Programs are becoming increasingly complex and typically contain an abundance of unneeded features, which could severely harm performance and security. Recently, we have witnessed a surge of debloating techniques that aim to create a reduced version of a program by eliminating the unneeded features therein. To debloat a program, most existing techniques require a usage profile of the program, typically provided as a set of inputs $I$. Unfortunately, these techniques tend to generate a reduced program that is overfitted to $I$ and thus fails to behave correctly for other inputs. To address this limitation of existing techniques, we propose DomGad, which has two main advantages over existing debloating approaches. First, it produces a reduced program that is guaranteed to work for entire subdomains, rather than for specific inputs. Second, it uses stochastic optimization to generate reduced programs that achieve a close-to-optimal trade-off between size reduction and generality (i.e., extent to which the reduced program is able to correctly handle inputs in its whole domain). To assess the effectiveness of DomGad, we applied our approach to a benchmark of ten Unix utility programs. Our results are promising, as they show that DomGad could produce debloated programs that achieve, on average, a 50% code reduction and 95% generality. Our results also show that DomGad performs well when compared with two state-of-the-art debloating approaches.

Qi Xin

Georgia Institute of Technology

United States

Myeongsoo Kim

Georgia Institute of Technology

United States

Qirun Zhang

Georgia Institute of Technology, USA

Alessandro Orso

Georgia Tech

United States

The research community has long recognized a complex interrelationship between test set size, test adequacy criteria, and test effectiveness in terms of fault detection. However, there is substantial confusion about the role and importance of controlling for test set size when assessing and comparing test adequacy criteria. This paper makes the following contributions: (1) A review of contradictory analyses of the relationship between fault detection, test set size, and test adequacy criteria. Specifically, this paper addresses the supposed contradiction of prior work and explains why test set size is neither a confounding variable, as previously suggested, nor an independent variable that should be experimentally manipulated. (2) An explication and discussion of the experimental design and sampling strategies of prior work, together with a discussion of conceptual and statistical problems, and specific guidelines for future work. (3) A methodology for comparing test-adequacy criteria on an equal basis, which accounts for test set size by treating it as a covariate. (4) An empirical evaluation that compares the effectiveness of coverage-based and mutation-based testing to one another and random testing. Additionally, this paper proposes probabilistic coupling, a methodology for approximating the representativeness of a set of test goals for a given set of real faults.

Yiqun Chen

University of Washington

Rahul Gopinath

CISPA Helmholtz Center for Information Security

Germany

Anita Tadakamalla

George Mason University, USA

United States

Michael D. Ernst

University of Washington, USA

Reid Holmes

University of British Columbia

Canada

Gordon Fraser

University of Passau

Germany

Paul Ammann

George Mason University, USA

René Just

University of Washington, USA

WebAssembly is a new programming language built for better performance in web applications. It defines a binary code format and a text representation for the code. At first glance, WebAssembly files are not easily understandable to human readers, regardless of the experience level. As a result, distributed third-party WebAssembly modules need to be implicitly trusted by developers as verifying the functionality requires significant effort. To this end, we develop an automated classification tool WASim for identifying the purpose of WebAssembly programs by analyzing features at the module-level. It assigns purpose labels to a module in order to assist developers in understanding the binary module. The code for WASim is available at https://github.com/WASimilarity/WASim and a video demo is available at https://youtu.be/usfYFIeTy0U.

Alan Romano

University at Buffalo, SUNY

United States

Weihang Wang

University at Buffalo, SUNY

United States

In this paper, we present Sosed, a tool for discovering similar software projects. We use fastText to compute the embeddings of sub-tokens into a dense space for 120,000 GitHub repositories in 200 languages. Then, we cluster embeddings to identify groups of semantically similar sub-tokens that reflect topics in source code. We use a dataset of 9 million GitHub projects as a reference search base. To identify similar projects, we compare the distributions of clusters among their sub-tokens. The tool receives an arbitrary project as input, extracts sub-tokens in 16 most popular programming languages, computes cluster distribution, and finds projects with the closest distribution in the search base. We labeled sub-token clusters with short descriptions to enable Sosed to produce interpretable output.

Sosed is available at https://github.com/JetBrains-Research/sosed/. The tool demo is available at https://www.youtube.com/watch?v=LYLkztCGRt8. The multi-language extractor of sub-tokens is available separately at https://github.com/JetBrains-Research/identifiers-extractor/.

Egor Bogomolov

JetBrains Research

Yaroslav Golubev

JetBrains Research, ITMO University

Russia

Artyom Lobanov

JetBrains Research

Vladimir Kovalenko

JetBrains Research, JetBrains N.V.

