System call analysis is a behavioral malware detection technique that is popular due to its promising detection results and ease of implementation. This study describes a system that uses system call analysis to detect malware that evade traditional defenses. The system monitors executing processes to identify compromised hosts in production environments. Experimental results compare the effectiveness of multiple feature extraction strategies and detectors based on their detection accuracy at low false positive rates. Logistic regression and support vector machines consistently outperform log-likelihood ratio and signature detectors as processing and detection methods. A feature selection study indicates that a relatively small set of system call 3-grams provide detection accuracy comparable to that of more complex models. A case study indicates that the detection system performs well against a variety of malware samples, benign workloads, and host configurations.

This paper describes the maintenance of long-lived mashup applications that are integrated at the user interface (UI) layer. It presents techniques that help mashup developers to maintain applications by identifying when and how the original applications' UIs change. It describes a novel mashup editing environment that can be used to create, share, and edit mashups. This paper also presents an experiment that demonstrates our approach's ability to track UI changes as an application evolves and a demonstration of the effort expanded by developers to maintain mashups as the applications used by the mashups evolve.

Complex software systems have become commonplace in modern organizations and are considered critical to their daily operations. They are expected to run on a diverse set of platforms while interoperating with a wide variety of other applications. Although there have been advances in the discipline of software engineering, software faults, and malicious attacks still regularly cause system downtime [1]. Downtime of critical applications can create additional work, cause delays, and lead to financial loss [2]. This paper presents a computational geometry technique to tackle the problem of timely failure diagnosis during the execution of a software application. Our approach to failure diagnosis involves collecting a set of software metrics and building a geometric enclosures corresponding to known classes of faults. The geometric enclosures are then used to partition the state space defined by the metrics.

As multicore and heterogeneous multiprocessor platforms replace uniprocessor systems, software programs must be designed with a greater emphasis on concurrency. Threading has become the dominant paradigm of concurrent computation in the most popular programming languages. Large threaded programs are known to be difficult to implement correctly, comprehend, and maintain, while concurrent programs written in process algebraic paradigms of concurrency, such as communicating sequential processes, are known to be easier to analyze. This paper presents our initial work on reverse engineering threaded source code and transforming the code into functionally-equivalent message-passing code. The paper also explores future work needed to convert the message-passing code into communicating sequential processes.

Managers are often unable to explain objectively why or when effort was misplaced during the development process. In this paper, we present a formal technique to depict the expended effort during the life-cycle of a software feature using feature development manifolds (FDMs). Using the FDMs we can compute the preferred development path for a given feature. This development path includes the versions of a software feature that contributed to the final version of the feature in a positive way. The preferred development path excludes versions of the software feature that should have been skipped. Once the preferred development path is computed the amount of wasted effort can be quantified using the metric that we have developed. We demonstrate the effectiveness of our approach to compute wasted software feature development by applying our technique to two large open source software systems, Gaim and Firefox.

REportal is an existing Web-based reverse engineering portal Web site that provides access to a suite of reverse engineering and program comprehension tools via a Web browser. This abstraction was intended to allow ease of system maintenance by adding and upgrading tools without involving the end user. However, the software tools and server technologies used became deprecated so quickly that it was not possible to take full advantage of the architectural vision. Using a service-oriented architecture, we abstract the process flow of the system from the underlying tools, enabling a wizard-style method of adding services to the system, and facilitating more "hands-off" maintenance. In this paper, we describe the challenges and benefits of this architectural migration.

MaxMash is a tool that can compose select features of networked application and generate the source code for application mashups that can integrate those features. This paper presents a case study that demonstrates how MaxMash is used to combine the Jabber chatting protocol and the Microsoft Maps Web application. The composed mashup is able to answer direction queries via a chat client.

Network administrators need a tool that detects the kind of applications running on their networks, in order to allocate resources and enforce security policies. Previous work shows that applications can be detected by analyzing packet size distributions. Detection by packet size distribution is more efficient and accurate if the distribution is binned. An unbinned packet size distribution considers the occurrences of each packet size individually. In contrast, a binned packet size distribution considers the occurrences of packets within packet size ranges. This paper reviews some of the common methods for binning distributions and presents an improved approach to binning using a genetic algorithms to assist the detection of network applications.

