Redriver: Runtime Enforcement For Autonomous Vehicles,
2024
Singapore Management University
Redriver: Runtime Enforcement For Autonomous Vehicles, Yang Sun, Christopher M. Poskitt, Xiaodong Zhang, Jun Sun
Research Collection School Of Computing and Information Systems
Autonomous driving systems (ADSs) integrate sensing, perception, drive control, and several other critical tasks in autonomous vehicles, motivating research into techniques for assessing their safety. While there are several approaches for testing and analysing them in high-fidelity simulators, ADSs may still encounter additional critical scenarios beyond those covered once they are deployed on real roads. An additional level of confidence can be established by monitoring and enforcing critical properties when the ADS is running. Existing work, however, is only able to monitor simple safety properties (e.g., avoidance of collisions) and is limited to blunt enforcement mechanisms such as hitting the …
Marco: A Stochastic Asynchronous Concolic Explorer,
2024
Singapore Management University
Marco: A Stochastic Asynchronous Concolic Explorer, Jie Hu, Yue Duan, Heng Yin
Research Collection School Of Computing and Information Systems
Concolic execution is a powerful program analysis technique for code path exploration. Despite recent advances that greatly improved the efficiency of concolic execution engines, path constraint solving remains a major bottleneck of concolic testing. An intelligent scheduler for inputs/branches becomes even more crucial. Our studies show that the previously under-studied branch-flipping policy adopted by state-of-the-art concolic execution engines has several limitations. We propose to assess each branch by its potential for new code coverage from a global view, concerning the path divergence probability at each branch. To validate this idea, we implemented a prototype Marco and evaluated it against the …
Beyond A Joke: Dead Code Elimination Can Delete Live Code,
2024
Singapore Management University
Beyond A Joke: Dead Code Elimination Can Delete Live Code, Haoxin Tu, Lingxiao Jiang, Debin Gao, He Jiang
Research Collection School Of Computing and Information Systems
Dead Code Elimination (DCE) is a fundamental compiler optimization technique that removes dead code (e.g., unreachable or reachable but whose results are unused) in the program to produce smaller or faster executables. However, since compiler optimizations are typically aggressively performed and there are complex relationships/interplay among a vast number of compiler optimizations (including DCE), it is not known whether DCE is indeed correctly performed and will only delete dead code in practice. In this study, we open a new research problem to investigate: can DCE happen to erroneously delete live code? To tackle this problem, we design a new approach …
Elevating Academic Administration: A Comprehensive Faculty Dashboard For Tracking Student Evaluations And Research,
2024
University of South Carolina
Elevating Academic Administration: A Comprehensive Faculty Dashboard For Tracking Student Evaluations And Research, Musa M. Azeem
Senior Theses
The USC Faculty Dashboard is a web application designed to revolutionize how department heads, professors, and instructors monitor progress and make decisions, providing a centralized hub for efficient data storage and analysis. Currently, there’s a gap in tools tailored for department heads to concisely manage the performance of their department, which our platform aims to fill. The USC Faculty Dashboard offers easy access to upload and view student evaluation and research information, empowering department heads to evaluate the performance of faculty members and seamlessly track their research grants, publications, and expenditures. Furthermore, professors and instructors gain personalized performance analysis tools, …
Nookipedia,
2024
St. Mary's University
Nookipedia, Shyann Francis
Posters - 2024
Animal Crossing involves managing around 9000 items within a gameplay environment. This abundance of items makes it difficult for players to effectively track progress and navigate through their possessions. The primary motivation of Nookipedia is to enhance overall gameplay experience by streamlining achievement management, thereby reducing unnecessary interactions with non-playable characters (NPCs) and enabling players to focus more on core game activities. By improving inventory organization and reducing clutter, the aim is to create a smoother and more immersive gaming experience for players.
Extracting Relevant Test Inputs From Bug Reports For Automatic Test Case Generation,
2024
Singapore Management University
Extracting Relevant Test Inputs From Bug Reports For Automatic Test Case Generation, Wendkuuni C. Ouédraogo, Laura Plein, Kader Kaboré, Andrew Habib, Jacques Klein, David Lo, Tegawende F. Bissyandé
Research Collection School Of Computing and Information Systems
The pursuit of automating software test case generation, particularly for unit tests, has become increasingly important due to the labor-intensive nature of manual test generation [6]. However, a significant challenge in this domain is the inability of automated approaches to generate relevant inputs, which compromises the efficacy of the tests [6].
