One of the most powerful tools in the hacker's reverse engineering arsenal is the virtual machine. These systems provide a simple mechanism for executing code in an environment in which the program can be carefully monitored and controlled, allowing attackers to subvert copy protection and access trade secrets. One of the challenges for anti-reverse engineering tools is how to protect software within such an untrustworthy environment. From the perspective of a running program, detecting an emulated environment is not trivial: the attacker can emulate the result of different operations with arbitrarily high fidelity. This paper demonstrates a mechanism that is able to detect even carefully constructed virtual environments by focusing on the stochastic variation of system call timings. A statistical technique for detecting emulated environments is presented, which uses a model of normal system call behavior to successfully identify two commonly used virtual environments under realistic conditions.

Summary form only given. Regression testing is often performed as part of the software maintenance process. The amount of tests cases for a large-scale system can range from several hundred to many thousands, requiring significant computing resources and lengthy execution times, often precluding their use in an interactive setting. Traditional approaches to reduce the execution time for regression testing typically focus on excluding selected tests from the suite that need to be run after a change is made to the system. Cloud computing offers an alternate solution to this problem: the use of virtualized hardware, effectively unlimited storage, and software services that can aid in reducing the execution time of large test suites in a cost-effective manner. However, migrating software testing to the cloud is not without cost, nor is it necessarily the best solution to all testing problems. The new area of software testing in the cloud (STITC) lies at the intersection of these key areas: software testing, cloud computing, and system migration. This tutorial presents the SMART-T decision framework for migrating software testing to the cloud. The framework is based on the "SOA Migration, Adoption, and Reuse Technique" (SMART) from Carnegie Mellon University's Software Engineering Institute, which has been successfully used to migrate legacy components to a service-oriented environment. SMART-T helps organizations identify their current testing process, describe the requirements of the target cloud computing environment for performing software testing, and through a gap analysis of these two states map out the issues, effort, and potential benefits of migrating their software testing to the cloud. Several case studies are used to illustrate the use of the SMART-T framework in real-world settings.

The assurance, reuse, and recertification of legacy safety-critical computer systems are problems affecting government and industry. The assurance and recertification processes involve gathering existing data from such systems, and evaluating how the data aids in meeting the intent of software safety requirements imposed on the systems after the fact. A Software Safety Risk Taxonomy and Software Safety Risk Evaluation (SSRE) process was used in four projects at three NASA Centers for the identification, analysis, consolidation and mitigation of software safety risks associated with meeting only a subset of the requirements of the NASA-STD-8719.13B Software Safety Standard. A Legacy Systems Risk Database was built to manage the projects data and create the traceability between a safety process improvement model (+SAFE), the NASA software safety requirements, the safety taxonomy and software safety risks. This paper describes the steps to perform the SSRE, the initial design of the database showing how the requirements traceability is maintained and some select research study results.

JUnit is the de-facto framework for creating and executing unit tests. This paper introduces a distributed execution framework for JUnit test cases called HadoopUnit, which is built upon Hadoop: an open-source platform for running applications that process vast amounts of data on large clusters built of commodity hardware. The primary motivation behind developing HadoopUnit was to test Hadoop production code using the Hadoop platform itself: existing approaches to testing the system were taking too long to run to completion, and were unable to provide feedback to the developers in a timely manner. Preliminary results suggest that HadoopUnit can reduce test execution time significantly: a 150-node cluster has produced a 30x improvement. HadoopUnit can be used by anyone for testing an application as long as they have access to a computing cluster with the Hadoop software installed and running.

2009 marks the 25thedition of the IEEE International Conference on Software Maintenance (ICSM). This special panel session celebrates ICSMs silver anniversary and the people who helped create and shape its history. From the pioneering efforts of the first workshop to todays weeklong series of federated events, many things have changed over the years. But at least one thing remains constant: the original goal of creating a supportive environment for fostering the exchange of ideas and information related to the disciplined maintenance and evolution of large-scale software-intensive systems.

