Automated functional user interface (UI) testing of mobile apps is a challenging task due to the highly interactive nature of the app UIs, and thus it commonly fails to provide high code coverage. In this paper, we present DroidDEV, an automated UI exerciser which aims to achieve high code coverage for real-world Android apps. DroidDEV dynamically builds a finite UI flow graph, generates and injects UI-context-aware inputs to exercise all the widgets on all the UI screens through a best-first search path finding algorithm. We have evaluated DroidDEV on 20 real-world open-source Android apps and compared it with manual UI testing and two other prevalent automated approaches including MobiGUITAR and Monkey. On these subjects, DroidDEV reports code coverage similar to manual UI testing, and it outperforms MobiGUITAR and Monkey in terms of code coverage and exercising time.

Android applications typically contain multiple third-party libraries and recent studies have shown that the presence of third-party libraries may introduce privacy risks and security threats. Furthermore, researchers have reported the importance of considering the third-party libraries for their program analysis tasks. A reason being that the presence of third-party libraries may dilute the features and affect the accuracy of their results. Existing literature typically employs a whitelist to exclude the third-party libraries from their analysis in order to achieve accurate results. However, these whitelists are generally incomplete and weak against the renaming obfuscation technique that is commonly employed in Android applications. In this paper, we propose LibSift, a tool to automatically detect third-party libraries in Android applications. LibSift detects third-party libraries based on package dependencies that are resilient to most common obfuscations. The evaluation results not only indicate that LibSift can detect third-party libraries accurately and effectively, but also show that LibSift can detect even the less popular libraries that are not detected by two of the state-of-the-art approaches.

Binary code search has received much attention recently due to its impactful applications, e.g., plagiarism detection, malware detection and software vulnerability auditing. However, developing an effective binary code search tool is challenging due to the gigantic syntax and structural differences in binaries resulted from different compilers, architectures and OSs. In this paper, we propose BINGO — a scalable and robust binary search engine supporting various architectures and OSs. The key contribution is a selective inlining technique to capture the complete function semantics by inlining relevant library and user-defined functions. In addition, architecture and OS neutral function filtering is proposed to dramatically reduce the irrelevant target functions. Besides, we introduce length variant partial traces to model binary functions in a program structure agnostic fashion. The experimental results show that BINGO can find semantic similar functions across architecture and OS boundaries, even with the presence of program structure distortion, in a scalable manner. Using BINGO, we also discovered a zero-day vulnerability in Adobe PDF Reader, a COTS binary.

Mining static code attributes for predicting software vulnerabilities has received some attention recently. There are a number of approaches for detecting vulnerabilities from source code, but commercial off the shelf components are, in general, distributed in binary form. Before using such third-party components it is imperative to check for presence of vulnerabilities. We investigate the use of static analysis and machine learning for predicting buffer overflow vulnerabilities from binaries in this study. To mitigate buffer overflows, developers typically perform size checks and input validation. We propose static code attributes characterizing buffer usage and defense mechanisms implemented in the code for preventing buffer overflows. The proposed approach starts by identifying potential vulnerable statement constructs during binary program analysis and extracts static code attributes for each of them as per proposed characterization scheme to capture buffer usage patterns and defensive mechanisms employed in the code. Data mining methods are then used on these collected code attributes for predicting buffer overflows. Our experimental evaluation on standard buffer overflow benchmark binaries shows that the proposed static code attributes are effective in predicting buffer overflow vulnerabilities.

The blooming mobile smart phone device industry has attracted a large number of application developers. However, due to the availability of reverse engineering tools for Android applications, it also caught the attention of plagiarists and malware writers. In recent years, application cloning has become a serious threat to the Android market. In previous work, mobile application clone detection mainly focuses on code-based analysis. Such an approach lacks resilient to advanced obfuscation techniques. Their efficiency is also questionable, as billions of opcodes need to be processed for cross-market clone detection. In this paper, we propose a novel technique of detecting Android application clones based on the analysis of user interface (UI) information collected at runtime. By leveraging on the multiple entry points feature of Android applications, the UI information can be collected easily without the need to generate relevant inputs and execute the entire application. Another advantage of our technique is obfuscation resilient since semantics preserving obfuscation technique do not affect runtime behaviors. We evaluated our approach on a set of real-world dataset and it has a low false positive rate and false negative rate. Furthermore, the results also show that our approach is effective in detecting different types of repackaging attacks.