Unleashing The Power Of Clippy In Real-World Rust Projects,
2024
Singapore Management University
Unleashing The Power Of Clippy In Real-World Rust Projects, Chunmiao Li, Yijun Yu, Haitao Wu, Luca Carlig, Shijie Nie, Lingxiao Jiang
Research Collection School Of Computing and Information Systems
The error messages generated by the Rust compiler (rustc) are useful for developers to identify and diagnose suspicious code segments. Complementing the compiler, linters can also play an important role in promoting the adherence to certain coding style conventions and best practices. Prominent linters utilized in the Rust ecosystem include Clippy [1] and Rustfmt [2]. Among them, the Rust community particularly emphasizes on the importance of heeding the warnings provided by Clippy to mitigate common errors and promote the adoption of idiomatic conventions. Clippy provides a set of more than 600 lints in addition to the built-in rustc lints. These …
Bidirectional Paper-Repository Tracing In Software Engineering,
2024
Singapore Management University
Bidirectional Paper-Repository Tracing In Software Engineering, Daniel Garijo, Miguel Arroyo, Esteban González Guardia, Christoph Treude, Nicola Tarocco
Research Collection School Of Computing and Information Systems
While computer science papers frequently include their associated code repositories, establishing a clear link between papers and their corresponding implementations may be challenging due to the number of code repositories used in research publications. In this paper we describe a lightweight method for effectively identifying bidirectional links between papers and repositories from both LaTeX and PDF sources. We have used our approach to analyze more than 14000 PDF and Latex files in the Software Engineering category of Arxiv, generating a dataset of more than 1400 paper-code implementations and assessing current citation practices on it.
Going Viral: Case Studies On The Impact Of Protestware,
2024
Singapore Management University
Going Viral: Case Studies On The Impact Of Protestware, Youmei Fan, Dong Wang, Supastsara Wattanakriengkrai, Hathaichanok Damrongsiri, Christoph Treude, Hideaki Hata, Raula Gaikovina Kula
Research Collection School Of Computing and Information Systems
Maintainers are now self-sabotaging their work in order to take political or economic stances, a practice referred to as "protestware". In this poster, we present our approach to understand how the discourse about such an attack went viral, how it is received by the community, and whether developers respond to the attack in a timely manner. We study two notable protestware cases, i.e., Colors.js and es5-ext, comparing with discussions of a typical security vulnerability as a baseline, i.e., Ua-parser, and perform a thematic analysis of more than two thousand protest-related posts to extract the different narratives when discussing protestware.
Enhancing Source Code Representations For Deep Learning With Static Analysis,
2024
Singapore Management University
Enhancing Source Code Representations For Deep Learning With Static Analysis, Xueting Guan, Christoph Treude
Research Collection School Of Computing and Information Systems
Deep learning techniques applied to program analysis tasks such as code classification, summarization, and bug detection have seen widespread interest. Traditional approaches, however, treat programming source code as natural language text, which may neglect significant structural or semantic details. Additionally, most current methods of representing source code focus solely on the code, without considering beneficial additional context. This paper explores the integration of static analysis and additional context such as bug reports and design patterns into source code representations for deep learning models. We use the Abstract Syntax Tree-based Neural Network (ASTNN) method and augment it with additional context information …
Minimon: Minimizing Android Applications With Intelligent Monitoring-Based Debloating,
2024
Singapore Management University
Minimon: Minimizing Android Applications With Intelligent Monitoring-Based Debloating, Jiakun Liu, Zicheng Zhang, Xing Hu, Thung Ferdian, Shahar Maoz, Debin Gao, Eran Toch, Zhipeng Zhao, David Lo
Research Collection School Of Computing and Information Systems
The size of Android applications is getting larger to fulfill the requirements of various users. However, not all the features of the applications are needed and desired by a specific user. The unnecessary and non-desired features can increase the attack surface and consume system resources such as storage and memory. To address this issue, we propose a framework, MiniMon, to debloat unnecessary features from an Android app based on the logs of specific users' interactions with the app.However, rarely used features may not be recorded during the data collection, and users' preferences may change slightly over time. To address these …