Timofey Bryksin

JetBrains Research, Saint Petersburg State University

Russia

Just-In-Time (JIT) defect prediction is a classification model that is trained using historical data to predict bug-introducing changes. However, recent studies raised concerns related to the explainability of the predictions of many software analytics applications (i.e., practitioners do not understand why commits are risky and how to improve them). In addition, the adoption of Just-In-Time defect prediction is still limited due to a lack of integration into CI/CD pipelines and modern software development platforms (e.g., GitHub). In this paper, we present an explainable Just-In-Time defect prediction framework to automatically generate feedback to developers by providing the riskiness of each commit, explaining why such commit is risky, and suggesting risk mitigation plans. The proposed framework is integrated into the GitHub CI/CD pipeline as a GitHub application to continuously monitor and analyse a stream of commits in many GitHub repositories. Finally, we discuss the usage scenarios and their implications to practitioners. The VDO demonstration is available at https://youtu.be/HJBzULrS6hE.

Chaiyakarn Khanan

Mahidol University

Worawit Luewichana

Mahidol University

Krissakorn Pruktharathikoon

Mahidol University

Jirayus Jiarpakdee

Monash University, Australia

Chakkrit (Kla) Tantithamthavorn

Monash University, Australia

Australia

Morakot Choetkiertikul

Mahidol University, Thailand

Thailand

Chaiyong Rakhitwetsagul

Mahidol University, Thailand

Thailand

Thanwadee Sunetnanta

Mahidol University

Using open-source libraries can provide rich functions and reduce development cost. However, some critical issues have also been caused such as license conflicts and vulnerability risks. In this paper, we design and implement an open-source libraries detection tool OSLDetector which uses methods of matching features to detect third-party libraries for multi-platform software in binaries. We took a series of methods such as filtering features and novelty building an internal clone forest to cope with the challenge of feature duplication. The tool can also provide the conflict of licenses and identify possible corresponding vulnerabilities, so these potential risks can be resolved and avoided. To evaluate the efficiency of OSLDetector, we collect 5K libraries containing 9K versions and manage their respective license type and existing vulnerabilities. The experimental results with a precision of 96\% and recall of 92.3\% show that OSLDetector is effective and outperforms similar tools.

Dan Zhang

Tsinghua University

This paper presents AirMochi, a tool that provides remote access and control of apps by leveraging a mobile platform’s publicly exported \emph{accessibility features}. While AirMochi is designed to be platform-independent, we discuss its iOS implementation. We show that AirMochi places no restrictions on apps, is able to handle a variety of scenarios, and imposes a negligible performance overhead. https://youtu.be/rhPz2Hs4Ius https://github.com/nkllkc/air_mochi

Nikola Lukic

University of Southern California

United States

Saghar Talebipour

University of Southern California

Nenad Medvidović

University of Southern California, USA

United States

Recognition of human behaviours including body motions and facial expressions plays a significant role in human-centric software engineering. However, due to the data and computation intensive nature of human behaviour recognition through video analytics, expensive powerful machines are often required, which could hinder the research and application in human-centric software engineering. To address such an issue, this paper proposes a cost-effective human behaviour recognition system named Edge4Real which can be easily deployed in an edge computing environment with commodity machines. Compared with existing centralised solutions, Edge4Real has three major advantages including cost-effectiveness, easy-to-use, and real-time. Specifically, Edge4Real adopts a distributed architecture where components such as motion capturing, human behaviour recognition, data decoding and extraction, and the application of the recognition result, can be deployed on separated end devices and edge nodes in an edge computing environment. Using a virtual reality application which can capture a user’s motion and translate into the motion of a 3D avatar in real time, we successfully validate the effectiveness of the system and demonstrate its promising value to the research and application of human-centric software engineering. The demo video can be found at https://youtu.be/tnEshD8j-kA.

DI SHAO

School of Information Technology, Deakin University

Xiao Liu

School of Information Technology, Deakin University

Australia

Ben Cheng

School of Information Technology, Deakin University

Owen Wang

School of Information Technology, Deakin University

Thuong Hoang

School of Information Technology, Deakin University

More and more new technologies are used in test development. Among them, automatic test generation, a promising technology to improve the efficiency of unit testing, currently performs not satisfactory in practice. Test recommendation, like code recommendation, is another feasible technology for supporting efficient unit testing and gets more and more attention. In this paper, we develop a novel system, namely HomoTR, which implements online test recommendations by measuring the homology of two methods. If the new method under test shares homology with an existing method that has tests, HomoTR would recommend the tests to the new method. The preliminary experiments show that HomoTR can quickly and effectively recommend test cases to help the testers improve the testing efficiency. Besides, HomoTR has been integrated into the MoocTest platform successfully, so it can also execute the recommended tests automatically and visualize the testing results (e.g., Branch Coverage) friendly to help testers understand the process of testing. The demo video of HomoTR can be found at {\color{blue}\url{https://youtu.be/_227EfcUbus}}.

Chenqian Zhu

Nanjing University

Weisong Sun

State Key Laboratory for Novel Software Technology, Nanjing University

China

Qin LIU

Yangyang Yuan

Nanjing University

Chunrong Fang

Nanjing University, China

China

Yong Huang

State Key Laboratory for Novel Software Technology, Nanjing University

China