检索结果-内蒙古大学图书馆

Safety Demonstration of a Class 1 Smart Device

NUCLEAR TECHNOLOGY 2018年第2-3期202卷 132-140页

作者： Guerra, Sofia Butler, Eoin Adelard LLP 24 Waterside44-48 Wharf Rd London N1 7UX England

Horizon Nuclear Power intends to build advanced boiling water reactors at Wylfa and Oldbury in the United Kingdom based on the Hitachi-GE (Hitachi) design. In accordance with U.K. policy for new nuclear build, Hitachi, as the reactor designer, is the requesting party to the Generic Design Assessment (GDA), during which the reactor design will be reviewed by the Office for Nuclear Regulation and the Environment Agency. An important step in the GDA process is to demonstrate the viability of the approach developed by Hitachi-GE for the assessment and justification of smart devices. This was done by means of pilot studies of safety class 1 (SC1) and SC2 devices. This paper describes the scope, criteria, process, and approach for the SC1 pilot study and summarizes the results of the study.

关键词： Smart devices safety demonstration source code analysis

来源：评论

学校读者我要写书评

暂无评论

Beyond source code: The importance of other artifacts in software development (a case study)

引用

JOURNAL OF SYSTEMS AND SOFTWARE 2006年第9期79卷 1233-1248页

作者： Robles, Gregorio Gonzalez-Barahona, Jesus M. Merelo, Juan Julian Univ Rey Juan Carlos Dept Ingn Telemat & Tecnol Elect Grp Sistemas & Comunicacc Madrid 28933 Spain Univ Granada Grp Geneura E-18071 Granada Spain

Current software systems contain increasingly more elements that have not usually been considered in software engineering research and studies. source artifacts, understood as the source components needed to obtain a binary, ready to use version of a program, comprise in many systems more than just the elements written in a programming language (source code). Especially when we move apart from systems-programming and enter the realm of end-user applications, we find files for documentation, interface specifications, internationalization and localization modules and multimedia data. All of them are source artifacts in the sense that developers work directly with them, and that applications are built automatically using them as input. This paper discusses the differences and relationships between source code (usually written in a programming language) and these other files, by analyzing the KDE software versioning repository (with about 6,800,000 commits and 450,000 files). A comprehensive study of those files, and their evolution in time, is performed, looking for patterns and trying to infer from them the related behaviors of developers with different profiles, from where we conclude that studying those 'other' source artifacts can provide a great deal of insight on a software system. (C) 2006 Elsevier Inc. All rights reserved.

关键词： mining software repositories source code analysis source code management systems

来源：评论

学校读者我要写书评

暂无评论

Studying logging practice in test code

引用

EMPIRICAL SOFTWARE ENGINEERING 2022年第4期27卷 1-45页

作者： Zhang, Haonan Tang, Yiming Lamothe, Maxime Li, Heng Shang, Weiyi Concordia Univ Dept Comp Sci & Software Engn Montreal PQ Canada Polytech Montreal Dept Comp Engn & Software Engn Montreal PQ Canada

Logging is widely used in modern software development to record run-time information for software systems and plays a significant role in software testing. Although the research area of logging has attracted much attention, little attention is paid to the practice of test logging (i.e., the logging involved in test files). To fill this knowledge gap, we conduct this empirical study to explore and disclose the practice of test logging. This study examines 21 open-source subjects with similar to 70K logging statements, of which similar to 48K are production logging statements and similar to 22K are test logging statements. We organize our study by answering four research questions, and as a result, (1) we have yielded five findings to reveal the differences between test and production logging statements, (2) we have disclosed four findings regarding the differences between the maintenance efforts of test and production logging statements, (3) we have identified four reasons why developers use test log, and (4) we have uncovered the relationship between test logging and production logging. To the best of our knowledge, this is the first study that quantitatively and qualitatively analyzes the logging practices in test and production code, providing developers and researchers with insight into this topic.

