Search

Reactive programming has emerged as a pivotal paradigm in modern mobile application development, enabling developers to handle asynchronous events and data streams seamlessly. The choice of reactive programming framework can significantly impact the performance, maintainability, and scalability of native mobile applications. In this research, we aim to conduct a comprehensive comparative study of reactive programming choices in native mobile development. Our research reveals significant performance disparities among various reactive programming frameworks in mobile application development. Specifically, Combine outperforms RxSwift in iOS environments, offering more efficient load times. Like- wise, Coroutines demonstrate a marked performance edge over RxJava in Android development, excelling in load time across multiple test scenarios. This consistent advantage positions Coroutines as a highly favorable choice for native Android app development, due to its efficiency and effectiveness. An intriguing aspect of our study is the performance of the Delegate Pattern in iOS development, which, despite its simplicity and lack of a reactive programming framework, surpasses both Combine and RxSwift in load time, memory consumption, and CPU usage.

Over the past several decades, the global reliance on electronics has surged due to ongoing advancements in computational hardware. This pursuit for enhanced performance, driven by its economic impact on productivity, has led to shorter computer lifespans and a rise in electronic waste. It's imperative for software engineers to understand performance characteristics by optimizing software for real-world use, we can potentially prolong computer lifespans and combat the escalating electronic waste issue. This research introduces Paptools, a novel software performance evaluation tool suite for predicting computational complexity and effectively mapping execution pathways. We designed and developed an instrumenting compiler, an execution path tracing library, an execution path model fitting utility using symbolic regression, and a platform-agnostic performance assertion library. Paptools accurately predicted performance models for 93% of identified execution paths for a single measurement environment We proved the platform-agnosticism of performance assertions based on execution pathways with 96% success rate across eight different measurement environments. Furthermore, Paptools provided more comprehensive insight into the intricacies of run time performance than Google Benchmark, a proven performance analysis utility, underscoring its potential in the field.

Strings are ubiquitous in computer programs. Both the correctness and the security of programs that use Strings often rely on them not being arbitrary Strings, but belonging to specific sets of Strings. However, this restriction is often not enforced, let alone clearly specified. To remediate this issue, this thesis creates a language extension on top of the standard Java language. The language extension introduces a Grammar Type that is a subtype of String but conforming to the regex expression specified for each Grammar Type. For example, String[[“a∗b”]] is a Grammar Type that represents all Strings that are any number of a’s followed by a b. When we declare or cast a variable as String[[some regex]], the variable has to be a String conforming to that some regex, otherwise it would be either a compile time error or runtime error depending on the situation. This makes the Java type system more powerful, as we can now inherently validate Strings with any pattern we define using a regex. At the same time, since Grammar Types compile down to Strings, they inherit all the functionality of Strings. With these advantages, Grammar Types can be used in various types of applications that need input validation, like validating email addresses, validating URLs, or mitigating SQL injection attacks.

Given a test input, not knowing the expected output of the software under test (SUT) is called the oracle problem. An emerging method of alleviating the oracle problem is metamorphic testing (MT). Rather than focusing on the correctness of output from a single execution of the SUT, MT exploits metamorphic relations (MRs) as derived oracles for checking the functional correctness of the code. Although researchers have argued that MT can be a simple and effective technique to help software developers, little is known about the actual cost of constructing MRs in real-world software and the relationship between MT and the already well-adopted method in software development. This research examines a series of practices to evaluate the effectiveness of MT during software development. Our investigation is conducted within the context of a real-world scientific software, the Storm Water Management Model (SWMM), developed and maintained by the U.S. Environmental Protection Agency (EPA). To ensure SWMM's accuracy in modeling stormwater runoff and executing hydraulic and water quality simulations, the development team continually evolves the software. Among the challenges they face, software testing stands out as one of the most technically complex tasks. Our research initially investigates the current testing practices and software quality assurance (QA) workflows in scientific software development, taking the SWMM as a case study. The value of our work resides in the qualitative characterizations and quantitative assessments of the tests that scientific software developers have independently written and released within the SWMM context. Our findings indicate that oracles indeed play a role in scientific software testing. Furthermore, by employing an empirical approach, we identified four critical requirements for the improved integration of MT into scientific software development. Constructing MRs is critical because without them, MT cannot be performed. Meanwhile, constructing MRs is typically a costly task. Therefore, we present an approach to classifying input and output (I/O) variables from scientific software's user manual, then mining these variables' associations from the user forum to reduce the cost of constructing MRs. On the other hand, regression testing has long been used by scientific software developers to tackle the oracle problem amid code changes. Although MT has the potential to complement regression testing by checking functional correctness more directly, the cost of constructing MRs and their added advantage in an evolving and highly specialized scientific software system are not yet understood. To further explore this, we conducted an exploratory case study focusing on MR construction by scientific software developers, enabling us to critically evaluate the value addition MT brings to software development. This dissertation offers significant contributions in three distinct areas: Firstly, it fosters a better understanding of the software QA workflow and existing test practices, which in turn aids in more effective support for MT adoption. Secondly, it provides automated support for enhancing the diversity of MRs and reducing the cost associated with MT. Lastly, it scrutinizes the feasibility of MT and its additional advantages compared to regression testing, demonstrated through a real-world system.

Parallel programming offers the ability to simultaneously improve the performance and reduce the energy consumption of software running on heterogeneous computing systems. Software developers have long preferred to avoid parallel programming, if possible, for reasons such as perceived difficulty, lack of portability between systems, and the pace of improvement in computer hardware. However, generational changes in computer hardware are now focused on specialized components and increased computational cores, and the continued evolution of these systems places increased emphasis on achieving improvements via the use of these components. This thesis investigates parallel programming techniques that make use of components common to modern heterogeneous systems, and proposes that the difficulty and lack of portability need not be barriers to large improvements. Using a variety of heterogeneous systems, algorithms were implemented and then transformed using multiple cores, SIMD execution units, and GPUs. Reductions in execution time ranging from 71-94% and energy consumption of 76-98% were observed, demonstrating the effectiveness of using specialized components for improved performance and reduced energy consumption.

Multivariate networks (henceforth, graphs) represent entities (vertices or nodes), their relationships to each other (edges), and manifest or derived data about both (attributes). Graphs easily map onto real-world entities and relationships. Therefore the visual analysis of such provide a valuable proxy for the analysis of concrete entities. Because graphs are so effective in modeling, they are ubiquitous: graphs are used in the design and construction of complex circuitry, GIS (Geographic Information Systems), database modeling, social networking, and neuroscience, among other fields. Graph visualization is challenging, and domain-specific requirements further complicate the production of intelligible visual representations. The datasets underlying modern graphs have grown exponentially, complicating visualization tasks, whether static, such as in a printed scientific paper or poster, or dynamic, where the graph, the visualization, or both evolve. Exploratory visualization of dynamical graphs requires the visualizations to evolve due to externally-generated events in realtime while preserving the contents of the analyst’s “mental map.” This thesis presents a novel, modular, composable Javascript API (Application Programming Interface) for organizing and applying the algorithmic operations and data structures required at each step of visualizing large, arbitrarily complex graphs while allowing the extensions and constraints required by specific application domains. To do so, we abstract quintessential graph layout tasks into EGOs (Exploratory Graph Operations), design an API exposing these operations, and demonstrate the synthesis of well-documented layout algorithms. Finally, we introduce a reference implementation in Javascript and WebGPU (GPU Computing for the Web) to visualize complex graphs in realtime and facilitate future research and development of novel approaches to these problems.

Quantum computers are becoming a reality. They have the potential to accelerate many computationally complex processes, and also to find better results in complex solution land- scapes. However, the kinds of problems which these computers are currently a good fit for, and the ways to express those problems, are substantially different from the kinds of prob- lems and expressions used in classical computing. Quantum annealers, in particular, are an interesting kind of quantum computers to considering how they are promising in solving spe- cific types of problems efficiently in the near term. However, they are also the most foreign compared to classical programs, as they require a different kind of computational thinking.In my work, I have created a novel formulation of the well known software engineering prob- lem of code clone detection by expressing it as an optimization problem in the framework of quantum annealing, a type of quantum computing. It also serves as an example of how soft- ware engineering problems can be formulated to be solved using quantum annealing. This thesis elaborates on how I rendered the code clone detection problem as a subgraph isomor- phism problem and formulated it as a quadratic optimization. The formulation compares the Abstract Syntax Tree (AST) representations of two given code fragments and reports an energy value indicative of their similarity. It is then implemented on a quantum annealer. The motivation behind this research goes well beyond code duplicate detection: this novel approach to thinking about software engineering problems as optimization problems paves the way into expressing them as problems that an be solved using optimization architectures like quantum annealing.

