Theory and practice of string solvers (invited talk abstract)

RE-MuSiC is a web-based multiple sequence alignment tool that can incorporate biological knowledge about structure, function, or conserved patterns regarding the sequences of interest. It accepts amino acid or nucleic acid sequences and a set of constraints as inputs. The constraints are pattern descriptions, instead of exact positions of fragments to be aligned together. The output is an alignment where for each pattern (constraint), an occurrence on each sequence can be found aligned together with those on the other sequences, in a manner that the overall alignment is optimized. Its predecessor, MuSiC, has been found useful by researchers since its release in 2004. However, it is noticed in applications that the pattern formulation adopted in MuSiC, namely, plain strings allowing mismatches, is not expressive and flexible enough. The constraint formulation adopted in RE-MuSiC is therefore enhanced to be regular expressions, which is convenient in expressing many biologically significant patterns like those collected in the PROSITE database, or structural consensuses that often involve variable ranges between conserved parts. Experiments demonstrate that RE-MuSiC can be used to help predict important residues and locate phylogenetically conserved structural elements. RE-MuSiC is available on-line at http://140.113.239.131/RE-MUSIC.

Search-based software engineering (SBSE) consists of the application of metaheuristic search techniques—such as genetic algorithms, simulated annealing, hill climbing, and tabu search—to software engineering problems. This idea is based on the observation that some software engineering activities can be thought of as optimization problems, and on the fact that techniques providing exact solutions are, very often, unable to adequately scale to large, real-world software engineering problems. Define fitness functions to guide an automated search for solutions, rather than attempting to construct solutions from scratch by hand. SBSE moves the engineer up the abstraction chain, from the tedious and expensive role of detailed solution construction, to the potentially more productive and more cost-effective area of fitness function design. This approach has been repeatedly demonstrated to have successful applications across the software engineering life cycle from requirements and project planning to maintenance and testing. This special issue focuses on applications of search SBSE to the maintenance phase of the life cycle. After software testing 2, software maintenance is the most widely studied application area for SBSE research. Work on SBSE applications to problems in software maintenance can be traced back to the pioneering work of the Mancoridis et al. 3, which led to the development of the Bunch tool for software re-modularization 4. In the past five years there has been a significant increase in SBSE applications to software maintenance and evolution. Search-based techniques have been applied to post-development code improvement problems, such as object-oriented refactoring 5, 6, and imperative language slicing and transformation 7. Other applications are related to software engineering economics and project management problems, such as release planning 8-12, effort, and cost estimation 13-16, and project staffing and planning 17-20. Last, but not the least, SBSE has been applied to deal with service-oriented architectures, for example for services QoS-aware composition 21, service-level agreement negotiation 22, and testing 23. A complete overview of SBSE with a discussion of future research trends can be found in the recent International Conference on Software Engineering (ICSE) ‘Future of Software Engineering’ paper 24. This issue of the Journal of Software Maintenance and Evolution: Research and Practice features three outstanding papers, dealing with different aspects of software maintenance and evolution: release planning and staffing, re-factoring, and component substitution. The paper ‘Optimized Staffing for Product Releases—Focused Search and its Application at Chartwell Technologies’ by Puneet Kapur, An Ngo-The, Günther Ruhe, and Andrew Smith presents an approach for optimizing the staffing for product releases. The problem they solve can be viewed as part of the more general release planning problem, which assigns features to releases such that technical, resource, risk, and budget constraints are met. In particular, the genetic search-based approach the authors propose aims at assigning human resources to software development tasks, taking them from a pool of developers having different levels of skills. The applicability of the proposed approach is demonstrated with an industrial case study. The paper ‘Search-Based Refactoring: an Empirical Study’ by Mark O'Keffe and Mel Ó Cinnéide presents an approach to automatically re-factor, using search-based techniques, object-oriented systems that undergo repeated addition of functionality. Such addition can, very often, deteriorate the quality of the system's underlying design. Their re-factoring is guided by the QMOOD quality model 25, and the paper compares different optimization techniques, such as Genetic Algorithms, Simulated Annealing, and Multiple Ascent Hill-Climbing. The results of experiments carried out on five software systems suggest that the latter technique outperforms the others. The paper ‘Search-based Many-to-one Component Substitution’ by Nicolas Desnos, Marianne Huchard, Guy Tremblay, Christelle Urtado, and Sylvain Vauttier presents a search-based approach that allows the replacement of an obsolete component with a composition of multiple components. When a component becomes obsolete, the approach searches for a minimal assembly of other components, exposing their functionality by means of ports that preserves the behavior of the original component. The proposed approach has been evaluated on a set of randomly generated components. We hope that readers will enjoy this special issue and find the selected papers insightful and inspiring. We would like to thank all the authors who presented papers for this special issue: there were many good quality papers, but unfortunately we could accept only three of them. Last, but not the least, we would like to thank the reviewers who provided timely, detailed and constructive feedbacks to the authors. Without their precious help this special issue would not have been possible.