关键词： Software logs Logging practices Software testing Mining software repository source code analysis

来源：评论

学校读者我要写书评

暂无评论

AspectJ code analysis and verification with GASR

引用

JOURNAL OF SYSTEMS AND SOFTWARE 2016年 117卷 528-544页

作者： Fabry, Johan De Roover, Coen Noguera, Carlos Zschaler, Steffen Rashid, Awais Jonckers, Viviane Univ Chile Comp Sci Dept DCC PLEIAD Lab Santiago Chile Vrije Univ Brussel Software Languages Lab Brussels Belgium Kings Coll London Dept Informat London WC2R 2LS England Univ Lancaster Dept Comp Sci Lancaster England

Aspect-oriented programming languages extend existing languages with new features for supporting modularization of crosscutting concerns. These features however make existing source code analysis tools unable to reason over this code. Consequently, all code analysis efforts of aspect-oriented code that we are aware of have either built limited analysis tools or were performed manually. Given the significant complexity of building them or manual analysis, a lot of duplication of effort could have been avoided by using a general-purpose tool. To address this, in this paper we present GASR: a source code analysis tool that reasons over Aspect) source code, which may contain metadata in the form of annotations. GASR provides multiple kinds of analyses that are general enough such that they are reusable, tailorable and can reason over annotations. We demonstrate the use of GASR in two ways: we first automate the recognition of previously identified aspectual source code assumptions. Second, we turn implicit assumptions into explicit assumptions through annotations and automate their verification. In both uses GASR performs detection and verification of aspect assumptions on two well-known case studies that were manually investigated in earlier work. GASR finds already known aspect assumptions and adds instances that had been previously overlooked. (C) 2016 Elsevier Inc. All rights reserved.

关键词： Aspect oriented programming source code analysis Logic program querying

来源：评论

学校读者我要写书评

暂无评论

RefDiff 2.0: A Multi-Language Refactoring Detection Tool

引用

IEEE TRANSACTIONS ON SOFTWARE ENGINEERING 2021年第12期47卷 2786-2802页

作者： Silva, Danilo da Silva, Joao Paulo Santos, Gustavo Terra, Ricardo Valente, Marco Tulio Univ Fed Minas Gerais Dept Comp Sci BR-31270010 Belo Horizonte MG Brazil Quimbik Inc San Rafael CA 94901 USA Fed Univ Technol UTFPR Software Engn BR-85660000 Dois Vizinhos PR Brazil Fed Univ Lavras UFLA Dept Comp Sci BR-37200000 Lavras MG Brazil

Identifying refactoring operations in source code changes is valuable to understand software evolution. Therefore, several tools have been proposed to automatically detect refactorings applied in a system by comparing source code between revisions. The availability of such infrastructure has enabled researchers to study refactoring practice in large scale, leading to important advances on refactoring knowledge. However, although a plethora of programming languages are used in practice, the vast majority of existing studies are restricted to the Java language due to limitations of the underlying tools. This fact poses an important threat to external validity. Thus, to overcome such limitation, in this paper we propose RefDiff 2.0, a multi-language refactoring detection tool. Our approach leverages techniques proposed in our previous work and introduces a novel refactoring detection algorithm that relies on the code Structure Tree (CST), a simple yet powerful representation of the source code that abstracts away the specificities of particular programming languages. Despite its language-agnostic design, our evaluation shows that RefDiff's precision (96 percent) and recall (80 percent) are on par with state-of-the-art refactoring detection approaches specialized in the Java language. Our modular architecture also enables one to seamlessly extend RefDiff to support other languages via a plugin system. As a proof of this, we implemented plugins to support two other popular programming languages: JavaScript and C. Our evaluation in these languages reveals that precision and recall ranges from 88 to 91 percent. With these results, we envision RefDiff as a viable alternative for breaking the single-language barrier in refactoring research and in practical applications of refactoring detection.

