As demand grows, serverless computing systems must scale to meet increasing throughput requirements. Cloud computing easily achieves scalability by allocating abundant and elastic resources. In contrast, edge computing pre-deploys scarce and inelastic resources on site. However, edge applications often need to scale dramatically to handle bursty demand. Because they typically serve fewer users with highly variable workloads, our study shows that peak usage may require up to 8× more resources to be pre-deployed across edge nodes than in a centralized cloud. We observe that a typical serverless request can often be satisfied by different implementations, with dissimilar resource consumption profiles. When an edge application fails to scale up, the culprit is often a single bottleneck resource being fully consumed, with other resources readily available. Motivated by this observation, we introduce SCALEWAVE, a middleware for seamlessly scaling up with different implementations to fully utilize all available resources to achieve scalable serverless computing at the edge. Supporting multiple implementations, however, introduces new challenges for conventional auto-scaler designs. Reactive strategies tend to yield suboptimal performance, while proactive methods struggle with compatibility. SCALEWAVE overcomes these limitations by proactively distributing traffic across implementations, while leveraging existing autoscalers to manage instance scaling reactively for each one. Our evaluations using real workload traces on a heterogeneous cluster of edge devices demonstrate that our design allows edge applications to serve 2x more requests with minimal latency and achieve 50% more successful requests during workload bursts — showcasing substantial gains in scalability and resource efficiency.

Despite ongoing efforts to integrate security concepts into computer science curricula, many graduates still lack practical software security skills. Active learning strategies---such as drill-and-practice---offer a promising approach to bridging this educational gap. To implement these strategies effectively, educators must design and deliver hands-on exercises focusing specifically on secure programming. However, creating effective secure programming exercises is difficult, requiring substantial time and in-depth expertise. This paper examines the potential of generative AI to aid in creating drill-and-practice exercises for introductory secure programming settings. Specifically, we prompt several large language models (LLMs) to assist in generating exercises targeting three common software vulnerability classes, with tasks aligned to the advanced beginner stage of the Dreyfus skills acquisition model. We systematically evaluate the generated exercises for correctness and instructional viability. Our results show that, for some vulnerabilities, LLMs can produce technically sound and useful exercises for advanced beginners. While many generated exercises were near classroom-ready, minor fine-tuning is often necessary to ensure quality and pedagogical alignment. These findings suggest that effective exercise generation in secure programming is best achieved through a symbiosis between generative AI and human educators.

The increasingly poor state of software security poses significant threats to many of modern society's critical functions. Computing educators play a pivotal role in equipping future software engineers with the necessary skills to build secure systems. However, while traditional security courses often focus on conceptual knowledge, practical application is crucial for ensuring students can develop robust, secure software. Despite the importance of hands-on experience, students often lack suitable platforms for practicing secure programming. Inspired by drill-and-practice platforms that effectively train general programming skills, we have been working on a similar platform that focuses explicitly on teaching secure coding practices through active learning strategies. In this paper, we discuss the design of our prototype implementation: SecureCoder. Rooted in active learning principles, SecureCoder's design aims to promote student-centered education by encouraging students to actively apply theoretical secure programming concepts. Specifically, SecureCoder engages students with interactive attack-and-defend exercises, challenging them to exploit or patch software vulnerabilities in a sandboxed environment. Our ultimate objective is to bridge the gap between theoretical knowledge and practical application, fostering a deeper understanding and retention of secure coding principles. Through immediate and actionable feedback on validated exercises, SecureCoder is designed to reinforce learning and empower students to iteratively refine their solutions and build confidence in their skills. To study the potential of our design, we conducted a pilot study. The study results indicate that participants found SecureCoder to be relevant and engaging. Further, participant perceptions toward the attack-and-defend exercises suggest that SecureCoder's design has the potential to enhance secure programming education. Encouraged by SecureCoder's initial positive reception, we plan to open-source the project, inviting the broader education community to contribute to and benefit from shared security expertise. These collaborative efforts are essential for educating the next generation of security-aware software engineers. By integrating hands-on practice and active learning techniques, SecureCoder's design aims to address the urgent need for practical, skill-based security education, preparing students to meet the ever-evolving challenges of engineering secure solutions in the real world.

Modern replicated data systems often rely on libraries integrated with application code. These replicated data libraries exchange asynchronous messages, whose execution orderings are non-deterministic, allowing any message interleaving to occur during system execution. Testing the integration of application code with library code requires considering all possible interleavings, whose detection and simulation pose significant challenges for application developers. In this paper, we present ER-π, a middleware system, designed to detect and replay possible interleavings in replicated data systems. ER-π identifies potential interleavings for a given code segment and applies four novel pruning techniques to reduce the complexity of the problem space. Subsequently, it replays the remaining interleavings to perform the specified integration testing tasks. To assess the applicability and efficacy of ER-π, we integrated it with third-party replicated data libraries across various programming languages. Our experiments demonstrate ER-π 's capability to replicate 12 known bugs and uncover 5 types of common misconceptions associated with replicated data libraries. Given that integration testing is essential for ensuring correctness and robustness, the design of ER-π holds promise in extending these testing benefits to the realm of replicated data systems.

Fuzzing has become a popular technique for discovering bugs and vulnerabilities. To increase the probability of finding bugs, developers should apply fuzzers that maximize program coverage. Program coverage typically measures the percentage of program lines or branches a fuzzer executes. However, these metrics fail to communicate the value of hitting a particular line, branch, or path. Many bugs manifest only within non-trivial control flows. To improve software quality, fuzzing non-trivial program paths should be more important than fuzzing trivial ones. This paper introduces rare-path coverage (RP-Coverage), a novel program coverage metric that conveys the value of discovering an unlikely control flow path. We have developed a new technique for estimating the probability of taking an execution path, which relies on probabilistic logic programming to declaratively express the logic for constructing and analyzing a probabilistic control flow graph. Our evaluation indicates RP-Coverage's promise as a metric for measuring fuzzing efficacy. Specifically, we observe that defects along rare paths-intuitively-substantially impact the effectiveness of fuzzers. However, we argue that existing fuzzing metrics fall short when conveying this significance. We also observe that the value of uncovering an unlikely path is better reflected by increases in RP-Coverage than existing metrics. Specifically, the average coverage increases are up to 49.5%, 11.1 %, and 15.4 % for RP-Coverage, line coverage, and branch coverage, respectively. This finding indicates that RP-Coverage is more elastic, or sensitive, to path probabilities and thus capable of more effectively quantifying a fuzzer's ability to discover unlikely program paths. As such, RP-Coverage demonstrates promise as a program coverage metric that enhances fuzzer fitness measures when supplementing standard criteria.

Abstract Despite the widespread adoption of Web services in modern computing applications, there remains a lack of a systematic approach that can guide service developers in creating appealing services. This article addresses this gap by presenting findings from a comprehensive study of RapidAPI web services, the largest service marketplace, and their integration into GitHub-hosted applications. We collected data on over 16K RapidAPI services and 19K corresponding GitHub repositories invoking these services, evaluating each service based on metrics such as latency, reliability, pricing, followers, aggregate ratings community support, and provider support. Our analysis examines how these metrics influence service popularity and usage patterns on GitHub. We manually analyzed 800 GitHub repositories and identified developers’ service selection preferences and integration patterns, considering alternative services and their features. We then classified GitHub developers based on proficiency levels to understand how developers’ levels of proficiency impact their service selection and integration strategies. Moreover, we examined the metrics influence for matured set of repositories by excluding those intended solely for practice purposes. Our findings offer insights for service marketplaces to recommend integration-friendly services and for service developers to create offerings tailored to real-world application needs.