An in-depth review of key techniques in software error detection Software error detection is one of the most challenging problems in software engineering. Now, you can learn how to make the most of software testing by selecting test cases to maximize the probability of revealing latent errors. Software Error Detection through Testing and Analysis begins with a thorough discussion of test-case selection and a review of the concepts, notations, and principles used in the book. Next, it covers: Code-based test-case selection methods Specification-based test-case selection methods Additional advanced topics in testing Analysis of symbolic trace Static analysis Program instrumentation Each chapter begins with a clear introduction and ends with exercises for readers to test their understanding of the material. Plus, appendices provide a logico-mathematical background, glossary, and questions for self-assessment. Assuming a basic background in software quality assurance and an ability to write nontrivial programs, the book is free of programming languages and paradigms used to construct the program under test. Software Error Detection through Testing and Analysis is suitable as a professional reference for software testing specialists, software engineers, software developers, and software programmers. It is also appropriate as a textbook for software engineering, software testing, and software quality assurance courses at the advanced undergraduate and graduate levels.

In today’s organizations, a vast amount of existing software systems is insecure, which results in compromised valuable assets and has negative consequences on the organizations. Throughout the years, many attempts have been made to build secure software systems, but the solutions proposed were limited to a few add-on fixes made after implementation and installation of the system.The contribution of the research in this thesis is a software security engineering methodology, called Controlled Security Engineering Process, which provides support to developers when developing more secure software systems by integrating software lifecycle and security lifecycle, and enhancing the control in the engineering process. The proposed methodology implements security in every phase of general software system engineering, i.e., requirement, design, implementation, and testing, as well as operation and maintenance to certify that software systems are built with security in mind.The Controlled Security Engineering Process methodology addresses security problems in the development lifecycle. Construction of a secure software system involves specific steps and activities, which include security requirements specifications of system behavior, secure software design, an analysis of the design, implementation, with secure coding and integration, and operating and maintenance procedures.The methodology incorporates software security patterns and control of the engineering process. The software security patterns can be used as security controls and information sources to demonstrate how a specific security task should be performed or a specific security problem solved. Many patterns can be implemented in an automated way, which can facilitate the work of software engineers.The control of the engineering process provides visibility over the development process. The control assures that authorised developers access legitimate and necessary information and projects’ documents by using authentication, and authorization.To support implementation of automated patterns and provide control over the engineering process, a design of a multi-agent system is provided. The multi-agent system supports implementation of patterns and extracting security information, and provides traceability in the engineering process. The security information is requirements, threats and security mechanisms that are provided by matching project documents, and traceability is achieved by monitoring and logging services.The Controlled Security Engineering Process methodology has been evaluated through interviews with developers, security professionals, and decision makers in different types of organizations but also through a case study which was carried out in an organization.

Software quality assurance and testing is a vital phase in the software development lifecycle, oftentimes requiring a significant portion of the overall development budget. Providing authentic, real-world software quality assurance and testing experiences within the context of a Computer Science or Software Engineering curriculum is challenging. Based on prior experience leveraging Free and Open Source Software (FOSS) as an instructional medium for teaching Software Engineering concepts, this paper describes five increasingly involved learning interventions that utilize FOSS in a software testing course to provide students real-world hands-on software testing knowledge and experience. The proposed approach will be piloted and assessed in software testing courses at the undergraduate and graduate level.