Service-Oriented Architecture (SOA) is a way of designing, developing, deploying, and managing enterprise systems where business needs and technical solutions are closely aligned. SOA offers a number of potential benefits, such as cost-efficiency and agility. However, adopting SOA is not without considerable challenges. For example, the most common way to implement a SOA-based system is with Web services, but the standards that define Web services are evolving rapidly and many of the Web services tools are still somewhat immature. There is also the question of how to leverage existing legacy assets within a SOA context. Perhaps most importantly, there are serious challenges related to the testing of SOA-based systems that must be addressed before the SOA paradigm will enjoy broadbased success.

This paper reports on the activities and results from the 3rd International Symposium on Software Engineering Course Projects (SWECP 2006), which was held on October 19, 2006 in Toronto, Canada as part of the IBM CASCON 2006 conference. The symposium explored how educators, students, and industry can work together to develop a more rewarding educational experience for all stakeholders involved in the context of senior design classes and team-based course projects. Several key topics were discussed at the symposium, including team dynamics, the choice of software development process, and the role of advanced software engineering tools in design project courses. SWECP 2006 was a sequel to the workshops that were held in 2002 and 2005.

The main goal of this working session is to provide an opportunity for participants to present current work and have a lively discussion of open issues for the maintenance and evolution of SOA-based systems. The dialog will include both business issues (e.g., organizational changes in the context of migrating to an SOA environment) and technical issues (e.g., analyzing the reuse potential of legacy components in an SOA environment). A draft version of a research agenda will be used as a starting point for obtaining feedback from researchers and practitioners active in this area.

This paper looks back at fifteen years of program comprehension (WPC, IWPC, ICPC), gathering key themes and important issues that have been discussed. Since the traditional gift for a 15thanniversary is crystal, the workshop also strives to peer into the future and outline some of the coming challenges in the field for the next few years.

This special issue features extended versions of selected papers from the 8th IEEE International Symposium on Web Site Evolution (WSE 2006) that was held in Philadelphia PA, on 23-24 September 2006.The symposium was co-located with the 22nd IEEE International Conference on Software Maintenance (ICSM 2006).Since its inception in 1999, the Web Site Evolution (WSE) series of events have provided a forum for researchers and practitioners from the communities of Software Maintenance and Evolution and Web Engineering to present original work and discuss subjects related to the disciplined evolution of large-scale Web sites.Researchers and practitioners working in the areas of Web application design, development, maintenance, and evolution attend WSE to discuss results and exchange experiences about models, methods, tools, and technologies related to the above-mentioned areas.In particular, the last editions of WSE have represented a significant step in making the WSE community more and more interdisciplinary, building bridges with various areas such as communication, HCI, usability, and quality and maintenance.We wish to maintain and enrich this multi-faceted spirit of the community, as well as to reach and involve other researchers and practitioners in this effort.WSE began as a one-day workshop, but, thanks to the success in terms of attendance and number of submissions, in 2006 it expanded into a two-day symposium to include keynote presentations, technical sessions, working sessions, and panels discussions.Out of 31 submissions, 13 excellent papers were selected to be presented at the symposium.The accepted papers covered a broad range of topics of the whole life cycle of Web systems, from design to implementation, evaluation, and maintenance, including: Modeling and Architecture, Web Trends and Technology, Accessibility and User Behavior, Comprehension, Testing and Security.The WSE 2006 program also included two inspiring keynotes: 'Model Driven Evolution of Network-Centric Applications: Perspectives, Applications, and Issues' by Kostas Kontogiannis, and 'Knowing Your Online Readership, Organizing Your Communication' by Lorenzo Cantoni.After the symposium, five outstanding papers were selected by the program chairs for invitation to this special issue of the Journal of Software Maintenance and Evolution: Research and Practice.The authors of the selected papers were asked to prepare a significant extension on the symposium version of their papers.Each paper underwent a rigorous reviewing process, involving three independent reviewers and two rounds of revisions.Eventually, four papers were accepted for inclusion in this special issue, covering four different topics of Web systems maintenance and evolution: Comprehension, Testing, Empirical Studies, and Patterns.During Web application re-engineering, a common activity is to identify similar content located in different static and dynamically generated Web pages, so that the content can be more effectively reused.The paper 'Identifying Similar Pages of Web Applications using a Competitive Clustering