Software Engineering practices are changing in an age of artificial intelligence. While the core activities of design, develop, maintain, test and evaluate remain, the methods used in these activities are evolving. The prevalence of generative programming models has the potential to reconstitute the duties of a software engineer. Widely adopted models like Copilot and Bard are IDE-based pair-programming assistants that create code from virtually any input: contextual code, natural language, specifications, input output pairs, etc. The way developers interact with these models will redefine some core ideas of software engineering. These models empower virtually anyone, of varying coding proficiency, to create software. Models with the capacity to code will surely manage to inherit software design and analysis capabilities [186], albeit for now, with specific training or prompting.Naturally, one wonders how language modeling, or more specifically the modeling of source code and its features, will impact developers. Researchers often conjecture on the varying degree of influence these methods will have, but certainly, these tools will support developers in new and existing tasks: code completion, bug and vulnerability detection, code summarization, type annotation, and more are already prominent use cases. One can envision a world where software developers delegate portions of their work to machine learning pipelines, such as unit testing and vulnerability testing of their code; how much of that code they actually write is up for debate as well. Developers will likely automate portions of their work flow but simultaneously gain new tasks and responsibilities. These tasks might include passing automatic code reviews that detect code smells, place code comments automatically, and detect refactorings; maybe using models from [56], [133], [59]. These capabilities come from modeling source code and its features directly by distilling down meaningful representations for the task at hand.This thesis explores learning meaningful representations from code through a variety of applications for developer supporting tools. The first application is a type-prediction model using representations learned with masked-language-modeling. While effective, we find that the off-the-shelf model fails at an aspect of modeling source code, namely the use of local user-defined types. The next application modifies the model learned representations with one characterized by an objective function capturing how developers actually use types. Along this body of work, the next two chapters present a type inference dataset for the community and a framework for new machine learning models with a Visual Studio plugin. This thesis concludes with a study of large language models on single statement bug introduction and proposes avoidance strategies. Finally I present some future work to improve these models. By reading this thesis, I hope the reader has a few takeaways:(1) Machine learning is an essential tool for capturing code and its meta data. Models trained on code and its features are capable of generalizing and improving old and new processes.(2) The data that models train on is not perfect, and the resulting models often inherit biases towards vulnerable and buggy code; researchers must evaluate the risk vs. reward with broadly trained models.(3) The objectives optimized for software models may not align with our goals; models that incorporate human feedback may ultimately align better to our values and understanding of code.(4) Large language models are powerful tools for software engineering, but they’re only part of the picture. Models that learn data and control flow, project and file meta data, local and global scope semantics, and information associated with code traces, are better informed on the source code it consumes and produces.This thesis attempts to quantify the utility of off-the-shelf LLMs like BERT, the misalignment of LLM representations to human derived representations of coding constructs, and the present risks of using LLM predictions at face value. Hopefully, in each case, the chapters leave you optimistic that many of the aforementioned concerns can be minimized, or mitigated with just a bit of ingenuity.

Management of bug reports is a necessary evil in the software development process. Report management involves handling user-submitted bug reports, which is known to be a time-consuming task because the developers need to sift through many reports, with many containing insufficient information. This lack of information is partially attributed to a gap in knowledge: users without relevant technical knowledge often do not know how to appropriately report a bug. Attaching a video recording to such reports has shown promise in reducing bug resolution time in bug reporting for mobile applications, and might have the potential for similar results for other types of systems. However, editing or even creating videos specifically for bug reporting is not a simple task. In this thesis, I introduce VideoLab, a novel prototype tool to simplify the creation of videos for bug reports. VideoLab is based primarily around a pared-down video editing interface with a set of dedicated annotations that aim to make communicating defective behavior to developers easier for end-users.

Due to ubiquitous use of software services, protecting the confidentiality of private information stored in compute clouds is becoming an increasingly critical problem. Although access control specification languages and libraries provide mechanisms for protecting confidentiality of information, without verification and validation techniques that can assist users in writing policies, complex policy specifications are likely to have errors that can lead to unintended and unauthorized access to data, possibly with disastrous consequences. Current state-of-the art approaches focus on either assertion checking which requires manual specification of assertions (which may not be available or difficult to write) or compare existing policies and report binary results (such as policy 1 is more permissive than policy 2). These techniques however cannot perform quantitative analysis on policies (how much more permissive is policy 1 than policy 2?). It is crucial to develop automated approaches for quantitatively assessing properties of access control policies.Model counting is an emerging area with applications in quantitative analysis. A model counting constraint solver computes the number of solutions for a given constraint within a given bound. Recently, model counting constraint solvers have also been applied to automating quantitative software verification, analysis and security tasks. The goal in quantitative program analysis is not to just give a ``yes'' or ``no'' answer, but to also quantify the result. For example, rather than answering if there is information leakage in a program with a ``yes'' or ``no'' answer, quantitative analysis techniques can compute the amount of information leaked. In this dissertation, we first discuss state-of-the-art techniques for model counting using automata-theoretic techniques and its applications in quantitative program analysis. We then introduce the revamped model counting constraint solver ABC2. Next, we discuss how model counting techniques can be combined with traditional policy analysis approaches to perform quantitative analysis of access control policies, culminating in the open-source policy analysis tool Quacky. At the end, we introduce a quantitative symbolic analysis approach for automated policy repair for fixing overly permissive policies.

The increasing popularity of machine learning techniques in software engineering research promises to improve software development practices by automating various tasks, such as defect prediction, code completion, bug localization and etc. However, the susceptibility of these models to feature bias can significantly affect their performance and reliability. This dissertation delves deep into the realm of machine learning in software engineering, focusing on the profound effects of feature bias on model performance. Feature bias, characterized by the uneven distribution of features in training datasets, can inadvertently skew the results of machine learning models, leading to potential inaccuracies in predictions. In the first of the three studies, we embark on a journey to uncover the presence and implications of feature bias in software engineering tasks. Our findings are revelatory, indicating that feature bias is not just a theoretical concern but a tangible issue that can significantly hamper the performance of machine learning models. By analyzing both traditional statistical models and advanced deep learning algorithms, we underscore the pervasive nature of feature bias. The implications of these findings are vast, especially when considering the increasing reliance on machine learning models in software engineering. Ensuring the performance and reliability of these models is paramount, and as such, understanding the role of feature bias becomes crucial.In our second study, rather than viewing feature bias as a mere impediment, we harness its characteristics as an advantage. We delve into the mispredictions of machine learning models, using feature bias as a lens to interpret these inaccuracies. This unique approach allows us to gain deeper insights into the areas where models are most susceptible to errors. Building on these insights, we introduce a novel technique aimed at bolstering model performance, especially in regions that are traditionally vulnerable to mispredictions. This proactive approach not only mitigates the negative effects of feature bias but also leverages it to refine and enhance model accuracy.In the third segment of our research, we delved into feature bias within Transformer-based models. These recent advancements in machine learning have set benchmarks in various software engineering tasks, such as code clone detection, code generation, and code translation. Central to their functionality is the attention mechanism, which allows them to focus on relevant input segments during training and prediction. Despite their impressive performance, we sought to determine if an 'attention bias' exists during predictions. Our findings highlighted a notable attention bias towards specific source code tokens, potentially affecting their efficacy in software engineering tasks. In response, we devised a strategy to enhance Transformer-based model performance by directing their attention to crucial source code tokens, aiming to bolster their reliability in real-world applications.Our study underscores the criticality of recognizing and mitigating both feature bias and attention bias when crafting machine learning models for software engineering endeavors. The methodologies we introduced serve to enhance the efficacy and dependability of these models, making them more apt for deployment in practical software engineering scenarios.

