CODE-CHANGE IMPACT ANALYSIS USING COUNTERFACTUALS: THEORY AND IMPLEMENTATION

Static code analysis is widely used to support the development of high-quality software. It helps developers detect potential bugs and security vulnerabilities in a program's source code without executing it. While the potential benefits of static analysis tools are beyond question, their usability is often criticised and prevents software developers from using static analysis to its full potential. In the past decade, researchers have studied developer needs and contrasted them to available static analysis tool functionalities. In this paper, we summarize the main design challenges for building usable static analysis tools, and show that they revolve around the notion of explainability, which is a subarea of usability. We present existing analysis tools and current research in static analysis usability, and detail how they approach those challenges. This leads us to proposing potential lines of future work in explainability for static analysis, namely turning static analysis tools into assistants and teachers.

Timing side channels arise in software when a program's execution time can be correlated with security-sensitive program input. Recent results on software side-channel detection focus on analysis of program's source code. However, runtime behavior, in particular optimizations introduced during just-in-time (JIT) compilation, can impact or even introduce timing side channels in programs. In this paper, we present a technique for automatically detecting such JIT-induced timing side channels in Java programs. We first introduce patterns to detect partitions of secret input potentially separable by side channels. Then we present an automated approach for exploring behaviors of the Java Virtual Machine (JVM) to identify states where timing channels separating these partitions arise. We evaluate our technique on three datasets used in recent work on side-channel detection. We find that many code variants labeled safe with respect to side-channel vulnerabilities are in fact vulnerable to JIT-induced timing side channels. Our results directly contradict the conclusions of four separate state-of-the-art program analysis tools for side-channel detection and demonstrate that JIT-induced side channels are prevalent and can be detected automatically.

Perpetrators might employ computer programs (software) to perform their offenses or to cover their wrongdoings. Program's source code, in particular variables and their values diverge in their scope and duration in RAM. Object oriented languages encapsulate variables and operations in classes and allow for objects to be instantiated, which simplify software design but add to the complexity of its execution behavior and its data and control flow. This paper explores execution behaviors and information left by program execution in support for legal actions against perpetrators in the court of law. Our investigation model assumes no information is provided by the operating system; only raw RAM dumps. Our methodology employs information from the presumed program source code and its object oriented design. It explores various execution states and scenarios to uncover the evidence of potential software usage. These scenarios are designed to show that scope, access modifiers, and storage information of various source code variables can be used to identify program's activities. Results show that investigators have good chances locating various variables' values that are uniquely corresponded to the presumed software and its execution states. In some cases, values are successfully identified in memory dumps even after the process is stopped.

This paper describes a process for determining the value of the gradient of the real outputs of a program with respect to its real parameters. CalledGradient Instrumentation, it is a mechanical process of insertion into the program's source code. The resulting program yields the gradient without the re-execution of the program. The sample path derivatives of many discrete event dynamical system simulations can be found using Gradient Instrumentation, by treating them as deterministic programs. The technique can also be applied to continuous simulations. The subject of a patent, Gradient Instrumentation yields derivatives of any order.

This paper seeks to broaden the view of what programming is, who programs, and how programming fits in to larger systems. With growing frequency, people are approaching programming from unlikely backgrounds such as the arts. Often these new programmers bring with them ways of working which are incompatible with mainstream programming practices, but which allow for new possibilities in programming interfaces. This paper makes suggestions for the design of these new programming interfaces. It presents as a case study and demonstration Recursive Drawing. Recursive Drawing is a reimplementation of the textual programming language Context Free as a graphical, directly manipulable interface. Instead of a compiler or interpreter, Recursive Drawing's programming interface is modeled as a constraint solver. This allows the programmer to modify the program's source code by manipulating the program's output. Additionally, the design of the interface focuses on program transformation, rather than program construction.

CEJVM is a cluster enabled Java Virtual Machine, which executes in a distributed fashion among collaborating nodes of a dedicated cluster. It extends Java's multithreading mechanism to the parallel computing paradigm by transparent migration of independent application threads modeled in master worker paradigm. The goal is to obtain improved performance for computationally-intensive multi-threaded Java programs without modifying traditional code, Java language or compiler implementation. Deploying a master worker relationship among the nodes in the cluster, CEJVM monitors, packs, transports and resurrects the Java threads on Master JVM and helper Worker JVMs. Currently, we have created a prototype that runs pure Java applications on the local Ethernet based cluster of Win2K computers. We have achieved appreciable speedup for an ANN training program written in Java (with independent threads) on CEJVM without any modification to the program's source code.

Refactoring changes a program's source code without changing its external behavior, typically to improve the software's design The articles selected for this issue range from historical, exploring refactoring research's origins, to practical, exploring software developers' experiences with refactoring, to theoretical, exploring new refactoring techniques that haven't yet appeared in the wild. The Web extra at https://youtu.be/f2IK3V9wwa8 is an audio recording of Davide Falessi speaking with guest editors Emerson Murphy-Hill of North Carolina State University, Don Roberts of the University of Evansville, and Peter Sommerlad of Fachhochschule Ostschweiz / Hochschule fur Technik Rapperswil about past, present, and future approaches to refactoring.

