Software metrics capture information about software development processes and products. These metrics support decision-making, e.g., in team management or dependency selection. However, existing metrics tools measure only a snapshot of a software project. Little attention has been given to enabling engineers to reason about metric trends over time—longitudinal metrics that give insight about process, not just product. In this work, we present PRIME (PRocess MEtrics), a tool to compute and visualize process metrics. The currently-supported metrics include productivity, issue density, issue spoilage, and bus factor. We illustrate the value of longitudinal data and conclude with a research agenda. The tool’s demo video can be watched at https://bit.ly/ase2022-prime. Source code can be found at https://github.com/SoftwareSystemsLaboratory/prime.

Video conferencing apps (VCAs) make it possible for previously private spaces — bedrooms, living rooms, and kitchens — into semi-public extensions of the office. For the most part, users have accepted these apps in their personal space without much thought about the permission models that govern the use of their private data during meetings. While access to a device’s video camera is carefully controlled, little has been done to ensure the same level of privacy for accessing the microphone. In this work, we ask the question: what happens to the microphone data when a user clicks the mute button in a VCA? We first conduct a user study to analyze users’ understanding of the permission model of the mute button. Then, using runtime binary analysis tools, we trace raw audio flow in many popular VCAs as it traverses the app from the audio driver to the network. We find fragmented policies for dealing with microphone data among VCAs — some continuously monitor the microphone input during mute, and others do so periodically. One app transmits statistics of the audio to its telemetry servers while the app is muted. Using network traffic that we intercept en route to the telemetry server, we implement a proof-of-concept background activity classifier and demonstrate the feasibility of inferring the ongoing background activity during a meeting — cooking, cleaning, typing, etc. We achieved 81.9% macro accuracy on identifying six common background activities using intercepted outgoing telemetry packets when a user is muted.

Context-based authentication is a method for transparently validating another device's legitimacy to join a network based on location. Devices can pair with one another by continuously harvesting environmental noise to generate a random key with no user involvement. However, there are gaps in our understanding of the theoretical limitations of environmental noise harvesting, making it difficult for researchers to build efficient algorithms for sampling environmental noise and distilling keys from that noise. This work explores the information-theoretic capacity of context-based authentication mechanisms to generate random bit strings from environmental noise sources with known properties. Using only mild assumptions about the source process's characteristics, we demonstrate that commonly-used bit extraction algorithms extract only about 10% of the available randomness from a source noise process. We present an efficient algorithm to improve the quality of keys generated by context-based methods and evaluate it on real key extraction hardware. MOONSHINE is a randomness distiller which is more efficient at extracting bits from an environmental entropy source than existing methods. Our techniques nearly double the quality of keys as measured by the NIST test suite, producing keys that can be used in real-world authentication scenarios.

The emergence of advanced in-vehicle infotainment (IVI) systems, such as Apple CarPlay and Android Auto, calls for fast and intuitive device pairing mechanisms to discover newly introduced devices and make or break a secure, high-bandwidth wireless connection. Current pairing schemes are tedious and lengthy as they typically require users to go through pairing and verification procedures by manually entering a predetermined or randomly generated pin on both devices. This inconvenience usually results in prolonged usage of old pins, significantly degrading the security of network connections.

We present PANDA, a data acquisition technique for energy-constrained sensor nodes that reduces the energy per operation required to sample and preprocess analog sensor data. PANDA takes advantage of the energy consumption patterns of commodity microcontrollers by sampling input signals in short bursts followed by long periods of inactivity. This approach reduces the overhead of repetitively transitioning the CPU and analog components in and out of low-power sleep states. This nonuniformly-spaced input data is then fed to a nonuniform FFT algorithm that computes the frequency spectrum. We show that the spectrum computed with the nonuniform FFT is very close to the spectrum that would be computed from uniformly sampled data preprocessed with a conventional FFT. The output of the nonuniform FFT can be filtered or post-processed with conventional frequency domain analysis techniques, and a uniformly resampled output can be constructed with the conventional inverse FFT. We compare the energy consumption patterns of burst-mode sampling to those of conventional uniform sampling in several real sensor nodes. We demonstrate that for reasonably sized input datasets, burst mode sampling and postprocessing consumes more than 17 percent less energy than conventional uniform sampling, including the additional computations required to compute the nonuniform DFT.

We present dBHound, a mobile sensing analytics app for tracking room occupancy and activities while preserving privacy for users. dBHound takes advantage of audio sensors available on mobile devices to collect data about the environment. dBHound is a layer in the mobile operating system API that gathers decibel (dB) data from the device's onboard audio sensors and strips it of sensitive information. Using mobile devices as sensors has the advantage that users do not have to purchase or manage additional sensing devices within the home. Among the different sensor modalities discussed in [4, 1, 2, 5, 3] many of which are limited to detecting a small subset of activities in-home, sound is a highly general and aligns well with everyday human activity. We demonstrate that having access to decibel-level data streams from multiple devices can give us more insight into activity and occupancy patterns than a single sensor, without compromising privacy.