The purpose of this transcendental phenomenological study was to describe the lived experiences of Black women with a bachelor’s, master’s, or doctoral degree in computer science, currently employed in the United States. The theory guiding this study was Krumboltz’s social learning theory of career decision-making, as it provides a foundation for understanding how a combination of factors leads to an individual’s educational and occupational preferences and skills. This qualitative study answered the following central research question: What are the lived experiences of Black women with a bachelor’s, master’s, or doctoral degree in computer science, currently employed in the United States? Purposeful criterion sampling was used to select between 12 to 15 participants from the Society of Women Engineers who met the following criteria: a female, Black or African American, with a bachelor’s, master’s, or doctoral degree in computer science, graduated from an accredited college, university, or vocational program, and currently employed in the United States. Data collection methods included individual interviews, letter writing, and focus groups. Data analysis followed Moustakas modified approach: setting aside personal experiences and prejudgments, organizing data and conducting horizonalization, developing clusters of meaning into common themes, generating and combining textural and structural descriptions, and generating a composite description of the phenomenon experienced by all participants.

Out of 7,151 living languages, 665 languages (9.299%) are spoken by nearly 2 billion people across Southern Asia. Of these, 37.74% (251 languages) are endangered, while the vast majority remain underrepresented in language systems. This thesis presents a new NLP toolkit called IndoLib designed to support natural language processing (NLP) research in South Asian languages, consisting of the Indo-Aryan, Dravidian, and Sino-Tibetan language families, in this case. IndoLib includes four primary components: (i) monolingual and multilingual datasets to expand language modeling and language detection for thirty-one Indic languages, (ii) fine-tuned multilingual models for named entity recognition (NER) and summarization, (iii) a bilingual dataset with Sanskrit-English and English-Sanskrit parallel sentences, and (iv) a fine-tuned machine translation model for two-way translations between Sanskrit and English. The fine-tuned multilingual NER and bilingual translation models outperform current benchmark models upon evaluation. This thesis is intended to aid researchers interested in applying transfer learning to develop or optimize transformer-based models for South Asian languages.

Software engineering relies heavily on collaboration between developers, but there is a lack of processes that fully support the collaboration of multiple parties and follow model-driven software engineering approaches. Additionally, advances in virtual reality present an opportunity to increase the size of the modeling workspace, present new perspectives, and overcome the limitations of remote conferencing. We researched and developed a framework, CoMoVR (“come over”), that integrates the advantages of virtual reality into a fully collaborative software modeling environment. This includes a novel approach to software modeling in virtual reality, an implementation of such an approach, and a systematic evaluation that assesses CoMoVR’s modeling and collaborative functionality independently. We conclude that CoMoVR represents a functional modeling editor in a virtual reality environment that permits functional collaboration.

Since millennia, contracts have fulfilled a fundamental role to regulate the relation between entities. A contract can be abstracted as an agreement that defines rights and obligations between two or more parties; in this context, the calculation of the resulting rights and obligations, provided the agreement considerations, has fundamentally been a human task given the typical natural language nature of these agreements. This thesis analyses the context in which the outcome of a contract can be computer calculated and the validity of the calculated result, while proposing an algorithmic approach to transform a natural language contract, within the subset of contracts denominated “Stateless Commercial Contracts”, into a computer computable form compatible with tools already available within the legal industry.

We develop a method for maximizing potential in the sports analytics picking winners problem. We do so by: i) leveraging BERT-based, large-scale sentiment anal- ysis of tweets about players. ii) statistical modeling incorporating sentiment analysis, weather, stadium, and other professional projections to create player projections. iii) an integer programming algorithm to construct player lineups. Our experiments show that this method outperforms similar lineup creation using solely existing professional projections by an order of magnitude, with player projections alone outperforming professional projections by nearly 30%. These results suggest a new approach to sports prediction modeling that relies on natural language processing and state-of- the-art language models to incorporate the wisdom of the crowd.

This thesis further develops a suite of tools designed for calculating stellar parameters and measuring radial velocities using spectra obtained with the Tillinghast Reflector Echelle Spectrograph (TRES). The standard pipeline was designed for solar-like stars and produces a quick-look summary of stellar parameters and radial velocities. Tools external to the current pipeline have recently been developed to work with hotter or cooler stars. Integrating these tools in the current pipeline extends the capabilities of the pipeline by providing users with the most accurate and precise radial velocities and stellar parameters available for a wider range of stars. A quality flag parameter has been implemented in the stellar parameter classification code to determine the quality of results based on the known capabilities of the classification code. Radial velocities have been corrected to an absolute scale by closely monitoring and correcting for changes in nightly observations of non-variable standard star radial velocities. An additional correction is made by monitoring reflected sunlight using asteroids and daytime sky observations. A complete analysis of all TRES TESS observations have been processed to derive stellar parameters and those parameters have been uploaded and shared with a broad community of users via an exoplanet community repository called ExoFOP. A new TRES instrument front end was installed during this work. The pipeline was edited to accommodate the new changes and additional testing was done to ensure that the pipeline was producing correct results. Finally, as a step to allow ease of use of all the available tools, a TRES Pipeline Results and Analysis Guide was written to give new users a resource to use as they get started working with TRES data.

In their pursuit of faster code, compilers invoke increasingly more complex optimizations. Along with the increase in complexity the difficulty to identify missed optimizations and performance regressions also increases. Most existing work does not focus on finding such missed opportunities. It either concentrates on correctness, does not pinpoint the precise missed optimization, or only finds missed optimizations for specific components of a compiler. We built DEAD, a tool that leverages Dead Code Elimination and Differential Testing to find regressions, and generate corresponding bug reports. We conducted an empirical study on the 647 regressions found by DEAD and developed a new analysis to assess the evolution of LLVM and GCC. With DEAD, we help to improve the quality of compilers and enable further thorough testing of new changes.

Statistical fault localization (SFL) techniques use execution profiles and success/failure information from software executions, in conjunction with statistical inference, to automatically score program elements based on how likely they are to be faulty. SFL techniques typically employ one type of profile data: coverage data, predicate outcomes, or variable values. In the relatively short history of automated SFL, most proposed techniques are based on statistical relationships between the elements of coverage profiles/spectra and the occurrences of program failures. Valuable information carried by variables has usually been ignored, and far fewer techniques are based on the analysis of variable values. In addition, the vast majority of subject programs used to evaluate techniques have been small programs containing artificial faults (faults created by mutations in code), rather than large programs containing real faults (faults logged by developers), which inhibit the credibility of these techniques.Most SFL techniques measure correlation, rather than causation, between profile values and success/failure, and so, they are subject to confounding bias that distorts the scores they produce. In recent years, techniques using the sound causal inference methodology (Causal Statistical Fault Localization) to adjust for the confounding bias properly have been successfully applied to a wide range of programs and profile data. While these first attempts at causal statistical fault localization have yielded promising results, they have lacked cohesion between the different types of profile data, flexible machine learning models, or large subject programs containing real faults in their empirical evaluation.In my work, I present new insights into the properties and limitations inherent in the SFL literature and their effect on the performance of SFL. Furthermore, I present novel algorithms that use causal inference techniques and flexible machine learning models to integrate information from various data profiles, including predicates, objects and different variable types, to estimate the real failure-causing effect of program statements more accurately. Observations with a critical condition, covariate balance of faulty predicates, presents useful intuitions about the use of causal inference and value-based techniques in fault localization. Experiments using the well-known Defects4J repository, which consists of large programs containing real faults and theoretical results, show the proposed techniques' efficacy and usability. This work helps programmers locate faults in software programs by applying a sound causal inference based approach combined with robust machine learning models to the problem of fault localization.

