检索结果-内蒙古大学图书馆

mining software repository for Security Smell Code Review

Mining Software Repository for Security Smell Code Review

International Conference on Data and software Engineering (ICoDSE) - Data and software Engineering for Supporting Sustainable Development Goals

作者： Paramitha, Ranindya Asnar, Yudistira Dwi Wardhana Inst Teknol Bandung Sch Elect Engn & Informat Bandung Indonesia

ISBN: (纸本)9781665494533

Security smells found in a source code could be a subtle sign of security vulnerability in the future. Developers could do security code review to find those signs, however it takes a lot of time for a large code base. To increase security code review efficiency, developers should focus on files that most likely have high-risk. In finding those high-risk files, mining software repository is a promising method as it has been used for bug localization in some prior researches. Our analysis in 34 CVE-related (smelly) Java files from 7 different projects found that ordinal LOC, ordinal commit count, and ordinal author count, have positive correlation with the likelihood of a file being smelly (related to known security vulnerability/ies). We then built a tool that return a list of files that are considered smelly, using ordinal LOC, ordinal commit count, and ordinal author count information. We applied this tool on 2 test projects and analyzed the result manually. The manual analysis found that we could find as many as 69 smelly files which contain identified security smell/s by only manually inspecting 185 files rather than all 4,383 files. This means we could reduce the time needed for security code review, which we found could reach 84.63% time reduction. We also found positive correlation between smelly files with known security vulnerability, which shows that using mining software repository for finding security smells has the potential to prevent security vulnerability in the future.

关键词： security smell smelly files mining software repository

来源：评论

学校读者我要写书评

暂无评论

PANDORA: Continuous mining software repository and Dataset Generation 29

PANDORA: Continuous Mining Software Repository and Dataset G...

引用

29th IEEE International Conference on software Analysis, Evolution and Reengineering (SANER)

作者： Nguyen, Hung Lomio, Francesco Pecorelli, Fabiano Lenarduzzi, Valentina Aalto Univ Helsinki Finland Tampere Univ Tampere Finland Univ Oulu Oulu Finland

ISBN: (纸本)9781665437868

During the mining software repository activities, a huge amount of data gathered from different sources is analyzed. Different tools have been developed for collecting and aggregating data from repositories, but they do not easily allow researchers to develop new extractors, to integrate the data collected from other platforms, and in particular from platforms that delete the data periodically. Moreover, mining software repository studies are commonly performed on old versions of software projects and their results are not commonly periodically updated. As a result of the non-continuously updated studies, practitioners often do not trust results from empirical studies. In order to overcome the aforementioned issues, in this paper, we present PANDORA, a tool that automatically and continuously mines data from different existing tools and online platforms and enables to run and continuously update the results of mining software repository studies. To evaluate the applicability of our tool, we currently analyzed 365 projects (developed in different languages), continuously collecting data from December 2020 to May 2021 and running an example study, investigating the build-stability of SonarQube rules. Link to dashboard: http://***/superset/dashboard/1 Link to source code: https://***/clowee/PANDORA Link to 5-minutes video: https://***/CuVO9YGJ59I

关键词： mining software repository Data Analysis Machine Learning

来源：评论

学校读者我要写书评

暂无评论

CrossFix: Resolution of GitHub issues via similar bugs recommendation

引用

JOURNAL OF software-EVOLUTION AND PROCESS 2024年第4期36卷

作者： Tan, Shin Hwei Li, Ziqiang Yan, Lu Southern Univ Sci & Technol Dept Comp Sci & Engn Shenzhen Peoples R China Southern Univ Sci & Technol Res Inst Trustworthy Autonomous Syst Shenzhen Peoples R China

