Software Assurance During Maintenance

This research methodology isolates coding properties and identifies the probability of security vulnerabilities using machine learning and historical data. Several approaches characterize the effectiveness of detecting security-related bugs that manifest as vulnerabilities, but none utilize vulnerability patch information. The main contribution of this research is a framework to analyze LLVM Intermediate Representation Code and merging core source code representations using source code properties. This research is beneficial because it allows source programs to be transformed into a graphical form and users can extract specific code properties related to vulnerable functions. The result is an improved approach to detect, identify, and track software system vulnerabilities based on a performance evaluation. The methodology uses historical function level vulnerability information, unique feature extraction techniques, a novel code property graph, and learning algorithms to minimize the amount of end user domain knowledge necessary to detect vulnerabilities in applications. The analysis shows approximately 99% precision and recall to detect known vulnerabilities in the National Institute of Standards and Technology (NIST) Software Assurance Metrics and Tool Evaluation (SAMATE) project. Furthermore, 72% percent of the historical vulnerabilities in the OpenSSL testing environment were detected using a linear support vector classifier (SVC) model.

Funded by the Department of Homeland Security (DHS), the National Institute of Standards and Technology (NIST) started a long-term, ambitious project to identify, enhance and develop software assurance tools. The Software Assurance Metrics And Tool Evaluation (SAMATE) project is leading in (A) developing tests for software evaluation tools, (B) measuring the effectiveness of tools, and (C) identifying gaps in tools and methods. See the workshop web site at http://samate.nist.gov/ SASII.

Software Testing is known as an important part in software development as the product needs to meet the user's expectations and requirements. The testing tool is developed along with the development of automated software testing to act as a medium to test the software, and the existence of these tools eventually cut down the human's effort, energy, and time. Software testing tools are the key assets of a project that can improve productivity and software quality. As there are many tools in the market nowadays, the process of selecting the tool should be explained in detail and specific towards its functions and efficiency. This paper aims to help the authors in making the tool selection from the various versions of testing tools. This study finally chose the most suitable tool according to the research needs.

Software testing plays a key role in Software Development. There are two approaches to software testing i.e. Manual Testing and Automated Testing which are used to detect the faults. There are numbers of automated software testing tools with different purposes, but it is always a problem to select a software testing tool according to the needs. Web service is broadly utilised idea these days due to quick promotion of Web services and less literature is accessible with respect to web administration's performance. Web applications are hard to test in contrast with customary applications particularly as far as Performance testing, for example, unpredictable load, response time and so on. In this investigation correlation of performances testing tools i.e. Apache JMeter, NeoLoad, and Loadster is done based on various parameters. Performance parameters results generated by these performance testing tools have been evaluated and assessed in terms of usability test parameters & performance parameters.

Software maintainers have long been acutely aware of the challenges involved in managing software change processes. Activities such as software migration, restructuring and reengineering all involve source code modification. They rely heavily on analysis and comprehension of the complex system structures and interactions that characterize both legacy and modern software systems. It is widely accepted that tools that support software analysis and maintenance tasks would go a long way towards addressing the constraints that software developers and maintainers work with on a day-to-day basis. Nevertheless, despite an abundance of tools, not many are used by practitioners and very few are considered essential for a particular development or maintenance task. This workshop examined design issues related to the development and application of tools to support software analysis and maintenance

Software testing provides a means to reduce errors, cut maintenance and overall software costs. Numerous software development and testing methodologies, tools, and techniques have emerged over the last few decades promising to enhance software quality. While it can be argued that there has been some improvement it is apparent that many of the techniques and tools are isolated to a specific lifecycle phase or functional area. This paper presents a set of best practice models and techniques integrated in optimized and quantitatively managed software testing process (OptimalSQM), expanding testing throughout the SDLC. Further, we explained how can Quantitative Defect Management Model be enhanced to be practically useful for determining which activities need to be addressed to improve the degree of early and cost-effective software fault detection with assured confidence is proposed. To enable software designers to achieve a higher quality for their design, a better insight into quality predictions for their design choices, test plans improvement using Simulated Defect Removal Cost Savings model is offered in this paper.