Due to limited time and resources, web software engineers need support in identifying vulnerable code. A practical approach to predicting vulnerable code would enable them to prioritize security auditing efforts. In this paper, we propose using a set of hybrid (static+dynamic) code attributes that characterize input validation and input sanitization code patterns and are expected to be significant indicators of web application vulnerabilities. Because static and dynamic program analyses complement each other, both techniques are used to extract the proposed attributes in an accurate and scalable way. Current vulnerability prediction techniques rely on the availability of data labeled with vulnerability information for training. For many real world applications, past vulnerability data is often not available or at least not complete. Hence, to address both situations where labeled past data is fully available or not, we apply both supervised and semi-supervised learning when building vulnerability predictors based on hybrid code attributes. Given that semi-supervised learning is entirely unexplored in this domain, we describe how to use this learning scheme effectively for vulnerability prediction. We performed empirical case studies on seven open source projects where we built and evaluated supervised and semi-supervised models. When cross validated with fully available labeled data, the supervised models achieve an average of 77 percent recall and 5 percent probability of false alarm for predicting SQL injection, cross site scripting, remote code execution and file inclusion vulnerabilities. With a low amount of labeled data, when compared to the supervised model, the semi-supervised model showed an average improvement of 24 percent higher recall and 3 percent lower probability of false alarm, thus suggesting semi-supervised learning may be a preferable solution for many real world applications where vulnerability data is missing.

During bug reporting, The same bugs could be repeatedly reported. As a result, extra time could be spent on bug triaging and fixing. In order to reduce redundant effort, it is important to provide bug reporters with the ability to search for previously reported bugs efficiently and accurately. The existing bug tracking systems are using relatively simple ranking functions, which often produce unsatisfactory results. In this paper, we apply Ranking SVM, a Learning to Rank technique to construct a ranking model for accurate bug report search. Based on the search results, a topic model is used to cluster the bug reports into multiple facets. Each facet contains similar bug reports of the same topic. Users and testers can locate relevant bugs more efficiently through a simple query. We perform evaluations on more than 16,340 Eclipse and Mozilla bug reports. The evaluation results show that the proposed approach can achieve better search results than the existing search functions.

Despite being studied for more than two decades buffer overflow vulnerabilities are still frequently reported in programs. In this paper, we propose a hybrid approach that combines static and dynamic program analysis to audit buffer overflows. Using simple rules, test data are generated to automatically confirm some of the vulnerabilities through dynamic analysis and the remaining cases are predicted by mining static code attributes. Confirmed cases can be directly fixed without further verification whereas predicted cases need to be manually reviewed to confirm existence of vulnerabilities. Since our approach combines the strengths of static and dynamic analyses, it results in an overall accuracy improvement. In our evaluation of approach using the standard benchmark suite, our classifiers achieved a recall over 92% and precision greater than 81%. The dynamic analysis component confirmed 51% of known vulnerabilities along with reporting 2 new bugs, thereby reducing by half, otherwise needed manual auditing effort.

Input manipulation vulnerabilities such as SQL Injection, Cross-site scripting, Buffer Overflow vulnerabilities are highly prevalent and pose critical security risks. As a result, many methods have been proposed to apply static analysis, dynamic analysis or a combination of them, to detect such security vulnerabilities. Most of the existing methods classify vulnerabilities into safe and unsafe. They have both false-positive and false-negative cases. In general, security vulnerability can be classified into three cases: (1) provable safe, (2) provable unsafe, (3) unsure. In this paper, we propose a hybrid framework-Detecting Input Manipulation Vulnerabilities (DIMV), to verify the adequacy of security vulnerability defenses for input manipulation vulnerabilities by integrating formal verification with vulnerability prediction in a seamless way. The verification part takes into account sink predicates and effect of domain and custom specifications for detecting input manipulation vulnerabilities. Proving from specification is used as far as possible. Cases that cannot be proved are then predicted from the signatures mined. Our evaluation shows the practicality of the proposed framework.