With the increasing popularity of Open-Source software (OSS), the number of GitHub issues reported daily in these OSS projects has been growing rapidly. To resolve these issues, developers need to spend time and effort in debugging and fixing these issues. Meanwhile, a recent approach shows that similar bugs exist across different projects, and one could use the GitHub issues from a different project for finding new bugs for a related project. To locate similar bugs for our approach, we first conduct a study of similar bugs in GitHub. Our study redefines similar bugs as bugs that share the (1) same libraries, (2) same functionalities, (3) same reproduction steps, (4) same configurations, (5) same outcomes, or (6) same errors. Moreover, our study revealed the usefulness of similar bugs in helping developers to find more contexts about the bug and fixing. Based on our study, we design CrossFix, a tool that automatically suggests relevant GitHub issues based on an open GitHub issue. The suggested GitHub issues may contain solutions written in natural language or pull requests that help developers in resolving the given issue. Our evaluation on 249 open issues from Java and Android projects shows that CrossFix could suggest similar bugs to help developers in debugging and fixing.

关键词： debugging and program repair mining software repository open-source software

来源：评论

学校读者我要写书评

暂无评论

How Robust Is Your Development Team?

引用

IEEE software 2018年第1期35卷 64-71页

作者： Xiao, Lu Yu, Zhongyuan Chen, Bohong Wang, Xiao Stevens Inst Technol Software Engn Div Sch Syst & Enterprises Hoboken NJ 07030 USA Stevens Inst Technol Sch Syst & Enterprises Hoboken NJ 07030 USA Stevens Inst Technol Business Intelligence Hoboken NJ 07030 USA

Given the collaborative nature of software development, a robust team is a necessity for project success in both commercial and open source environments. That is, in the event of developers’ absence due to various reasons, how could it potentially disrupt a team’s routine operations? This article offers an automatic approach to intuitively visualize development team hierarchy, quantify overall team robustness, and identify the point (developers) of risk for team robustness. An investigation of six Apache open source projects has shown its effectiveness. This article is part of a special issue on Actionable Analytics for software Engineering.

关键词： Public Domain software software Development Management Team Working software Development Project Success Commercial Source Environments Open Source Environments Development Team Hierarchy Team Robustness Apache Open Source Projects software Development Collaboration Visualization Loss Measurement Data mining software Collaboration Social Network Information Loss Team Robustness mining software repository software Development software Engineering

来源：评论

学校读者我要写书评

暂无评论

Speeding Up Data Manipulation Tasks with Alternative Implementations: An Exploratory Study

引用

ACM TRANSACTIONS ON software ENGINEERING AND METHODOLOGY 2021年第4期30卷 p1-28页

作者： Tao, Yida Tang, Shan Liu, Yepang Xu, Zhiwu Qin, Shengchao Shenzhen Univ Coll Comp Sci & Software Engn 3688 Nanhai Ave Shenzhen Peoples R China Southern Univ Sci & Technol Dept Comp Sci & Engn 1088 Xueyuan Ave Shenzhen Guangdong Peoples R China Teesside Univ Middlesbrough Tees Valley England Shenzhen Univ 3688 Nanhai Ave Shenzhen Peoples R China

As data volume and complexity grow at an unprecedented rate, the performance of data manipulation programs is becoming a major concern for developers. In this article, we study how alternative API choices could improve data manipulation performance while preserving task-specific input/output equivalence. We propose a lightweight approach that leverages the comparative structures in Q&A sites to extracting alternative implementations. On a large dataset of Stack Overflow posts, our approach extracts 5,080 pairs of alternative implementations that invoke different data manipulation APIs to solve the same tasks, with an accuracy of 86%. Experiments show that for 15% of the extracted pairs, the faster implementation achieved >10x speedup over its slower alternative. We also characterize 68 recurring alternative API pairs from the extraction results to understand the type of APIs that can be used alternatively. To put these findings into practice, we implement a tool, AlterApi, to automatically optimize real-world data manipulation programs. In the 1,267 optimization attempts on the Kaggle dataset, 76% achieved desirable performance improvements with up to orders-of-magnitude speedup. Finally, we discuss notable challenges of using alternative APIs for optimizing data manipulation programs. We hope that our study offers a new perspective on API recommendation and automatic performance optimization.