: Computer Aided Ocular Assessment (CAOA) is a computer program designed to aid submarine Independent Duty Corpsmen with the diagnosis and treatment of eye disease. This manual serves as a programmer's reference for the program. It provides complete documentation of all of the program's source code. In addition, selected portions of the code are thoroughly explained. Expertise with the Exsys Professional expert system development package is required to use this manual effectively.

Genetic improvement (GI) has been successfully used to optimise non-functional properties of software, such as execution time, by automatically manipulating program's source code. Measurement of non-functional properties, however, is a non-trivial task; energy consumption, for instance, is highly dependant on the hardware used. Therefore, we propose the GI4GI framework (and two illustrative applications). GI4GI first applies GI to improve the fitness function for the particular environment within which software is subsequently optimised using traditional GI.

FFT-split-operator code for solving the Dirac equation in 2+1 dimensions

Despite the performance potential of parallel systems, several factors have hindered their widespread adoption. Of these, performance variability is among the most significant. Data parallel languages, which facilitate the programming of those systems, increase the semantic distance between the program's source code and its observable performance, thus aggravating the optimization problem. In this paper, we present a new methodology to automatically predict the performance scalability of data parallel applications on multicomputers. Our technique represents the execution time of a program as a symbolic expression that includes the number of processors (P), problem size (N), and other system-dependent parameters. This methodology is strongly based on information collected at compile time. By extending an existing data parallel compiler (Fortran D95), we derive during compilation, a symbolic cost model that represents the expected cost of each high-level code section and, inductively, of the complete program.

Frequent dynamic memory allocations (DyMAs) can significantly hinder the scalability of parallel multi-threaded programs. As the number of threads grows, DyMAs can even become the main performance bottleneck. We introduce modern tools and methods for evaluating the impact of DyMAs and present techniques for its reduction, which include scalable heap implementations, small buffer optimization, and memory pooling. Additionally, we provide a survey of state-of-the-art implementations of these techniques and study them experimentally by using a benchmark program, server simulator software, and a real-world high-performance computing application. As a result, we show that relatively small modifications in parallel program's source code or a way of its execution may substantially reduce the runtime overhead associated with the use of dynamic data structures.

In Engineering and Scientific computing, a significant number of software systems that are being commonly used by the Engineering community are developed and deployed as Open Source Systems (OSS). This collaborative development model has been widely accepted in both academia and industry. As these systems are typically developed by developers who are experts in their fields (e.g., Engineering), some of those programmers may be lacking an essential skillset today's software quality and engineering concepts (e.g., source code maintainability and analyzability, source code vulnerability, parallelization, etc.). An empirical study is presented that examines some of the source code quality aspects and programming practices (e.g., jumps statements, usage of recursion) from software engineering perspective in ten open source Engineering software systems. The studied systems are written in the C/C++ programming languages and comprised of over ten million lines of code, and present numerous tasks of the engineering community, including computer-aided design, computational fluid dynamics, and finite element analysis. Static analysis methods are applied to each system to determine the number of jump statements (Goto and Break statements) and functions that are recursively invoked. Functions that contain direct or indirect recursive calls are determined and counted. The results show that number of the used jump statements and functions that have recursive calls are significant and thus pose more of a roadblock to effectively and automatically maintain, comprehend, analyze, and re-engineer systems. Lastly, this leads to inefficiencies in a software engineer's ability to accomplish these common tasks. The study showed that issues in source code stemming from the lack of coding standards have increased over time and are prevalent.

Since the source code is only one of many types of documents that must be maintained as a software system evolves, modern software development could be improved by better interoperability between source code and other software documents. The Software Concordance is a prototype programming environment that uses hypermedia services and a uniform document model to achieve this interoperability. The Software Concordance editor allows developers to enhance their inline documentation with multimedia objects and hyperlinks, while still supporting advanced program analysis including lexing, parsing and type checking. We motivate the need for environments like the Software Concordance, describe the design and implementation of its program editor, and discuss lessons learned while creating it. The system is based on a uniform, Web compatible document model for both program source code and nonprogram software documents and a corresponding API. Important technical problems addressed by this research include creating a persistent representation of program lexemes that the analysis suite considers to be ephemeral (such as keywords), providing a simple incremental parsing system, and embedding multimedia in source code without disrupting program analysis. Based on insight gained in the process of implementing the document API, a new approach to the design of a more suitable program analysis infrastructure is suggested.

Designing security softwares that evolve as quickly as threats is a truthful challenge. In addition, current software becomes increasingly more complex and difficult to handle even for security experts. Intrusion Detection Softwares (IDS) represent a solution that can alleviate these concerns. This paper proposes a framework to automatically build an effective online IDS which can check if the program's expected behavior is respected during the execution. The proposed framework extracts relevant information from the program's source code to build a dedicated IDS. We use the GCC compiler to produce the structure of our behavior's model and ensure the IDS is correct. Thanks to Petri nets, our framework allows program offline monitoring and simplifies the online monitoring development.