This paper presents a validation approach to feature selection in software product lines (SPL). SPLs consist of similar products tailored to different needs, while SPLs sharing a common platform where feature configurations define product families. Validating feature configurations is critical to avoid defective shipments, recalls, and disposal. Exhaustive, pairwise, and combinatorial testing, among others, aim at ensuring configuration correctness. This paper introduces a novel method for improving feature selection and validation in SPLs by minimizing redundancy while ensuring configurations align with customer needs. The method emphasizes uncovering the differences in feature structures through "complex" and "simple" models, which helps identify and helps identify and tolerate potential errors arising from incorrect feature configurations. This ensures broader coverage while effectively managing dependencies. A case study using the Access Point (AP) SPL model, which is a networking device designed to enhance the strength of an existing wireless signal and expand its coverage area. The AP can enable or disable specific features on AP SPL depending on the characteristics of the third-party gateway with which it is integrated. AP SPL model with 66 features lead to 266configurations, generated by Exhaustive Testing. Pairwise testing achieves 87% coverage with 132 test cases, while combinatorial testing reaches 94% with 45,760 cases. Our method ensures 100% feature coverage with just 3 test configurations. Thus, the approach introduced in this paper enhances product quality while reducing costs by avoiding redundant tests, making the approaches valuable for large-scale SPLs.

Existing software product line (SPL) engineering testing approaches generally provide positive testing that validates the SPL’s functionality. Negative testing is commonly neglected. This research aims to unify behavioral and feature models of an SPL, enable testing before and after variability binding for domain-centric and product-centric testing, and combine positive and negative testing for a holistic testing view. This study suggests behavioral modeling with event sequence graphs (ESGs). This heterogeneous modeling strategy supports bottom-up domain testing and top-down product testing with the feature model. This new feature-oriented ESG test creation method generates shorter test sequences than the original ESG optimum test sequences. Statechart and original ESG test-generating methods are compared. Positive testing findings are similar. The Statechart technique generated 12 test cases with 59 events, whereas the ESG technique created six test cases with 60 events. The ESG technique generated 205 negative test cases with 858 events with the Test Suite Designer tool. However, the Conformiq Designer tool for the Statechart technique does not have a negative test case generation capability. It is shown that the proposed ESG-based holistic approach confirms not only the desirable (positive) properties but also the undesirable (negative) ones. As an additional research, the traditional ESG test-generating approach is compared to the new feature-oriented method on six SPLs of different sizes and features. Our case study results show that the traditional ESG test generation approach demonstrated higher positive test generation scores compare to the proposed feature-oriented test generation approach. However, our proposed feature-oriented test generation approach is capable of generating shorter test sequences, which could be beneficial for reducing the execution time of test cases compared to traditional ESG approach. Finally, our case study has also shown that regardless of the test generation approach, there has been found no significant difference between the Bottom-up and Top-down test strategies with respect to their positive test generation scores.

Testing is a vital part of achieving good-quality software. Deploying untested code can cause system crashes and unexpected behavior. To reduce these problems, testing should evolve with coding. In addition, test suites should not remain static throughout the software versions. Since whenever software gets updated, new functionalities are added, or existing functionalities are changed, test suites should be updated along with the software. Software repositories contain valuable information about the software systems. Access to older versions and differentiating adjacent versions’ source code and acceptance test changes can provide information about the evolution process of the software. This research proposes a method and implementation to analyze 21 open-source real-world projects hosted on GitHub regarding the co-evolution of both software and its acceptance test suites. Related projects are retrieved from repositories, their versions are analyzed, graphs are created, and analysis related to the co-evolution process is performed. Observations show that the source code is getting updated more frequently than the acceptance tests. They indicate a pattern that source code and acceptance tests do not evolve together. Moreover, the analysis showed that a few acceptance tests test most of the functionalities that take a significant line of code.