The exponential growth of genomic data presents a challenge to bioinformatics research. NCBI BLAST, a popular pairwise sequence alignment tool, does not scale with the hundreds of gigabytes (GB) of sequenced data. Therefore, mpiBLAST was widely adopted and scaled up to 65,536 processors. However, mpiBLAST is tightly coupled with an obsolete NCBI BLAST version, creating a challenge to upgrading mpiBLAST with the ever-changing NCBI BLAST code. Recent parallel BLAST implementations, like SparkBLAST, use parallelism wrappers separate from NCBI BLAST to overcome this issue. However, query partitioning, a parallel method that duplicates the genome database on each compute node, makes SparkBLAST scale poorly with databases larger than a single node's memory. Thus, no parallel BLAST utility simultaneously addresses performance, scalability, and software maintainability. To fill this gap, we introduce SparkLeBLAST, a parallel BLAST tool that uses the Spark framework and efficient data partitioning to combine mpiBLAST's performance and scalability with SparkBLAST's simplicity and maintainability. SparkLeBLAST democratizes scalable genomic analysis for domain scientists without extensive distributed computing experience. SparkLeBLAST runs up to 6.68× faster than SparkBLAST. SparkLeBLAST also accelerates taxonomic assignment of COVID-19 genomic diversity analysis by 20.9× as it speeds up the BLAST search component by 88.6× using 128 compute nodes.

To harness the potential of edge resources, two-tier client-cloud applications require transformation into three-tier client-edge-cloud applications. Such transformations are hard for programmers to perform correctly by hand. Many cloud services maintain a runtime state that needs to be replicated at the edge. Once replicated, this state must then be synchronized efficiently and correctly. To facilitate the transition to edge computing, we present a framework that automatically transforms client-cloud apps to their client-edge-cloud versions. Our framework, EdgStr, automatically replicates cloud-based services at the edge. EdgStr synchronizes the replicated service state by relying on a third-party Conflict-Free Replicated Data Type (CRDT). It generates code that connects service state changes to CRDT update operations, thus ensuring that the state changes at each replica eventually converge to the same replicated state. As an evaluation, we applied EdgStr to transform representative distributed mobile apps for deployment in dissimilar network and device setups. EdgStr correctly replicates cloud services (targeting the important domain of Node.js), deploying the resulting replicas on an ad-hoc edge cluster, hosted by Raspberry PI devices. As long as eventual consistency is congruent with the functionality of a cloud service, EdgStr can automatically replicate this service and deploy the replicas at the edge, thus offering the performance benefits of edge-based execution, without the high costs of manual program transformation.

To achieve low execution latency, time-sensitive applications, including AR/VR and autonomous driving, cache data at the edge of the network, close to end users. However, existing edge caches often fail to deliver low latency due to the inefficiency of DNS requests and the physical remoteness of their users. The solution described herein addresses these inefficiencies by presenting a millisecond-level, lightweight caching architecture that operates directly on widely deployed WiFi access points (APs). Specifically, our architecture interposes another level of caching closer to the client and is fine-tuned for APs's limited cache memory. Our solution (1) features a novel algorithm for managing cache at the AP level; (2) allows the cache query workflow to proceed at full speed; and (3) requires no changes to the application logic. Our evaluation demonstrates that our reference implementation can decrease application-level latency by as much as 76% compared to the existing solutions, without impacting AP core functions. Our caching architecture effectively improves application responsiveness by tapping into existing networking infrastructure, thus offering a powerful and cost-efficient system component for building emerging time-sensitive applications at the edge.

Despite the widespread adoption of Web services in modern computing applications, there remains a lack of a systematic approach that can guide service developers in creating appealing services. This paper addresses this gap by presenting findings from a comprehensive study of RapidAPI web services, the largest service marketplace, and their integration into GitHub-hosted applications. We collected data on over 16K RapidAPI services and 19K corresponding GitHub repositories invoking these services, evaluating each service based on metrics such as latency, reliability, pricing, community support, and provider support. Our analysis examines how these metrics influence service popularity and usage patterns on GitHub. We manually analyzed 800 GitHub repositories and identified developers' service selection preferences and integration patterns, considering alternative services and their features. Additionally, we classified GitHub developers based on proficiency levels to understand how developers' levels of proficiency impact their service selection and integration strategies. Our findings offer insights for service marketplaces to recommend integration-friendly services and for service developers to create offerings tailored to real-world application needs.

Despite their language-integrated design, Java exceptions can be difficult to use effectively. Although Java exceptions are syntactically straightforward, negligent practices often result in code logic that is not only inelegant but also unsafe. This paper explores the challenge of auditing Java software to enhance the effectiveness and safety of its exception logic. We revisit common anti-patterns associated with Java exception usage and argue that, for auditing, their detection requires a more nuanced approach than mere identification. Specifically, we investigate whether reporting such anti-patterns can be prioritized for subsequent examination. We prototype our approach as Händel, in which anti-patterns and their priority, or weight, are expressed declaratively using probabilistic logic programming. Evaluation with representative open-source code bases suggests Händel’s promise in detecting, reporting, and ranking the anti-patterns, thus helping streamline Java software auditing to ensure the safety and quality of exception-handling logic.

In a distributed replicated data system, Conflict-free Replicated Data Types (CRDTs) keep data replicas consistent on different nodes, while providing intuitive programming abstractions for accessing and modifying the replicas. Due to user errors, program bugs, or hardware malfunctions, a CRDT can be updated incorrectly, so the effect of the executed CRDT update operations needs to be undone. However, because CRDT libraries rarely include the undo capability, adding it requires modifying source code by hand, a task that is hard to accomplish in a modular and reusable fashion. As a result, programmers end up adding this advanced functionality in an ad-hoc fashion, with the resulting code being hard to understand, maintain, and reuse. To address this problem, this paper presents AUTO-UNDO, an automatic approach that generates and actuates undo functionality for existing CRDT libraries, based on simple configurations and without modifying the library code by hand. The configurations specify which CRDT operations undo each other and the conditions that trigger the execution of undo procedures. Based on the configuration, AUTO-UNDO generates and actuates a sequence of update operations that undo the specified updates on a given replica. We have implemented and evaluated AUTO-UNDO in JavaScript, a popular CRDT language, demonstrating our approach’s effectiveness, flexibility, and efficiency. Our experiences show that AUTO-UNDO effectively provides the undo capability for CRDT-based applications, thus streamlining the complexity of adding features to distributed programming frameworks.

When studying the research literature, one comes to the impression of code search engines as an essential software development tool that developers use regularly to accomplish their daily tasks. Driven by this impression, researchers primarily focus on improving the performance of code search. Nevertheless, as we argue in this paper, this impression is mostly unfounded. As a result, developers and researchers hold dissimilar perspectives on what code search engines are and their most important characteristics, with developers’ perspectives and the state of the art often diverging widely.This paper aims at reconciling these divergent perspectives by drawing a comprehensive picture of code search engines, as reflected in developers’ experiences and perspectives as well as the state of the art. To that end, we first survey more than 100 software developers to ascertain their usages of and preferences for code search engines. We then review the state of the art on this topic by analyzing academic papers, industry releases, and open-source projects. Finally, we juxtapose the results of our two investigations to synthesize a call-for-action for researchers and industry practitioners to better meet the demands of software developers when it comes to searching for code. Our findings can be used to better align the state of the art and practice of code search engines, leading to wider adoption and more effective use of this powerful software development tool.