We have developed a technique to characterize software developers- styles using a set of source code metrics. This style fingerprint can be used to identify the likely author of a piece of code from a pool of candidates. Author identification has applications in criminal justice, corporate litigation, and plagiarism detection. Furthermore, we can identify candidate developers who share similar styles, making our technique useful for software maintenance as well. Our method involves measuring the differences in histogram distributions for code metrics.Identifying a combination of metrics that is effective in distinguishing developer styles is key to the utility of the technique. Our case study involves 18 metrics, and the time involved in exhaustive searching of the problem space prevented us from adding additional metrics. Using a genetic algorithm to perform the search, we were able to find good metric combinations in hours as opposed to weeks. The genetic algorithm has enabled us to begin adding new metrics to our catalog of available metrics. This paper documents the results of our experiments in author identification for software forensics and outlines future directions of research to improve the utility of our method.

The implementations of software features evolve as an application matures. We define a measure of feature implementation overlap that determines how similar features are in their execution by examining their call graphs. We consider how this measure changes over time, and evaluate the hypothesis that over time and subsequent versions of a software application, the implementations of semantically similar features converge. As the features of an application converge in their implementation, we are able to more effectively determine groups of semantically similar features and to reduce the cost of program comprehension by selecting few key features that give an overview of the system. We present a case study analyzing the features of the Jext, Firefox, and Gaim software systems to support our hypothesis.

SOFTWARE maintenance and evolution are relevant to users, engineers, and researchers who come into contact with software beyond Version 1. The International Conference on Software Maintenance and Evolution (ICSM) is the premiere forum for software maintenance researchers and practitioners to examine, discuss, and exchange ideas regarding the key issues facing the software maintenance community. During the conference, participants from academia, government, and industry share ideas and experiences solving critical software maintenance problems. ICSM 2006 was held in Philadelphia on 24-27 September 2006 in cooperation with several colocated workshops. These included the Eighth IEEE International Symposium on Web Site Evolution (WSE), the Sixth IEEE International Workshop on Source Code Analysis and Manipulation (SCAM), the Second International IEEE Workshop on Software Evolvability, and the Second International Workshop on Predictive Models of Modern Industrial Software Engineering. ICSM 2006’s technical program was anchored by 45 papers selected from 147 submissions. The program also included keynote addresses from three distinguished speakers: Patrick Lardieri, David Notkin, and Richard Stallman. Of the 45 papers, seven were invited to this special issue with five passing the rigorous TSE review process. These five selected papers include two that discuss frameworks and three that present new techniques. The frameworks support the creation of language-independent program analyses and evolvable test suites. Two of the techniques consider source-code reengineering and the final one the challenging problem of making live updates to a software system while it is running. The first of the two framework papers, “An Extensible Metamodel for Program Analysis” by D. Strein, R. Lincke, J. Lundberg, and W. Lowe, describes a language-independent framework for building new analyses. The resulting architecture supports the construction of specific analyses (e.g., refactorings) and is easily extensible through the addition of new front ends to support new languages. This flexibility and the use of loose coupling between components of the existing framework support the easy integration of new components. The paper uses the implementation of the tools VIZZANALYZER and XDEVELOP as a proof of concept. Looking forward, further work includes empirical study (e.g., considering running time and memory consumption) and the incorporation of dynamic analysis into the framework (e.g., to support debuggers and profilers). This paper was published in the September 2007 issue of TSE; however, the abstract of this paper is included in this special section. The paper can be found in the Computer Society Digital Library at http://computer.org/tse/ archives.htm. In the second framework paper, “On the Detection of Test Smells: A Metrics-Based Approach for General Fixture and Eager Test” by B. Van Rompaey, B. Du Bois, S. Demeyer, and M. Rieger, a framework for evaluating the evolvability of white box tests suites alongside the program is presented. The goal of this approach is to avoid the (often significant) cost incurred when test cases must be coevolved with the program. The framework accomplishes this by describing a collection of test smells. Akin to code smells, test smells allow the concrete expression of what a good evolvable test is by exploiting the principles that underlie white box testing. The paper proposes a formal description of test smells by means of metric predictors, empirically evaluated for two example test smells. Looking forward, future work will consider the interplay between test smells and frequently changing test cases. Understanding how test smells emerge and grow should help in proactively detecting current and future smells. The third and fourth papers address reengineering, a problem into which significant software evolution energy is invested. The first of these two papers, “API-Evolution Support with Diff-CatchUp” by Z. Xing and E. Stroulia, addresses the API evolution problem. In short, reusable components, and thus their APIs, must evolve in response to client needs for improved functionality, quality, and generality. Applications using an API which evolve independently can thus “break.” To tackle the API-evolution problem, the paper presents a technique and a tool that automatically recognizes API changes in a reused component and proposes plausible fixes based on working examples of the framework code base. Looking forward, planned extensions to the work IEEE TRANSACTIONS ON SOFTWARE ENGINEERING, VOL. 33, NO. 12, DECEMBER 2007 797

