NOTE: SUBMITTED A RESEARCH PAPER TO ASE RESEARCH TRACK Application development for the modern Web involves sophisticated engineering workflows which include user interface aspects. Those involve Web elements typically created with HTML/CSS markup and JavaScript-like languages, yielding Web documents. WebMonitor leverages requirements formally specified in a logic able to capture both the layout of visual components as well as how they change over time, as a user interacts with them. Then, requirements are verified upon arbitrary web pages, allowing for automated support for a wide set of use cases in interaction testing and simulation. We position WebMonitor within a developer workflow, where in case of a negative result, a visual counterexample is returned. The monitoring framework we present follows a black-box approach, and as such is independent of the underlying technologies a Web application may be developed with, as well as the browser and operating system used.

Ennio Visconti

TU Wien

Christos Tsigkanos

University of Bern, Switzerland

Laura Nenzi

University of Trieste

Italy

This paper presents Quacky, a tool for quantifying permissiveness of access control policies in the cloud. Given a policy, Quacky translates it into a SMT formula and uses a model counting constraint solver to quantify permissiveness. When given multiple policies, Quacky not only determines which policy is more permissive, but also quantifies the relative permissiveness between the policies. With Quacky, users can automatically analyze complex policies, helping them ensure that there is no unintended access to their data. Quacky supports access control policies written in Amazon’s AWS Identity and Access Management (IAM), Microsoft’s Azure, and Google Cloud Platform (GCP) policy languages. Quacky is open-source and has both a command-line and a web interface. Video URL: \url{https://youtu.be/YsiGOI_SCtg}. The Quacky tool and benchmarks are available at \url{https://github.com/vlab-cs-ucsb/quacky}

William Eiers

University of California at Santa Barbara, USA

Ganesh Sankaran

University of California Santa Barbara

United States

Albert Li

University of California Santa Barbara

Emily O'Mahony

University of California Santa Barbara

Benjamin Prince

University of California Santa Barbara

Tevfik Bultan

University of California, Santa Barbara

United States

Software metrics capture information about software development products and processes. These metrics support decision-making, e.g., in team management or dependency selection. However, existing metrics tools measure only a snapshot of a software project. Little attention has been given to enabling engineers to reason about metric trends over time—longitudinal metrics that give insight about process, not just product. In this work, we present PRIME (PRocess Internal MEtrics), a tool for computing and visualizing process metrics. The currently-supported metrics include productivity, issue density, issue spoilage, and bus factor. We illustrate the value of longitudinal data and conclude with a research agenda. The demo video can be found at https://youtu.be/YigEHy3_JCo. The source code can be found at https://github.com/SoftwareSystemsLaboratory/prime.

Nicholas Synovic

Loyola University Chicago

United States

Matt Hyatt

Loyola University Chicago

Rohan Sethi

Loyola University Chicago

Sohini Thota

Loyola University Chicago

Shilpika

University of California at Davis

Allan J. Miller

Loyola University Chicago

Wenxin Jiang

Purdue University

Emmanuel S. Amobi

Loyola University Chicago

Austin Pinderski

Duke University, Loyola University Chicago

Konstantin Läufer

Loyola University Chicago

United States

Nicholas J. Hayward

Loyola University Chicago

Neil Klingensmith

Loyola University Chicago

James C. Davis

Purdue University, USA

United States

George K. Thiruvathukal

Loyola University Chicago and Argonne National Laboratory

To reduce the attack surface from app source code, massive tools focus on detecting vulnerabilities in Android apps. However, some obvious weaknesses have been highlighted in the previous studies. For example, (1) most of the available tools such as AndroBugs, MobSF, Qark, and Super use pattern-based methods to detect vulnerabilities. Although they are effective in detecting some types, a large number of false positives would be introduced, which inevitably increases the patching overhead for app developers. (2) Similarly, the static taint analysis tools such as FlowDroid and IccTA present hundreds of vulnerability candidates of data leakage instead of confirmed vulnerabilities. (3) Last but not least, a relatively complete vulnerability taxonomy is missing, which would introduce a lot of false negatives. In this paper, based on our prior knowledge in this research domain, we empirically propose a vulnerability taxonomy as the baseline and then extend AUSERA by augmenting the detection capability to 50 vulnerability types. Meanwhile, a new benchmark dataset including all these 50 vulnerabilities is constructed to demonstrate the effectiveness of AUSERA. The tool and datasets are available at: https://github.com/tjusenchen/AUSERA and the demonstration video can be found at: https://youtu.be/UCiGwVaFPpY.

