This work-in-progress paper aims to understand hard-to-comprehend class diagrams concepts (a standard in Unified Modeling Language (UML)) by CS students and to improve their understanding of these concepts. Fresh graduates have been reported (by the software industry) to face difficulties in solving real-world problems with class diagrams (one of many problematic areas). This incompetency affects software development negatively in the software industry when they join the workforce. Lack of proficiency in modeling knowledge leads to fault-prone software designs, which require additional testing and time for the developers in software development. To fill the skill gap, this research intends to develop a systematic pedagogical approach to help students understand these concepts better through checklist-based intervention and pair programming. Our proposed approach, in accordance with the SoTL (Scholarship of Teaching of Learning), in this study aims at conducting an empirical study in a software design course at North Dakota State University to (a) conduct a pretest to identify students' basic conceptual understanding and (b) post-tests to evaluate the impact of pair programming and checklist-based interventions. We will analyze the data collected from this session to find how much intervention and pair programming helped improve the learning concepts of software design in students and to meet industrial expectations by building skill setups for workforce industries.

Background: Open source software repositories like GitHub are mined to gain useful empirical software engineering insights and answer critical research questions. However, the present state of the art mining approaches suffers from high error rate in the labeling of data that is used for such analysis. This is particularly true when labels are automatically generated from the commit message, and seriously undermines the results of these studies. Aim: Our goal is to label commit comments with high accuracy automatically. In this work, we focus on classifying a commit as a “Bug-Fix commit” or not. Method: Traditionally, researchers have utilized keyword-based approaches to identify bug fix commits that leads to a significant increase in the error rate. We present an alternative methodology leveraging a deep neural network model called Bidirectional Encoder Representations from Transformers (BERT) that can understand the context of the commit message. We provide the rules for semantic interpretation of commit comments. We construct a hand-labeled dataset from real GitHub commits according to these rules and fine-tune BERT for classification. Results: Our initial evaluation shows that our approach significantly reduces the error rate, with up to 10% relative improvement in classification over keyword-based approaches. Future Direction: We plan on extending our dataset to cover more corner cases and reduce programming language specific biases. We also plan on refining the semantic rules. In this work, we have only considered a simple binary classification problem (Bug-Fix or not), which we plan to extend to other classes and extend the approach to consider multiclass problems. Conclusion: The rules, data, and the model proposed in this paper have the potential to be used by people analyzing open source repositories to improve the labeling of data used in their analysis.

The ubiquity of smart phones and their prevalence among the underprivileged has enabled the delivery of financial services to previously unbanked through digital means. At the same time it has exposed the same people to security vulnerabilities of digital infrastructure. In this paper, we analyze 10 Android Digital Financial Services (DFS) applications using static analysis tools and present results to show that off-the-shelf static bug checking tools, can be useful in finding many critical security bugs in DFS applications. Our findings also show that DFS applications from developing countries have more vulnerabilities in application specific code compared with DFS applications from developed countries. However, we observe that general purpose static analysis tools have low specificity for DFS specific bugs, such as the vulnerabilities in the use of cryptography and networking, and there is a need to develop better bug detection tools.

Dynamically allocated data structures pervade imperative and object-oriented programs. Automated analysis and testing of such programs requires reasoning about their data structures. The structures often have complex structural properties, such as a cyclicity of the object graph rooted at a given pointer. Such properties pose a challenge for automated reasoning. Shape analysis is a class of techniques that address reasoning about such programs. Traditionally, shape analysis is performed using static analysis of the program code. More recently, dynamic techniques for shape analysis have been developed, which inspect program states to identify properties of data structures. This paper presents a novel dynamic technique, which adapts well-studied results from graph theory to determine the shape of the program's key data structures. Specifically, spectral graph theory, a field that studies the properties of a graph in relation to the properties of matrices based on the graph, e.g., eigen values of its adjacency matrix, provides the foundational ideas. Experimental results using a suite of data structures demonstrate the potential the technique holds in identifying data structure properties and detecting likely erroneous program states.