Pengembangan perangkat lunak adalah tugas kompleks dan membutuhkan adaptasi untuk mengakomodasi kebutuhan pengguna. Untuk membuat konsep dan perubahan perangkat lunak, dalam pemeliharaan, sekarang telah dikembangkan lebih mudah dalam pengembangan perangkat lunak, pola model-view-controller, yang merupakan arsitektur yang dapat membantu memfasilitasi dalam pengembangan dan pemeliharaan perangkat luna. Hal ini, karena dalam arsitektur model tiga-lapis, yaitu: tampilan dan pengontrolan dalam pembangunan dilakukan secara independen, sehingga dapat memberikan dahan dalam pengembangan dan pemeliharaan. Selain itu, arsitektur ini juga dapat melihat hal-hal yang sederhana dan menarik bagi pengguna. Software sistem on-line test adalah perangkat lunak yang memerlukan interaksi dengan pengguna, dan pemeliharaan perangkat adaptif. Karena sistem ujian on-line memerlukan pengembangan perangkat lunak untuk mengakomodasi kebutuhan ini berkembang dengan cepat. Makalah ini untuk menganalisis Model-View-Controller dan mencoba pembangunan, untuk menerapkannya dalam pengembangan perangkat lunak sistem pengujian on-line.

Computer-aided software engineering (CASE) tools have been advocated for improving maintainer productivity and the quality of maintained software. While there is evidence that such benefits can accrue to organizations adopting maintenance-oriented CASE tools, a key problem in achieving the desired benefits from CASE tools is low usage of these tools by programmers. The previously tested Maintenance Tool Utilization Model was a first step in investigating the factors that affect whether maintainers choose to use CASE tools during maintenance projects. We test the addition of experience with software maintenance tools and with the software maintenance task to the Maintenance Tool Utilization Model. The role of experience is important because managers can provide training to increase experience and they can ensure that project teams have some members experienced with the tools or with the task. Data for the test are collected from software maintainers working on their organization’s normal maintenance project backlog. Tool experience is significant as both a main and interaction effect, but task experience adds little to the explanatory power of the Maintenance Tool Utilization Model. These results support the value of improved CASE tool training programs.

Computer-Aided Software Engineering (CASE) tools have been advocated for improving maintainer productivity and the quality of maintained software. While there is evidence that such benefits can accrue to organizations adopting maintenance-oriented CASE tools, a key problem in achieving the desired benefits from CASE tools is low usage of these tools by programmers. The previously tested Maintenance Tool Utilization Model was a first step in investigating the factors that affect whether maintainers choose to use CASE tools during maintenance projects. We test the addition of experience with software maintenance tools and with the software maintenance task to the Maintenance Tool Utilization Model. The role of experience is important because managers can provide training to increase experience and they can ensure that project teams have some members experienced with the tools or with the task. Data for the test are collected from software maintainers working on their organization’s normal maintenance project backlog. Tool experience is significant as both a main and interaction effect, but task experience adds little to the explanatory power of the Maintenance Tool Utilization Model. These results support the value of improved CASE tool training programs.

While development of software always implicitly takes place in contexts of inherited entanglements and legacies, its maintenance deals explicitly with what is already present. Software maintenance locates itself in media res, in the middle of things. Maintaining software typically involves intervening in the material archive of source code, documentation, and software tools. Doing so successfully requires relevant situated knowledge of how the software at hand already hangs together, and how to effectively put this knowledge to use. This knowledge builds on first-hand experience, acquired in practice over shared lifetimes of people and code. For code to continue to endure over time, ongoing articulation of its entanglements is externalized and materialized across contributing programmers and software development tools, each themselves vulnerable and in need of maintenance. This paper analyzes how this process of externalizing and materializing knowledge is negotiated. We conclude that the common knowledge which suspends the string figure of software in time and in a broken world (Jackson 2014) is always a locally hybrid assemblage which carries this knowledge forward. Hence, to maintain software well is to add on to its legacy.