Sen Chen

Tianjin University

China

Yuxin Zhang

Tianjin University

Lingling Fan

Nankai University

Jiaming Li

Tianjin University

Yang Liu

Nanyang Technological University

We present Trimmer, a state-of-the art tool for code size reduction. Trimmer reduces code size by specializing a program for constant inputs provided by developers. These constant inputs can be provided as command-line options or configuration files, and are used to specify features that must be retained, which in turn identify features that are unused in a specific deployment and can be removed. Trimmer includes sophisticated compiler transformations for input specialization, supports precise yet efficient context-sensitive inter-procedural constant propagation, and introduces a custom loop unroller. Trimmer is easy-to-use, and is highly configurable. In this paper, we discuss Trimmer’s configurable knobs that allow developers to explicitly control analysis precision vs analysis times. We also discuss the high-level implementation of Trimmer’s static analysis passes. The source code of Trimmer is publicly available at https://github.com/ashish-gehani/Trimmer. The video demonstration is available at https://www.youtube.com/watch?v=6pAuJ68INnI

Aatira Anum Ahmad

Lahore University of Management Sciences

Mubashir Anwar

University of Illinois Urbana-Champaign

Hashim Sharif

University of Illinois at Urbana-Champaign

Ashish Gehani

SRI

Fareed Zaffar

Lahore University of Management Sciences

The rapid expansion of robotics relies on properly configuring and testing hardware and software. Due to the expense and hazard of real-world testing on hardware, robot system testing increasingly utilizes extensive simulation. Creating robot simulation tests requires specialized skills in robot programming and simulation tools. While there are many platforms and tool-kits to create these simulations, they can be cumbersome when combined with automated testing. We present Maktub: a tool for creating tests using Unity and ROS. Maktub leverages the extensive 3D manipulation capabilities of Unity to lower the barrier in creating system tests for robots. A key idea of Maktub is to make tests without needing robotic software development skills. A video demonstration of Maktub can be found here: https://youtu.be/c0Bacy3DlEE, and the source code can be found here https://github.com/RobotCodeLab/Maktub.

Amr Moussa

North Carolina State University

John-Paul Ore

North Carolina State University

United States

A key threat to the usage of third-party dependencies has been the threat of security vulnerabilities, which risks unwanted access to a user application. As part of an ecosystem of dependencies, users of a library are prone to both the direct and transitive dependencies adopted into their application. Recent work involves tool supports for vulnerable dependency updates, rarely showing the complexity of the transitive updates. In this paper, we introduce our solution to support vulnerability updating. V-Achilles is a prototype that shows a visualization (i.e., using dependency graphs) affected by vulnerability attacks. In addition to the tool overview, we highlight three use cases to demonstrate usefulness, and an application of our prototype with real-world npm packages. The prototype is available at https://github.com/MUICT-SERU/V-Achilles, with an accompanying video demonstration at https://www.youtube.com/watch?v=tspiZfhMNcs.