In a database application, for each attribute, a value is created initially via insertion. Then, the value can be referenced or updated via selection and updating respectively. Eventually, when the record is deleted, the values of the attributes are also deleted. These occurrences of events are associated with the states to constitute the attribute lifecycle. Our empirical studies discover that faults and incompleteness in database applications are highly associated with the attribute lifecycle. Consequently, we propose a novel approach to automatically extract the attribute lifecycle out of a database application from its source code through inter-procedural static program analysis. Data mining methods are applied to predict faults and incompleteness in database applications. Experiments on PHP systems give evidence to support applicability and accuracy of the proposed method.

In previous work, we proposed a set of static attributes that characterize input validation and input sanitization code patterns. We showed that some of the proposed static attributes are significant predictors of SQL injection and cross site scripting vulnerabilities. Static attributes have the advantage of reflecting general properties of a program. Yet, dynamic attributes collected from execution traces may reflect more specific code characteristics that are complementary to static attributes. Hence, to improve our initial work, in this paper, we propose the use of dynamic attributes to complement static attributes in vulnerability prediction. Furthermore, since existing work relies on supervised learning, it is dependent on the availability of training data labeled with known vulnerabilities. This paper presents prediction models that are based on both classification and clustering in order to predict vulnerabilities, working in the presence or absence of labeled training data, respectively. In our experiments across six applications, our new supervised vulnerability predictors based on hybrid (static and dynamic) attributes achieved, on average, 90% recall and 85% precision, that is a sharp increase in recall when compared to static analysis-based predictions. Though not nearly as accurate, our unsupervised predictors based on clustering achieved, on average, 76% recall and 39% precision, thus suggesting they can be useful in the absence of labeled training data.

In recent years, malware (malicious software) has greatly evolved and has become very sophisticated. The evolution of malware makes it difficult to detect using traditional signature-based malware detectors. Thus, researchers have proposed various behavior-based malware detection techniques to mitigate this problem. However, there are still serious shortcomings, related to scalability and computational complexity, in existing malware behavior modeling techniques. This raises questions about the practical applicability of these techniques. This paper proposes and evaluates a bounded feature space behavior modeling (BOFM) framework for scalable malware detection. BOFM models the interactions between software (which can be malware or benign) and security-critical OS resources in a scalable manner. Information collected at run-time according to this model is then used by machine learning algorithms to learn how to accurately classify software as malware or benign. One of the key problems with simple malware behavior modeling (e.g., n-gram model) is that the number of malware features (i.e., signatures) grows proportional to the size of execution traces, with a resulting malware feature space that is so large that it makes the detection process very challenging. On the other hand, in BOFM, the malware feature space is bounded by an upper limit N, a constant, and the results of our experiments show that its computation time and memory usage are vastly lower than in currently reported, malware detection techniques, while preserving or even improving their high detection accuracy.

Key and referential constraints are two main integrity constraints in database applications. These constraints can be automatically enforced by the Database Management System with their exception—violation from these constraints—handled by programmers. This paper proposes an approach to relieve the burden of programmers from mechanical coding for handling exceptions of these constraints violation by using program transformation. We first propose an extended abstract syntax tree to include SQL query semantics. Based on it, each code pattern that requires exception handling together with the exception handling code to be inserted is represented as a transformation rule. We provide two alternatives to handle the exceptions: one is to handle the exceptions in conjunction with the built-in enforcement feature in Database Management System; the other is handling them without using the feature provided in Database Management System. Hence, two types of transformation rules are provided accordingly. A tool GEHPHP (Generation of Exception Handling for PHP Systems) has been developed to implement the proposed approach. Experiments have also been conducted to evaluate the applicable of the approach.

