Code-based analyzers often find too many potentially security-related issues to address them all. Therefore, issues likely to lead to vulnerabilities should be fixed first. Such prioritization requires project-specific knowledge, such as quality requirements, security-related decisions, and design, which is not accessible to code analyzers. We present TraceSEC, an automated technique for prioritizing issues according to their security-related importance to the project. Its core concept is to incorporate available design artifacts and trace links between them, thus considering the project context that the code lacks. We reduce the problem of issue prioritization to a maximum flow problem and quantify the importance of each issue by the flow from user-defined quality aspects to the issue, i.e., quantifying its impact on project-specific security preferences. Our evaluation shows that TraceSEC effectively provides automated prioritization and can be tailored to project-specific quality goals. Its prioritization correlates stronger with manual expert prioritization than SonarQube rule severities, which are commonly used in practice. In particular, TraceSEC has a higher similarity for identifying high-priority issues. TraceSEC scales reasonably well for codebases up to four million lines of code, and the initial setup overhead is likely to be recouped after the first automated prioritization.

Abstract The benefits of traceability have widely been discussed in research. However, studies have also shown that traceability practices are still not prevalent in industrial settings due to the high manual effort and lack of tool support. In this paper, we explore the feasibility of using eye tracking to automatically detect trace links to reduce manual effort and thereby increase practical applicability. We conducted a two-stage interview study in industry. In Stage 1 we interviewed 20 practitioners to provide an overview of how traceability is established in practice and how an eye tracking approach would need to be applied in order to be useful. In Stage 2 we conducted interviews with 16 practitioners from one project context to elicit role-specific workflows and analyzed which activities are suitable to obtain useful traceability links based on gaze data. As there is no one-fits-all solution to traceability, and technical limitations of eye tracking still exist, we collected information on used artifact types, tools and requirements management practices to adjust an approach to actual traceability stakeholders’ needs. We report on perspectives from different roles in software projects and give an overview of traced artifacts, current traceability experiences, as well as benefits and doubts concerned with using eye tracking to obtain links automatically. We discuss the implications for the evaluation and implementation of an automatic tracing approach in practice and how eye tracking can support requirements engineering activities.

The benefits of traceability have widely been discussed in research. However, studies have also shown that traceability practices are still hardly established in industrial settings due to the high manual effort and lack of tool support. In this paper, we explore the feasibility of using eye tracking to automatically detect trace links to reduce manual effort and thereby increase practical applicability. We conducted an interview study with 20 practitioners to give an overview of traceability practices in industry and how an eye tracking approach would need to be applied in order to be useful. As there is no one-fits-all solution to traceability, and technical limitations of eye tracking still exist, we collected information on used artifact types, tools and requirements management practices to adjust an approach to actual traceability stakeholders' needs. We report on perspectives from different roles in software projects and give an overview of traced artifacts, current traceability purposes and issues, as well as benefits and doubts concerned with using eye tracking to obtain links automatically. We discuss the implications for the implementation of an automatic tracing approach in practice and how eye tracking can support requirements engineering activities.

Abstract The creation of a shared understanding of the project vision of all relevant stakeholders is vital to the requirements engineering process. One way to create such a shared understanding is through the use of vision videos that visualize the project vision at an early project stage. However, not all functional aspects can be presented. For example, the fact that an access code is valid for only a single use can be hard to visualize. One low-effort solution could be the insertion of short texts or short audio clips. In this work, our question is twofold: What effects do short pieces of additional information have in vision videos? What are suitable ways to add this information to vision videos? To answer these research questions, we investigated three different methods of inserting additional information to vision videos in an eye tracking study. We inserted short texts either below the scene or as overlays and also investigated the addition of short audio clips. These methods were evaluated in terms of participants’ video comprehension, visual effort, cognitive load and subjective preference. The results of our study show that the pieces of additional information improve vision comprehension, thereby supporting the creation of a shared understanding. All investigated methods lead to only marginal increases of the viewers’ cognitive load. Based on our results, we derive recommendations on how to insert additional information in vision videos.

One main goal of requirements engineering is ensuring that all stakeholders share the same vision of the future system. Vision Videos can be used for this purpose. They visualize the product vision at an early stage of the project. However, some functional aspects, such as an access code being valid only once, are difficult to visualize. Short texts could be a low-effort solution to complement videos with additional information. Thus, represented visions and requirements could be taken to the next level of clarification. Our question is two-fold: What effects do texts have in vision videos? What are suitable ways to add textual information to vision videos? We conducted an eye tracking study to investigate the effects of adding short texts to vision videos, either below the scene or as text overlays. We evaluated these two methods regarding video comprehension, reading time, cognitive load and subjective preference. Our study shows that texts in vision videos improve vision comprehension and thus support the achievement of one requirements engineering goal. Both methods increase the cognitive load of viewers only by a reasonable margin. No clear-cut preference for a single variant was found. We derive recommendations on how to add texts to vision videos.

Despite its numerous scientifically cited benefits, traceability is still rarely established in industrial settings. Years of research in the area have brought several different approaches to create traceability links including Information Retrieval (IR) and Machine Learning approaches. However, their accuracy and overall traceability support is not sufficient yet to be properly applied in practice. In my research, I want to investigate the usage of eye tracking and interaction data in the field of traceability. By tracking how software engineers interact with documents, where they focus on and recording gaze links between those documents, an algorithm is designed to obtain trace links between artifacts from these data. Eye tracking and interaction data have the advantage that they can be recorded in an automatic, non-intrusive way without requiring manual effort. They give detailed insight about where people focus on when working on tasks. However, software support of eye tracking is still limited, especially in the context of dynamic content such as switching between, scrolling or editing documents. Therefore, one essential step of my research is to provide software support for recording eye tracking data in dynamic document environments. By combining eye tracking data with additionally recorded metadata such as interactions, this eye tracking framework shall enable the automatic capturing of gaze links and gaze durations during software engineering tasks. The approach of using eye tracking in the context of traceability will be evaluated in several usage scenarios such as requirements coverage assessment.

UNLABELLED: The R/Bioconductor package Protein Array Analyzer (PAA) facilitates a flexible analysis of protein microarrays for biomarker discovery (esp., ProtoArrays). It provides a complete data analysis workflow including preprocessing and quality control, uni- and multivariate feature selection as well as several different plots and results tables to outline and evaluate the analysis results. As a main feature, PAA's multivariate feature selection methods are based on recursive feature elimination (e.g. SVM-recursive feature elimination, SVM-RFE) with stability ensuring strategies such as ensemble feature selection. This enables PAA to detect stable and reliable biomarker candidate panels. AVAILABILITY AND IMPLEMENTATION: PAA is freely available (BSD 3-clause license) from http://www.bioconductor.org/packages/PAA/ CONTACT: [email protected] or [email protected].