Widely used in modern software systems, web services have become a standard means of provisioning remote resources. As the number of available web services increases, multiple services that satisfy the same functional requirement can be used interchangeably. Given a set of interchangeable services, a software developer needs to find a web service that would provide the best performance and utility. However, web services are recommended based only on their system-related performance characteristics (so called QoS, whose properties include latency, reliability, availability, etc.), while their data-related performance characteristics (e.g., data freshness, correctness, coverage, etc.) are often overlooked. As a consequence, a recommended service may end up delivering information that is inaccurate or outdated, but with high performance. To address this problem, this paper introduces Quality of Information (QoI), a quality metric complementary to QoS, that measures to which degree a web service satisfies data-related non-functional requirements. To minimize the manual effort required to evaluate the results of invoking individual services, we introduce a comparative testing methodology based on the new concept of Objects of Interest (OI). By using OI, developers can normalize the relevant information obtained from dissimilar services, so it can be automatically compared. To concretely realize our ideas, we create QiSR, a system that recommends web services based on their QoI metrics. QiSR helps developers in determining how to match services’ input and output with application data requirements and how to measure the information quality of services. To evaluate the effectiveness of QiSR, we test it on representative manually selected web services. Our evaluation shows that services recommended based on both QoI and QoS exhibit better combined performance and utility than services recommend on QoS alone.

In a mobile web app, a browser-based client communicates with a cloud-based server across the network. An app is statically divided into client and server functionalities, so the resulting division remains fixed at runtime. However, if such static division mismatches the current network conditions and the device’s processing capacities, app responsiveness and energy efficiency can deteriorate rapidly. To address this problem, we present Communicating Web Vessels (CWV), an adaptive redistribution and replication framework that improves the responsiveness of full-stack JavaScript mobile apps. Unlike standard computation offloading, in which client functionalities move to run on the server, CWV’s redistribution is bidirectional. Without any preprocessing, CWV enables apps to move any functionality from the server to the client and vice versa at runtime, thus adapting to the ever-changing execution environment of the web. Having moved to the client, former server functionalities become regular local functions. To further improve performance, CWV can replicate server-side functionalities on the client and keep the replicas consistent. By monitoring the network, CWV determines if a redistribution or a replication would improve app performance, and then analyzes, transforms, sandboxes, moves, or replicates functions and program state at runtime. An evaluation with third-party mobile web apps shows that CWV optimizes their performance for dissimilar network conditions and client devices. As compared to their original versions, CWV-powered web apps improve their performance (i.e., latency, energy consumption), particularly when executed over limited networks.1

Programmers declare variables to serve specific implementation purposes that we refer to as variable usage semantics (VUS). Understanding VUS is required for various software engineering tasks, including program comprehension, code audits, and vulnerability detection. To help programmers understand VUS, we present a new program analysis that infers a variable's usage semantics from its textual and context information (e.g., symbolic name, type, scope, information flow). To support this analysis, we introduce VarSem, a domain-specific language, in which a variable's semantic category is expressed as a set of declarative rules. VarSem's execution determines which program variables belong to a given semantic category. VarSem translates high-level declarative rules into low-level program analysis techniques, including natural language processing and data flow, and provides a highly extensible architecture for specifying new rules and analysis techniques. We evaluate VarSem with eight real-world systems to identify their personally identifiable information variables. The evaluation results show that VarSem infers variable semantics with satisfying accuracy/precision and passable recall, thus potentially benefiting both software and security engineers.

Mobile and energy harvesting devices increasingly provide resources for edge environments. These devices' mobility and limited energy budgets may cause failures and poor performance. The reliability and efficiency of edge services can be improved with equivalent microservices that satisfy application requirements by different means: execute equivalent microservices in the predefined patterns of fail-over to minimize execution costs or speculative parallelism to reduce latency. However, given the vast dissimilarities in resource availability and capability across edge environments, being limited to these predefined patterns when implementing edge services causes inconsistent QoS. To address this problem, we provide QoS-consistent edge services by customizing the execution of equivalent microservices. Our system estimates the environment-specific QoS of equivalent microservices and dynamically generates execution strategies that best satisfy given QoS requirements. We evaluate the effectiveness and performance of our system via simulations and benchmarks with realistic edge deployments. Our approach consistently out-performs the predefined execution patterns in satisfying the QoS requirements in unreliable and dynamic edge environments.

As the trusted computing base (TCB) unnecessarily increases its size, the performance and security of Trusted Execution Environments (TEE) can deteriorate rapidly. Existing solutions focus on placing only the necessary program parts in TEE, but neglect the numerous cases of legacy software with misplaced TEE-based non-sensitive code. In this paper, we introduce a new type of software refactoring-TEE Insourcing-that identifies and migrates non-sensitive code out of TEE. We present TEE-DRUP, the first semi-automated TEE Insourcing framework whose process comprises two phases: (1) a variable sensitivity analysis designates each variable as sensitive or non-sensitive; (2) a compiler-assisted program transformation automatically moves the functions that never operate on the sensitive variables out of TEE. Developers can participate to verify and confirm sensitive variables, and specify additional non-sensitive functions to migrate. The evaluation results of TEE-DRUP on real-world programs are encouraging. TEE-DRUP distinguishes between sensitive and non-sensitive variables with satisfactory accuracy, precision, and recall - all of their actual values are greater than 80% in the majority of evaluation scenarios. Further, moving non-sensitive code out of TEE improves system performance, with the speedup ranging between 1.35 and 10K. Finally, TEE-DRUP's automated program transformation requires only a small programming effort.

Participatory sensing uses both local devices for data collection and cloud-based servers for processing. However, transferring the collected data to the cloud can lead to draining device battery power and cause network bandwidth bottlenecks, especially for large multimedia files. In this paper, we investigate how the processing resources at the edge of the network can be leveraged to enable efficient participatory sensing that avoids heavy network traffic. In particular, we report on the experiences of designing, implementing, and evaluating a sensing system that constructs indoor maps by recognizing door signs. A distinguishing characteristic of our system is an almost exclusive use of edge-based processing for tasks that include ML-based image recognition, human-assisted data verification, data model retraining, and administrative data flow aggregation. Our evaluation shows that our system architecture effectively leverages the available edge resources, while greatly reducing network traffic. Based on our experiences of implementing and evaluating our system prototype, we identify several open research directions for further advancing edge-based participatory sensing.

Distributed applications enhance their execution by using remote resources. However, distributed execution incurs communication, synchronization, fault-handling, and security overheads. If these overheads are not offset by the yet larger execution enhancement, distribution becomes counterproductive. For maximum benefits, the distribution's granularity cannot be too fine or too crude; it must be just right. In this paper, we present a novel approach to re-architecting distributed applications, whose distribution granularity has turned ill-conceived. To adjust the distribution of such applications, our approach automatically reshapes their remote invocations to reduce aggregate latency and resource consumption. To that end, our approach insources a remote functionality for local execution, splits it into separate functions to profile their performance, and determines the optimal redistribution based on a cost function. Redistribution strategies combine separate functions into single remotely invocable units. To automate all the required program transformations, our approach introduces a series of domain-specific automatic refactorings. We have concretely realized our approach as an analysis and automatic program transformation infrastructure for the important domain of full-stack JavaScript applications, and evaluated its value, utility, and performance on a series of real-world cross-platform mobile apps. Our evaluation results indicate that our approach can become a useful tool for software developers charged with the challenges of re-architecting distributed applications.

Modern web applications are distributed across a browser-based client and a cloud-based server. Distribution provides access to remote resources, accessed over the web and shared by clients. Much of the complexity of inspecting and evolving web applications lies in their distributed nature. Also, the majority of mature program analysis and transformation tools works only with centralized software. Inspired by business process re-engineering, in which remote operations can be insourced back in house to restructure and outsource anew, we bring an analogous approach to the re-engineering of web applications. Our target domain are full-stack JavaScript applications that implement both the client and server code in this language. Our approach is enabled by Client Insourcing, a novel automatic refactoring that creates a semantically equivalent centralized version of a distributed application. This centralized version is then inspected, modified, and redistributed to meet new requirements. After describing the design and implementation of Client Insourcing, we demonstrate its utility and value in addressing changes in security, reliability, and performance requirements. By reducing the complexity of the non-trivial program inspection and evolution tasks performed to meet these requirements, our approach can become a helpful aid in the re-engineering of web applications in this domain.