Database is a major component of many software systems. This paper proposes a novel graph called the attribute dependency graph to reveal the dependencies between attributes in a database application and also the programs involved. The authors propose an approach to automatically extract the attribute dependency graph out of a database application from its source code through inter-procedural static program analysis. The extracted information is a straightforward indicator that benefits the maintenance process, particularly for impact analysis on the modifications in a database application. A tool has been developed to implement the proposed approach for PHP-based database applications. Case studies have also been conducted to demonstrate the use of our approach.

Key and referential constraints are the two main integrity constraints in database applications. These constraints can be enforced by the Database Management System automatically. Any violation from these constraints is handled by programmer's written code. This paper proposes an approach to relieve the burden of programmers from the mechanical coding for the exception handling of these constraints. In our approach, first SQL operations that may lead to constraint violations are identified. Then, based on SQL query patterns, the code for exception handling is generated accordingly and inserted into the program automatically. We provide two alternative ways to handle the exceptions: one is handling the exceptions without using the automated enforcement in Database Management System, the other is to handle it in conjunction with the DBMS enforcement. We have developed a tool, GEHPHP (Generation of Exception Handling for PHP Systems), and conducted experiments to verify the proposed approach.

Recent reports reveal that majority of the attacks to Web applications are input manipulation attacks. Among these attacks, SQL injection attack malicious input is submitted to manipulate the database in a way that was unintended by the applications' developers is one such attack. This paper proposes an approach for assisting to code verification process on the defense against SQL injection. The approach extracts all such defenses implemented in code. With the use of the proposed approach, developers, testers or auditors can then check the defenses extracted from code to verify their adequacy. We have evaluated the feasibility, effectiveness, and usefulness of the proposed approach by a set of open-source systems. Our experiment results showed that the proposed approach is effective in extracting all the possible defenses implemented/adopted by Web applications. We observed that the proposed approach would be useful in identifying the false positive cases resulting from other related approaches and auditing the code in order to fix the actual vulnerable cases.

Static code attributes such as lines of code and cyclomatic complexity have been shown to be useful indicators of defects in software modules. As web applications adopt input sanitization routines to prevent web security risks, static code attributes that represent the characteristics of these routines may be useful for predicting web application vulnerabilities. In this paper, we classify various input sanitization methods into different types and propose a set of static code attributes that represent these types. Then we use data mining methods to predict SQL injection and cross site scripting vulnerabilities in web applications. Preliminary experiments show that our proposed attributes are important indicators of such vulnerabilities.

Software defect prediction studies have shown that defect predictors built from static code attributes are useful and effective. On the other hand, to mitigate the threats posed by common web application vulnerabilities, many vulnerability detection approaches have been proposed. However, finding alternative solutions to address these risks remains an important research problem. As web applications generally adopt input validation and sanitization routines to prevent web security risks, in this paper, we propose a set of static code attributes that represent the characteristics of these routines for predicting the two most common web application vulnerabilities—SQL injection and cross site scripting. In our experiments, vulnerability predictors built from the proposed attributes detected more than 80% of the vulnerabilities in the test subjects at low false alarm rates.

Anti-malware vendors receive several thousand new malware (malicious software) variants per day. Due to large volume of malware samples, it has become extremely important to group them based on their malicious characteristics. Grouping of malware variants that exhibit similar behavior helps to generate malware signatures more efficiently. Unfortunately, exponential growth of new malware variants and huge-dimensional feature space, as used in existing approaches, make the clustering task very challenging and difficult to scale. Furthermore, malware behavior modeling techniques proposed in the literature do not scale well, where malware feature space grows in proportion with the number of samples under examination.

Bug reporting is an uncoordinated process that is often the cause of redundant workload in triaging and fixing bugs due to many duplicated bug reports. Furthermore, quite often, same bugs are repeatedly reported as users or testers are unaware of whether they have been reported from the search query results. In order to reduce both the users and developers' efforts, the quality of search in a bug tracking system is crucial. However, all existing search functions in a bug tracking system produce results with undesired relevance and ranking. Hence, it is essential to provide an effective search function to any bug tracking system.