Assessing Ai Detectors In Identifying Ai-Generated Code: Implications For Education,
2024
Singapore Management University
Assessing Ai Detectors In Identifying Ai-Generated Code: Implications For Education, Wei Hung Pan, Ming Jie Chok, Jonathan Leong Shan Wong, Yung Xin Shin, Yeong Shian Poon, Zhou Yang, Chun Yong Chong, David Lo, Mei Kuan Lim
Research Collection School Of Computing and Information Systems
Educators are increasingly concerned about the usage of Large Language Models (LLMs) such as ChatGPT in programming education, particularly regarding the potential exploitation of imperfections in Artificial Intelligence Generated Content (AIGC) Detectors for academic misconduct.In this paper, we present an empirical study where the LLM is examined for its attempts to bypass detection by AIGC Detectors. This is achieved by generating code in response to a given question using different variants. We collected a dataset comprising 5,069 samples, with each sample consisting of a textual description of a coding problem and its corresponding human-written Python solution codes. These samples were …
Out Of Sight, Out Of Mind: Better Automatic Vulnerability Repair By Broadening Input Ranges And Sources,
2024
Singapore Management University
Out Of Sight, Out Of Mind: Better Automatic Vulnerability Repair By Broadening Input Ranges And Sources, Xin Zhou, Kisub Kim, Bowen Xu, Donggyun Han, David Lo
Research Collection School Of Computing and Information Systems
The advances of deep learning (DL) have paved the way for automatic software vulnerability repair approaches, which effectively learn the mapping from the vulnerable code to the fixed code. Nevertheless, existing DL-based vulnerability repair methods face notable limitations: 1) they struggle to handle lengthy vulnerable code, 2) they treat code as natural language texts, neglecting its inherent structure, and 3) they do not tap into the valuable expert knowledge present in the expert system. To address this, we propose VulMaster, a Transformer-based neural network model that excels at generating vulnerability repairs by comprehensively understanding the entire vulnerable code, irrespective of …
Coca: Improving And Explaining Graph Neural Network-Based Vulnerability Detection Systems,
2024
Singapore Management University
Coca: Improving And Explaining Graph Neural Network-Based Vulnerability Detection Systems, Sicong Cao, Xiaobing Sun, Xiaoxue Wu, David Lo, Lili Bo, Bin Li, Wei Liu
Research Collection School Of Computing and Information Systems
Recently, Graph Neural Network (GNN)-based vulnerability detection systems have achieved remarkable success. However, the lack of explainability poses a critical challenge to deploy black-box models in security-related domains. For this reason, several approaches have been proposed to explain the decision logic of the detection model by providing a set of crucial statements positively contributing to its predictions. Unfortunately, due to the weakly-robust detection models and suboptimal explanation strategy, they have the danger of revealing spurious correlations and redundancy issue.In this paper, we propose Coca, a general framework aiming to 1) enhance the robustness of existing GNN-based vulnerability detection models to …
Ppt4j: Patch Presence Test For Java Binaries,
2024
Singapore Management University
Ppt4j: Patch Presence Test For Java Binaries, Zhiyuan Pan, Xing Hu, Xin Xia, Xian Zhan, David Lo, Xiaohu Yang
Research Collection School Of Computing and Information Systems
The number of vulnerabilities reported in open source software has increased substantially in recent years. Security patches provide the necessary measures to protect software from attacks and vulnerabilities. In practice, it is difficult to identify whether patches have been integrated into software, especially if we only have binary files. Therefore, the ability to test whether a patch is applied to the target binary, a.k.a. patch presence test, is crucial for practitioners. However, it is challenging to obtain accurate semantic information from patches, which could lead to incorrect results.In this paper, we propose a new patch presence test framework named Ppt4J …
Exploiting Library Vulnerability Via Migration-Based Automated Test Generation,
2024
Singapore Management University
Exploiting Library Vulnerability Via Migration-Based Automated Test Generation, Zirui Chen, Xing Hu, Xin Xia, Yi Gao, Tongtong Xu, David Lo, Xiaohu Yang
Research Collection School Of Computing and Information Systems