Software developers sometimes have to repeat an edit in multiple parts of their codebase in order to maintain or extend their software. To let the user perform a repetitive edit, text editors provide multi-cursor editing, which applies editing commands in multiple locations simultaneously. However, multi-cursor text editing is limited, since each executed command must make the desired change regardless of which cursor executes it. To perform a wider range of repeated edits, some developers write refactoring scripts that work structurally. However, unlike multi-cursor editing, the process of developing a refactoring script is not interactive. We propose Forest, the first editor which specially integrates structural editing commands with multi-cursor editing. Compared to a text editor, Forest offers different editing commands, and therefore supports different multi-cursor edits. Forest allows performing edits similar to those from refactoring scripts, while still being interactive. We attempted to perform edits from 48 real-world refactoring scripts using Forest and found that 11 were possible, while another 17 would be possible with added features. Additionally, we investigated a real-world codebase, finding that ∼15% of commits contained edits with potential for multi-cursor editing.

One of the challenges of a capstone course in software development is providing a real world experience that enhances professional skills development. Use of agile methodologies in capstone courses has gained interest and garnered positive outcomes. However, implementation of all twelve Agile Principles from the Agile Manifesto has not been previously addressed. In this thesis, a project-based senior capstone course is designed that addresses all twelve Agile Principles while using best practices from industry and literature. The efficacy of the learning experience is assessed based on analysis of student feedback as well as assessments of student performance. Course learning outcomes are assessed via assignments, while metrics for use of agile development tools are gathered directly from the software development environment. Surveys are used to capture student perceptions regarding skills and learning gains. In general, the measures of student performance indicate emerging competency in agile methodologies and tools, while the student feedback indicates their perceptions of proficiency in Agile Principles and practices. The thesis provides a foundation for capstone instructors interested in incorporating or enhancing agile in their courses. The findings may be useful in software engineering practice to illuminate areas that are difficult for novice users of agile techniques.

Videogames are software systems expressed in structure code and data, but it’s far from obvious how changing one bit of code will impact the experience a human player might have with the game. Traditional playtesting and quality assurance testing remains the gold standard for ensuring a quality gaming experience, however there are considerable resource and morale requirements necessary to ensure that testing procedures will unveil problems in the user experience. Further, these testing traditions do not scale down to incremental, in-development, builds of videogame software, placing the entirety of videogame quality control at the ends of vast periods of coding. With the advent of advanced AI gameplaying algorithms, I present a way to leverage gameplaying AI as an assistive tool for game developers. Rather than playing to win, these AI techniques aim to explore the playable areas of a videogame that a human player could encounter, potentially encountering areas of gameplay that developers did not intend to implement. I have developed two exploration techniques, one which relies on human gameplay traces, and one which self-improves with only a single seed of human gameplay. With this information, I also present a visualization workflow to generate visual reports of gameplay differences between versions of a videogame.

Modular software applications are developed based on a software design technique that emphasizes separating the program's functionality into independent, interchangeable components. Each component contains everything necessary to provide certain functionality. Building software systems using modules introduces many benefits, including improving software quality, easier maintainability, and better scalability, especially for large, complex, and long-running software systems. Although a software system's architecture is often conceptualized in terms of high-level constructs, e.g., software components, connectors, and interfaces, programming languages usually provide low-level constructs, e.g., classes, methods, and variables. To bridge this gap, many widely used programming languages, such as Java and C++, have recently incorporated the notion of module or component. The increasing support of modularization in the modern programming languages, although offering many benefits, introduces plenty of new challenges in all phases of software development and execution, including at build-time, module installation-time, and run-time. Hence, the need for effective validation and verification techniques has increased more than ever. This dissertation proposes to advance validation and verification of modular applications through investigating the static and dynamic behavior of modular applications and introducing automatic validation, and verification techniques to (1) detect and repair architectural inconsistencies at both build- and run-time, and (2) test dynamic delivery failures at module installation-time.All conducted experiments on real-world subject apps corroborate the effectiveness and efficiency of the proposed approaches and their ability to validate and verify the behavior of modular software applications at all different phases of their development and execution.

Similar to social media platforms, people use emojis in software development-related com- munication to enrich the context and convey additional emotion. With the increasing emoji use in software development-related communication, it has become important to understand why software developers are using emojis and their impact. Gaining a deeper understanding is essential because the intention of emoji usage might be affected by the demographics and experience of developers; also, frequency and the distribution of emoji usage might change depending on the activity, stage of the development, and nature of the conversation, etc. In this paper, we present a large-scale empirical study on the intention of emoji usage conducted on 2,712 Open Source Software (OSS) projects. We build a machine learning model to auto- mate classifying the intentions behind emoji usage in 39,980 posts. We also study the impact of emoji usage on pull request acceptance and examine if emoji usages can help facilitate the speed of getting a response. To validate the outcomes, we surveyed 60 open-source software developers from 17 countries to understand developers’ perceptions of why and when emojis are used. Our results show that we can classify the intention of emoji usage with high accuracy (AUC of 0.97). In addition, the results indicate that developers use emoji for varying intentions, and emoji usage intention changes throughout a conversation. Our results also show that emoji usage has a significant association with quicker responses which leads us to posit that an emoji conveying a positive sentiment will speed up the response time than an emoji conveying a negative sentiment. However, our results does not show that emoji usage has an impact on pull request acceptance. Our study opens a new avenue in Software Engineering research related to automatically identifying the intention of the emoji use that can help improve the communication efficiency and help project maintainers monitor and ensure the quality of communication. Another thread of future research could look into what intentions of emoji usage or what kind of emojis are more likely to attract users and how that is associated with emoji usage diffusion in different levels (threads, projects, etc.)

Software for language documentation has a long and successful history, but challenges remain. In this work I describe my efforts to provide a path toward reinvigoration of software design for language documentation, one which equips linguists to participate more directly in designing software for their own workflows. I begin with the description of a simple, extensible data model for all the major data types used in language documentation. I then show how the standardized, well- tested technology that powers modern web browsers can serve as the basis for novel interfaces which are nonetheless closely linked to the terminology and descriptive systems in which linguists are trained.

Modular verification of parallel and concurrent software built from reusable data abstractions is a challenging problem. Reasoning about sequential software can be modularized using the specifications of data abstractions, but the need to consider implementation details complicates reasoning about parallel execution.Addressing this challenge requires advancing the state of the art in several ways, beginning with a theoretical foundation. The A/P Calculus for describing the effects of program actions is developed in this dissertation to enable sound modular reasoning about parallel programs with non-interfering parallel sections of operation calls on abstract data types. Building on the calculus and a programming language with clean semantics, a methodology for designing decomposable data abstractions is presented to produce fork-join parallel programs that are manifestly data race free and readily amenable to modular reasoning. A new specification construct, the non-interference contract, is proposed to enhance the specification of data abstractions to hide implementation details and yet facilitate modular reasoning about parallel programs that share objects among processes.As a key first step to transition these results to practice, this dissertation describes Clean++, a discipline for writing software in C++ that leverages move semantics to make ownership transfer the primary data movement operation (as opposed to either deep or shallow copying) and produce programs that are amenable to formal verification with only minimal scaffolding related to pointer manipulation.

Responding to anomalies in the critical digital services domain involves coordination across a distributed system of automated subsystems and multiple human roles (Allspaw, 2015; Grayson, 2019). Exploring the costs of this joint activity is an underexamined area of study (Woods, 2017) but has important implications for managing complex systems across distributed teams and for tool design and use. It is understood that anomaly recognition is a shared activity between the users of the service, the automated monitoring systems, and the practitioners responsible for developing and operating the service (Allspaw, 2015). In addition, multiple, diverse perspectives are needed for their different views of the system and its behavior and their ability to recognize unexpected and abnormal conditions. While the collaborative interplay and synchronization of roles is critical in anomaly response (Patterson et al, 1999; Patterson & Woods, 2001), the cognitive costs for practitioners (Klein et al, 2005; Klinger & Klein, 1999; Klein, 2006) can be substantial. The choreography of this joint activity is shown to be a subtle and highly integrated into the technical efforts of dynamic fault management. This work uses process tracing to take a detailed look at a corpus of five cases involving software engineers coping with unexpected service outages of varying difficulty. In doing so, it is noted that the practices of incident management work very differently than domain models suggest and the tooling designed to aid coordination incurs a cognitive cost for practitioners. Adding to the literature on coordination in ambiguous, time pressured and non co-located groups, this study shows that adaptive choreography enables practitioners to cope with dynamic events – and dynamic coordination demands. These demands can also be a function of the coordination strategies of others – in particular when they shift costs of coordination across time and organizational boundaries.