Computer‐aided software engineering (CASE) is both a field of study and a marketplace. As a field of study, it is the collection of research and development over many years in software development management, methods, environments, and software tools. In general terms, CASE is the industrialization of software engineering techniques and computer technology to improve and automate the practice of information systems development. It is an integration technology that incorporates software development techniques, tools, and approaches into common and consistent frameworks. CASE draws on technologies from computer‐aided design, software engineering, operating systems, database, networking, and many other computer disciplines. Thus CASE is not principally a field of new invention. Rather, it is a field of application, integration, and synthesis. As a marketplace, CASE represents a diverse set of products and services for software development and systems integration. The acronym CASE is used as an umbrella for a wide variety of claims regarding software tools and software development productivity. Definitions of CASE are given. CASE evironments, automation of analusis, computer‐supported collaboration, apportunities for quality engineering, maintenance and reengineering are discussed.

Security has been always treated as an add-on feature in the software development lifecycle, and addressed by security professionals using firewalls, proxies, intrusion prevention systems, antivirus and platform security. Software is at the root of all common computer security problems, and hence hackers don't create security holes, but rather exploit them. Security holes in software applications are the result of bad design and implementation of software systems and applications. To address this problem, several initiatives for integrating security in the software development lifecycle have been proposed, along with tools to support a security-centric software development lifecycle. This paper introduces a framework for evaluating security static analysis tools such as source code analyzers, and offers evaluation of non-commercial static analysis tools such as Yasca, CAT.NET, and FindBugs. In order to evaluate the effectiveness of such tools, common software weaknesses are defined based on CWE/SANS Top 25, OWASP Top Ten and NIST source code weaknesses. The evaluation methodology is based on the NIST Software Assurance Metrics And Tool Evaluation (SAMATE). Results show that security static analysis tools are, to some extent, effective in detecting security holes in source code; source code analyzers are able to detect more weaknesses than bytecode and binary code scanners; and while tools can assist the development team in security code review activities, they are not enough to uncover all common weaknesses in software. The new test cases developed for this research have been contributed to the NIST Software Assurance Reference Dataset (samate.nist.gov/SARD).

Many development practices and software tools enable new product development (NPD), yet few empirical studies shed light on the project characteristics and project contexts driving their use. Using a cross-sectional sample of NPD projects, this study examines how project characteristics and availability of information technology (IT) infrastructure relate to the use of NPD practices and software tools. We also examine how the extent of their use is associated with NPD project performance. The results indicate that different project characteristics influence the use of NPD practices and software tools, with project complexity associated with software tool use, but project uncertainty associated with NPD practice use. Also, customer facing IT infrastructure is associated with the use of NPD practices, while manufacturing plant IT infrastructure is associated with the use of design/validation software tools. Moreover, use of NPD practices has a positive association with all project-level performance metrics examined in this study, and as a result, a greater impact on overall market success. In comparison, the performance impacts of software tools appear relatively limited, with only design/validation software tools exhibiting a strong positive association with product performance quality and a weak positive association with time-to-market and responsiveness. Communication/teamwork software tools exhibit no such impact.

Software testing is an important process in software quality assurance(SQA). Software testing consumes the majority of the software developers' time and cost of all the phases of system development. An important problem in software testing is to determine whether a program has been tested enough with a testing criterion and when one could stop testing. On the other hand, software measurement is used to estimate the quality of a software. Complexity measures can be used to compare software quality and development cost. This paper proposes a new testing approach which choosing testing path based on path complexity. The process is to use a set of testing paths that satisfying all-uses testing criterion, and then choose the testing path with the most complexity to test. This process is continued until the program can be accepted. The proposed formula is used to determine if it is possible to stop testing before satisfying all-du-paths testing criterion. The main contribution of the paper is that software developers can choose a proper testing action with lower testing effort.

One of the main concerns in the software industry continues to be the development of high quality software. This concern will be exacerbated as software systems become more complex. The training of software developers continues to grow in academia since more institutions are offering software engineering (SE) courses. However, the list of topics that are expected to be covered in this course leaves little or no time for topics that focus on developing quality software, such as software testing and the use of testing tools.In this paper we describe an approach that non-intrusively integrates the use of software testing tools in SE courses. The cornerstone of our approach is the interaction students have with a Web-Based Repository of Software Testing Tools (WReSTT) that contains tutorials on testing concepts and testing tools. WReSTT employs both collaborative learning and social networking features that are attractive to students. We present the results of preliminary study performed in two SE courses that show how using the resources in WReSTT can potentially impact the students' understanding of software testing and the use of testing tools.