关键词： API selection data manipulation performance optimization mining software repository empirical study

来源：评论

学校读者我要写书评

暂无评论

Analysing app reviews for software engineering: a systematic literature review (vol 27, 43, 2022)

引用

EMPIRICAL software ENGINEERING 2022年第2期27卷 1-63页

作者： Dabrowski, Jacek Letier, Emmanuel Perini, Anna Susi, Angelo UCL London England Fdn Bruno Kessler Trento Italy

App reviews found in app stores can provide critically valuable information to help software engineers understand user requirements and to design, debug, and evolve software products. Over the last ten years, a vast amount of research has been produced to study what useful information might be found in app reviews, and how to mine and organise such information as efficiently as possible. This paper presents a comprehensive survey of this research, covering 182 papers published between 2012 and 2020. This survey classifies app review analysis not only in terms of mined information and applied data mining techniques but also, and most importantly, in terms of supported software engineering activities. The survey also reports on the quality and results of empirical evaluation of existing techniques and identifies important avenues for further research. This survey can be of interest to researchers and commercial organisations developing app review analysis techniques and to software engineers considering to use app review analysis.

关键词： App store analysis mining app reviews User feedback mining software repository software engineering Systematic literature review

来源：评论

学校读者我要写书评

暂无评论

Which Commits Can Be CI Skipped?

引用

IEEE TRANSACTIONS ON software ENGINEERING 2021年第3期47卷 448-463页

作者： Abdalkareem, Rabe Mujahid, Suhaib Shihab, Emad Rilling, Juergen Concordia Univ Dept Comp Sci & Software Engn Data Driven Anal Software DAS Lab Montreal PQ H3G 1M8 Canada Concordia Univ Dept Comp Sci & Software Engn Montreal PQ H3G 1M8 Canada

Continuous Integration (CI) frameworks such as Travis CI, automatically build and run tests whenever a new commit is submitted/pushed. Although there are many advantages in using CI, e.g., speeding up the release cycle and automating the test execution process, it has been noted that the CI process can take a very long time to complete. One of the possible reasons for such delays is the fact that some commits (e.g., changes to readme files) unnecessarily kick off the CI process. Therefore, the goal of this paper is to automate the process of determining which commits can be CI skipped. We start by examining the commits of 58 Java projects and identify commits that were explicitly CI skipped by developers. Based on the manual investigation of 1,813 explicitly CI skipped commits, we first devise an initial model of a CI skipped commit and use this model to propose a rule-based technique that automatically identifies commits that should be CI skipped. To evaluate the rule-based technique, we perform a study on unseen datasets extracted from ten projects and show that the devised rule-based technique is able to detect and label CI skip commits, achieving Areas Under the Curve (AUC) values between 0.56 and 0.98 (average of 0.73). Additionally, we show that, on average, our technique can reduce the number of commits that need to trigger the CI process by 18.16 percent. We also qualitatively triangulated our analysis on the importance of skipping the CI process through a survey with 40 developers. The survey results showed that 75 percent of the surveyed developers consider it to be nice, important or very important to have a technique that automatically flags CI skip commits. To operationalize our technique, we develop a publicly available prototype tool, called CI-Skipper, that can be integrated with any git repository and automatically mark commits that can be CI skipped.

关键词： Java software Prototypes Tools Virtual machining Data collection Manuals Continuous integration travis CI build status mining software repository

来源：评论

学校读者我要写书评

暂无评论

On the Untriviality of Trivial Packages: An Empirical Study of npm JavaScript Packages

引用

IEEE TRANSACTIONS ON software ENGINEERING 2022年第8期48卷 2695-2708页

作者： Chowdhury, Md Atique Reza Abdalkareem, Rabe Shihab, Emad Adams, Bram Concordia Univ Dept Comp Sci & Software Engn Data Driven Anal Software DAS Lab Montreal PQ H3G 1M8 Canada Queens Univ Sch Comp Software Anal & Intelligence Lab SAIL Kingston ON K7L 3N6 Canada Queens Univ Sch Comp Lab Maintenance Construct & Intelligence Software Kingston ON K7L 3N6 Canada