In this thesis, we study commented-out code in software and its automatic identification.Commented-out code can inhibit program comprehension, it can have legal ramifications, andmay degrade the performance of text analysis techniques. In order to address these issues, wedevelop a taxonomy on comments and commented-out code. Using this taxonomy, we manuallyclassify nearly 3,000 lines of comments as commented-out code or English Prose. Using theresulting gold set, a model to automatically classify commented-out code based on characterfrequencies and decision trees is developed. The generated model achieves a F1 score of 87.51on a testing set drawn from 50 projects not used to form the gold set. The model is additionallyapplied to these 50 open-source projects to analyze the prevalence of commented-out code.Results show that on average, 4.46% of lines of comments are commented-out code (median2.76) with only five of the 50 projects containing no commented-out code.

Today, most successful business models widely use software programs to bridge the gap between data and business requirements. Changes in business strategies also require software programs to adapt with it. As a result, the available software products are continuously evolving, and are rapidly changing with new technologies and user requirements.Earlier in 2017, the Ohio Department of Transportation (ODOT) and University of Cincinnati started developing a web application, called the Common Operating Platform (COP), to remotely process the drone-captured images into 3D models using commercial (Pix4D) and open-source (OpenDroneMap). The idea is to engage shared hardware and software resources to perform such complex tasks. The platform immediately gained popularity and actively used by the personnel at ODOT. Preliminary study shows that the Common Operating Platform has a lot of room to incorporate more features. Hence, this thesis introduces the Common Operating Platform v11.0 that comes more complex 3D modeling and visualization workflows. The purpose of this work is to enhance functionality, reliability, efficiency, and usability of the Common Operating Platform. Initially, this document enlists shortcomings of the existing system and proposes new solutions to eliminate these shortcomings. Secondly, the proposed system architecture is compared against the existing architecture. In the final stage, the proposed enhancements are implemented by leveraging commercial (Pix4D) and open-source (MeshLabJS) software tools. Other miscellaneous features to improve system performance, efficiency and reliability are also discussed.

Debugging distributed systems is difficult. Most of the techniques that have been developed for debugging such systems use either model checking, or postmortem analysis of logs and traces. Interactive debugging is a widely-used technique for debugging single threaded applications. But only a few interactive debuggers for distributed systems are available as the techniques used for building traditional debuggers for sequential single-threaded programs cannot be easily transferred to a distributed setting. In this thesis, I look at the topic of designing interactive debuggers for distributed systems and introduce GoTcha which is an interactive debugging tool for distributed systems based on the GoT distributed programming model. GoTcha supports the core features of traditional single-threaded debuggers like step-through debugging and breakpoints so that users can wield these powerful tools in a distributed context. I demonstrate the capabilities of GoTcha through a series of usage examples, and discuss the design and architecture of GoTcha.

The rising popularity of mobile apps deployed on battery-constrained devices has motivated the need for effective and efficient energy-aware testing techniques. However, currently there is a lack of test generation tools for exercising the energy properties of apps. Automated test generation is not useful without tools that help developers to measure the quality of the tests. Additionally, the collection of tests generated for energy testing could be quite large, as it may involve a test suite that covers all the energy-greedy parts of the code under different use-cases. Thereby, there is a need for techniques to manage the size of test suite, while maintaining its effectiveness in revealing energy defects. This research proposes a four-pronged approach to advance energy testing for mobile applications, including techniques for energy-aware test input generation, energy-aware test oracle construction, energy-aware test-suite adequacy assessment, and energy-aware test-suite minimization.

Distributed systems are widespread today, and they are being used to serve millions of customers and process huge amounts of data. These systems run on commodity hardware and in an environment with many uncertainties, e.g., partial network failures and race condition between nodes. Testing distributed systems requires new test libraries that take into account these uncertainties and can reproduce scenarios with specificc timing constraints in a programming-language-agnostic way. To this end, we present Failify, a cross-platform, programming-language-agnostic and deterministic failure testing library for distributed systems, which can be seamlessly integrated into different build systems. Failify, as an infrastructure, can also facilitate research in testing distributed systems in various ways. We experimented with six open-source distributed systems to show the compactness of the Failify's deployment API. Our results indicate that, in average, the most reliable deployment architecture for these systems can be defined in less that 17 lines of code. We also experimented with HDFS to demonstrate potential scenarios where Failify's deterministic environmental manipulation and failure injection API can be effective.

Modern software is bloated. Demand for new functionality has led developers to include more and more features, many of which become unneeded or unused as software evolves. This phenomenon of software bloat results in software consuming more resources than it otherwise needs to. Automation of effective debloating is a long standing problem in software engineering. Various software debloating techniques have been proposed since the late 1990s. However, many of these techniques are built upon pure static analysis and have yet to be extended and evaluated in the context of modern Java applications where dynamic language features are prevalent. To this end, we develop an end-to-end bytecode debloating framework called JShrink. JShrink augments traditional static reachability analysis with dynamic profiling and type dependency analysis, and renovates existing byte-code transformations to perform effective debloating. We highlight several nuanced technical challenges that must be handled properly to debloat modern Java applications and further examine behavior preservation of debloated software via regression testing. Our study finds that (1) JShrink is able to debloat our real-world Java benchmark suite by up to 47% (14% on average); (2) accounting for reflection and dynamic language features is crucial to ensure behavior preservation for debloated software | reducing 98% of test failures incurred by a purely static equivalent, Jax, and 84% for ProGuard; and (3) compared with purely dynamic approaches, integrating static analysis with dynamic profiling makes the debloated software more robust to unseen test executions|in 22 out of 26 projects, the debloated software ran successfully under new tests. We enhance JShrink with the checkpointing feature to ensure 100% behaviour preservation with minimal loss in code size reduction(0.9% om average), to make it a practical solution for balancing semantic preservation and code size reduction benefits

From snippets to tutorials, programmers rely on sample programs to learn and get work done. The process of creating sample programs, however, can be demanding, limiting the dissemination of programming knowledge. To enhance this process, we introduce the concept of program distillation, methods for its implementation, and usability studies verifying its power. Program distillation is the tool-assisted transformation of existing programs into simpler ones, where key ideas are emphasized, and cruft has been removed.Three interactive tools are introduced for distilling code snippets, notebooks, and tutorials. Each tool contributes novel interactions grounded in proven program analysis techniques. CodeScoop helps programmers extract snippets from existing code through interactive program slicing and simplification. Code gathering tools let a programmer extract subsets of cells from a computational notebook that reproduce key results. And Torii provides a live programming experience for creating output-rich multi-step tutorials. Studies with users reveal that these tools satisfy important needs, support efficient sample program creation, and provide a level of expressiveness not yet available in today’s standard tools.

Given the rapid advances in development of unmanned aerial vehicles (UAV), employment of drones in various business functions becomes reasonable and affordable. Usage of drones as data collection tools will give us access to a new set of geo-referenced images and videos that were not easily accessible in the past. The ultimate objective of this web based platform for data processing workflows, from here on referred to as the common operating platform, is to enable users to archive, process and visualize aerial data without a need for advanced hardware and software locally. This work details the development of the the common operating platform which consist of a web-based frontend and a backend. The frontend is a web app developed based on Django, Twitter Bootstrap and Javascript where the user authenticates, uploads data, submit processing tasks and visualizes the results. The back end, developed using Python 3, is where data is being stored and various processing tasks are being done based on commercial(Pix4D), open source(OpenDroneMap) and custom(Traffic Monitoring) processing engines. First, the intricacies of the data processing workflow is discussed and this includes diving into detail the various steps related to processing workflows using proprietary, open software and custom software. Second, procedures for integrating commercial processing engines as well as development of the in house traffic parameter extraction system will be shown and the result of running various case studies and their processing performance will be discussed. And finally, the system architecture design and implementation will be detailed given the scalability, modularity,extensibility and reliablity requirements will be discussed. The idea is to have a secure system, which is accessible to a broad audience, that can receive and service all of their processing requirements. In doing so, it dismisses the need for an uninitiated audience to install highly specialized software on their personal computers as well as relieves the need for them to maintain sophisticated hardware.