Vipawan Jarukitpipat

Mahidol University

Xiao Peng

China EverBright Bank

Chaiyong Ragkhitwetsagul

Mahidol University, Thailand

Thailand

Morakot Choetkiertikul

Mahidol University, Thailand

Thailand

Thanwadee Sunetnanta

Mahidol University

Raula Gaikovina Kula

Nara Institute of Science and Technology

Japan

Bodin Chinthanet

Nara Institute of Science and Technology

Japan

Takashi Ishio

Nara Institute of Science and Technology

Japan

Kenichi Matsumoto

Nara Institute of Science and Technology

We present RoboSimVer, a tool for modeling and analyzing RoboSim Models. It uses a graphical modeling approach to model platform-independent simulation models of Robotics called RoboSim. For model analysis, we implemented a model-transformation approach to translate RoboSim models into NTA (Network of Timed Automata) and its stochastic version SHA (Stochastic Hybrid Automata) based on some patterns and mapping rules. RoboSimVer is able to get a simulation model. It also provides different rigorous verification techniques to check whether the simulation models satisfy property constraints. For experimental demonstrations, we adopt the case study Alpha algorithm for robotics. We use a robotic platform model of swarm robots in an uncertain environment, to illustrate how our tool supports the verification of stochastic and hybrid systems. The demonstration video of the tool is available at https://youtu.be/mNe4q64GkmQ

Dehui Du

East China Normal University

Ana Cavalcanti

University of York

United Kingdom

JihuiNie

East China Normal University

Cross-Chain bridges have become the most popular solution to support asset interoperability between heterogeneous blockchains. However, while providing efficient and flexible cross-chain asset transfer, the complex workflow involving both on-chain smart contracts and off-chain programs causes emerging security issues. In the past year, there have been more than ten severe attacks against cross-chain bridges, causing billions of loss. With few studies focusing on the security of cross-chain bridges, the community still lacks the knowledge and tools to mitigate this significant threat. To bridge the gap, we conduct the first study on the security of cross-chain bridges. We document three new classes of security bugs and propose a set of security properties and patterns to characterize them. Based on those patterns, we design Xscope, an automatic tool to find security violations in cross-chain bridges and detect real-world attacks. We evaluate Xscope on four popular cross-chain bridges. It successfully detects all known attacks and finds suspicious attacks unreported before. A video of Xscope is available at https://youtu.be/vMRO_qOqtXY.

Jiashuo Zhang

Peking University, China

Jianbo Gao

Peking University

China

Yue Li

Peking University

Ziming Chen

Peking University

Zhi Guan

Peking University

Zhong Chen

Many organizations seek to increase their agility in order to deliver more timely and competitive products. However, in safety-critical systems such as medical devices, autonomous vehicles, or factory floor robots, the release of new features has the potential to introduce hazards that potentially lead to runtime failures that impact software safety. As a result, many projects suffer from a phenomenon referred to as the `big freeze’. SAFA is designed to address this challenge. It uses cutting-edge deep-learning solutions to generate trees of requirements, design, code, tests, and other artifacts, in order to visually depict how hazards are mitigated in the system, and then generates warnings when key artifacts are missing. It uses a combination of colors, annotations, and recommendations to dynamically visualize change across software versions, and augments safety cases with visual annotations to aid users in detecting and analyzing potentially adverse impacts of change upon system safety. A link to our tool demo can be found at https://www.youtube.com/watch?v=r-CwxerbSVA.

Alberto D. Rodriguez

University of Notre Dame

Timothy Newman

University of Notre Dame

Katherine R. Dearstyne

University of Notre Dame

Jane Cleland-Huang

University of Notre Dame

United States

Recommender systems (RSs) are increasingly being used to help in all sorts of software engineering tasks, including modelling. However, building a RS for a modelling notation is costly. This is especially detrimental for development paradigms that rely on domain-specific languages (DSLs), like model-driven engineering and lowcode approaches. To alleviate this problem, we propose a DSL called Droid that facilitates the configuration and creation of RSs for particular modelling notations. Its tooling provides automation for all phases in the development of a RS: data preprocessing, system configuration for the modelling language, evaluation and selection of the best recommendation algorithm, and deployment of the RS into a modelling tool. A video of the tool is available at https://www.youtube.com/watch?v=VHiObfKUhS0.