SUMMARY User‐interactive undo is a recovery facility that enables users to correct mistakes easily by canceling or re‐executing operations that have already been executed. This paper presents an interesting common structural property that has been discovered in programs that implementing user‐interactive undo features. The property shows that there is a one‐to‐one correspondence between program statements that raise erroneous effects and those statements that can undo these effects. Statistical validation has been conducted which gives evidences to show that this property holds for 99 per cent of all the cases. An approach for automated verification of user‐interactive undo features in database applications through the use of this empirical property is further proposed. Based on the verification results, test cases are automatically generated to confirm the correctness of these features. A case study has been conducted to evaluate the performance of the proposed verification and testing approach in terms of fault detection capability. Copyright © 2010 John Wiley & Sons, Ltd.

Database applications constitute a large portion of the software systems. This paper proposes a novel graph called attribute dependency graph to show the dependencies between attributes in a database application and also the programs involved. We propose an approach to automatically extract the attribute dependency graph through analyzing the source code of database applications. The extracted information can be used in the maintenance process particularly in the impact analysis upon modification of a database application. A tool has been developed to implement the proposed approach for PHP-based database applications. Case studies have also been conducted to demonstrate the use of our proposed approach.

Size estimation plays a key role in effort estimation that has a crucial impact on software projects in the software industry. Some information required by existing software sizing methods is difficult to predict in the early stage of software development. A conceptual data model is widely used in the early stage of requirements analysis for information systems. Lines of code (LOC) is a commonly used software size measure. This article proposes a novel LOC estimation method for information systems from their conceptual data models through using a multiple linear regression model. We have validated the proposed method using samples from both the software industry and open-source systems.

We perform an empirical study of class sizes (in terms of Lines of Code) on a number of large Java software systems, and discover an interesting pattern - that many classes have only small sizes whereas a few classes have large size. We call this phenomenon the small class phenomenon. Further analysis shows that the class sizes follow the lognormal distribution. Having understood the distribution of class sizes, we then derive a general size estimation model, which reveals the relationship between the size of a large Java system and the number of classes the system has. In this paper, we also show that the adoption of object- orientation is a possible cause of the small class phenomenon. We believe our study reveals the regularity that emerges from large-scale object-oriented software construction, and hope our research can contribute to a deep understanding of computer programming.

A great majority of program paths are found to be infeasible, which in turn make static analysis overly conservative. As static analysis plays a central part in many software engineering activities, knowledge about infeasible program paths can be used to greatly improve the performance of these activities especially structural testing and coverage analysis. In this paper, we present an empirical approach to the problem of infeasible path detection. We have discovered that many infeasible paths exhibit some common properties which are caused by four code patterns including identical/complement-decision, mutually-exclusive-decision, check-then-do and looping-by-flag pattern. Through realizing these properties from source code, many infeasible paths can be precisely detected. Binomial tests have been conducted which give strong statistical evidences to support the validity of the empirical properties. Our experimental results show that even with some limitations in the current prototype tool, the proposed approach accurately detects 82.3% of all the infeasible paths.

Abstract Most information systems deal with inputs submitted from their external environments. In such systems, input validation is often incorporated to reject erroneous inputs. Unfortunately, many input errors cannot be detected automatically and therefore result in errors in the effects raised by the system. Therefore, the provision of input error‐correction features (IECFs) to correct these erroneous effects is critical. However, recovery and maintenance of these features are complicated, tedious and error prone because there are many possible input errors during user interaction with the system; each input error, in turn, might result in several erroneous effects. Through empirical study, we have discovered some interesting control flow graph patterns with regard to the implementation of IECFs in information systems. Motivated by these initial findings, in this paper, we propose an approach to the automated recovery of IECFs by realizing these patterns from the source code. On the basis of the recovered information, we further propose a decomposition‐slicing technique to aid the maintenance of these features without interfering with other parts of the system. A case study has been conducted to show the usefulness of the proposed approach. Copyright © 2007 John Wiley & Sons, Ltd.