Equivalent services deliver the same functionality with dissimilar non-functional characteristics, including latency, accuracy, and cost. With these dissimilarities in mind, developers can exploit the combined execution of equivalent services to increase accuracy, shorten latency, or reduce cost. However, it remains unknown how to effectively combine equivalent services to satisfy application requirements. With the recent surge in popularity of machine learning, different vendors offer a plethora of equivalent services, whose characteristics are mostly undocumented. As a result, developers cannot make an informed decision about which service to select from a set of equivalent services. To address this problem, we explore different service combination strategies (i.e., majority voting, weighted-majority voting, stacking, and custom) to ascertain their impact on non-functional characteristics. In particular, we study how these strategies impact the accuracy, cost, and latency of the face detection task and validate our findings on the sentiment analysis task. We consider the combined executions of commercial web services, deployed in the cloud, and open-source implementations, deployed as edge services. Our evaluation reveals that the combined execution of equivalent services is most effective for improving cost and latency. Informed by our experimental results, we formulate practical guidelines to help developers identify the best execution strategy for a given set of services.

The applicability of the microservice architecture has extended beyond traditional web services, making steady inroads into the domains of IoT and edge computing. Due to dissimilar contexts in different execution environments and inherent mobility, edge and IoT applications suffer from low execution reliability. Replication, traditionally used to increase service reliability and scalability, is inapplicable in these resource-scarce environments. Alternately, programmers can orchestrate the parallel or sequential execution of equivalent microservices-microservices that provide the same functionality by different means. Unfortunately, the resulting orchestrations rely on parallelization, synchronization, and failure handing, all tedious and error-prone to implement. Although automated orchestration shifts the burden of generating workflows from the programmer to the compiler, existing programming models lack both syntactic and semantic support for equivalence. In this paper, we enhance compiler-generated execution orchestration with equivalence to efficiently increase reliability. We introduce a dataflow-based domain-specific language, whose dataflow specifications include the implicit declarations of equivalent microservices and their execution patterns. To automatically generate reliable workflows and execute them efficiently, we introduce new equivalence workflow constructs. Our evaluation results indicate that our solution can effectively and efficiently increase the reliability of microservice-based applications.

One of the greatest achievements of Scratch as an educational tool is the eager willingness of programmers to use existing projects as the starting point for their own projects, a practice known as remixing. Despite the importance of remixing as a foundation of collaborative and communal learning, the practice remains poorly understood, with the Scratch programming community remaining in the dark about which programming practices encourage and facilitate remixing. Scratch designers lack feedback on how the remixing facility is used in the wild. To gain a deeper insight into remixing, this paper investigates heretofore unexplored dimensions of remixing: (1) the prevailing modifications that remixes perform on existing projects, (2) the impact of the original project's code quality on the granularity, extent, and development time of the modifications in the remixes, and (3) the propensity of the dominant programming practices in the original project to remain so in the remixes. Our findings can encourage remixing and improve its effectiveness, benefiting the educational and end-user programming communities.

Block-based programming has been overwhelmingly successful in revitalizing introductory computing education and in facilitating end-user development. However, poor code quality makes block-based programs hard to understand, modify, and reuse, thus hurting the educational and productivity effectiveness of blocks. There is great potential benefit in empowering programmers in this domain to systematically improve the code quality of their projects. Refactoring--improving code quality while preserving its semantics--has been widely adopted in traditional software development. In this work, we introduce refactoring to Scratch. We define four new Scratch refactorings: Extract Custom Block, Extract Parent Sprite, Extract Constant, and Reduce Variable Scope. To automate the application of these refactorings, we enhance the Scratch programming environment with powerful program analysis and transformation routines. To evaluate the utility of these refactorings, we apply them to remove the code smells detected in a representative dataset of 448 Scratch projects. We also conduct a between-subjects user study with 24 participants to assess how our refactoring tools impact programmers. Our results show that refactoring improves the subjects' code quality metrics, while our refactoring tools help motivate programmers to improve code quality.

Recent studies have demonstrated that the code quality of Scratch projects impacts this learning environment's educational effectiveness. For example, novice programmers are less willing to remix and continue modifying those projects whose code quality is low. This showpiece demonstrates QIS (pronounced as /che̅z/), a novice-friendly refactoring tool for Scratch 3.0. Integrated with the latest Scratch environment, QIS analyzes on-the-fly the code quality of an edited project, displaying the refactorable quality problems as actionable improvement hints. Programmers can then decide to act by carrying out the suggested refactoring to improve the quality of the project's code. QIS not only empowers novice programmers to easily and effectively improve their code, but also educates them about the benefits and importance of code quality and its improvement practices.

Modern mobile devices feature ever increasing computational, sensory, and network resources, which can be shared to execute tasks on behalf of nearby devices. Mobile device clouds (MDCs) facilitate such distributed execution by exposing the collective resources of a set of nearby mobile devices through a unified programming interface. However, the true potential of MDCs remains untapped, as they fail to provide practical programming support for developers to execute distributed functionalities. To address this problem, we introduce a microservice-based Programmable MDC architecture (PMDC), highly customized for the unique features of MDC environments. PMDC conveniently provisions functionalities as microservices, which are deployed on MDC devices on demand. PMDC features a novel domain specific language that provides abstractions for concisely expressing fine-grained control over the procedures of device capability sharing and microservice execution. Furthermore, PMDC introduces a new system component-the microservice gateway, which reconciles the supply of available device capabilities and the demand for microservice execution to distribute microservices within an MDC. Our evaluation shows that MDCs, expressed by developers through the PMDC declarative programming interface, exhibit low energy consumption and high performance.

Real-time systems must meet strict timeliness requirements. These systems also often need to protect their critical program information (CPI) from adversarial interference and intellectual property theft. Trusted execution environments (TEE) execute CPI tasks on a special-purpose processor, thus providing hardware protection. However, adapting a system written to execute in environments without TEE requires partitioning the code into the regular and trusted parts. This process involves complex manual program transformations that are not only laborious and intellectually tiresome, but also hard to validate and verify for the adherence to real-time constraints. To address these problems, this paper presents novel program analyses and transformation techniques, accessible to the developer via a declarative meta-programming model. The developer declaratively specifies the CPI portion of the system. A custom static analysis checks CPI specifications for validity, while probe-based profiling helps identify whether the transformed system would continue to meet the original real-time constraints, with a feedback loop suggesting how to modify the code, so its CPI can be isolated. Finally, an automated refactoring isolates the CPI portion for TEE-based execution, communicated with through generated calls to the TEE API. We have evaluated our approach by successfully enabling the trusted execution of the CPI portions of several microbenchmarks and a drone autopilot. Our approach shows the promise of declarative meta-programming in reducing the programmer effort required to adapt systems for trusted execution under real-time constraints.

Data science keeps growing in popularity as an introductory computing experience, in which students answer real-world questions by processing data. Armed with carefully prepared pedagogical datasets, computing educators can contextualize assignments and projects in societally meaningful ways, thereby benefiting students' long-term professional careers. However, integrating data science into introductory computing courses requires that the datasets be sufficiently complex, follow appropriate organizational structure, and possess ample documentation. Moreover, the impact of a data science context on students' motivation remains poorly understood. To address these issues, we have created an open-sourced manual for developing pedagogical datasets (freely available at https://think.cs.vt.edu/pragmatics). Structured as a collection of patterns, this manual shares the expertise that we have gained over the last several years, collecting and curating a large collection of real-world datasets, used in a dozen of universities worldwide. We also present new evidence confirming the efficacy of integrating data science in an introductory computing course. As a significant extension of our ongoing work, this study not only validates existing positive assessment, but also provides fine-grained nuance to the potential of data science as a motivational educational element.

