Reverse Engineering State and Strategy Design Patterns using Static Code Analysis

Static analysis technology is used to find programming errors before run time. Unlike dynamic analysis technique which looks at the application state while it is being executed, static analysis technique does not require the application to be executed. In this paper, we classify security vulnerability patterns in source code and design a model to express various security vulnerability patterns by making use of pushdown automata. On the basis of the model, it is possible to find a security vulnerability by making use of Abstract Syntax Tree (AST) based pattern matching technique in parsing level.

A declarative approach to detecting design patterns from Java execution traces and source code

The article presents an approach to modeling domain ontologies based on graph databases. Ontology is traditionally considered as a means of studying and formalizing the subject area. Based on ontologies, knowledge bases of information systems are formed, which can later be replenished and used to study certain applied aspects of the subject area. At the same time, with the development of NoSQL technologies and graph databases aimed at optimizing work with related data, it becomes possible to design a data warehouse without a strict pre-established domain model. Due to the obvious graph nature of ontologies, graph databases are a promising solution for storing and working with ontologies. However, with all the similarities, the ontology and data models used in graph DBMSs are not so easy to combine. The paper proposes an approach to the integration of ontological and graph models of knowledge representation and considers its application in creating a database for a prototype of a web ontology editor. Visual tools for editing ontologies are described, an algorithm for layer-by-layer rendering of a directed graph is given, a mechanism for generating dynamic forms for editing classes and ontology instances is described, and basic support for ontological design patterns is implemented.

Feature location, an important task in program comprehension, occurs when the developer identifies the source code entity or entities responsible for implementing a functionality. Researchers have applied static analysis techniques to multiple software maintenance tasks, including feature localization. Static analysis techniques operate on a document corpus. Configuration and preprocessing decisions are required to build a suitable source code corpus for a static analysis technique. Currently, there is little guidance in the software engineering literature for making such configuration decisions. This paper focuses on two preprocessing methods for source code corpora, identifier splitting and stop word lists. We experiment on three open source Java test suites, i.e. Mylyn 1.0.1, Rhino 1.5R5, and Rhino 1.6R5. Our results indicate that identifier splitting and stop word list decisions do not significantly affect the performance of the LDA based feature location technique.

Periodic refactoring of a large source code often becomes a ne- cessity especially for long-lived projects. In order to increase maintainabil- ity and extensibility of such projects, design pattern based refactoring can be seen as an emerging alternative. Manual inspection of source code to find candidate spots where patterns can be introduced is time consuming. Therefore automated tools can help in identifying candidate spots where patterns can be introduced. The level of source code abstraction plays an important role for building such tools. We propose a new abstrac- tion for object oriented source code that is named as Refactoring Pattern (ReP) Graph to realize an eective design pattern based refactoring tool. The ReP graph abstracts the source code information thereby making the process of design pattern inference easier. The proposed tool identifies candidate spots in a given source code to introduce design patterns.

Access control vulnerabilities that lead to elevated privileges are among the most dangerous vulnerabilities in Web applications. Most of the existing detection methods use dynamic or static analysis techniques alone, which suffer from high manual involvement, low automation, high leakage rate, low page coverage, and other deficiencies. To this end, this paper proposes a novel access control vulnerability detection method (DetAC) based on a sitemap model with global information representation. This method first constructs a static site-wide sitemap model based on the page link addresses in the Web application source code through static analysis techniques. After that, the application is logged in and executed dynamically with different role users. During this process, execution traces and request parameters are collected and converted into annotations to fill the corresponding edges of the static site-wide sitemap model. Then, the sitemap model with global information representation is obtained. This model can represent both the global control flow and data flow of the application. Then DetAC analyzes the role-based and user-based access control policies of the Web application based on the node reachability and annotated data features of the model. And according to the information such as role, user, and access resources, it generates attack vectors to achieve different roles and the same role of different users to access each other’s resources. Finally, access control vulnerabilities are detected based on the equivalence of the results obtained using attack vector access and normal access to the Web application server. DetAC was validated on five real open-source Web applications, and the results showed that DetAC successfully detected up to 12 access control vulnerabilities, which are more than those of the traditional seven tools. The dynamic analysis page coverage rate was significantly improved during the detection process, reaching an average of 91.37%.