In this paper, we present an approach that examines the evolution of code stored in source control repositories. The technique identifies change clusters, which can help managers to classify different code change activities as either software maintenance or a new development. Furthermore, identifying the variations in change clusters over time exposes trends in the development of a software system. We present a case study that uses a sequence of change clusters to track the evolution of the PostgreSQL software project. Our case study demonstrates that our technique reveals interesting patterns about the progress of code development within each release of PostgreSQL. We show that the increase in the number of clusters not only identifies the areas where development has occurred, but also reflects the amount of structural change in code. We also compare how the change clusters vary over time in order to make generalizations about the focus of development

Since modern software systems are large and complex, appropriate abstractions of their structure are needed to make them more understandable and, thus, easier to maintain. Software clustering techniques are useful to support the creation of these abstractions by producing architectural-level views of a system's structure directly from its source code. This paper examines the Bunch clustering system which, unlike other software clustering tools, uses search techniques to perform clustering. Bunch produces a subsystem decomposition by partitioning a graph of the entities (e.g., classes) and relations (e.g., function calls) in the source code. Bunch uses a fitness function to evaluate the quality of graph partitions and uses search algorithms to find a satisfactory solution. This paper presents a case study to demonstrate how Bunch can be used to create views of the structure of significant software systems. This paper also outlines research to evaluate the software clustering results produced by Bunch.

No abstract available.

Typical documentation for object-oriented programs includes descriptions of the parameters and return types of each method in a class, but little or no information on valid method invocation sequences. Knowing the sequence with which methods of a class can be invoked is useful information especially for software engineers (e.g., developers, testers) who are actively involved in the maintenance of large software systems. This paper describes a new approach and a tool for generating class usage scenarios (i.e., how a class is used by other classes) from method invocations, which are collected during the execution of the software. Our approach is algorithmic and employs the notion of canonical sets to categorize method sequences into groups of similar sequences, where each group represents a usage scenario for a given class.

This paper presents an approach for comprehending large software systems using views that are created by subjecting the software systems to dynamic analysis under various use-case scenarios. Two sets of views are built from the runtime data: (1) graphs that capture the parts of the software's architecture that pertain to the use-cases; and (2) metrics that measure the intricacy of the software and the similarity between the software's use-cases. The Mozilla Web browser was chosen as the subject software system in our case study due to its size, intricacy, and ability to expose the challenges of analyzing large systems.

This work presents a hierarchy of dynamic views that is constructed using tools that analyze program execution traces. At the highest-level of abstraction are the feature-interaction and implementation views, which track the inter-feature dependencies as well as the classes that implement these features. At the middle-level is the class-interaction view, which is an abstract view of the object-interactions. The object-interaction view is the base view for all the views, and captures the low-level runtime interactions between objects. Two case studies are used to demonstrate the effectiveness of our work.

Software maintainers and auditors would benefit from a tool to help them focus their attention on functions that are likely to be the source of security vulnerabilities. However, the existence of such a tool is predicated on the ability to characterize a function's 'security vulnerability likelihood'. Our hypothesis is that functions near a source of input are most likely to contain security vulnerability. These functions should be a small percentage of the total number of functions in the system. To validate this hypothesis, we performed an experiment involving thirty one vulnerabilities in thirty open source systems. This paper describes the experiment, its outcome, and the tools used to conduct it. It also describes the FLF (front line functions) finder, which is a tool that was developed using knowledge gathered from the outcome of the experiment. This tool automates the detection of high-risk functions. To demonstrate the effectiveness of the FLF finder, three open source applications with known vulnerabilities were tested. In addition to this test, a case study was performed on the privilege separation code in the OpenSSH server daemon.

In this paper we describe a two step process for reverse engineering the software architecture of a system directly from its source code. The first step involves clustering the modules from the source code into abstract structures called subsystems. The second step involves reverse engineering the subsystem-level relations using a formal (and visual) architectural constraint language. We use search techniques to accomplish both of these steps, and have implemented a suite of integrated tools to support the reverse engineering process. Through a case study, we demonstrate how our tools can be used to extract the software architecture of an open-source software package from its source code without having any a priori knowledge about its design.

Decomposing source code components and relations into subsystem clusters is an active area of research. Numerous clustering approaches have been proposed in the reverse engineering literature, each one using a different algorithm to identify subsystems. Since different clustering techniques may not produce identical results when applied to the same system, mechanisms that can measure the extent of these differences are needed. Some work to measure the similarity between decompositions has been done, but this work considers the assignment of source code components to clusters as the only criterion for similarity. We argue that better similarity measurements can be designed if the relations between the components are considered. The authors propose two similarity measurements that overcome certain problems in existing measurements. We also provide some suggestions on how to identify and deal with source code components that tend to contribute to poor similarity results. We conclude by presenting experimental results, and by highlighting some of the benefits of our similarity measurements.