Background: Software testing and software security have become one of the most important parts of an application. Many studies have explored each of these topics but there is a gap wherein the relation of software security and software testing in general has not been explored. Objective: This study aims to conduct a systematic literature review to capture the current state-of-the-art in software testing related to security. Methods: The search strategy obtains relevant papers from IEEE Xplore and ScienceDirect. The results of the search are filtered by applying inclusion and exclusion criteria. Results: The search results identified 50 papers. After applying the inclusion/exclusion criteria, we identified 15 primary studies that discuss software security and software testing. We found approaches, aspects, references, and domains that are used in software security and software testing. Conclusion: We found certain approach, aspect, references, and domain are used more often in software security testing Keywords: Software security, Software testing, Security testing approach, Security threats, Systematic literature review

Parsing with Derivatives (PwD) is an elegant approach to parsing context-free grammars (CFGs). It takes the equational theory behind Brzozowski's derivative for regular expressions and augments that theory with laziness, memoization, and fixed points. The result is a simple parser for arbitrary CFGs. Although recent work improved the performance of PwD, it remains inefficient due to the algorithm repeatedly traversing some parts of the grammar. In this functional pearl, we show how to avoid this inefficiency by suspending the state of the traversal in a zipper. When subsequent derivatives are taken, we can resume the traversal from where we left off without retraversing already traversed parts of the grammar. However, the original zipper is designed for use with trees, and we want to parse CFGs. CFGs can include shared regions, cycles, and choices between alternates, which makes them incompatible with the traditional tree model for zippers. This paper develops a generalization of zippers to properly handle these additional features. Just as PwD generalized Brzozowski's derivatives from regular expressions to CFGs, we generalize Huet's zippers from trees to CFGs. Abstract The resulting parsing algorithm is concise and efficient: it takes only 31 lines of OCaml code to implement the derivative function but performs 6,500 times faster than the original PwD and 3.24 times faster than the optimized implementation of PwD.

We tackle the problem of analyzing filter and sanitizer programs remotely, i.e. given only the ability to query the targeted program and observe the output. We focus on two important and widely used program classes: regular expression (RE) filters and string sanitizers. We demonstrate that existing tools from machine learning that are available for analyzing RE filters, namely automata learning algorithms, require a very large number of queries in order to infer real life RE filters. Motivated by this, we develop the first algorithm that infers symbolic representations of automata in the standard membership/equivalence query model. We show that our algorithm provides an improvement of x15 times in the number of queries required to learn real life XSS and SQL filters of popular web application firewall systems such as mod-security and PHPIDS. % Active learning algorithms require the usage of an equivalence oracle, i.e. an oracle that tests the equivalence of a hypothesis with the target machine. We show that when the goal is to audit a target filter with respect to a set of attack strings from a context free grammar, i.e. find an attack or infer that none exists, we can use the attack grammar to implement the equivalence oracle with a single query to the filter. Our construction finds on average 90% of the target filter states when no attack exists and is very effective in finding attacks when they are present. For the case of string sanitizers, we show that existing algorithms for inferring sanitizers modelled as Mealy Machines are not only inefficient, but lack the expressive power to be able to infer real life sanitizers. We design two novel extensions to existing algorithms that allow one to infer sanitizers represented as single-valued transducers. Our algorithms are able to infer many common sanitizer functions such as HTML encoders and decoders. Furthermore, we design an algorithm to convert the inferred models into BEK programs, which allows for further applications such as cross checking different sanitizer implementations and cross compiling sanitizers into different languages supported by the BEK backend. We showcase the power of our techniques by utilizing our black-box inference algorithms to perform an equivalence checking between different HTML encoders including the encoders from Twitter, Facebook and Microsoft Outlook email, for which no implementation is publicly available.