关键词： codes Java source coding History Crawlers Measurement Refactoring source code analysis code repositories git

来源：评论

学校读者我要写书评

暂无评论

Empirical evidence on the link between object-oriented measures and external quality attributes: a systematic literature review

引用

EMPIRICAL SOFTWARE ENGINEERING 2015年第3期20卷 640-693页

作者： Jabangwe, Ronald Borstler, Jurgen Smite, Darja Wohlin, Claes Blekinge Inst Technol S-37179 Karlskrona Sweden

There is a plethora of studies investigating object-oriented measures and their link with external quality attributes, but usefulness of the measures may differ across empirical studies. This study aims to aggregate and identify useful object-oriented measures, specifically those obtainable from the source code of object-oriented systems that have gone through such empirical evaluation. By conducting a systematic literature review, 99 primary studies were identified and traced to four external quality attributes: reliability, maintainability, effectiveness and functionality. A vote-counting approach was used to investigate the link between object-oriented measures and the attributes, and to also assess the consistency of the relation reported across empirical studies. Most of the studies investigate links between object-oriented measures and proxies for reliability attributes, followed by proxies for maintainability. The least investigated attributes were: effectiveness and functionality. Measures from the C&K measurement suite were the most popular across studies. Vote-counting results suggest that complexity, cohesion, size and coupling measures have a better link with reliability and maintainability than inheritance measures. However, inheritance measures should not be overlooked during quality assessment initiatives;their link with reliability and maintainability could be context dependent. There were too few studies traced to effectiveness and functionality attributes;thus a meaningful vote-counting analysis could not be conducted for these attributes. Thus, there is a need for diversification of quality attributes investigated in empirical studies. This would help with identifying useful measures during quality assessment initiatives, and not just for reliability and maintainability aspects.

关键词： Systematic literature review Object-oriented system source code analysis source code measures Software metrics Software quality Static analysis

来源：评论

学校读者我要写书评

暂无评论

Efficient storage and fast querying of source code

引用

INFORMATION SYSTEMS FRONTIERS 2011年第3期13卷 349-357页

作者： Panchenko, Oleksandr Plattner, Hasso Zeier, Alexander B. Hasso Plattner Inst Software Syst Engn D-14440 Potsdam Germany

Enabling fast and detailed insights over large portions of source code is an important task in a global development ecosystem. Numerous data structures have been developed to store source code and to support various structural queries, to help in navigation, evaluation and analysis. Many of these data structures work with tree-based or graph-based representations of source code. The goal of this project is to elaborate a data storage that enables efficient storing and fast querying of structural information. The naive adjacency list method has been enhanced with the use of recent data compression approaches for column-oriented databases to allow no-loss albeit compact storage of fine-grained structural data. The graph indexing has enabled the proposed data model to expeditiously answer fine-grained structural queries. This paper describes the basics of the proposed approach and illustrates its technical feasibility.

关键词： source code search source code analysis Global code repository Structural information

来源：评论

学校读者我要写书评

暂无评论

DAPP: automatic detection and analysis of prototype pollution vulnerability in *** modules

引用

INTERNATIONAL JOURNAL OF INFORMATION SECURITY 2022年第1期21卷 1-23页

作者： Kim, Hee Yeon Kim, Ji Hoon Oh, Ho Kyun Lee, Beom Jin Mun, Si Woo Shin, Jeong Hoon Kim, Kyounggon Korea Univ Dept Cyber Def Seoul South Korea Hayyim Secur Seoul South Korea Alice & Mallory Seoul South Korea THEORI Seoul South Korea Naif Arab Univ Secur Sci Dept Forens Sci Riyadh Saudi Arabia