This accompanying document describes the background, research, and process of creating a web application called Airwaves from the ground up. Spanning from the original concept, to the final working implementation. The purpose of Airwaves is to facilitate interpersonal audio communication and content presentation. The foundational components of the application are: A backend server that provides an API endpoint to the frontend, handles audio processing and delivery, and interfaces with the transcription model. A frontend that provides a straightforward and pleasant user experience for both content creators and consumers. And a transcription model that is capable of transcribing a single speaker audio sample into corresponding text. Together, these components should deliver a user experience that lowers the bar of entry to the market of audio content creation. Justification for the project’s commercial viability stems from the success of radio and podcasts as content mediums, as well as the tendency for more versatile and more accessible internet services replacing traditional media structures. The above combined with Airwaves’ ability and plan to target live content and interactivity are what make this project novel.

The safety and reliability of deep learning systems necessitate a compelling demonstration of their encoded behavior. Unfortunately, testing metrics developed for traditional software systems are poorly suited for measuring how well this behavior has been modeled. Recent work in this area has produced a popular solution in neuron coverage, which is inspired by the notion of traditional code coverage. Neuron coverage measures the proportion of neurons activated in a neural network as a proxy for the effectiveness of a test suite. In this work, we systematically investigate the relationship between neuron coverage and three important test suite properties: defect detection, naturalness, and output diversity. We also propose a novel regularization technique to efficiently induce higher neuron coverage and use it to extend two well-known adversarial attack algorithms. Contrary to expectation, our study finds that increasing neuron coverage actually makes it harder to generate effective test suites. For most of our experimental configurations, higher neuron coverage meant fewer defects detected, less natural tests, and more biased class preferences that harmed output diversity. Our results invoke skepticism that neuron coverage is a meaningful measure for testing deep neural networks.

Asynchronous event-driven systems are ubiquitous across domains such as device drivers, distributed systems, and robotics. These systems are notoriously hard to get right as the programmer needs to reason about numerous control paths resulting from the complex interleaving of events (or messages) and failures. Unsurprisingly, it is easy to introduce subtle errors while attempting to fill in gaps between high-level system specifications and their concrete implementations.This dissertation proposes new methods for programming safe event-driven asynchronous systems.In the first part of the thesis, we present ModP, a modular programming framework for compositional programming and testing of event-driven asynchronous systems.The ModP module system supports a novel theory of compositional refinement for assume-guarantee reasoning of dynamic event-driven asynchronous systems. We build a complex distributed systems software stack using ModP.Our results demonstrate that compositional reasoning can help scale model-checking (both explicit and symbolic) to large distributed systems.ModP is transforming the way asynchronous software is built at Microsoft and Amazon Web Services (AWS). Microsoft uses ModP for implementing safe device drivers and other software in the Windows kernel.AWS uses ModP for compositional model checking of complex distributed systems. While ModP simplifies analysis of such systems, the state space of industrial-scale systems remains extremely large.In the second part of this thesis, we present scalable verification and systematic testing approaches to further mitigate this state-space explosion problem.First, we introduce the concept of a delaying explorer to perform prioritized exploration of the behaviors of an asynchronous reactive program. A delaying explorer stratifies the search space using a custom strategy (tailored towards finding bugs faster), and a delay operation that allows deviation from that strategy. We show that prioritized search with a delaying explorer performs significantly better than existing approaches for finding bugs in asynchronous programs.Next, we consider the challenge of verifying time-synchronized systems; these are almost-synchronous systems as they are neither completely asynchronous nor synchronous.We introduce approximate synchrony, a sound and tunable abstraction for verification of almost-synchronous systems. We show how approximate synchrony can be used for verification of both time-synchronization protocols and applications running on top of them.Moreover, we show how approximate synchrony also provides a useful strategy to guide state-space exploration during model-checking.Using approximate synchrony and implementing it as a delaying explorer, we were able to verify the correctness of the IEEE 1588 distributed time-synchronization protocol and, in the process, uncovered a bug in the protocol that was well appreciated by the standards committee.In the final part of this thesis, we consider the challenge of programming a special class of event-driven asynchronous systems -- safe autonomous robotics systems.Our approach towards achieving assured autonomy for robotics systems consists of two parts: (1) a high-level programming language for implementing and validating the reactive robotics software stack; and (2) an integrated runtime assurance system to ensure that the assumptions used during design-time validation of the high-level software hold at runtime.Combining high-level programming language and model-checking with runtime assurance helps us bridge the gap between design-time software validation that makes assumptions about the untrusted components (e.g., low-level controllers), and the physical world, and the actual execution of the software on a real robotic platform in the physical world. We implemented our approach as DRONA, a programming framework for building safe robotics systems.We used DRONA for building a distributed mobile robotics system and deployed it on real drone platforms. Our results demonstrate that DRONA (with the runtime-assurance capabilities) enables programmers to build an autonomous robotics software stack with formal safety guarantees.To summarize, this thesis contributes new theory and tools to the areas of programming languages, verification, systematic testing, and runtime assurance for programming safe asynchronous event-driven across the domains of fault-tolerant distributed systems and safe autonomous robotics systems.

Programmers often write code with similarity to existing code written somewhere. Code search tools can help developers find similar solutions and identify possible improvements. For code search tools, good search results rely on valid data collection. Social coding websites, such as Question & Answer forum Stack Overflow (SO) and project repository GitHub, are popular destinations when programmers look for how to achieve certain programming tasks. Over the years, SO and GitHub have accumulated an enormous knowledge base of, and around, code. Since these software artifacts are publicly available, it is possible to leverage them in code search tools. This dissertation explores the opportunities of leveraging software artifacts from the social coding websites in searching for not just similar, but related, code. Programmers query SO and GitHub extensively to search for suitable code for reuse, however, not much is known about the usability or quality of the available code from each website. This dissertation first investigates under what circumstances the software artifacts found in social coding websites can be leveraged for purposes other than their immediate use by developers. It points out a number of problems that need to be addressed before those artifacts can be leveraged for code search and development tools. Specifically, triviality, fragility, and duplication, dominate these artifacts. However, when these problems are addressed, there is still a considerable amount of good quality artifacts that can be leveraged.SO and GitHub are not only two separate data resources, moreover, they together, belong to a larger system of software development process: the same users that rely on facilities of GitHub often seeks support on SO for their problems, and return to GitHub to apply the knowledge acquired. This dissertation further studies the crossover of software artifacts between SO and GitHub, and categorizes the adaptations from a SO code snippet to its GitHub counterparts. Existing search tools only recommend other code locations that are syntactically or semantically similar to the given code but do not reason about other kinds of relevant code that a developer should also pay attention to, e.g., auxiliary code to accomplish a complete task. With the good quality software artifacts and crossover between the two systems available, this dissertation presents two approaches that leverage these artifacts in searching for related code. Aroma indexes GitHub projects, takes a partial code snippet as input, searches the corpus for methods containing the partial code snippet, and clusters and intersects the results of the search to recommend. Aroma is evaluated on randomly selected queries created from the GitHub corpus, as well as queries derived from SO code snippets. It recommends related code for error checking and handling, objects configuring, etc. Furthermore, a user study is conducted where industrial developers are asked to complete programming tasks using Aroma and provide feedback. The results indicate that Aroma is capable of retrieving and recommending relevant code snippets efficiently. CodeAid reuses the crossover between SO and GitHub and recommends related code outside of a method body. For each SO snippet as a query, CodeAid retrieves the co-occurring code fragments for its GitHub counterparts and clusters them to recommend common ones. 74% of the common co-occurring code fragments represent related functionality that should be included in code search results. Three major types of relevancy--complementary, supplementary, and alternative methods, are identified.