Programs written in languages such as Java and C# maintain most of their state on the heap. The size and complexity of these programs pose a challenge in understanding and maintaining them; Heap analysis by summarizing the state of heap graphs assists programmers in these tasks. In this paper we present a novel dynamic heap analysis technique that uses spectra of the heap graphs to summarize them. These summaries capture the shape of recursive data structures as dynamic invariants or likely properties of these structures that must be preserved after any destructive update. Initial experiments show that this approach can generate meaningful summaries for a range of subject structures.

Developers have used data structure repair over the last few decades as an effective means to recover on-the-fly from errors in program state. Traditional repair techniques were based on dedicated repair routines, whereas more recent techniques have used invariants that describe desired structural properties as the basis for repair. All repair techniques are designed with one primary goal: run-time error recovery. However, the actions that any such technique performs to repair an erroneous program state are meant to produce the effect of the actions of a (hypothetical) correct program. The key insight in this paper is that repair actions on the program state can guide debugging of code (when the erroneous program execution is due to a fault in the program and not an external event).This paper presents an approach that abstracts concrete repair actions that a routine performs to repair an erroneous state into a sequence of program statements that perform the same actions using variables visible in the scope of the faulty code. Thus, appending the generated statements to the original code is akin to performing the repair from within the program. Our implementation uses the Juzi data structure repair tool as an enabling technology. Experimental results using a library data structure as well as two applications demonstrate the effectiveness of our approach in enabling repair of faulty code.

Automated debugging is becoming increasingly important as the size and complexity of software increases. This paper makes a case for using constraint-based data structure repair, a recently developed technique for fault recovery, as a basis for automated debugging. Data structure repair uses given structural integrity constraints for key data structures to monitor their correctness during the execution of a program. If a constraint violation is detected, repair performs mutations on the data structures, i.e., corrupt program state, and transforms it into another state, which satisfies the desired constraints. The primary goal of data structure repair is to transform an erroneous state into an acceptable state. Therefore, the mutations performed by repair actions provide a basis of debugging faults in code (assuming the errors are due to bugs). A key challenge to embodying this insight into a mechanical technique arises due to the difference in the concrete level of the program states and the abstract level of the program code: repair actions apply to concrete data structures that exist at runtime, whereas debugging applies to code. We observe that static structures (program variables) hold handles to dynamic structures (heap-allocated data), which allows bridging the gap between the abstract and concrete levels. We envision a tool-chain where a data structure repair tool generates repair logs that are used by a fault localization tool and a repair abstraction tool that apply in synergy to not only identify the location of fault(s) in code but also to synthesize debugging suggestions. An embodiment of our vision can significantly reduce the cost of developing reliable software.

Deryaft is a tool for generating likely representation invariants of structurally complex data. Given a small set of concrete structures, Deryaft analyzes their key characteristics to formulate local and global properties that the structures exhibit. For effective formulation of structural invariants, Deryaft focuses on graph properties, including reachability, and views the program heap as an edge-labeled graph. Deryaft outputs a Java predicate that represents the invariants; the predicate takes an input structure and returns true if and only if it satisfies the invariants.

We present aDeryaft, a novel technique for automating the writing of specifications in Alloy-a first-order relational logic with transitive closure. Alloy is particularly suitable for specifying structural properties of software, and has steadily been gaining popularity due to the rapid feedback that its SAT-based analyzer provides fully automatically. Alloy users however, still have to manually write specifications in a declarative language and use a paradigm that is different from the commonly used imperative programming paradigm. aDeryaft assists Alloy users in writing their specifications by providing a novel specification-writing approach, which is particularly tailored to users, such as engineers or practitioners in industry, who may not have much prior experience or proficiency in Alloy or similar logics. The user constructs by hand a few small concrete instances that represent the constraints of the software structure they want to specify. aDeryaft then fully automatically generates an executable Alloy specification, which represents the constraints that summarize the given structures. The generated specification is fully executable. For example, the Alloy Analyzer can use it to systematically enumerate a large number of concrete instances that satisfy the same constraints as the given instances. Indeed, a user may use aDeryaft to generate partial specifications while the user writes the rest of the specification by hand. To efficiently generate Alloy specifications, aDeryaft exploits the relational basis of Alloy and formulates graph properties that are likely to hold for the given instances. It then checks the properties for these instances and translates the valid properties into Alloy constraints, which it outputs as an Alloy specification. We illustrate aDeryaft's constraint generation on a variety of commonly used data structures.