Change impact analysis evaluates the changes that are made in the software and finds the ripple effects, in other words, finds the affected software components. Code changes and bug fixes can have a high impact on code quality by introducing new vulnerabilities or increasing their severity. A recent high-visibility example of this is the code changes in the log4j web software CVE-2021-45105 to fix known vulnerabilities by removing and adding method called change types. This bug fix process exposed further code security concerns. In this article, we analyze the most common set of bug fix change patterns to have a better understanding of the distribution of software changes and their impact on code quality. To achieve this, we implemented a tool that compares two versions of the code and extracts the changes that have been made. Then, we investigated how these changes are related to change impact analysis. In our case study, we identified the change types for bug-inducing and bug fix changes using the Quixbugs dataset. Furthermore, we used 13 of the projects and 621 bugs from Defects4J to identify the common change types in bug fixes. Then, to find the change types that cause an impact on the software, we performed an impact analysis on a subset of projects and bugs of Defects4J. The results have shown that, on average, 90% of the bug fix change types are adding a new method declaration and changing the method body. Then, we investigated if these changes cause an impact or a ripple effect in the software by performing a Markov chain-based change impact analysis. The results show that the bug fix changes had only impact rates within a range of 0.4–5%. Furthermore, we performed a statistical correlation analysis to find if any of the bug fixes have a significant correlation with the impact of change. The results have shown that there is a negative correlation between caused impact with the change types adding new method declaration and changing method body. On the other hand, we found that there is a positive correlation between caused impact and changing the field type.

Code changes are one of the essential processes of software evolution. These changes are performed to fix bugs, improve quality of software, and provide a better user experience. However, such changes made in code could lead to ripple effects that can cause unwanted behavior. To prevent such issues occurring after code changes, code change prediction, change impact analysis techniques are used. The proposed approach uses static call information, forward slicing, and method change information to build a Markov chain, which provides a prediction for code changes in the near future commits. For static call information, we utilized and compared call graph and effect graph. We performed an evaluation on five open-source projects from GitHub that varies between 5K-26K lines of code. To measure the effectiveness of our proposed approach, recall, precision, and f-measure metrics have been used on five open-source projects. The results show that the Markov chain that is based on call graph can have higher precision compared to effect graph. On the other hand, for small number of cases higher recall values are obtained with effect graph compared to call graph. With a Markov chain model based on call graph and effect graph, we can achieve recall values between 98%-100%.

Change impact analysis analyzes the changes that are made in the software and finds the ripple effects, in other words, finds the affected software components. In this study, we analyze the bug fix change patterns to have a better understanding of what types of changes are common in fixing bugs. To achieve this, we implemented a tool that compares two versions of codes and detects the changes that are made. Then, we investigated how these changes are related to change impact analysis. In our case study, we used 13 of the projects and 621 bugs from Defects4J to identify the common change types in bug fixed. Then, to find the change types related to cause an impact in the software, we performed an impact analysis on a subset of projects and bugs of Defects4J. The results have shown that, on average, 90% of the bug fix change types are adding a new method declaration and changing the method body. Then, we investigated if these changes cause an impact or a ripple effect in the software by performing a Markov chain-based change impact analysis. The results show that the bug fix changes had only impact rates within a range of 0.4%-5%. Furthermore, we performed a statistical correlation analysis to find if any of the bug fixes have a significant correlation on the impact of change. The results have shown that there is a negative correlation between caused impact with the change types adding new method declaration and changing method body. On the other hand, we found that there is a positive correlation between caused impact and changing the field type.

The goal of software product lines (SPLs) is rapid development of high-quality software products in a specific domain with cost minimization. To assure quality of software products from SPLs, products need to be tested systematically. However, testing every product variant in isolation is generally not feasible for large number of product variants. An approach to deal with this issue is to use incremental testing, where test artifacts that are developed for one product are reused for another product which can be obtained by incrementally adding features to the prior product. We propose a novel model-based test generation approach for products developed using SPL that follows incremental testing paradigm. First, we introduce Featured Event Sequence Graphs (FESGs), an extension of ESGs, that provide necessary definitions and operations to support commonalities and variabilities in SPLs with respect to test models. Then we propose a test generation technique for the product variants of an SPL, which starts from any product. The proposed technique with FESGs avoids redundant test generation for each product from SPL. We compare our technique with in-isolation testing approach by a case study.

As cloud platforms turn into software product lines (SPLs), testing products composed of customer selected features becomes more and more important. In this paper, we propose a feature-oriented testing approach for platform-based SPLs through a novel extension to Gherkin called SPL-AT Gherkin and a novel automatic test method generation technique, which utilizes TestNG framework. We demonstrate the applicability of the proposed approach by a case study.

Change impact analysis plays an important role in identifying potential affected areas that are caused by changes that are made in a software. Most of the existing change impact analysis techniques are based on architectural design and change history. However, source code-based change impact analysis studies are very few and they have shown higher precision in their results. In this study, a static method-granularity level change impact analysis, that uses program slicing and Bayesian Network technique has been proposed. The technique proposes a directed graph model that also represents the call dependencies between methods. In this study, an open source Java project with 8999 to 9445 lines of code and from 505 to 528 methods have been analyzed through 32 commits it went. Recall and f-measure metrics have been used for evaluation of the precision of the proposed method, where each software commit has been analyzed separately.

