Late Breaking ResultsASE 2020

Oscar Nierstrasz

University of Bern, Switzerland

Switzerland

I am a Professor of Computer Science at the Institute of Computer Science (IAM) of the University of Bern, where he founded the Software Composition Group in 1994. I am a co-author of over 200 publications and co-author of the open-source books Object-Oriented Reengineering Patterns and Pharo by Example.

The advances in machine learning(ML) have stimulated the integration of their capabilities into software systems and services. However, there is a tangible gap between software engineering and machine learning practices, that is delaying the progress of intelligent services development. Software organisations are devoting effort to adjust the software engineering processes and practices to facilitate the integration of machine learning models. Machine learning researchers as well are focusing on improving the interpretability of machine learning models to support overall system robustness. Our research focuses on bridging this gap through a methodology that evaluates the robustness of machine learning-enabled software engineering systems. In particular, this methodology will automate the evaluation of the robustness properties of software systems against dataset shift problems in ML. It will also feature a notification mechanism that facilitates the debugging of ML components.

Hala Abdelkader

Applied Artificial Intelligence Institute, Deakin University

Automated test generators, such as search based software testing (SBST) techniques, replace the tedious and expensive task of manually writing test cases. SBST techniques are effective at generating tests with high code coverage. However, is high code coverage sufficient to maximise the number of bugs found? We argue that SBST needs to be focused to search for test cases in defective areas rather in non-defective areas of the code in order to maximise the likelihood of discovering the bugs. Defect prediction algorithms give useful information about the bug-prone areas in software. Therefore, we formulate the objective of this thesis: \textit{Improve the bug detection capability of SBST by incorporating defect prediction information}. To achieve this, we devise two research objectives, i.e., 1) Develop a novel approach (SBST${CL}$) that allocates time budget to classes based on the likelihood of classes being defective, and 2) Develop a novel strategy (SBST${ML}$) to guide the underlying search algorithm (i.e., genetic algorithm) towards the defective areas in a class. Through empirical evaluation on 434 real reported bugs in the Defects4J dataset, we demonstrate that our novel approach, SBST$_{CL}$, is significantly more efficient than the state of the art SBST when they are given a tight time budget in a resource constrained environment.

Anjana Perera

Monash University

Australia

Whenever software components process personal or private data, appropriate data protection mechanisms are mandatory. An essential factor in achieving trust and transparency is not to give preference to a single party but to make it possible to audit the data usage in an unbiased way. The scenario in mind for this contribution contains (i) users bringing in sensitive data they want to be safe, (ii) service developers building software-based services whose Intellectual Properties (IPs) they desire to protect, and (iii) platform providers wanting to be trusted and to be able to rely on the component developers integrity. The authors see these interests as an insufficiently solved field of tension that can be relaxed by a suitable level of transparently represented software components to give insights without exposing every detail.

Christian Schindler

Institute for Enterprise Systems, University of Mannheim

Formal specifications in \textsf{Alloy} are organized around user-defined data domains, associated with \emph{signatures}, with almost no support for built-in datatypes. This minimality in the built-in datatypes provided by the language is one of its main features, as it contributes to the automated analyzability of models. One of the few built-in datatypes available in Alloy specifications are integers, whose SAT-based treatment allows only for small bit-widths. In many contexts, where relational datatypes dominate, the use of integers may be auxiliary, e.g., in the use of cardinality constraints and other features. However, as the applications of \textsf{Alloy} are increased, e.g., with the use of the language and its tool support as backend engine for different analysis tasks, the provision of efficient support for numerical datatypes becomes a need. In this work, we present our current preliminary approach to providing an efficient, scalable and user-friendly extension to \textsf{Alloy}, with arithmetic support for numerical datatypes. Our implementation allows for arithmetic with varying precisions, and is implemented via standard \textsf{Alloy} constructions, thus resorting to SAT solving for resolving arithmetic constraints in models.

Cesar Cornejo

University of Rio Cuarto and CONICET

Argentina

Software reliability is a primary concern in the construction of software, and thus a fundamental component in the definition of software quality. Analyzing software reliability requires a \emph{specification} of the intended behavior of the software under analysis. Unfortunately, software many times lacks such specifications. This issue seriously diminishes the analyzability of software with respect to its reliability. Thus, finding novel techniques to capture the intended software behavior in the form of specifications would allow us to exploit them for automated reliability analysis.

Our research focuses on the application of learning techniques to automatically distinguish correct from incorrect software behavior. The aim here is to decrease the developer’s effort in specifying oracles, and instead \emph{generating} them from actual software behaviors.

Facundo Molina

University of Río Cuarto

Argentina

The design and development of production-grade microservice backends is a tedious and error-prone task. In particular, they must be capable of handling all Functional Requirements (FRs) and all Non-Functional Requirements (NFRs) (like security) including all operational requirements (like monitoring). This becomes even more difficult if there are many clients with different roles, linked to diverse (non-)functional requirements and many existing services are involved, which have to consider these in a consistent way. In this paper, we present a model-driven approach that automatically generates client-specific production-grade backends by incorporating previously expressed architectural knowledge out of an interpretable specification of the targeted APIs and the NFRs.