Nowadays, developing software would be unthinkable without the use of third-party packages. Although such code reuse helps to achieve rapid continuous delivery of software to end-users, blindly reusing code has its pitfalls. For example, prior work has investigated the rationale for using packages that implement simple functionalities, known as trivial packages (i.e., in terms of the code size and complexity). This prior work showed that although these trivial packages were simple, they were popular and prevalent in the npm ecosystem. This popularity and prevalence of trivial packages peaked our interest in questioning the 'triviality of trivial packages'. To better understand and examine the triviality of trivial packages, we mine a large set of JavaScript projects that use trivial npm packages and evaluate their relative centrality. Specifically, we evaluate the triviality from two complementary points of view: based on project usage and ecosystem usage of these trivial packages. Our result shows that trivial packages are being used in central JavaScript files of a software project. Additionally, by analyzing all external package API calls in these JavaScript files, we found that a high percentage of these API calls are attributed to trivial packages. Therefore, these packages play a significant role in JavaScript files. Furthermore, in the package dependency network, we observed that 16.8 percent packages are trivial and in some cases removing a trivial package can impact approximately 29 percent of the ecosystem. Overall, our finding indicates that although smaller in size and complexity, trivial packages are highly depended on packages by JavaScript projects. Additionally, our study shows that although they might be called trivial, nothing about trivial packages is trivial.

关键词： Trivial packages npm ecosystem mining software repository

来源：评论

学校读者我要写书评

暂无评论

Extracting communication structure of a development organization from a software repository

引用

PERSONAL AND UBIQUITOUS COMPUTING 2014年第6期18卷 1413-1421页

作者： Han, Jongdae Jung, Woosung Seoul Natl Univ Seoul South Korea Chungbuk Natl Univ Gaesin Dong Cheongju South Korea

Researchers have found that communication cost is one of the major overheads affecting the overall cost of software development. Actually, there could be communication problems caused by cultural difference, language barrier, different time zone, and, etc. in geographically distributed software development. Thus, extracting potential communication structural information is very useful in understanding and optimizing the development organization. Analyzing the communication structure is also crucial in order to resolve cost issues. While this is already true for general development organizations, geographically distributed software development organizations are especially sensitive to these issues because they are forced to rely on costly mediums. Therefore, this paper suggests a way to extract the development organization from software repositories with respect to the temporal locality. The temporal locality is important for when the project is prolonged for a lengthy period of time. In order to evaluate these issues, we define two metrics which measure contribution of the individual developer and communication need between developers. We also provide a tool to extract a communication structure using these two metrics. The extracted communication structure is visualized to give insight into managers and developers. Finally, we provide statistical results of empirical research to prove the soundness of our approach. The result shows that our approach reflects the real-world relationship between developers well.

关键词： Development organization mining software repository Conway's law Communication structure

来源：评论

学校读者我要写书评

暂无评论

Studying logging practice in test code

引用

EMPIRICAL software ENGINEERING 2022年第4期27卷 1-45页

作者： Zhang, Haonan Tang, Yiming Lamothe, Maxime Li, Heng Shang, Weiyi Concordia Univ Dept Comp Sci & Software Engn Montreal PQ Canada Polytech Montreal Dept Comp Engn & Software Engn Montreal PQ Canada

Logging is widely used in modern software development to record run-time information for software systems and plays a significant role in software testing. Although the research area of logging has attracted much attention, little attention is paid to the practice of test logging (i.e., the logging involved in test files). To fill this knowledge gap, we conduct this empirical study to explore and disclose the practice of test logging. This study examines 21 open-source subjects with similar to 70K logging statements, of which similar to 48K are production logging statements and similar to 22K are test logging statements. We organize our study by answering four research questions, and as a result, (1) we have yielded five findings to reveal the differences between test and production logging statements, (2) we have disclosed four findings regarding the differences between the maintenance efforts of test and production logging statements, (3) we have identified four reasons why developers use test log, and (4) we have uncovered the relationship between test logging and production logging. To the best of our knowledge, this is the first study that quantitatively and qualitatively analyzes the logging practices in test and production code, providing developers and researchers with insight into this topic.

关键词： software logs Logging practices software testing mining software repository Source code analysis

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：