This paper reports on the activities and results from the 2nd International Workshop on Software Engineering Course Projects (SWECP 2005), which was held on October 18, 2005 in Toronto, Canada. Creating software engineering course projects for undergraduate students is a challenging task. The instructor must carefully balance the conflicting goals of academic rigor and industrial relevance. Some of the fundamental characteristics of software engineering projects (e.g., team-based, large-scale, long-lived) are difficult to realize within the constraints of a university course in a single semester. This is particularly true when dealing with young students who may lack the real-world experience needed to appreciate some of the more subtle aspects of software engineering. This workshop explored how educators and industry can work together to develop a more rewarding educational experience for all stakeholders involved. Several key themes emerged from the workshop, including the importance of forming teams that are fair and balanced, the challenges in selecting a project that engages the students and meets the goals of the course, and the need for knowledge transfer amongst instructors.

This paper reports on a case study of redesigning a legacy application for the Web using the Ubiquitous Web Applications Design Framework with an extended version of its Transaction Design Model (UWAT+). Web application design methodologies hold the promise of engineering high-quality and long-lived Web systems and rich Internet applications. However, many such techniques focus solely on green-field development, and do not properly address the situation of leveraging the value locked in legacy systems. The redesign process supported by UWAT+ holistically blends design recovery technologies for capturing the know-how embedded in the legacy application with forward design methods particularly well suited for Web-based systems. The case study highlights some of the benefits of using UWAT+ in this context, as well as identifying possible areas for improvement in the redesign process and opportunities for tool automation to support it.

Scott Tilley is an Associate Professor of Software Engineering in the Department of Computer Sciences at the Florida Institute of Technology.

Business Web applications are complex data- and operation-intensive Web applications intended to support business processes. In this kind of application, the user executes sets of activities organized into transactions (also generally called workflows) in order to accomplish one of his/her tasks or fulfill one of his/her goals. The way these transactions are structured, the properties associated with their component activities and the way each activity is implemented by the Web application are a consequence of the transaction design as well as the business rules implied by the business process. The Ubiquitous Web Applications (UWA) design framework explicitly includes a design activity and a related meta-model, called the Transaction Design Model, specifically focused on the conceptual design of Web application transactions (Web Transactions for short). This paper describes preliminary steps towards a revised and extended version of the UWA Transaction Design Model that emphasizes a user-centered approach, is easier to adopt and manages the information, navigation and operation aspects involved in a Web Transaction in a comprehensive and integrated way.

Test-driven development is a relatively new approach to software engineering, involving the iterative construction of test cases first, and then the application code that passes the test cases second. This panel session will discuss the impacts of test-driven development on long-term software maintenance costs. The panelists represent different research disciplines related to this topic, including software maintenance, software testing, program redocumentation, program understanding, and empirical studies.

Abstract This paper provides a balanced perspective of the business value and technical challenges of adopting Web services. Technology adoption is a continual challenge for both tool developers and enterprise users. Web services are a prime example of an emerging technology that is fraught with adoption issues. Part of the problem is separating marketing hype from business reality. Web services are network‐accessible interfaces to application functionality. They are built using Internet technologies such as XML and standard protocols such as SOAP. The adoption issues related to Web services are complex and multifaceted. For example, determining whether this technology is a fundamental advance, rather than something old under a new name, requires technical depth, business acumen, and considerable historical knowledge of past developments. A sample problem from the health care industry is used to illustrate some of the adoption issues. Copyright © 2004 John Wiley & Sons, Ltd.

The key objective of this workshop is to explore innovative approaches to the adoption of software engineering tools and practices-in particular by embedding them in extensions of Commercial Off-The-Shelf (COTS) software products and/or middleware technologies. The workshop aims to advance the understanding and evaluation of adoption of software engineering tools and practices by bringing together researchers and practitioners who investigate novel solutions to software engineering adoption issues.

Presents preliminary results from an ongoing case study of effort estimation for net-centric applications in an undergraduate software engineering class. For two consecutive course offerings, students' effort estimates were tracked against the same project: modifying a Web-site log analyzer program. The question was to see if the application domain of net-centric computing is qualitatively different, quantitatively different, or both, from "regular" software applications. In both classes, the effort estimates produced by the students were quite erratic, a finding that might be traced, in part, to inadequate requirements engineering, to the novelty of the application domain and to the students' inexperience. The study is of interest in part due to the novelty of net-centric applications, which are representative of the sort of modern software system that the students will likely work on when they enter the workforce.