Effort and cost estimation is crucial in software management. Estimation of software size plays a key role in the estimation. Line of Code (LOC) is still a commonly used software size measure. Despite the fact that software sizing is well recognized as an important problem for more than two decades, there is still much problem in existing methods. Conceptual data model is widely used in the requirements analysis for information systems. It is also not difficult to construct conceptual data models in the early stage of developing information systems. Much characteristic of an information system is actually reflected from its conceptual data model. We explore into the use of conceptual data model for estimating LOC. This paper proposes a novel method for estimating LOC for an information system from its conceptual data model through the use of multiple linear regression model. We have validated the method through collecting samples from both the industry and open-source systems.

Input validation is an essential and a very important feature in any software system that has intensive interaction with its users. In this paper, we introduce some invariant properties with regards to input validation through analyzing the control and data dependency among inputs accessed and effects raised in a program. We then propose a method for the automated recovery of input validation from program source code. Based on the information recovered, we present the techniques to aid the understanding and maintenance of the feature using program slicing. A prototype tool has been implemented to validate the approach, and the empirical results show that the proposed approach can be very useful and effective for both experienced and inexperienced programmers.

In an information system, inputs are submitted to the system from its external environment. However, many input errors cannot be detected automatically and therefore result in errors in the effects raised by the system. Hence, the provision of input error correction features to correct these erroneous effects is critical. The recovery and maintenance of these features are complex and tedious. We have discovered some interesting control flow graph properties with regard to input errors and the implementation of their correction features. This paper proposes a method for the automated recovery of after-effect input error correction features from these properties. Based on the recovered information, we further propose a method to aid the maintenance of these features using decomposition slicing. All the empirical properties have been validated statistically. The approach has also been evaluated through some case studies.

Database interactions are among the most essential functional features in web applications. Thus, for the maintenance and understanding of web applications, it is vital that the web engineer could identify all code segments which implement the database interactions features. Unfortunately, the highly dynamic nature of web applications makes it challenging to automatically extract all the possible database interactions from source code. In this paper, we propose an automated approach to extract database interactions from source code by using symbolic execution and inference rules. In our approach, all paths which might lead to a database interaction are symbolically executed following symbolic evaluation rules. In each execution, we derive a symbolic expression for each parameter defining the interaction type. We also develop inference rules to deduce the interaction types from the set of symbolic expressions derived. The approach has been applied extensively to extract database interactions in open-source web applications.

Functional refinement is beneficial to object-oriented (OO) software development, especially for problems with more complex functions. However, the use of functional refinement in OO software development has not received much attention. This paper proposes an enhanced data flow diagram (DFD), called data flow net (DF net), for specifying use-cases through functional decomposition. It proposes a novel approach to complement existing OO software development methods with functional decomposition for realizing use-cases, especially those with more complex functions. In the requirements analysis stage, the proposed approach realizes use-cases through functional refinement and specifies them in DF nets. In the design and implementation stages, it transforms the DF nets systematically and precisely into OO design and implementation. The approach is amenable to automation and a prototype has been developed to support the transformation process. In the development of an OO system, it is seamless to realize some of the use-cases using the proposed approach and the remaining use-cases in the same target system using any existing OO software development methods.

Automated recovery of system features and their designs from program source codes is important in reverse engineering and system comprehension. It also helps in the testing of software. An error that is made by users in an input to an execution of a transaction and discovered only after the completion of the execution is called a posttransaction user-input error (PTUIE) of the transaction. For a transaction in any database application, usually, it is essential to-provide transactions for correcting the effect that could result from any PTUIE of the transaction. We discover some probable properties that exist between the control flow graph of a transaction and the control flow graphs of transactions for correcting PTUIE of the former transaction. Through recognizing these properties, we present a novel approach for the automated approximate recovery of provisions and designs for transactions to correct PTUIE of transactions in a database application. The approach recognizes these properties through analyzing the source codes of transactions in the database application statically.

Abstract Inclusion dependency is an important data dependency in databases. Enforcement of data dependencies is a major component in any database application. Due to the nature of software development and maintenance and the limitation of database management systems (DBMSs) in handling the enforcement of inclusion dependency, many inclusion dependencies are enforced not through the DBMS, but through the transactions that update the database. It is very difficult and time consuming to elicit (to extract or to recover) inclusion dependencies from transactions manually during the reengineering, verification and maintenance of database applications. With the use of program analysis, this paper proposes a novel approach for the automated elicitation of inclusion dependencies from the source code of transactions that update the database. The approach is based on detecting program path patterns for enforcing inclusion dependency. Copyright © 2003 John Wiley & Sons, Ltd.