Design patterns are elegant and well-tested solutions to recurrent software development problems. They are the result of software developers dealing with problems that frequently occur, solving them in the same or a slightly adapted way. A pattern's semantics provide the intent, motivation, and applicability, describing what it does, why it is needed, and where it is useful. Consequently, design patterns encode a well of information. Developers weave this information into their systems whenever they use design patterns to solve problems. This work presents Feature Maps, a flexible human- and machine-comprehensible software representation based on micro-structures. Our algorithm, the Feature-Role Normalization, presses the high-dimensional, inhomogeneous vector space of micro-structures into a feature map. We apply these concepts to the problem of detecting instances of design patterns in source code. We evaluate our methodology on four design patterns, a wide range of balanced and imbalanced labeled training data, and compare classical machine learning (Random Forests) with modern deep learning approaches (Convolutional Neural Networks). Feature maps yield robust classifiers even under challenging settings of strongly imbalanced data distributions without sacrificing human comprehensibility. Results suggest that feature maps are an excellent addition in the software analysis toolbox that can reveal useful information hidden in the source code.

Design patterns and their variants detection from source code using different techniques and tools are keys to understand complex architecture of different applications. Design patterns are key to develop quality applications and well know solutions to well know problems. The discussion is on accuracy of existing techniques and tools is debatable because of multiple advanced technologies and a lot of variations in Gang of Four (GOF) design patterns. In fact, during development developers modified standard patterns according to their needs and design, but intent remain same. In this research, we will find different variants of Gang of Four design patterns from source code of legacy applications through various techniques that developers are using to tackle commonly occurring problems. These discovered variants are detected and validated through different design patterns detection techniques and tools.

In recent years, the increase in the amount of data generated in basic social practices and specifically in all fields of research has boosted the rise of new database models, many of which have been employed in the field of Molecular Biology. NoSQL graph databases have been used in many types of research with biological data, especially in cases where data integration is a determining factor. For the most part, they are used to represent relationships between data along two main lines: (i) to infer knowledge from existing relationships; (ii) to represent relationships from a previous data knowledge. In this work, a short history in a timeline of events introduces the mutual evolution of databases and Molecular Biology. We present how graph databases have been used in Molecular Biology research using High Throughput Sequencing data, and discuss their role and the open field of research in this area.

Software maintenance is an important issue during the software design life cycle, especially, in late stages. Frequent changes in the software system with lack of documentation lead to the increase in the cost of maintenance. For this reason an important step for software maintenance is detecting patterns from the source code to provide relevant information that can help in understanding the system design and improve its documentation. Design patterns help maintainers and developers to understand the implementation of any software system which make software maintenance process faster and well-informed. Also it decreases the time and efforts that are needed in learning the software. Detecting patterns is not an easy task because the nature of design patterns. This research introduces a detection process based on software domains. This work is done through collecting five different domains for Java open source code. The dynamic analysis approach is used in extracting patterns. The experimental results showed that there are existing some common patterns between source codes which have the same domain in some source codes.

Static and dynamic program analysis techniques are important research areas in software security. Static analysis helps us locate vulnerabilities in a software by looking at the source code. Dynamic analysis helps us reason about the behavior of the software from information gathered at run-time. In this thesis, we are focusing on data flow analysis and heap analysis which are key static and dynamic program analysis techniques respectively.
\n
\nIn the first part of this thesis, we aim at detecting vulnerabilities in Android applications which have capability leaks. The security of the Android platform relies mainly on sandboxing applications and restricting their capabilities such that no application, by default, can perform any operations that would adversely impact other applications, the operating system, or the user. However, a recent research reported that a genuine but vulnerable application may leak its capabilities. When being leveraged, other applications can gain extra capabilities which they are not granted originally. We present DroidChecker, an Android application analyzing tool which searches for the aforementioned vulnerability in Android applications. DroidChecker uses interprocedural control flow graph searching and static taint checking to detect exploitable data paths in an Android application. We analyzed more than 1100 Android applications using DroidChecker and found 6 previously unknown vulnerable applications including the renowned Adobe Photoshop Express application. We also developed a malicious application that exploits the previously unknown vulnerability found in the Adobe Photoshop Express application. We showed that the malicious application, which is not granted any permissions, can access contacts on the phone with just a few lines of code.
\n
\nIn the second part of this thesis, we explore the use of heap analysis to extract software birthmarks. There are techniques like code obfuscation and watermarking which can make the source code of a program difficult to understand by humans and prove the ownership of the program. However, code obfuscation cannot avoid the source code being copied and a watermark can be defaced. A birthmark is a group of unique characteristics a program possesses that can be used to identify the program. We propose two novel dynamic birthmark systems based on the run-time heap. A dynamic birthmark is one that is extracted when the program is executing. Since it is based on the run-time behavior of the program, semantics-preserving transformations of the code like obfuscation cannot defeat dynamic birthmarks. In this regard, dynamic birthmarks are more robust compared with static birthmarks.
\n
\nTo the best of our knowledge, these are the first birthmark systems using heap analysis as the underlying technique. The basic idea is to take snapshots of the heap while the program is running. From the snapshots, heap graphs are constructed to model the referencing structure between objects. After going through some filtering and referencing processes, they become the birthmarks. The two birthmark systems have been devised to extract birthmarks for Java programs and JavaScript programs respectively. While the underlying ideas of the two birthmark systems are similar, the differences in nature of the two programming languages led to different implementation designs.