Java is one of the most widely used programming languages. However, the absence of explicit support for architectural constructs, such as software components, in the programming language itself has prevented software developers from achieving the many benefits that come with architecture-based development. To address this issue, Java 9 has introduced the Java Platform Module System (JPMS), resulting in the first instance of encapsulation of modules with rich software architectural interfaces added to a mainstream programming language. The primary goal of JPMS is to construct and maintain large applications efficiently—as well as improve the encapsulation, security, and maintainability of Java applications in general and the JDK itself. A challenge, however, is that module declarations do not necessarily reflect actual usage of modules in an application, allowing developers to mistakenly specify inconsistent dependencies among the modules. In this paper, we formally define 8 inconsistent modular dependencies that may arise in Java-9 applications. We also present Darcy, an approach that leverages these definitions and static program analyses to automatically (1) detect the specified inconsistent dependencies within Java applications and (2) repair those identified inconsistencies. The results of our experiments, conducted over 38 open-source Java-9 applications, indicate that architectural inconsistencies are widespread and demonstrate the benefits of Darcy in automated detection and repair of these inconsistencies.

Software defects can frequently be traced to poorly-specified requirements. Many software teams manage their requirements using tools such as checklists and databases, which lack a formal semantic mapping to system behavior. Such a mapping can be especially helpful for safety-critical systems. Another limitation of many requirements analysis methods is that much of the analysis must still be done manually. We propose techniques that automate portions of the requirements analysis process, as well as clarify the syntax and semantics of requirements models using a variety of methods, including machine learning tools and our own tool, VeriCCM. The machine learning tools used help us identify potential model elements and verify their correctness. VeriCCM, a formalized extension of the causal component model (CCM), uses formal methods to ensure that requirements are well-formed, as well as providing the beginnings of a full formal semantics. We also explore the use of statecharts to identify potential abnormal behaviors from a given set of requirements. At each stage, we perform empirical studies to evaluate the effectiveness of our proposed approaches.

Software developers depend on good source code documentation to understand existing source code to perform various tasks such as fixing bugs and implementing new features. Manual documentation by developers is often missing or outdated. Past research has suggested automatic code summarization tools to remedy this problem. While several works on source code summarization leveraged only source code to generate summaries, very little work exists on using other information sources. A lot of tacit knowledge is exchanged between developers in discussion forums or bug reporting sites that can be very useful for summarization. The novelty of our work is that we conducted an empirical study using eye tracking equipment to investigate the effects of four different types of information sources namely, source code, Stack Overflow, bug reports and their combination on code summarization, to understand how developers perform using these multiple sources of information during code summarization tasks. Each participant is asked to summarize four code elements in their own words using different contexts. We evaluate the summaries against a human oracle to find similarities and analyze the developers' eye gaze patterns to see what they look for and how they switch between different contexts. Our results indicate that Stack Overflow and bug reports are as helpful as source code in supporting code summarization tasks. Participants were more confident when using Stack Overflow and bug reports when compared to source code. The results of our study can be useful to researchers and practitioners interested in building context-aware code summarization tools that can help augment official documentation with the insightful information extracted from multiple sources.

The rapid advancement of web and mobile application technologies has recently posed numerous challenges to the Software Engineering community, including how to cost-effectively test applications that have complex event spaces. Many software testing techniques attempt to cost-effectively improve the quality of such software. This dissertation primarily focuses on that of hybrid test suite prioritization. The techniques utilize two or more criteria to perform test suite prioritization as it is often insufficient to use only a single criterion. The dissertation consists of the following contributions: (1) a weighted test suite prioritization technique that employs the distance between criteria as a weighting factor, (2) a coarse-to-fine grained test suite prioritization technique that uses a multilevel approach to increase the granularity of the criteria at each subsequent iteration, (3) the Caret-HM tool for Android user session-based testing that allows testers to record, replay, and create heat maps from user interactions with Android applications via a web browser, and (4) Android user session-based test suite prioritization techniques that utilize heuristics developed from user sessions created by Caret-HM. Each of the chapters empirically evaluate the respective techniques. The proposed techniques generally show improved or equally good performance when compared to the baselines, depending on an application under test. Further, this dissertation provides guidance to testers as it relates to the use of the proposed hybrid techniques.

Android is widely used for the development and deployment of autonomous and smart systems, including software targeted for IoT and mobile devices. Security of such systems is an increasingly important concern. Although Android is the predominant mobile platform, it is also the most targeted platform by malware authors resulting in millions of malicious apps distributed in numerous app stores. Android relies on a permission model to secure the system's resources and apps. In Android, since the permissions are granted at the granularity of apps, and all components in an app inherit those permissions, an app's components are over-privileged, i.e., components are granted more privileges than they actually need. Systematic violation of least-privilege principle in Android is the root cause of many types of Inter-Component Communication (ICC) attacks that can lead to serious security and privacy risks.Due to the increasing use of code obfuscation in Android apps, the current security mechanisms for Android apps, both static and dynamic analysis approaches, are insufficient for detection and prevention of the increasingly dynamic and sophisticated security attacks.Static analysis approaches suffer from false positives whereas dynamic analysis approaches suffer from false negatives. Moreover, they all lack the ability to efficiently analyze systems with incremental changes---such as adding/removing apps, granting/revoking permissions, and dynamic components' communications. Each time the system changes, the entire analysis needs to be repeated, making the existing approaches inefficient for practical use.To mitigate these issues, this dissertation presents a novel self-protecting Android software system that automatically determines and continuously maintains the least-privilege architecture of an Android system, incrementally and efficiently analyzes its security posture, and dynamically enforces the maintained least-privilege architecture at runtime. The approach, entitled SALMA, protects the system against ICC attacks at all times in spite of changes at runtime.The least-privilege architecture limits the privileges granted to apps without the need to modify them or breaking their functionalities. Static program analysis techniques have been utilized to extract the exact privileges each component needs for providing its functionality.A Multiple-Domain Matrix representation of the system's least-privilege architecture is then kept in sync with the running system to reason about it at runtime. Every time the system changes, SALMA determines (1) the impacted part of the system, and (2) the subset of the security analyses that need to be performed, thereby greatly improving the performance and the scalability of the approach.All conducted experiments on hundreds of real-world apps corroborate the scalability and efficiency of the proposed approach in reducing the attack surface of Android systems as well as its ability to detect and prevent security attacks at runtime with minimal disruption.

Successful software engineering activities require qualified software developers with proper expertise. Although expertise has been studied for many years and various expertise location approaches have been postulated, new approaches and opportunities are emerging today because of the rise of code hosting and knowledge sharing sites. As a step towards understanding the past work and the present opportunities in the context of today's software engineering practice, we perform a systematic literature survey. In analyzing the literature, we identify two broad categories of expertise research: 1) identifying the characteristics of experts, and 2) locating experts. The studies in the latter category can be further classified into three subcategories, which are: i) locating expertise by leveraging the organizational setting; ii) by mining historical artifacts; and iii) by knowledge sharing. Our analysis also identifies the major limitations of existing work, including a disconnect between early expertise studies and current location approaches; an over reliance on the experience-based model to measure expertise; a neglect on the constraints for coordination; and a lack of empirical evaluation in the real-world context, among others. Finally, we highlight research trends and promising directions for future research.

Eliminating so-called "out-of-thin-air" (OOTA) results is an open problem in many existing programming language memory models including Java, C, and C++. OOTA behaviors are problematic in that they break both formal and informal modular reasoning about program behavior. In spite of many years of research efforts, defining memory model semantics that are easily understood, allow existing optimizations, and forbid OOTA results remains an open problem. This dissertation explores two solutions to this problem that forbid OOTA results. The first solution is targeted towards Java-like languages in which all memory operations may create OOTA results, and the second solution is targeted towards C/C++-like memory models in which racing operations are explicitly labeled as atomic operations. Our solutions provide a per-candidate execution criterion that makes it possible to examine a single execution and determine whether the memory model permits the execution. We implemented and evaluated both solutions in the LLVM compiler framework. Our results show that on an ARMv8 processor the first solution has an average overhead of 3.1% and a maximum overhead of 17.6% on the SPEC CPU2006 C/C++ benchmarks, and that the second solution has no overhead on average and a maximum overhead of 6.3% on 43 concurrent data structures. The results indicate that these approaches to eliminating out-of-thin-air behaviors deserve further consideration.