The safe maintenance of *** modules is critical in the software security industry. Most server-side web applications are built on ***, an environment that is highly dependent on modules. However, there is clear lack of research on *** module security. This study focuses particularly on prototype pollution vulnerability, which is an emerging security vulnerability type that has also not been studied widely. To this point, the main goal of this paper is to propose patterns that can identify prototype pollution vulnerabilities. We developed an automatic static analysis tool called DAPP, which targets all the real-world modules registered in the Node Package Manager. DAPP can discover the proposed patterns in each *** module in a matter of a few seconds, and it mainly performs and integrates a static analysis based on abstract syntax tree and control flow graph. This study suggests an improved and efficient analysis methodology. We conducted multiple empirical tests to evaluate and compare our state-of-the-art methodology with previous analysis tools, and we found that our tool is exhaustive and works well with modern JavaScript syntax. To this end, our research demonstrates how DAPP found over 37 previously undiscovered prototype pollution vulnerabilities among 30,000 of the most downloaded *** modules. To evaluate DAPP, we expanded the experiment and ran our tool on 100,000 *** modules. The evaluation results show a high level of performance for DAPP along with the root causes for false positives and false negatives. Finally, we reported the 37 vulnerabilities, respectively, and obtained 24 CVE IDs mostly with 9.8 CVSS scores.

关键词： Node js security Automatic vulnerability extrapolation source code analysis Prototype pollution

来源：评论

学校读者我要写书评

暂无评论

Assessing vulnerability exploitability risk using software properties

引用

SOFTWARE QUALITY JOURNAL 2016年第1期24卷 159-202页

作者： Younis, Awad Malaiya, Yashwant K. Ray, Indrajit Colorado State Univ Dept Comp Sci 1873 Campus Delivery Ft Collins CO 80523 USA

Attacks on computer systems are now attracting increased attention. While the current trends in software vulnerability discovery indicate that the number of newly discovered vulnerabilities continues to be significant, the time between the public disclosure of vulnerabilities and the release of an automated exploit is shrinking. Thus, assessing the vulnerability exploitability risk is critical because this allows decision-makers to prioritize among vulnerabilities, allocate resources to patch and protect systems from these vulnerabilities, and choose between alternatives. Common vulnerability scoring system (CVSS) metrics have become the de facto standard for assessing the severity of vulnerabilities. However, the CVSS exploitability measures assign subjective values based on the views of experts. Two of the factors in CVSS, Access Vector and Authentication, are the same for almost all vulnerabilities. CVSS does not specify how the third factor, Access Complexity, is measured, and hence it is unknown whether it considers software properties as a factor. In this work, we introduce a novel measure, Structural Severity, which is based on software properties, namely attack entry points, vulnerability location, the presence of the dangerous system calls, and reachability analysis. These properties represent metrics that can be objectively derived from attack surface analysis, vulnerability analysis, and exploitation analysis. To illustrate the proposed approach, 25 reported vulnerabilities of Apache HTTP server and 86 reported vulnerabilities of Linux Kernel have been examined at the source code level. The results show that the proposed approach, which uses more detailed information, can objectively measure the risk of vulnerability exploitability and results can be different from the CVSS base scores.

关键词： Risk assessment Software vulnerability Software security metrics Attack surface CVSS metrics source code analysis

来源：评论

学校读者我要写书评

暂无评论

Cobra: a light-weight tool for static and dynamic program analysis

引用

INNOVATIONS IN SYSTEMS AND SOFTWARE ENGINEERING 2017年第1期13卷 35-49页

作者： Holzmann, Gerard J. CALTECH NASA Jet Prop Lab Pasadena CA 91125 USA

Static source code analysis tools have become indispensable for the development of reliable software applications. The best analyzers can reveal subtle flaws in a code base, but they can also be slow. In part this is due to the collection of detailed information about the possible data and control flow of an application to support the broadest possible range of analyses. For larger code bases it is not unusual that even the best of breed static analyzers can take an hour or more to complete an analysis. In this paper we describe a framework for a much faster, but more light-weight type of static analysis that can support interactive use for standard types of queries. The Cobra tool we designed for this purpose can scale to explore millions of lines of code interactively. The tool is mostly language agnostic, and can therefore easily be configured to resolve even dynamic program analysis queries.

关键词： Static analysis source code analysis Lightweight tools Token expression matching Dynamic analysis Runtime verification

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：