It remains unclear when it is the right time to introduce software quality into the computing curriculum. Introductory students often cannot afford to also worry about software quality, while advanced students may have been groomed into undisciplined development practices already. To answer these questions satisfactorily, educators need strong quantitative evidence about the pervasiveness of software quality problems in software written by novice programmers. This paper presents a comprehensive study of software quality practices of novice programmers writing Scratch programs. By focusing on finding code smells-coding patterns indicative of quality problems-we analyze a longitudinal dataset of 100+ novice Scratch programmers and close to 3K of their programs. Even after gaining proficiency, students continue to introduce the same quality problems into their code, suggesting a need for timely educational interventions. Given the importance of software quality for modern society, computing educators should teach quality concepts and practices alongside the core computing curriculum.

To successfully bring introductory computing to non-CS majors, one needs to create a curriculum that will appeal to students from diverse disciplines. Several educational theories emphasize the need for introductory contexts that align with students' long-term goals and are perceived as useful. Data Science, using algorithms to manipulate real-world data and interpreting the results, has emerged as a field with cross-disciplinary value, and has strong potential as an appealing context for introductory computing courses. However, it is not easy to find, clean, and integrate datasets that will satisfy a broad variety of learners. The CORGIS project (https://think.cs.vt.edu/corgis) enables instructors to easily incorporate data science into their classroom. Specifically, it provides over 40 datasets in areas including history, politics, medicine, and education. Additionally, the CORGIS infrastructure supports the integration of new datasets with simple libraries for Java, Python, and Racket, thus empowering introductory students to write programs that manipulate real data. Finally, the CORGIS web-based tools allow learners to visualize and explore datasets without programming, enabling data science lessons on day one. We have incorporated CORGIS assignments into an introductory course for non-majors to study their impact on learners' motivation, with positive initial results. These results indicate that external adopters are likely to find the CORGIS tools and materials useful in their own pedagogical pursuits.

Block-based programming languages have become increasingly prominent in both the educational and end-user communities. As the block-based codebase is growing rapidly, its quality remains poorly understood, even though the awareness of recurring quality problems in this domain can benefit educators and end-user programmers alike. To address this problem, we report on the results of a large-scale assessment of recurring quality problems in block-based software. Our work identifies quality problems endemic of block-based software, as well as applies program analysis to assess the prevalence and severity of quality problems in close to 600K representative Scratch projects. Our empirical evidence shows how certain recurring quality problems hinder code sharing for popular Scratch projects. These results indicate that the quality of block-based software warrants the attention of CS educators, end-user programmers, and tool builders. Our study's results can help programmers avoid introducing the quality problems, while guiding tools builders in supporting the systematic quality improvement of block-based software.

In this showpiece, we demonstrate the functionality of Quality Hound - an online program analysis tool that takes as input a Scratch project and presents to the user a visual representation of the detected quality problems. Made accessible via a browser-based user interface, Quality Hound is instantaneously accessible to any Scratch user all over the world. The design of Quality Hound is informed by our research on cataloging and automatically detecting recurring quality problems, commonly referred to as code smells. We envision that Quality Hound can benefit the entire Scratch community by raising the awareness of software quality in this visual programming domain.

A key retention issue when educating computing novices is ensuring that the frustrations of mastering programming fundamentals do not demotivate and discourage students from studying the discipline. In particular, non-CS majors often struggle to find relevance in traditional computing curricula that tend to either emphasize abstract concepts, focus on non-practical entertainment (e.g., game and animation design), or rely on decontextualized settings. To address these issues, this paper introduces BlockPy, a block-based environment for Python (http://www.blockpy.com). BlockPy is a web-based, open-access programming environment that supports introductory programming with an emphasis on data science. It promotes long-term transfer by scaffolding an introduction to textual programming (Python) through a block-based programming view, ideal for beginners of any background. By supporting the latest Learning Tools Interoperability (LTI) standards, BlockPy is designed to support both informal learners and formal class settings. Specifically, it can be configured to provide guiding feedback for its interactive programming problems, so as to support learners at their own pace. The results from a pilot study of the initial deployment and utilization of BlockPy indicate the potential of the environment to address many of the problems faced by novice learners.

One of the fundamental building blocks of a mobile application is the ability to persist program data between different invocations. Referred to as persistence, this functionality is commonly implemented by means of persistence frameworks. When choosing a particular framework, Android—the most popular mobile platform—offers a wide variety of options to developers. Unfortunately, the energy, performance, and programming effort trade-offs of these frameworks are poorly understood, leaving the Android developer in the dark trying to select the most appropriate option for their applications. To address this problem, this paper reports on the results of the first systematic study of six Android persistence frameworks (i.e., ActiveAndroid, greenDAO, OrmLite, Sugar ORM, Android SQLite, and Java Realm) in their application to and performance with popular benchmarks, such as DaCapo. Having measured and analyzed the energy, performance, and programming effort trade-offs for each framework, we present a set of practical guidelines for the developer to choose between Android persistence frameworks. Our findings can also help the framework developers to optimize their products to meet the desired design objectives.

For maximal market penetration, popular mobile applications are typically supported on all major platforms, including Android and iOS. Despite the vast differences in the look-and-feel of major mobile platforms, applications running on these platforms in essence provide the same core functionality. As an application is maintained and evolved, the resulting changes must be replicated on all the supported platforms, a tedious and error-prone programming process. Existing automated source-to-source translation tools prove inadequate due to the structural and idiomatic differences in how functionalities are expressed across major platforms. In this paper, we present a new approach---Native-2-Native---that automatically synthesizes code for a mobile application to make use of native resources on one platform, based on the equivalent program transformations performed on another platform. First, the programmer modifies a mobile application's Android version to make use of some native resource, with a plugin capturing code changes. Based on the changes, the system then parameterizes a web search query over popular programming resources (e.g., Google Code, StackOverflow, etc.), to discover equivalent iOS code blocks with the closest similarity to the programmer-written Android code. The discovered iOS code block is then presented to the programmer as an automatically synthesized Swift source file to further fine-tune and subsequently integrate in the mobile application's iOS version. Our evaluation, enhancing mobile applications to make use of common native resources, shows that the presented approach can correctly synthesize more than 86% of Swift code for the subject applications' iOS versions.

This workshop introduces participants to CORGIS, a technology developed under the auspices of an NSF-funded project at Virginia Tech. The CORGIS Datasets Project comprises a software architecture framework and carefully engineered client libraries through which students can access either large datasets or those generated by real-time web services from domains, including weather reports, stocks, earthquakes, and news updates. The CORGIS technical scaffolding gradually introduces students to some of the most vexing complexities of distributed computing. To support the diverse needs of computing educators when teaching introductory CS classes, each CORGIS dataset is available in Python, Java, and Racket, with compatibility on key platforms. The dataset libraries are available through an online curated gallery, designed to be easily adapted to instructors' specific academic needs, including the ability to rapidly prototype new CORGIS libraries. With CORGIS, computing educators can introduce important big data or real-time distributed computing concepts without overwhelming students with the low-level details that working with such data typically requires.