In software development, developers extensively utilize third-party libraries to avoid implementing existing functionalities. When a new third-party library vulnerability is disclosed, project maintainers need to determine whether their projects are affected by the vulnerability, which requires developers to invest substantial effort in assessment. However, existing tools face a series of issues: static analysis tools produce false alarms, dynamic analysis tools require existing tests and test generation tools have low success rates when facing complex vulnerabilities.Vulnerability exploits, as code snippets provided for reproducing vulnerabilities after disclosure, contain a wealth of vulnerability-related information. This study proposes a new method based on vulnerability …
Mut: Human-In-The-Loop Unit Test Migration,
2024
Singapore Management University
Mut: Human-In-The-Loop Unit Test Migration, Yi Gao, Xing Hu, Tongtong Xu, Xin Xia, David Lo, Xiaohu Yang
Research Collection School Of Computing and Information Systems
Test migration, which enables the reuse of test cases crafted with knowledge and creativity by testers across various platforms and programming languages, has exhibited effectiveness in mobile app testing. However, unit test migration at the source code level has not garnered adequate attention and exploration. In this paper, we propose a novel cross-language and cross-platform test migration methodology, named MUT, which consists of four modules: code mapping, test case filtering, test case translation, and test case adaptation. MUT initially calculates code mappings to establish associations between source and target projects, and identifies suitable unit tests for migration from the source …
Curiosity-Driven Testing For Sequential Decision-Making Process,
2024
Singapore Management University
Curiosity-Driven Testing For Sequential Decision-Making Process, Junda He, Zhou Yang, Jieke Shi, Chengran Yang, Kisub Kim, Bowen Xu, Xin Zhou, David Lo
Research Collection School Of Computing and Information Systems
Sequential decision-making processes (SDPs) are fundamental for complex real-world challenges, such as autonomous driving, robotic control, and traffic management. While recent advances in Deep Learning (DL) have led to mature solutions for solving these complex problems, SDMs remain vulnerable to learning unsafe behaviors, posing significant risks in safety-critical applications. However, developing a testing framework for SDMs that can identify a diverse set of crash-triggering scenarios remains an open challenge. To address this, we propose CureFuzz, a novel curiosity-driven black-box fuzz testing approach for SDMs. CureFuzz proposes a curiosity mechanism that allows a fuzzer to effectively explore novel and diverse scenarios, …
Towards Speedy Permission-Based Debloating For Android Apps,
2024
Singapore Management University
Towards Speedy Permission-Based Debloating For Android Apps, Thung Ferdian, Jiakun Liu, Pattarakrit Rattanukul, Shahar Maoz, Eran Toch, Debin Gao, David Lo
Research Collection School Of Computing and Information Systems
Android apps typically include many functionalities that not all users require. These result in software bloat that increases possible attack surface and app size. Common functionalities that users may not require are related to permissions that they intend to disallow in the first place. As these permissions are disallowed, their related code would never be executed and therefore can be safely removed. Existing work has proposed a solution to debloat Android apps according to the disallowed permissions. However, for large and complex applications, the debloating process could take hours, typically due the long time that may be needed to construct …
Concretely Mapped Symbolic Memory Locations For Memory Error Detection,
2024
Singapore Management University
Concretely Mapped Symbolic Memory Locations For Memory Error Detection, Haoxin Tu, Lingxiao Jiang, Jiaqi Hong, Xuhua Ding, He Jiang
Research Collection School Of Computing and Information Systems
Memory allocation is a fundamental operation for managing memory objects in many programming languages. Misusing allocated memory objects (e.g., buffer overflow and use-after-free) can lead to catastrophic consequences. Symbolic execution-based approaches are often used to detect such memory errors, leveraging their capabilities in automatic path exploration and test case generation. However, existing symbolic execution engines face significant limitations in modeling dynamic memory layouts. These engines either represent memory object locations as concrete addresses, limiting analyses to specific address layouts and missing errors that occur at special addresses, or represent locations as simple symbolic variables without sufficient constraints, resulting in memory …