Nils Wieber

Institute for Enterprise Systems (InES), University of Mannheim

Symbolic execution is still facing the scalability problem caused by path explosion and constraint solving overhead. The recently proposed MuSE framework supports exploring multiple paths by generating partial solutions in one time of solving. In this work, we improve MuSE from two aspects. Firstly, we use a light-weight check to reduce redundant partial solutions, avoiding the wasteful executions having the same results. Secondly, we introduce online learning to devise an adaptive search strategy for the target programs. The preliminary experimental results indicate the promising of the proposed methods.

Tianqi Zhang

National University of Defense Technology

Yufeng Zhang

College of Information Science and Engineering, Hunan University

Zhenbang Chen

College of Computer, National University of Defense Technology, Changsha, PR China

China

Ziqi Shuai

National University of Defense Technology

Ji Wang

National University of Defense Technology

The robustness of deep neural network (DNN) is critical and challenging to ensure. In this paper, we propose a general data-oriented mutation framework, called Styx, to improve the robustness of DNN. Styx generates new training data by slightly mutating the training data. In this way, Styx ensures the DNN’s accuracy on the test dataset while improving the adaptability to small perturbations, i.e., improving the robustness. We have instantiated Styx for image classification and proposed pixel-level mutation rules that are applicable to any image classification DNNs. We have applied Styx on several commonly used benchmarks and compared Styx with the representative adversarial training methods. The preliminary experimental results indicate the effectiveness of Styx.

Meixi Liu

National University of Defense Technology, Changsha, China

Weijiang Hong

National University of Defense Technology, Changsha, China

Weiyu Pan

National University of Defense Technology, Changsha, China

Chendong Feng

College of Computer, National University of Defense Technology, Changsha, China

Zhenbang Chen

College of Computer, National University of Defense Technology, Changsha, PR China

China

Ji Wang

National University of Defense Technology

Constraint solving is one of the challenges for symbolic execution. Modern SMT solvers allow users to customize the internal solving procedure by solving strategies. In this extended abstract, we report our recent progress in synthesizing a program-specific solving strategy for the symbolic execution of a program. We propose a two-stage procedure for symbolic execution. At the first stage, we synthesize a solving strategy by utilizing deep learning techniques. Then, the strategy will be used in the second stage to improve the performance of constraint solving. The preliminary experimental results indicate the promising of our method.

Zehua Chen

National University of Defense Technology

Zhenbang Chen

College of Computer, National University of Defense Technology, Changsha, PR China

China

Ziqi Shuai

National University of Defense Technology

Yufeng Zhang

College of Information Science and Engineering, Hunan University

Weiyu Pan

National University of Defense Technology, Changsha, China

Since the new privacy feature in iOS enabling users to acknowledge which app is reading or writing to his or her clipboard through prompting notifications was updated, a plethora of top apps have been reported to frequently access the clipboard without user consent. However, the lack of monitoring and control of Android application’s access to the clipboard data leave Android users blind to their potential to leak private information from Android clipboards, raising severe security and privacy concerns. In this preliminary work, we envisage and investigate an approach to (i) dynamically detect clipboard access behaviour, and (ii) determine privacy leaks via static data flow analysis, in which we enhance the results of taint analysis with call graph concatenation to enable leakage source backtracking. Our preliminary results indicate that the proposed method can expose clipboard data leakage as substantiated by our discovery of a popular app, Sogou Input, directly monitoring and transferring user data in a clipboard to backend servers.

Zach Wei Wang

The University of Adelaide

Australia

Ruoxi Sun

The University of Adelaide

Australia

Jason Minhui Xue

The University of Adelaide

Australia

Damith C. Ranasinghe

The University of Adelaide

In software development, issue tracker systems are widely used to manage bug reports. In such a system, a bug report can be filed, diagnosed, assigned, and fixed. In the standard process, a bug can be resolved as \emph{fixed}, \emph{invalid}, \emph{duplicated} or \emph{won’t fix}. Although the above resolutions are well-defined and easy to understand, a bug report can end with a less known resolution, \emph{i.e.}, \emph{workaround}. Compared with other resolutions, the definition of workarounds is more ambiguous. Besides the problem that is reported in a bug report, the resolution of a workaround raises more questions. Some questions are important for users, especially those programmers who build their projects upon others (\emph{e.g.}, libraries). Although some early studies have been conducted to analyze API workarounds, many research questions on workarounds are still open. For example, which bugs are resolved as workarounds? Why is a bug report resolved as workarounds? What are the repairs of workarounds? In this experience paper, we conduct the first empirical study to explore the above research questions. In particular, we analyzed 221 real workarounds that were collected from Apache projects. Our results lead to ten findings and our answers to all the above questions. For example, we find that most bug reports are resolved as workarounds, because their problems arise across projects (38.01%) or reside in the environments (21.27%). Although the problems of some workarounds (37.56%) reside in the project where they are reported, they are difficult to be fixed fully and perfectly. Our findings are useful to understand workarounds and to improve software projects and issue trackers.

