Detecting design patterns in large software systems is a common reverse engineering task that can help the comprehension process of the system's design. While several design pattern detection tools presented in the literature are capable of detecting design patterns automatically, evaluating these detection results is usually done in a manual and subjective fashion. Differences in design pattern definitions, as well as pattern instance counting and presenting, exacerbate the difficulty of evaluating design pattern detection results. In this paper, we present a novel approach to evaluating and comparing design pattern detection results. Our approach, called MoRe, introduces a novel way to present design pattern instances in a uniform fashion. Based on this characterization of design pattern instances, we propose four measures for design pattern detection evaluation that convey a concise assessment of the quality of the results produced by a given detection method. We have implemented these measures, and present case studies that showcase their usefulness.

Protecting web applications against security attacks, such as command injection, is an issue that has been attracting increasing attention as such attacks are becoming more prevalent. Taint tracking is an approach that achieves protection while offering significant maintenance benefits when implemented at the language library level. This allows the transparent re-engineering of legacy web applications without the need to modify their source code. Such an approach can be implemented at either the string or the character level.

The need to decompose large, complex software systems into smaller, more manageable subsystems has been recognized for more than two decades. Many cluster analysis algorithms have been applied to the software domain, and several algorithms specializing in software clustering have been developed. This in turn has created the need to evaluate and compare clustering results.

Several software clustering algorithms have been proposed in the literature, each with its own strengths and weaknesses. Most of these algorithms have been applied to particular software systems with considerable success. However, no algorithm has been shown to be superior in all cases. As a result, selecting a software clustering algorithm that is best suited for a specific software system remains a hard question to answer. At the same time, improving the effectiveness of an existing algorithm is a time-consuming process that would benefit from a methodology that allowed the early evaluation of an idea. In this paper, we first introduce a formal description template for software clustering algorithms. Based on this template, we propose a novel method for the selection of a software clustering algorithm for specific needs, as well as a method for software clustering algorithm improvement. The applicability and usefulness of the two methods introduced in this paper is demonstrated by applying them in four distinct case studies. Copyright © 2012 John Wiley & Sons, Ltd.

Denial of Service (DoS) attacks overwhelm online services, preventing legitimate users from accessing a service, often with impact on revenue or consumer trust. Approaches exist to filter network-level attacks, but application-level attacks are harder to detect at the firewall. Filtering at this level can be computationally expensive and difficult to scale, while still producing false positives that block legitimate users. This article presents a model-based adaptive architecture and algorithm for detecting DoS attacks at the web application level and mitigating them. Using a performance model to predict the impact of arriving requests, a decision engine adaptively generates rules for filtering traffic and sending suspicious traffic for further review, where the end user is given the opportunity to demonstrate they are a legitimate user. If no legitimate user responds to the challenge, the request is dropped. Experiments performed on a scalable implementation demonstrate effective mitigation of attacks launched using a real-world DoS attack tool.

Design patterns have been used successfully to build well-organized, flexible software systems. In the reverse engineering field, detecting design patterns can simplify program comprehension by providing clues about the rationale behind the system's design. However, the precision and recall of existing approaches to design pattern detection leave room for improvement. In this paper, we introduce a novel technique called FiG that complements existing detection methods by utilizing fine-grained static information contained in the software system. Our approach filters a large number of false positives by utilizing fine-grained rules that describe the static structure of a design pattern. We have implemented our approach in the context of the Eiffel programming language. Several experiments were performed to determine the effectiveness of the proposed approach.

Evaluation of software clustering algorithms is typically done by comparing the clustering results to an authoritative decomposition prepared manually by a system expert. A well-known drawback of this approach is the fact that there are many, equally valid ways to decompose a software system, since different clustering objectives create different decompositions. Evaluating all clustering algorithms against a single authoritative decomposition can lead to biased results. In this paper, we introduce LimSim, a novel approach for software clustering evaluation that utilizes multiple simulated authoritative decompositions. We also present experimental results of applying the new approach to evaluate various software clustering algorithms. The results demonstrate the usefulness of LimSim.

Evaluation of software clustering algorithms is typically done by comparing the clustering results to an authoritative decomposition prepared manually by a system expert. A well-known drawback of this approach is the fact that there are many, equally valid ways to decompose a software system, since different clustering objectives create different decompositions. Evaluating all clustering algorithms against a single authoritative decomposition can lead to biased results. In this paper, we introduce and quantify the notion of clustering algorithm comparability. It is based on the concept that algorithms with different objectives should not be directly compared. Not surprisingly, we find that several of the published algorithms in the literature are not comparable to each other.

The evaluation of the effectiveness of software clustering algorithms is a challenging research question. Several approaches that compare clustering results to an authoritative decomposition have been presented in the literature. Existing evaluation methods typically compress the evaluation results into a single number. They also often disagree with each other for reasons that are not well understood. In this paper, we introduce a novel set of indicators that evaluate structural discrepancies between software decompositions. They also allow researchers to investigate the differences between existing evaluation approaches in a reduced search space. Several experiments with real software systems showcase the usefulness of the introduced indicators.

Several software clustering algorithms have been proposed in the literature, each with its own strengths and weaknesses. Most of these algorithms have been applied to particular software systems with considerable success. However, the question of how to select a software clustering algorithm that is best suited for a specific software system remains unanswered. In this paper, we introduce a method for the selection of a software clustering algorithm for specific needs. The proposed method is based on a newly introduced formal description template for software clustering algorithms. Using the same template, we also introduce a method for software clustering algorithm improvement.

The majority of the algorithms in the software clustering literature utilize structural information to decompose large software systems. Approaches using other attributes, such as file names or ownership information, have also demonstrated merit. At the same time, existing algorithms commonly deem all attributes of the software artifacts being clustered as equally important, a rather simplistic assumption. Moreover, no method that can assess the usefulness of a particular attribute for clustering purposes has been presented in the literature. In this paper, we present an approach that applies information theoretic techniques in the context of software clustering. Our approach allows for weighting schemes that reflect the importance of various attributes to be applied. We introduce LIMBO, a scalable hierarchical clustering algorithm based on the minimization of information loss when clustering a software system. We also present a method that can assess the usefulness of any nonstructural attribute in a software clustering context. We applied LIMBO to three large software systems in a number of experiments. The results indicate that this approach produces clusterings that come close to decompositions prepared by system experts. Experimental results were also used to validate our usefulness assessment method. Finally, we experimented with well-established weighting schemes from information retrieval, Web search, and data clustering. We report results as to which weighting schemes show merit in the decomposition of software systems.

One of the central questions that a similarity measure for software decompositions has to address is whether to consider discrepancies in terms of the nodes of a particular decomposition, or assess similarity based on differences in clustering the edges of the system's dependency graph. We argue that considering nodes or edges in isolation is too one-sided. We outline shortcomings of previous approaches, and introduce the first dissimilarity measure that takes both nodes and edges into account. We also present experiments on real and synthetic data sets that illustrate the differences between various measures.

There have been many systems developed that attempt to recover design and structure from code. We present our experience with using one such tool, SoFi, to extract design structure from a large industrial system written in C. We compare the extracted structure to that which was intended by the designers of the system. We observe and categorize, for our system, the reasons why these two views differ. We observe that seemingly minor decisions in implementation, can have a large impact an the extracted design, and draw some conclusions about the practicality of trying to recover "intended designs" from source code.