This paper describes an evaluation of the reverse engineering capabilities of three Web tools for understanding site content and structure. The evaluation is based on partitioning Web sites into three classes (static, interactive, and dynamic), and is structured using an existing reverse engineering environment framework (REEF). This case study also represents an initial evaluation of the applicability of the REEF in the related but qualitatively different domain of Web sites. The case study highlights several shortcomings of current Web tools in the context of aiding understanding to support evolution. For example, most Web tools are geared towards new page design and development, not to understanding detailed page content or overall site structure. The evaluation also identified some aspects of the REEF that might benefit from refinement to better reflect Web tool capabilities that support common evolution tasks. For example, Web server log file analysis as a specialized form of data gathering and subsequence information presentation.

The paper introduces the topic of distributed object technology and its impact on reengineering and reverse engineering. It considers how distributed object technology is dramatically changing the nature and economics of legacy system reengineering in two important ways

For pt. II see International Conference on Software Maintenance (ICSM '94), p. 336-342. The paper describes ongoing work on a domain-retargetable reverse engineering environment which is used to aid the structural understanding of large information spaces. In particular, it presents a layered modeling approach to representing three classes of artifacts manipulated during the reverse engineering process. The approach provides a practical and extensible method of integrating existing tools and techniques into a reverse engineering environment by leveraging results from other areas, such as relational databases, hypertext, and conceptual modeling.

For pt. I see ibid. p. 142-51, 1993 (S.R. Tilley et al.). The user interface is an integral part of any application. This is especially true for reverse engineering environments, since the understanding process depends both on the user's specific cognitive abilities and on the palette of tools accessible through the interface. Because software engineers approach program understanding in so many different ways, it is impossible to predict what they want from the supporting environment in all situations. Therefore, the user interface should be malleable and customizable. By having such a personalizable user interface, users can adapt the environment to their particular needs and "taste", while still maintaining a common "look and feel".>

Program understanding can be enhanced using reverse engineering technologies. The understanding process is heavily dependent on both individuals and their specific cognitive abilities, and on the set of facilities provided by the program understanding environment. Unfortunately, most reverse engineering tools provide a fixed palette of extraction, selection, and organization techniques. This paper describes a programmable approach to reverse engineering. The approach uses a scripting language that enables users to write their own routines for common reverse engineering activities, such as graph layout, metrics, and subsystem decomposition, thereby extending the capabilities of the reverse engineering toolset to better suit their needs. A programmable environment supported by this approach subsumes existing reverse engineering systems by being able to simulate facets of each one.

A user programmable approach to reverse engineering is described. The approach uses a scripting language that enables users to write their own routines for these activities, making the system domain-retargetable. The environment supported by this programmable approach subsumes existing reverse engineering systems by being able to simulate facets of each one and provides a smooth transition from semi-automatic to automatic reverse engineering.>

Abstract Reverse‐engineering is the process of extracting system abstractions and design information out of existing software systems. This process involves the identification of software artefacts in a particular subject system, the exploration of how these artefacts interact with one another, and their aggregation to form more abstract system representations that facilitate program understanding. This paper describes our approach to creating higher‐level abstract representations of a subject system, which involves the identification of related components and dependencies, the construction of layered subsystem structures, and the computation of exact interfaces among subsystems. We show how top‐down decompositions of a subject system can be (re)constructed via bottom‐up subsystem composition. This process involves identifying groups of building blocks (e.g., variables, procedures, modules, and subsystems) using composition operations based on software engineering principles such as low coupling and high cohesion. The result is an architecture of layered subsystem structures. The structures are manipulated and recorded using the Rigi system, which consists of a distributed graph editor and a parsing system with a central repository. The editor provides graph filters and clustering operations to build and explore subsystem hierarchies interactively. The paper concludes with a detailed, step‐by‐step analysis of a 30‐module software system using Rigi.