Form is a framework used to construct tools for analyzing the runtime behavior of standalone and distributed software systems. The architecture of Form is based on the event broadcast and pipe and filter styles. In the implementation of this architecture, execution profiles may be generated from standalone or distributed systems. The profile data is subsequently broadcast by Form to one or more views. Each view is a tool used to support program understanding or other software development activities. The authors describe the Form architecture and implementation, as well as a tool that was built using Form. This tool profiles Java-based distributed systems and generates UML sequence diagrams to describe their execution. We also present a case study that shows how this tool was used to extract sequence diagrams from a three-tiered EJB-based distributed application.

Collections of general purpose networked workstations offer processing capability that often rivals or exceeds supercomputers. Since networked workstations are readily available in most organizations, they provide an economic and scalable alternative to parallel machines. The authors discuss how individual nodes in a computer network can be used as a collection of connected processing elements to improve the performance of a software engineering tool that we developed. Our tool, called Bunch, automatically clusters the structure of software systems into a hierarchy of subsystems. Clustering helps developers understand complex systems by providing them with high-level abstract (clustered) views of the software structure. The algorithms used by Bunch are computationally intensive and, hence, we would like to improve our tool's performance in order to cluster very large systems. The paper describes how we designed and implemented a distributed version of Bunch, which is useful for clustering large systems.

Software systems are typically modified in order to extend or change their functionality, improve their performance, port them to different platforms, and so on. For developers, it is crucial to understand the structure of a system before attempting to modify it. The structure of a system, however, may not be apparent to new developers, because the design documentation is non-existent or, worse, inconsistent with the implementation. This problem could be alleviated if developers were somehow able to produce high-level system decomposition descriptions from the low-level structures present in the source code. We have developed a clustering tool called Bunch that creates a system decomposition automatically by treating clustering as an optimization problem. The paper describes the extensions made to Bunch in response to feedback we received from users. The most important extension, in terms of the quality of results and execution efficiency, is a feature that enables the integration of designer knowledge about the system structure into an otherwise fully automatic clustering process. We use a case study to show how our new features simplified the task of extracting the subsystem structure of a medium size program, while exposing an interesting design flaw in the process.

We have developed a framework for specifying high-level software designs. The core of the framework is a very simple visual notation. This notation enables designers to document designs as labelled rectangles and directed edges. In addition to the notation, our framework features a supporting formalism, called ISF (Interconnection Style Formalism). This formalism enables designers to customize the simple design notation by specifying the type of entities, relations, legal configurations of entities and relations, as well as scoping rules of the custom notation. In this paper we present the formal definition of ISF and use ISF to specify two custom design notations. We also describe how ISF specifications, using deductive database technology, are used to generate supporting tools for these custom notations.

An important product of the software design phase is the specification of the software structure at various levels of detail. Without reliable design documentation, significant software systems become less accessible to software engineers because structural information is buried in the intricate implementation source code. Reverse engineering techniques aim at recovering the structure of software systems, from the source code and mental models of developers, in order to make these systems more understandable to those maintaining them. Many reverse engineering techniques rely on creating a decomposition hierarchy by recursively clustering related software components (e.g., variables, procedures, classes, modules) into composite components (e.g., subsystems). Component clustering is necessary for managing complexity, and therefore is an important step in the reverse engineering process. We argue that the clustering of interconnections is also necessary during reverse engineering, We propose an approach, based on a formalism called tube graphs, to specifying system structure that considers both composite software components and composite interconnections between these components. We present efficient algorithms for software interconnection clustering, which nicely complement existing software component clustering algorithms.

There are a number of programming languages and tools available to educators for teaching programming to un- dergraduate computer science students.Although efforts have been made to integrate these languages and tools into programming environments, these environments generally do not have all of the ingredients that would make them useful at all levels of a typical undergraduate curriculum.Current technology used in most undergraduate courses is suitable for teaching students how to code in a particular programming language.Software development tools for activities other than coding such as requirements analysis, design, maintenance, and so on, are not provided.In addition, most programming languages in current use cannot be used in both beginner and advanced courses.We describe a "curriculum-cycle" environment for teaching programming, called Object-Oriented Turing (OOT), and elaborate on the pedagogical experience of using 00T at all levels of our university's undergraduate curriculum.