The analysis and utilization of grid big data, big data driven grid analysis and optimization have received extensive attention in recent years, and non-relational databases can handle big data problems efficiently. The graph database is a kind of non-relational database. This paper takes the graph database Neo4j as an example. Based on the domain modeling theory and follows the CIM model, the grid data modeling principle is proposed. Under these principles, some power grid data models and their applicable occasions, and methods for converting these models to each other are proposed. Finally, three graph database models are built using the modeling method proposed in this paper. The query performance of Neo4j and MySQL is compared by three examples. The conclusion is that in the traversal with obvious topological characteristics, such as shortest path traversal, deep traversal and time tree traversal, etc., the graph database model proposed in this paper can greatly improve the retrieval efficiency. It proves the effectiveness of the proposed modeling method and the efficiency of the graph database in specific retrieval.

The article presents a study of the tasks that determine the features of power-loaded networks, and tasks that are solved using graph models for power-loaded networks. The tasks that determine the features of power-loaded networks are communication check, isolation of network components and components, combinatorial tasks on graphs, calculation of flow distribution, graph simplification, optimal impact on the power grid, and determination of power proportions. This article presents the high-level architecture of Neo4j. Neo4j is an open-source graph database management system implemented in Java and is considered the most comprehensive and promising graph database management system. In comparison with modelling a graph database using a relational database management system, this approach allows applying additional optimization in the case of data with a more complex and loaded structure. The article proposes a model of an energy-loaded network, because it is a system of interaction of a large number of loads or consumers, active sources, communication lines. The declarative query language for graph databases Cypher was used for implementation. A graph database of an electrical network with a description of analytical data processing using a mathematical algorithm and software specifics of the work of queries in a multi-relational database environment has been built. When a query is executed for a user-specified network segment, a connectivity component is allocated; then for the selected elements of the network graph, correspondence is made with the elements of the network itself.

Software patterns are often considered as an important methodology in the process of analysis and design of a software, when the proposed architecture of the software is a complex one. During the process of reverse engineering, design patterns become helpful to analyze the source code. A pattern-based analysis often improves maintainability of the source code. The proposed reverse engineering approach considers software metrics for the development of the datasets. The study is comprises of two phases such as preparation of requisite dataset based on object-oriented software metrics and identification of design patterns. Preparation of dataset is carried out using pattern instances from source code, mapped with software metrics. Analysis of design patterns is accomplished by considering a learning-based method i.e., Artificial Neural Network. In this study, two open source software such as JRefactory and Quaqua have been considered to exploit the idea of reverse engineering.

Design patterns in software development have shown great promise in improving software quality. Traditionally, software developers utilize a set of design patterns to foster reusability and better software design. Recently, mobile applications (apps) have become a mainstay of modern computing, as well as, a challenging domain for software engineers. This is because mobile apps now target more critical domains such as health, banking, m-payments, and even military to mention just a few. Android is a very popular mobile platform, and has managed to take over the majority of mobile market. It is true that there are comprehensive studies in the area of design patterns detection in several object-oriented languages such as Java, C# and C++. However, little studies target design patterns in Android apps. As a step toward helping to measure and explore the application of design patterns in Android apps, we introduce PatRoid, an automated framework for detecting design patterns. PatRoid is a model-based approach that is able to detect design patterns laying inside Android apps source code. The model is based on a graph isomorphism approach, where design patterns are divided into sub-patterns that can be aggregated to formulate design patterns. We have conducted a preliminary evaluation and the results show that PatRoid can detect all of the 23 GoF design patterns.