Daohan Song

Shanghai Jiao Tong University

Hao Zhong

Shanghai Jiao Tong University

China

Li Jia

Shanghai Jiao Tong University

Artificial Intelligence (AI) has been widely used in smart systems such as smart health and smart agriculture to enable intelligent services for people and other smart systems. At present, most of the smart systems are based on cloud computing, and massive data generated at the smart end device will need to be transferred to the cloud where AI models are deployed. Therefore, a big challenge for smart system engineers is that cloud based smart systems often face issues such as network congestion and high latency. In recent years, mobile edge computing (MEC) is becoming a promising solution which supports computation-intensive tasks such as deep learning through computation offloading to the servers located at the local network edge. To take full advantage of MEC, an effective collaboration between the end device and the edge server is essential. However, this is a brand new and challenging issue for smart system engineers. In this paper, as an initial investigation, we propose Edge4Sys, a Device-Edge Collaborative Framework for MEC based Smart System. Specifically, we employ the deep learning based user identification process in a MEC-based UAV (Unmanned Aerial Vehicle) delivery system as a case study to demonstrate the effectiveness of the proposed framework which can significantly reduce the network traffic and the response time.

Han Gao

School of Computer Science and Technology, Anhui University

Yi Xu

School of Computer Science and Technology, Anhui University

Xiao Liu

School of Information Technology, Deakin University

Australia

Jia Xu

School of Computer Science and Technology, Anhui University

Tianxiang Chen

School of Computer Science and Technology, Anhui University

Bowen Zhou

School of Computer Science and Technology, Anhui University

Rui Li

School of Information Technology, Deakin University

Xuejun Li

School of Computer Science and Technology, Anhui University

While traditionally, software comprehension relies on approaches like reading through the code or looking at charts on screens, which are 2D mediums, there have been some recent approaches that advocate exploring 3D approaches like Augmented or Virtual Reality (AR/VR) to have a richer experience towards understanding software and its internal relationships. However, there is a dearth of objective studies that compare such 3D representations with their traditional 2D counterparts in the context of software comprehension. In this paper, we present an evaluation study to quantitatively and qualitatively compare 2D and 3D software representations with respect to typical comprehension tasks. For the 3D medium, we utilize an AR-based approach for 3D visualizations of a software system (XRaSE), while the 2D medium comprises of textual IDEs and 2D graph representations. The study, which has been conducted using 20 professional developers, shows that for most comprehension tasks, the developers perform much better using the 3D representation, especially in terms of velocity and recollection, while also displaying reduced cognitive load and better engagement.

Rohit Mehra

Accenture Labs, India

India

Vibhu Saujanya Sharma

Accenture Labs, Bangalore, India

Vikrant Kaulgud

Accenture Labs, India

India

Sanjay Podder

Accenture

India

Adam P. Burden

Accenture

Smart home systems are becoming increasingly popular. Engineering such systems hence becomes a prominent software engineering challenge.In this specific engineering paradigm,users are often interested in considering sensor states while they are performing various activities. Existing works have proposed initial efforts on incremental development method with activity-oriented requirements. However, there is no systematic way of ensuring reliability and security of such systems which may be developed incrementally by various developers and may execute in a complex environment. Some properties, especially those including metric timing constraints, need to be satisfied. In this paper, we introduce ACTOM, a framework for identification of activity-oriented requirements and runtime verification.ACTOM supports the development of the mapping between activities and required sensor readings (activity-sensor mapping) based on the physical requirements of activities. At runtime, ACTOM receives results of activity recognition and is able to trigger actuators to provide the required physical conditions for the activities, as determined by the activity-sensor mapping. Moreover, ACTOM continuously monitors whether activity-sensor mapping holds over a time period during the activity. We plan to evaluate ACTOM with a case study in a smart home in which various activities are observed to show its effectiveness. The end product will be a systematic framework to facilitate the development of activity-oriented requirements and monitor properties related to metric timing constraints to improve reliability and security.

Xuansong Li

School of Computer Science and Engineering, Nanjing University of Science and Technology

Wei Song

School of Computer Science and Engineering, Nanjing University of Science and Technology

Xiangyu Zhang

Purdue University, USA

United States

Given that creating an in-house test lab is expensive and time-consuming to maintain, companies and app developers often use device clouds to test their apps. To ensure that this service is functional, cloud organizations need to use management software to control test executions and perform frequent system updates to patch possible issues with the devices. In this paper, we present a preliminary study investigating issues and highlighting research opportunities for managing and maintaining device clouds. In the study, we analyzed more than 12 million test executions on 110 devices. We found that the management software of the cloud infrastructure we considered affected some test executions, and almost all the cloud devices had at least one security-related issue.

Mattia Fazzini

University of Minnesota

United States

Alessandro Orso

Georgia Tech

United States