Lissette Almonte

Universidad Autónoma de Madrid

Spain

Esther Guerra

Universidad Autónoma de Madrid

Iván Cantador

Universidad Autónoma de Madrid

Spain

Juan de Lara

Autonomous University of Madrid

Spain

Test-based generate-and-validate automated program repair (APR) systems generate many patches that pass the test suite without fixing the bug. The generated patches must be manually inspected by the developers, a task that tends to be time-consuming, thereby diminishing the role of APR in reducing debugging costs. We present the design and implementation of a novel tool, named Shibboleth, for automatic assessment of the patches generated by test-based generate-and-validate APR systems. Shibboleth leverages lightweight static and dynamic heuristics from both test and production code to rank and classify the patches. Shibboleth is based on the idea that the buggy program is almost correct and the bugs are small mistakes that require small changes to fix and specifically the fix does not remove the code implementing correct functionality of the program. Thus, the tool measures the impact of patches on both production code (via syntactic and semantic similarity) and test code (via code coverage) to separate the patches that result in similar programs and that do not remove desired program elements. We have evaluated Shibboleth on 1,871 patches, generated by 29 Java-based APR systems for Defects4J programs. The technique outperforms state-of-the-art raking and classification techniques. Specifically, in our ranking data set, in 66% of the cases, Shibboleth ranks the correct patch in top-1 or top-2 positions and, in our classification data set, it achieves an accuracy and F1-score of 0.887 and 0.852, respectively, in classification mode. A demo video of the tool is available at https://bit.ly/3NvYJN8.

Ali Ghanbari

Iowa State University

United States

Andrian Marcus

University of Texas at Dallas

United States

Third-party libraries (TPLs) are frequently reused in software to reduce development cost and the time-to-market. However, exter- nal library dependencies may introduce vulnerabilities into host applications. The issue of library dependency has received consid- erable critical attention. Many package managers like Maven, Pip, NPM are proposed to manage TPLs, and there has been a lot of effort put into studying dependencies in language ecosystem like Java, Python, JavaScript except C/C++. Due to the lack of a unified package manager for C/C++, existing research has only a few un- derstanding of TPL dependency in C/C++ ecosystem, especially at large-scale.

Towards Understanding TPL dependencies in C/C++ ecosystem, we collect existing TPL databases, package management tools and dependency detection tools, summarize the dependency patterns of C/C++ projects, and construct a comprehensive and precise C/C++ dependency detector. Using our detector, we extract dependencies from a large-scale database containing 24K C/C++ repositories from GitHub. Based on the extracted dependencies, we provide the results and findings of an empirical study aimed at understanding the characteristics of the TPL dependencies. We further discuss the challenges to manage dependency for C/C++ and the future directions for software engineering researchers and developers in fields of software composition analysis, C/C++ package manager and library development. Our dataset of extracted dependencies used in this work are anonymously available at url:

Wei Tang

Tsinghua University

Zhengzi Xu

Nanyang Technological University

Chengwei Liu

Nanyang Technological University, Singapore

Wu Jiahui

Nanyang Technological University

shouguo yang

Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China

Yi Li

Nanyang Technological University, Singapore

Singapore

Ping Luo

Tsinghua University

Yang Liu

Nanyang Technological University

Modern software systems are often built by leveraging code written by others in the form of libraries and packages to accelerate their development. While there are many benefits to using third-party packages, software projects often become dependent on a large number of software packages. Consequently, developers are faced with the difficult challenge of maintaining their project dependencies by keeping them up-to-date and free of security vulnerabilities. However, how often are project dependencies used in production where they could pose a threat to their project’s security?

We conduct an empirical study on 100 JavaScript projects using the Node Package Manager (npm) to quantify how often project dependencies are released to production and analyze their characteristics and their impact on security. Our results indicate that most project dependencies are not released to production. In fact, the majority of dependencies declared as runtime dependencies are not used in production, while some development dependencies are used in production, debunking two common assumptions of dependency management. Our analysis reveals that the functionality of a package is not enough to determine if it will be shipped to production or not. Findings also indicate that most security alerts target dependencies not used in production, making them highly unlikely to be a risk for the security of the software. Our study unveils a more complex side of dependency management: not all dependencies are equal. Dependencies used in production are more sensitive to security exposure and should be prioritized. However, current tools lack the appropriate support in identifying production dependencies.