Summary The popular Representational State Transfer (REST) architectural style for constructing web applications offers simplicity and scalability advantages. However, to improve the survivability of a RESTful application, programmers commonly find themselves writing vast amounts of nontrivial, ad hoc fault tolerance code. Network volatility, HTTP server errors, service outages—all require custom fault handling code, whose effective implementation requires considerable programming expertise and effort. These implementation impediments hinder the survivability of RESTful applications—without proper fault tolerance functionality, these applications are likely to crash when experiencing faults. To provide a systematic and principled approach to handling faults in RESTful applications, this article presents FT‐REST—an architectural framework for specifying fault tolerance functionality declaratively and then translating these specifications into platform‐specific code. FT‐REST encapsulates fault tolerance strategies in XML‐based specifications and compiles them to modules that reify the requisite fault tolerance. To validate our approach, we have applied FT‐REST to enhance several realistic RESTful applications to withstand the faults described in their FT‐REST specifications. As REST is said to apply verbs (HTTP commands) to nouns (URIs), FT‐REST enhances this conceptual model with adverbs that render REST reliable via reusable and extensible fault tolerance. Copyright © 2014 John Wiley & Sons, Ltd.

While computing is becoming increasingly distributed, programming projects in introductory classes remain mostly divorced from the student's day-to-day computing experiences. These experiences entail interacting with real-time Web-based data from sources that include weather reports, news updates, and restaurant recommendations. The disconnect between student experiences and the content of their programming projects is known to drive some students away from computing. In addition, to adequately prepare students for the realities of modern software engineering, educators should introduce issues pertaining to distributed computing early in the curriculum. To address these problems, we have created RealTimeWeb - an architectural framework that makes real-time web data accessible for introductory programming projects. The framework effectively introduces important real-time distributed computing concepts without overwhelming students with the low-level details that working with such data typically requires. Preliminary results indicate that our approach can be effective in the context of a typical CS2 course, and that real-time data is relevant to students. RealTimeWeb libraries and associated resources are publicly available for use, with multiple language bindings to many real-time data sources. A rapid-prototyping tool available through the project's website facilitates the development of client libraries with easily accessible APIs for new real-time Web-based data sources.

This workshop introduces participants to RealTimeWeb, a technology developed under the auspices of an NSF-funded project at Virginia Tech. RealTimeWeb is a software architecture framework that makes real-time web data, such as weather reports, news updates, and restaurant recommendations, accessible for introductory programming projects. The presented technology offers technical scaffolding for the students to gradually ease into (or completely circumvent if appropriate) some of the most vexing complexities of distributed computing. At the heart of RealTimeWeb are carefully engineered client libraries through which students can access the data provided by real-time web services. To support computing educators teaching introductory CS classes in a variety of programming languages, each library is available in Python, Java, and Racket, with compatibility on key platforms, including Android. These libraries are readily available through an online curated gallery, designed to be quickly adapted to instructors' specific academic needs. This gallery also provides a tool for rapidly prototyping new libraries based on our framework. RealTimeWeb enables computing educators to introduce important real-time distributed computing concepts without overwhelming students with the low-level details that working with such data typically requires. This workshop introduces RealTimeWeb via a hands-on approach by introducing participants to the core functionality of our architectural framework and client libraries. The workshop proceeds in three parts in which we: (1) present RealTimeWeb by working through a case study of creating a programming project in a typical CS 2 course; (2) demonstrate how the framework can be used to rapidly prototype a new library of the participants' choice; and (2) critically discuss the technology in small and large groups.

As energy efficiency has become a key consideration in the engineering of mobile applications, an increasing number of perfective maintenance tasks are concerned with optimizing energy consumption. However, optimizing a mobile application to reduce its energy consumption is non-trivial due to the highly volatile nature of mobile execution environments. Mobile applications commonly run on a variety of mobile devices over mobile networks with divergent characteristics. Therefore, no single, static energy consumption optimization is likely to yield across-the-board benefits, and may even turn to be detrimental in some scenarios. In this paper, we present a novel approach to perfective maintenance of mobile applications to reduce their energy consumption. The maintenance programmer declaratively specifies the suspected energy consumption hotspots in a mobile application. Based on this input, our approach then automatically transforms the application to enable it to offload parts of its functionality to the cloud. The offloading is highly adaptive, being driven by a runtime system that dynamically determines both the state-to-offload and its transfer mechanism based on the execution environment in place. In addition, the runtime system continuously improves its effectiveness due to a feedback-loop mechanism. Thus, our approach flexibly reduces the energy consumption of mobile applications behind the scenes. Applying our approach to third- party Android applications has shown that it can effectively reduce the overall amount of energy consumed by these applications, with the actual numbers ranging between 25% and 50%. These results indicate that our approach represents a promising direction in developing pragmatic and systematic tools for the perfective maintenance of mobile applications.

To successfully compete in the software marketplace, modern mobile applications must run on multiple competing platforms, such as Android, iOS, and Windows Phone. Companies producing mobile applications spend substantial amounts of time, effort, and money to port applications across platforms. Creating individual program versions for different platforms further exacerbates the maintenance burden. This paper presents Cloud Twin, a novel approach to natively executing the functionality of a mobile application written for another platform. The functionality is accessed by means of dynamic cross-platform replay, in which the source application's execution in the cloud is mimicked natively on the target platform. The reference implementation of Cloud Twin natively emulates the behavior of Android applications on a Windows Phone. Specifically, Cloud Twin transmits, via web sockets, the UI actions performed on the Windows Phone to the cloud server, which then mimics the received actions on the Android emulator. The UI updates on the emulator are efficiently captured by means of Aspect Oriented Programming and sent back to be replayed on the Windows Phone. Our case studies with third-party applications indicate that the Cloud Twin approach can become a viable solution to the heterogeneity of the mobile application market.

Although battery capacities keep increasing, the execution demands of modern mobile devices continue to outstrip their battery lives. As a result, battery life is bound to remain a key constraining factor in the design of mobile applications. To save battery power, mobile applications are often partitioned to offload parts of their execution to a remote server. However, partitioning an application renders it unusable in the face of network outages. In this paper, we present a novel approach that reduces the energy consumption of mobile applications through server offloading without partitioning. The functionality that consumes energy heavily is executed in the cloud, with the program's state check pointed and transferred across the mobile device and the cloud. Our approach is portable, as it introduces the offloading functionality through byte code enhancement, without any changes to the runtime system. The check pointed state's size is minimized through program analysis. In the case of a network outage, the offloading interrupts and the application reverts to executing locally from the latest checkpoint. Our case studies demonstrate how our approach can reduce energy consumption for third-party Android applications. Transformed through our approach, the applications consume between 30% and 60% fewer Joules than their original versions. Our results indicate that portable offloading can improve the battery life of modern mobile applications while maintaining their resilience to network outages.

As the prevailing programming model of enterprise applications is becoming more declarative, programmers are spending an increasing amount of their time and efforts writing and maintaining metadata, such as XML or annotations. Although metadata is a cornerstone of modern software, automatic bug finding tools cannot ensure that metadata maintains its correctness during refactoring and enhancement. To address this shortcoming, this paper presents metadata invariants, a new abstraction that codifies various naming and typing relationships between metadata and the main source code of a program. We reify this abstraction as a domain-specific language. We also introduce algorithms to infer likely metadata invariants and to apply them to check metadata correctness in the presence of program evolution. We demonstrate how metadata invariant checking can help ensure that metadata remains consistent and correct during program evolution; it finds metadata-related inconsistencies and recommends how they should be corrected. Similar to static bug finding tools, a metadata invariant checker identifies metadata-related bugs as a program is being refactored and enhanced. Because metadata is omnipresent in modern software applications, our approach can help ensure the overall consistency and correctness of software as it evolves.