Code clone detection tools find exact or similar pieces of code, known as code clones. Code clones are categorized into four types of increasing difficulty of detection, ranging from purely textual (Type I) to purely semantic (Type IV). Most clone detectors reported in the literature, work well up to Type III, which accounts for syntactic differences. In between Type III and Type IV, however, there lies a spectrum of clones that, although still exhibiting some syntactic similarities, are extremely hard to detect { the Twilight Zone. Besides correctness, scalability has become a must-have requirement for modern clone detection tools. The increase in amount of source code in web-hosted open source repository services has presented opportunities to improve the state of the art in various modern use cases of clone detection such as detecting similar mobile applications, license violation detection, mining library candidates, code repair, and code search among others. Though these opportunities are exciting, scaling such vast corpora poses critical challenge.Over the years, many clone detection techniques and tools have been developed. One class of these techniques is based on software metrics. Metrics based clone detection has potential to identify clones in the Twilight Zone. For various reasons, however, metrics-based techniques are hard to scale to large datasets. My work highlights issues which prohibit metric based clone detection techniques to scale large datasets while maintaining high levels of correctness. The identification of these issues allowed me to rethink how metrics could be used for clone Detection. This dissertation starts by presenting an empirical study using software metrics to understand if metrics can be used to identify differences in cloned and non-cloned code. The study is followed by another large scale study to explore the extent of cloning in GitHub. Here, the dissertation highlights scalability challenges in clone detection and how they were addressed. The above two studies provided a strong base to use software metrics for clone detection in a scalable manner. To this end, the dissertation presents Oreo, a novel approach capable of detecting harder-to-detect clones in the Twilight Zone. Oreo is built using a combination of machine learning, information retrieval, and software metrics. This dissertation evaluates the recall of Oreo on BigCloneBench, a benchmark of real world code clones. In experiments to compare the detection performance of Oreo with other five state of the art clone detectors, we found that Oreo has both high recall and precision. More importantly, it pushes the boundary in detection of clones with moderate to weak syntactic similarity, in a scalable manner. Further, to address the issues identified in precision evaluations, the dissertation presents InspectorClone, a semi automated approach to facilitate precision studies of clone detection tools. InspectorClone makes use of some of the concepts introduced in the design of Oreo to automatically resolve different types of clone pairs. Experiments demonstrate that InspectorClone has a very high precision and it significantly reduces the number of clone pairs that need human validation during precision experiments. Moreover, InspectorClone aggregates the individual effort of multiple teams into a single evolving dataset of labeled clone pairs, creating an important asset for software clone research. Finally, the dissertation concludes with a discussion on the lessons learned during the design and development of Oreo and lists down a few areas for the future work in code clone detection.

Abstract: Over the last few decades, model-driven code generation has been the flagship paradigm used to promote adoption of model-driven engineering among the general software-engineering community. Model-driven code generators integrate model-to-model and model-to-text transformations to build applications that systematically differ from each other. Typically, generators use multi-step transformation chains to translate high-level application specifications, captured using domain-specific languages, into executable artifacts such as code and deployment scripts. A key challenge in the construction of development environments for model transformations involves the analysis and visualization of traceability information. Access to fine-grained traceability links enables developers to assess evolutionary scenarios in transformation ecosystems, to effectively debug complex binding expressions, and to accurately determine the metamodel coverage of transformation chains. Unfortunately, current traceability-analysis techniques do not consider implicit bindings when collecting traceability information from complex transformation expressions. Implicit bindings manipulate, constrain, or navigate the structure of a metamodel in order to realize the final intent of a transformation expression. Furthermore, they do not conceive model-to-model and model-to-text transformations as equal constituent elements of a unified model-driven engineering toolbox. This effectively limits their usability in the context of non-trivial model-driven code generators. To the best of our knowledge, the effectiveness of current traceability analysis, and the development environments built on top of them, has not been validated in empirical studies with real developers. In this work, we address these shortcomings. We propose an end-to-end fine-grained traceability-analysis technique for individual model-to-model and model-to-text transformations, as well as model-transformation chains combining the two. Our analysis technique is based on a traceability framework that considers traceability links as symbolic dependencies between metamodels, transformation expressions, and generated artifacts. Furthermore, we introduce ChainTracker, a traceability-analysis environment. We evaluated the completeness of our traceability-analysis technique using 25 model-to-model and 18 model-to-text transformations from the ATLZoo and the Acceleo Example Repository. Our analysis technique achieved an overall fine-grained traceability coverage of 91\% and 85\%, respectively. Furthermore, we evaluated the usability of ChainTracker in an empirical study in which 25 developers completed traceability-driven tasks in two model-driven code generators of different complexity. We found statistically significant evidence that ChainTracker improves the accuracy and efficiency of developers by between 22\% and 900\%.

Software engineers construct modern-day software applications by building on existing standard and third-party software libraries and components that they necessarily do not author themselves. Consequently, to dynamically analyze a contemporary software application, all transitively dependent external libraries must also be monitored and analyzed, at each layer of the software application’s call stack. However, dynamically analyzing large and often numerous external libraries may prove prohibitively expensive. To address the expenses associated with analyzing dynamically observable behavior of software components, this work presents an approach to summarize and reuse the results of dynamic analysis. This work, specifically focuses on dynamic analysis that computes data- and control-dependencies between executing instructions, and the memory locations they access, by monitoring software-runs at a fine-grained instruction-level. As such, the approach in this work models and summarizes software component behavior as data- and control-dependencies between inputs and outputs of invocable methods within software components. Such behavior models for invocable methods are called method dependence summaries. Method dependence summaries may be created with static analysis, as has been done and studied by prior work. However, a novel contribution of this work is the creation and investigation of method summaries by runtime monitoring of executing instructions in software runs. Such dynamically inferred method summaries are called “dynamic dependence summaries.” Additionally, the approach to reuse a dependence summary — created statically or dynamically — for the purposes of dynamic dependence analysis is, in itself, an important contribution of this work. Software components, equipped with reusable dependence summaries, afford the omission of their exhaustive runtime monitoring and analysis during their future runs. Nonetheless, the reuse of dependence summaries would necessitate the abstraction of any concrete runtime information enclosed within the summary; thus potentially causing a loss in the information modeled by the dependence summary. As a result, benefits to the efficiency of dynamic analyses that use summarization may be afforded with losses of accuracy. This work investigates the resulting trade-offs between accuracy losses and performance gains with 83 system-wide executions across eight real-world software systems. The empirical results show that dynamic dependence summaries exhibit median precision scores of 1.0 when modeling individual method invocations, across multiple executions of the eight software systems — indicating acceptable levels of accuracy. Simultaneously, statically created dependence summaries exhibit median precision scores ranging from 0.5 to 1.0, when modeling method invocations. The results also show notable degrees of cost savings while using summarized analysis, with median trace size reductions of 61% across the 83 executions, when compared to traditional exhaustive dynamic dependence analysis.

As testing is an incomplete validation of software changes, many developers review code changes before patching the system. Popular source code versioning systems aid review by showing the textual differences between the old and new versions of the source code. This leaves developers with the difficult task of determining whether the differences produced the desired behavior.We introduce Continuous Semantic Inspection (CSI), which aids code review with inter-version differential semantic analysis. During inspection of a new commit, a developer is presented with not only code differences, but also changes to behaviors, as expressed by likely invariants inferred from testing. We hypothesize that with the extra semantic information developers can more easily determine whether the code changes produced the desired effect.This dissertation comprises four parts to demonstrate our hypothesis. (1) We present the design and implementation of GETTY, a highly automated tool to support the concept of CSI. (2) To scale the expensive invariant inferences for practical use, we divide GETTY’s analysis into multiple processes distributed to a 16-processor cluster. We achieve substantial performance improvement and show that our approach is feasible for open source projects by enabling a timely repair-compile-review feedback loop. (3) From applying CSI on six open source projects, we found inferred invariants contain the information required to help discover insufficient tests and inconsistent semantic changes at the time of their introduction. (4) We conducted a user study of reviewers using GETTY, which shows that invariant differentials draw attention to information that otherwise often escapes notice, helping developers formulate more focused questions that keep the review moving forward.