Jasmine Latendresse

Concordia University

Canada

Suhaib Mujahid

Mozilla

Canada

Diego Costa

Concordia University, Canada

Canada

Emad Shihab

Concordia University

Canada

Docker building is a critical component of containerized workflow, which automates the process by which sources are packaged and transformed into container images. If not run properly, Docker builds can bring long durations (i.e., slow builds), which increases the cost in human and computing resources, and thus inevitably affect the software development. However, the current status and remedy for the duration cost in Docker builds remain unclear and need an in-depth study. To fill this gap, this paper provides the first empirical investigation on 171,439 Docker builds from 5,833 open source software (OSS) projects. Starting with an exploratory study, the Docker build durations can be characterized in real-world projects, and the developers’ perceptions of slow builds are obtained via a comprehensive survey. Driven by the results of our exploratory study, we propose a prediction modeling of Docker build duration, leveraging 27 handcrafted features from build-related context and configuration and 8 regression algorithms for the prediction task. Our results demonstrate that Random Forest provides the superior performance with a Spearman’s correlation of 0.781, outperforming the baseline random model by 82.9% in RMSE, and 90.6% in MAE, respectively. The implications of this study will facilitate research and assist practitioners in improving the Docker build process.

Yiwen Wu

National University of Defense Technology

Yang Zhang

National University of Defense Technology, China

China

Kele Xu

National University of Defense Technology

Tao Wang

National University of Defense Technology

Huaimin Wang

National University of Defense Technology

In this work, we introduce an approach, called CIT-daily, which integrates combinatorial interaction testing (CIT) with the daily build processes to systematically test the interactions between the factors/parameters affecting the system’s behaviors, on a daily basis. We also develop a number of CIT-daily strategies and empirically evaluate them on highly-configurable systems. The first strategy tests the same t-way covering array every day throughout the process, achieving a t-way coverage on a daily basis by covering each possible combination of option settings for every combination of t options. The other strategies, on the other hand, while guaranteeing a t-way coverage on a daily basis, aim to cover higher order interactions between the configuration options over time by varying the t-way covering arrays tested. In the experiments, we observed that the proposed approach significantly improved the effectiveness (i.e., fault revealing abilities) of the daily build processes; randomizing the coverage of higher order interactions between the configuration options while guaranteeing a base $t$-way coverage every day, further improved the effectiveness; and the more the higher order interactions covered during the process, the higher the fault revealing abilities tended to be.

Hanefi Mercan

Sabanci University

Turkey

Atakan Aytar

Sabanci University

Giray Coskun

Sabanci University

Turkey

Dilara Müstecep

Sabanci University

Gülsüm Uzer

Sabanci University

Cemal Yilmaz

Sabancı University

Traceability establishes trace links among software artifacts (e.g., requirements and code) based on whether two artifacts relate to the same part of system functionalities. These trace links are valuable for software development process, but are difficult to obtain manually. To cope with the costly and fallible manual recovery, researchers proposed many automated approaches that help to recover trace links through the textual similarities among software artifacts, such as approaches based on Information Retrieval (IR). However, the low quality and the low quantity of artifact texts negatively impact the calculated textual similarities, thus greatly hindering the performance of IR-based approaches. In this study, we propose to extract co-occurred word pairs from the text structures of both requirements and code (i.e., consensual biterms) to improve IR-based traceability recovery. Specifically, we first collect a set of biterms based on the part-of-speech of requirement texts, and then filter them through the code texts. We then use these consensual biterms to both enrich the input corpus for IR techniques and enhance the calculations of IR values. An empirical evaluation based on nine real-world systems shows that our approach can not only outperform baseline approaches, but also achieve a significant complementary effect with other enhancing strategies from different perspectives.

Hui Gao

Nanjing University

China

Hongyu Kuang

Nanjing University

China

Kexin Sun

Nanjing University

Xiaoxing Ma

Nanjing University

China

Alexander Egyed

Johannes Kepler University Linz

Austria

Patrick Mäder

Technische Universität Ilmenau

Germany

Guoping Rong

Nanjing University

Dong Shao

Nanjing University

He Zhang

Nanjing University

China