Programmers are spending a large and increasing amount of their time writing and modifying metadata, such as Java annotations and XML deployment descriptors. And yet, automatic bug finding tools cannot find metadata-related bugs introduced during program refactoring and enhancement. To address this shortcoming, we have created metadata invariants, a new programming abstraction that expresses naming and typing relationships between metadata and the main source code of a program. A paper that appears in the main technical program of ICSE 2012 describes the idea, concept, and prototype of metadata invariants [4]. The goal of this demo is to supplement that paper with a demonstration of our Eclipse plugin, Metadata Bug Finder (MBF). MBF takes as input a script written in our domain-specific language that describes a set of metadata coding conventions the programmer wishes to enforce. Then after each file save operation, MBF checks the edited codebase for the presence of any violations of the given metadata programming conventions. These violations are immediately reported to the programmer as potential metadata-related bugs. By making the programmer aware of these potential bugs, MBF prevents them from seeping into production, thereby improving the overall correctness of the edited codebase.

Despite the simplicity and scalability benefits of REST, rendering RESTful web applications fault-tolerant requires that the programmer write vast amounts of non-trivial, ad-hoc code. Network volatility, HTTP server errors, service outages-all require custom fault handling code, whose effective implementation requires considerable programming expertise and effort. To provide a systematic and principled approach to handling faults in RESTful applications, we present FT-REST-an architectural framework for specifying fault tolerance functionality declaratively and then translating these specifications into platform-specific code. FT-REST encapsulates fault tolerance strategies in XML-based specifications and compiles them to modules that reify the requisite fault tolerance. To validate our approach, we have applied FT-REST to enhance several realistic RESTful applications to withstand the faults described in their FT-REST specifications. As REST is said to apply verbs (HTTP commands) to nouns (URIs), FT-REST enhances this conceptual model with adverbs that render REST reliable via reusable and extensible fault tolerance.

Abstract Despite using multiple concurrent processors, a typical high‐performance parallel application is long‐running, taking hours, even days to arrive at a solution. To modify a running high‐performance parallel application, the programmer has to stop the computation, change the code, redeploy, and enqueue the updated version to be scheduled to run, thus wasting not only the programmer's time, but also expensive computing resources. To address these inefficiencies, this article describes how dynamic software updates (DSU) can be used to modify a parallel application on the fly, thus saving the programmer's time and using expensive computing resources more productively. The net effect of updating parallel applications dynamically can reduce the total time that elapses between posing a problem and arriving at a solution, otherwise known as time‐to‐discovery. To explore the benefits of dynamic updates for high performance applications, this article takes a two‐pronged approach. First, we describe our experiences of building and evaluating a system for dynamically updating applications running on a parallel cluster. We then review a large body of literature describing the existing state of the art in DSU and point out how this research can be applied to high‐performance applications. Our experimental results indicate that DSU have the potential to become a powerful tool in reducing time‐to‐discovery for high‐performance parallel applications. Copyright © 2010 John Wiley & Sons, Ltd.

In modern distributed object systems, reference parameters to a remote method are passed according to their runtime type. This design choice limits the expressiveness, readability, and maintainability of distributed applications. Further, to extend the built-in set of parameter passing semantics of a distributed object system, the programmer has to understand and modify the underlying middleware implementation. To address these design shortcomings, this article presents (i) a declarative and extensible approach to remote parameter passing that decouples parameter passing semantics from parameter types, and (ii) a plugin-based framework, DeXteR , which enables the programmer to extend the built-in set of remote parameter passing semantics, without having to understand or modify the underlying middleware implementation. DeXteR treats remote parameter passing as a distributed cross-cutting concern and uses aspect-oriented and generative techniques. DeXteR enables the implementation of different parameter passing semantics as reusable application-level plugins, applicable to application, system, and third-party library classes. The expressiveness, flexibility, and extensibility of the approach is validated by adding several nontrivial remote parameter passing semantics (i.e., copy-restore, lazy, streaming) to Java Remote Method Invocation (RMI) as DeXteR plugins.

Online software upgrades are often plagued by runtime behaviors that are poorly understood and difficult to ascertain. For example, the interactions among multiple versions of the software expose the system to race conditions that can introduce latent errors or data corruption. Moreover, industry trends suggest that online upgrades are currently needed in large-scale enterprise systems, which often span multiple administrative domains (e.g., Web 2.0 applications that rely on AJAX client-side code or systems that lease cloud-computing resources). In such systems, the enterprise does not control all the tiers of the system and cannot coordinate the upgrade process, making existing techniques inadequate to prevent mixed-version races. In this paper, we present an analytical framework for impact assessment, which allows system administrators to directly compare the risk of following an online-upgrade plan with the risk of delaying or canceling the upgrade. We also describe an executable model that implements our formal impact assessment and enables a systematic approach for deciding whether an online upgrade is appropriate. Our model provides a method of last resort for avoiding undesirable program behaviors, in situations where mixed-version races cannot be avoided through other technical means.

In a grid application, some requirements may change while the execution is in progress. This paper presents in-vivo enhancement--updating running grid applications to facilitate their perfective maintenance. Because applications in this domain are not only typically long-running, but also time-consuming to deploy, we propose a in-vivo enhancement can change a running application flexibly and efficiently. Specifically, this paper presents a novel technique for dynamically updating grid applications deployed on the Java Virtual Machine (JVM). Our technique overcomes constraints of JVM HotSwap, a facility for replacing classes at runtime. While HotSwap precludes the programmer from adding new methods and fields, changing the signatures of existing methods, and has no support for transferring state between old and new objects, our approach effectively removes these constraints by rewriting program bytecode. Further, the rewritten programs incur only minimal performance overhead (less than 2% on average). We demonstrate the efficiency and extensibility of our approach through micro and macro benchmarks, as well as through a case study of dynamically updating a parallel bioinformatics application.

Although distributed object systems, including RMI and CORBA, enable object-oriented programs to be easily distributed across a network, achieving acceptable performance usually requires client-specific optimization of server interfaces, making such systems difficult to maintain and evolve. Automatic optimization techniques, including Batched Futures and Communication Restructuring, do not work as well as hand optimization. This paper presents Batched Remote Method Invocation (BRMI), a language-level technique for clients to specify explicit batches of operations on remote objects. We have implemented BRMI for Java as an extension of RMI, with support for batches with array cursors, custom exception handling, conditionals and loops. BRMI allows common design patterns, including Data Transfer Objects and Remote Object Facade, to be constructed on the fly by clients. The performance benefits of batching operations are well known; our evaluation focuses on the usability of explicit batches, but we also confirm that BRMI outperforms RMI and scales significantly better when clients make multiple remote calls. The applicability of BRMI is demonstrated by rewriting third-party RMI client applications to use BRMI.

Faced with the challenges of understanding the source code of a program, software developers are assisted by a wealth of software visualization research. This work explores how visualization can be supplemented by sonification as a cognitive tool for code comprehension. By engaging the programmer's auditory senses, sonification can improve the utility of program comprehension tools. This paper reports on our experiences of creating and evaluating a program comprehension prototype tool that employs sonification to assist program understanding by rendering sonic cues. Our empirical evaluation of the efficacy of information sonification indicates that this cognitive aid can effectively complement visualization when trying to understand an unfamiliar code base. Based on our experiences, we then propose a set of guidelines for the design of a new generation of tools that increase their information utility by combining visualization and sonification.

Programs written in managed languages are compiled to a platform-independent intermediate representation, such as Java bytecode. The relative high level of Java bytecode has engendered a widespread practice of changing the bytecode directly, without modifying the maintained version of the source code. This practice, called bytecode engineering or enhancement, has become indispensable in introducing various concerns, including persistence, distribution, and security, transparently. For example, transparent persistence architectures help avoid the entanglement of business and persistence logic in the source code by changing the bytecode directly to synchronize objects with stable storage. With functionality added directly at the bytecode level, the source code reflects only partial semantics of the program. Specifically, the programmer can neither ascertain the program's runtime behavior by browsing its source code, nor map the runtime behavior back to the original source code.