F. Barbier et al. (2003) introduced a formal definition for the semantics of the whole-part relationship in the Unified Modeling Language (UML). This paper reports some discrepancies that appeared previously and proposes solutions to these discrepancies.

Today, most of the OO software development methodologies analyze requirements in terms of objects and their interactions. As a result, they have the problem of forcing analysts to make design decisions on objects and their interactions at the early stage of requirements analysis. This paper gives a brief introduction of an enhanced DFD model called data flow net (DF net) that resolves the impeding mismatch between DFD based models and OO models. It also gives a brief introduction of an approach that uses DF net to specify use-cases in the requirements analysis stage without the need of making the above-mentioned major design decisions. In the design stage, the proposed approach transforms the DF nets specified during the requirements analysis stage systematically and precisely into OO designs. It bridges the gap between requirements and OO design. A significant part of the transformation can be automated.

Data dependencies play an important role in the design of a database. Many legacy database applications have been developed on old generation database management systems and conventional file systems. As a result, most of the data dependencies in legacy databases are not enforced in the database management systems. As such, they are not explicitly defined in database schema and are enforced in the transactions, which update the databases. It is very difficult and time consuming to find out the designed data dependencies manually during the maintenance and reengineering of database applications. In software engineering, program analysis has long been developed and proven as a useful aid in many areas. With the use of program analysis, this paper proposes a novel approach for the recovery of common data dependencies, i.e., functional dependencies, key constraints, inclusion dependencies, referential constraints, and sum dependencies, designed in a database from the behavior of transactions, which update the database. The approach is based on detecting program path patterns for implementing most commonly used methods to enforce these data dependencies.

Abstract A data‐intensive program interacts with its environment through accepting and delivering information from and to its environment respectively. As such, the functionality in a program is achieved through its input/output statements. Based on this hypothesis, this paper proposes a novel approach for the extraction of code fragments for implementing functionality from program source code. This helps the software maintainer identify affected code fragments for making changes to program functionality. The code fragments extracted may also be suitable for reuse in other software projects. Copyright © 2001 John Wiley & Sons, Ltd.

A program interacts with its environment through accepting and delivering information from and to its environment respectively. As such, the functionality in a program is achieved through its input/output statements. Based on this hypothesis, this paper proposes a novel approach for the extraction of code fragments for implementing each functionality or a given group of related functionalities from program source code. This helps the software maintainer to identify affected code fragments for making changes to functionalities. The code fragments extracted are also reusable for implementing the same functionalities in the same hardware and software platform. At least, the designs of the code fragments are reusable.

Software reuse has received more attention in recent years. However, very often, we still need to re-design and re-develop parts of software, ranging from small to very large size (we shall call them software factors) that have been developed before, for the development of new software systems. These software factors do not fall into any existing implementation constructs. The problem that prevents the reuse of these software factors is the lack of a representation that can represent them separately and compose them together to form a software system. The paper proposes a novel software representation, called the software event net (the SE net), to address the problem. The SE net is based on the high level Petri net with some modification and extension for the specification of events produced in software systems. It applies implicit invocation software architecture in representing a software factor.

Visual development environments have provided good support in the reuse of graphical user interface, report and query generation, and simpler database retrieval and updating. However, many commonly used components for computation and database processing and updating are still required to be repeatedly designed and developed. The main problem is that current methods do not support the separation of component interface from a component. Component interface is not an intrinsic property of the component. Incorporating it into the component affects the reusability of the component adversely. A program representation is proposed in this paper to address the problem. The representation enhances the reusability of a component through separating the component interface front the component.

Functional components are program components which provide a set of tightly-coupled program functionalities. As functionalities embody domain knowledge, these components provide a basis for the recovery of reusable program components. We augment general program slicing to handle the interaction among input/output statements operating on a database. With the use of augmented program slicing, an approach, called functional slicing, is proposed for computing the functional components of a program.