo in 2016 demonstrated the powerful learning ability of deep learning and its enormous potential. Deep learning has been increasingly used to develop state-of-the-art software engineering (SE) research tools due to its ability to boost performance for various SE tasks. There are many factors, e.g., deep learning model selection, internal structure differences, and model optimization techniques, that may have an impact on the performance of DNNs applied in …

Evaluation Of Continuous Power-Down Schemes, James Andro-Vasko, Wolfgang Bein

Computer Science Faculty Research

We consider a power-down system with two states—“on” and “off”—and a continuous set of power states. The system has to respond to requests for service in the “on” state and, after service, the system can power off or switch to any of the intermediate power-saving states. The choice of states determines the cost to power on for subsequent requests. The protocol for requests is “online”, which means that the decision as to which intermediate state (or the off-state) the system will switch has to be made without knowledge of future requests. We model a linear and a non-linear system, and …

Novel Architecture Of Onem2m-Based Convergence Platform For Mixed Reality And Iot, Seungwoon Lee, Woogeun Kil, Byeong Hee Roh, Si-Jung Kim, Jin Suk Kang

College of Engineering Faculty Research

There have been numerous works proposed to merge augmented reality/mixed reality (AR/MR) and Internet of Things (IoT) in various ways. However, they have focused on their specific target applications and have limitations on interoperability or reusability when utilizing them to different domains or adding other devices to the system. This paper proposes a novel architecture of a convergence platform for AR/MR and IoT systems and services. The proposed architecture adopts the oneM2M IoT standard as the basic framework that converges AR/MR and IoT systems and enables the development of application services used in general-purpose environments without being subordinate to specific …

Developing A Virtual Modular Synthesizer For Sound Waves And Midi, Margaret Jagger

Senior Independent Study Theses

Modular synthesis involves the alteration and modification of digital sound signals. Thus, this modular synthesizer allows a user the option of supplying their own MIDI-compatible controller to serve as an input source, or to use the built-in pure sound waves instead. Either input will be fed into the domain-specific language SuperCollider and altered, with specific sound modifications dependent on the input source used. Using theoretical knowledge of the physics behind the motion of sound waves, various modules and functionalities are created. Then, with SuperCollider, these modules are implemented into a synthesizer which accepts either pure sound waves or MIDI as …

Taming The Data In The Internet Of Vehicles, Shahab Tayeb

Mineta Transportation Institute

As an emerging field, the Internet of Vehicles (IoV) has a myriad of security vulnerabilities that must be addressed to protect system integrity. To stay ahead of novel attacks, cybersecurity professionals are developing new software and systems using machine learning techniques. Neural network architectures improve such systems, including Intrusion Detection System (IDSs), by implementing anomaly detection, which differentiates benign data packets from malicious ones. For an IDS to best predict anomalies, the model is trained on data that is typically pre-processed through normalization and feature selection/reduction. These pre-processing techniques play an important role in training a neural network to optimize …

Github Discussions: An Exploratory Study Of Early Adoption, Hideaki Hata, Nicole Novielli, Sebastian Baltes, Raula Kula, Christoph Treude

Research Collection School Of Computing and Information Systems

Discussions is a new feature of GitHub for asking questions or discussing topics outside of specific Issues or Pull Requests. Before being available to all projects in December 2020, it had been tested on selected open source software projects. To understand how developers use this novel feature, how they perceive it, and how it impacts the development processes, we conducted a mixed-methods study based on early adopters of GitHub discussions from January until July 2020. We found that: (1) errors, unexpected behavior, and code reviews are prevalent discussion categories; (2) there is a positive relationship between project member involvement and …