Presents the introductory welcome message from the conference proceedings. May include the conference officers' congratulations to all involved with the conference event and publication of the proceedings record.

Presents the introductory welcome message from the conference proceedings. May include the conference officers' congratulations to all involved with the conference event and publication of the proceedings record.

Presents the introductory welcome message from the conference proceedings. May include the conference officers' congratulations to all involved with the conference event and publication of the proceedings record.

User inputs are critical for the security, safety, and reliability of software systems. This paper proposes a new concept called user input contracts, which is an integral part of a design-by-contract supplemented development process, and a model-based testing approach to detect violations of user input contracts. The approach generates test cases from an input contract integrated with graph-based model of user interface specification and applies them to the system under consideration. The paper presents a proof-of-concept tool that has been developed and used to validate the approach by experiments. The experiments are conducted on a web-based system for marketing tourist services to analyze input robustness of system under consideration with respect to user input contracts.

This paper rigorously introduces the concept of model-based mutation testing (MBMT) and positions it in the landscape of mutation testing. Two elementary mutation operators, insertion and omission , are exemplarily applied to a hierarchy of graph-based models of increasing expressive power including directed graphs, event sequence graphs, finite-state machines and statecharts. Test cases generated based on the mutated models ( mutants ) are used to determine not only whether each mutant can be killed but also whether there are any faults in the corresponding system under consideration (SUC) developed based on the original model. Novelties of our approach are: (1) evaluation of the fault detection capability (in terms of revealing faults in the SUC) of test sets generated based on the mutated models, and (2) superseding of the great variety of existing mutation operators by iterations and combinations of the two proposed elementary operators. Three case studies were conducted on industrial and commercial real-life systems to demonstrate the feasibility of using the proposed MBMT approach in detecting faults in SUC, and to analyze its characteristic features. Our experimental data suggest that test sets generated based on the mutated models created by insertion operators are more effective in revealing faults in SUC than those generated by omission operators. Worth noting is that test sets following the MBMT approach were able to detect faults in the systems that were tested by manufacturers and independent testing organizations before they were released.

Presents a listing of the Symposium organizing committee.

Biometrics is the science of identifying or verifying every individual uniquely in a set of people by using physiological or behavioral characteristics possessed by the user. Opposed to the knowledge-based and token-based security systems, cutting-edge biometrics-based identification systems offer higher security and less probability of spoofing. The need of biometric systems is increasing in day-to-day activities due to its ease of use by common people in any sector of personalized access, e.g. in attendance system of organizations, citizenship proof, door lock for high security zones, etc. Financial sector, government, and reservation systems are adopting biometric technologies to ensure highest possible security in their own domains and to maintain signed activity log of every individual.

No document was made available for publication as part of the conference proceedings.

Multi-agent systems (MAS) which communicate with intra-domain and inter-domain agent platforms have access control requirements. Instead of a central mechanism, a fine-grained access control mechanism could have been applied to MAS platforms. This paper emphasizes MAS-based domain and security ontologies with XACML-based access control approach for MAS platforms. The domain dependent behaviour and access control parameters in agent ontologies could be combined within a common XACML policy document that is used through different MAS applications. Agent-based access control requirements and common XACML policy documents should be consistent to enforce policies for MAS. To obtain this condition, the translation of organizational policies and platform based policies have to be considered in detail and the verified policy features have to be enforced in MAS to provide access for resources.

Boundary overflows are caused by violation of constraints, mostly limiting the range of internal values of program, and can be provoked by an intruder to gain control of or access to stored data. In order to countermeasure this well-known vulnerability issue, this paper focuses on input validation of graphical user interfaces (GUI). The approach proposed generates test cases for numerical inputs based on GUI specification through decision tables. If boundary overflow error(s) are detected, the source code will be analyzed to localize and correct the encountered error(s) automatically.

This paper proposes an approach for validation of numerical inputs based on graphical user interfaces (GUI) that are modeled and specified by event sequence graphs (ESG). For considering complex structures of input data, ESGs are augmented by decision tables and patterns of design by contract (DbC). The approach is evaluated by experiments on boundary overflows, which occur when input values violate the range of specified values. Furthermore, a tool is presented that implements our approach enabling a semi-automatically detection of boundary overflow errors and suggesting correction steps based on DbC.