J-Orchestra is a system that enhances centralized Java programs with distribution capabilities. Operating at the bytecode level, J-Orchestra transforms a centralized Java program (i.e., running on a single Java Virtual Machine (JVM)) into a distributed one (i.e., running across multiple JVMs). This transformation effectively separates distribution concerns from the core functionality of a program. J-Orchestra follows a semiautomatic transformation process. Through a GUI, the user selects program elements (at class granularity) and assigns them to network locations. Based on the user's input, the J-Orchestra backend automatically partitions the program through compiler-level techniques, without changes to the JVM or to the Java Runtime Environment (JRE) classes. By means of bytecode engineering and code generation, J-Orchestra substitutes method calls with remote method calls, direct object references with proxy references, etc. It also translates Java language features (e.g., static methods and fields, inheritance, inner classes, new object construction, etc.) for efficient distributed execution. We detail the main technical issues that J-Orchestra addresses, including its mechanism for program transformation in the presence of unmodifiable code (e.g., in JRE classes) and the translation of concurrency and synchronization constructs to work correctly over the network. We further discuss a case study of transforming a large, commercial, third-party application for efficient execution in a client server environment and outline the architectural characteristics of centralized programs that are amenable to automated distribution with J-Orchestra.

We present an automated approach for marshaling C++ data structures in high performance computing (HPC) applications. Our approach utilizes a graphical editor through which the user can express a subset of an object's state to be marshaled and sent across a network. Our tool, MPI serializer, then automatically generates efficient marshaling and unmarshaling code for use with the message passing interface (MPI), the predominant communication middleware for HPC systems. Our approach provides a more comprehensive level of support for C++ language features than the existing state of the art, and does so in full compliance with the C++ language standard. Specifically, we can marshal effectively and efficiently non-trivial language constructs such as polymorphic pointers, dynamically allocated arrays, non-public member fields, inherited members, and STL container classes. Additionally, our marshaling approach is also applicable to third party libraries, as it does not require any modifications to the existing C++ source code. We validate our approach through two case studies of applying our tool to automatically generate the marshaling functionality of two realistic HPC applications. The case studies demonstrate that the automatically generated code matches the performance of typical hand-written implementations and surpasses current state-of-the-art C++ marshaling libraries, in some cases by more than an order of magnitude. The results of our case studies indicate that our approach can be beneficial for both the initial construction of HPC applications as well as for the refactoring of sequential applications for parallel execution.

Since annotations were added to the Java language, many frameworks have moved to using annotated Plain Old Java Objects (POJOs) in their newest releases. Legacy applications are thus forced to undergo extensive restructuring in order to migrate from old framework versions to new versions based on annotations (Version Lock-in). Additionally, because annotations are embedded in the application code, changing between framework vendors may also entail largescale manual changes (Vendor Lock-in).

We present natural remote method invocation (NRMI): a middleware mechanism that provides a fully general implementation of call-by-copy-restore semantics for arbitrary linked data structures, used as parameters in remote procedure calls. Call-by-copy-restore offers a more natural programming model for distributed systems than traditional call-by-copy middleware, enabling remote calls to behave much like local calls. We discuss in depth the effects of calling semantics for middleware, describe when and why NRMI is more convenient to use than standard middleware, and present three implementations of NRMI in distinct settings, showing the generality of the approach.

Bioinformaticists use the Basic Local Alignment Search Tool (BLAST) to characterize an unknown sequence by comparing it against a database of known sequences, thus detecting evolutionary relationships and biological properties. mpiBLAST is a widely-used, high-performance, open-source parallelization of BLAST that runs on a computer cluster delivering super-linear speedups. However, the Achilles heel of mpiBLAST is its lack of modularity, thus adversely affecting maintainability and extensibility. Alleviating this shortcoming requires an architectural refactoring to improve maintenance and extensibility while preserving high performance. Toward that end, this paper evaluates five different software architectures and details how each satisfies our design objectives. In addition, we introduce a novel approach to using mixin layers to enable mixing-and-matching of modules in constructing sequence-search applications for a variety of high-performance computing systems. Our design, which we call "mixin layers with refined roles", utilizes mixin layers to separate functionality into complementary modules and the refined roles in each layer improve the inherently modular design by precipitating flexible and structured parallel development, a necessity for an open-source application. We believe that this new software architecture for mpiBLAST-2.0 will benefit both the users and developers of the package and that our evaluation of different software architectures will be of value to other software engineers faced with the challenges of creating maintainable and extensible, high-performance, bioinformatics software.

User-level indirection is the automatic rewriting of an application to interpose code that gets executed upon program actions such as object field access, method call, object construction, etc. The approach is constrained by the presence of opaque (native) code that cannot be indirected and can invalidate the assumptions of any indirection transformation. In this paper, we demonstrate the problem of employing user-level indirection in the presence of native code. We then suggest reasonable assumptions on the behavior of native code and a simple analysis to compute the constraints they entail. We show that the type information at the native code interface is often a surprisingly sufficient approximation of native behavior for heuristically estimating when user-level indirection can be applied safely. Furthermore, we introduce a new user-level indirection approach that minimizes the constraints imposed by interactions with native code.

We present Binary Refactoring: a software engineering technique for improving the implementation of programs without modifying their source code. While related to regular refactoring in preserving a program's functionality, binary refactoring aims to capture modifications that are often applied to source code, although they only improve the performance of the software application and not the code structure. We motivate binary refactoring, present a binary refactoring catalogue, describe the design and implementation of BARBER---our binary refactoring browser for Java, and demonstrate the usefulness of binary refactoring through a series of benchmarks.

Adding distributed capabilities to existing programs has come to the forefront of software evolution. As a standard Java distributed technology, applets offer the advantages of being easily deploy able over Web browsers and requiring little to no explicit distributed programming. Yet applets are inflexible: they download remote code and run it only on the client machine. We present appletizing: a semi-automatic approach to transforming a Java GUI application into a client-server application, in which the client runs as a Java applet that communicates with the server through RMI. To enable appletizing, we have expanded the capabilities of J-Orchestra, our automatic partitioning system that takes as input a Java application in bytecode format and transforms it into a distributed application, running across multiple standard JVMs. We discuss the motivation, benefits, and J-Orchestra support for appletizing, and validate our approach via a set of case studies and associated benchmarks.

We present NRMI: a drop-in replacement of Java RMI that offers call-by-copy-restore semantics for arbitrary linked data structures, in addition to regular call-by-copy semantics. Call-by-copy-restore middleware is more natural to use than traditional call-by-copy RPC mechanisms, enabling distributed calls to behave much like local calls. We discuss in depth the effect of calling semantics for middleware, describe how call-by-copy-restore can be implemented efficiently, and show examples of Java programs where NRMI is more convenient than regular Java RMI.

We discuss how a collection of domain-specific and domain-independent tools can be combined to "aspectize" the distributed character of server-side applications, to a much greater extent than with prior efforts. Specifically, we present a framework that can be used with a large class of unaware applications to turn their objects into distributed objects with minimal programming effort. Our framework is developed on top of three main components: AspectJ (a high-level aspect language), XDoclet (a low-level aspect language), and NRMI (a middleware facility that makes remote calls behave more like local calls). We discuss why each of the three components offers unique advantages and is necessary for an elegant solution, why our approach is general, and how it constitutes a significant improvement over past efforts to isolate distribution concerns.