We welcome you to the Twenty-Eighth International Conference on Software Engineering and Shanghai, China. This is the first instance of the ICSE conference series to be held in China, and it is an exciting time and place for ICSE 2006. The conference brings researchers, educators, practitioners and students together to present, exchange ideas and engage in discussions about the recent and exciting innovations and research in software engineering. Exciting sessions on practical experience, educational issues, and doctoral and new faculty symposia have been organized. The conference also includes a wide variety of tutorial, workshops and demonstration offerings. Finally, since research and markets in our host country China are continuously growing, ICSE includes a separate Far East Track for discussions on the contributions and challenges of our Chinese colleagues. We trust that this mix will provide interesting and stimulating offerings to all members of our growing community. The technical program committee is pleased to present this conference proceeding that contains the research papers of the technical program for ICSE 2006. The technical program for this conference focuses on new and innovative software engineering contributions in theory, formal methods, system building and empirical studies. The papers represent an alluring array of topics, including software design, architecture, reuse, testing, analysis, processes and formal methods. Because of the growing number of paper submission and the resulting large program committees in the past, we instituted a new two-phase reviewing process this year. Our program committee had 36 members. In the first phase, each submitted paper was reviewed by 3 reviewers: 2 from the program committee and an external reviewer from the software engineering community. We had 265 external reviewers who contributed 370 reviews for this phase. Those papers receiving the best reviews were considered in the second phase. A total of 99 papers entered the second phase. Each of these papers was reviewed by another program committee member. Thus, each accepted paper had a total of 4 reviews (3 reviews from pc members and 1 review from an external reviewer). Each rejected paper had at least 3 reviews. The pc members reviewed 24-25 papers in the two phases, a reasonable number. We feel that this system worked very well. The program committee met for two days in December, 2005 in Frankfurt, Germany. By the end of the meeting, a consensus emerged for the 36 papers in this proceedings (9% of the total submissions). There were many high quality submissions that could not be accommodated in the program; hopefully a revised version will be published elsewhere. In addition to the papers, we organized four invited sessions. One invited session focuses on empirical studies, an increasingly important component of software engineering research and practice. We also have an invited panel that addresses the value and practice of formal methods. Since software engineering techniques are growing in importance in challenging safety critical domains, we included two invited sessions: one on software engineering for automotive engineering and the other on software engineering for assisted living. We are very pleased that a notably diverse and outstanding group of three leaders of the software engineering community have agreed to present keynote speeches. The opening day keynote will be presented by Prof. Yang Fuqing, from Peking University, a woman who has been at the very forefront of the software engineering communities of research and practice in China for decades. Her perspectives on the past and future of software engineering in China will be complemented by a keynote on similar themes presented on the second day. This second keynote will be delivered by Prof. Barry Boehm, from the University of Southern California, USA. His talk will review the history of software engineering research and practice in the West over the past decades, and project it forward into the 21st century. Finally, the keynote speaker on the third day, Mr. Reinhold Achatz, from Siemens Corp., will present a complementary view of software engineering research and practice, as viewed from the perspective of one of the great multinational corporations, based in Europe. We are truly excited at the prospect that these three keynotes will provide a searching multidimensional view of our community at this time of historic convergence of communities. The continued success and high quality of the ICSE conference series would not be possible without the help and support of the software engineering community. First, we would like to gratefully acknowledge and thank all of the authors who submitted papers. We especially thank the program committee members for their efforts and commitments in reviewing the papers and securing reviews from external reviewers. They put in an extraordinary amount of their time to provide thoughtful and knowledgeable reviews. The exceptionally strong technical program represented by the papers in this proceeding could not be possible without their efforts.

This report documents the program and the outcomes of Dagstuhl Seminar 19062 Bringing CP, SAT and SMT together: Next Challenges in Constraint Solving, whose main goals were to bring together leading researchers in the different subfields of automated reasoning and constraint solving, foster greater communication between these communities and exchange ideas about new research directions. Constraint solving is at the heart of several key technologies, including program analysis, testing, formal methods, compilers, security analysis, optimization, and AI. During the last two decades, constraint solving has been highly successful and transformative: on the one hand, SAT/SMT solvers have seen a significant performance improvement with a concomitant impact on software engineering, formal methods and security; on the other hand, CP solvers have also seen a dramatic performance improvement, with deep impact in AI and optimization. These successes bring new applications together with new challenges, not yet met by any current technology. The seminar brought together researchers from SAT, SMT and CP along with application researchers in order to foster cross-fertilization of ideas, deepen interactions, identify the best ways to serve the application fields and in turn help improve the solvers for specific domains.

Putting Requirements and Quality at the Core of Global Service Delivery: Current Efforts and Future Plans at Pace University

Reliability problems in software engineering — a review: Downs, TComput. Syst. Sci. Eng. Vol 2 No 3 (July 1987) pp 131–147

Security affects every software component in different types of computing systems. Many vulnerabilities and attacks on software systems are due to security weaknesses in the software itself. During the process of software specification, development, or testing, security issues are either taken into consideration insufficiently or not at all. Such software, due to internal weaknesses is prone to new attacks. By teaching secure software engineering techniques for designing and developing software modules, students would learn systematic secure software development techniques, such as defect detecting and security testing. This paper presents a series of modules that are designed to be integrated into undergraduate software engineering courses from a security perspective. The goal of the modules is to teach the building of robust software security requirements, secure software design and development, and secure software verification through a secure software development lifecycle.

Learning TOC – begins is a web application which is useful for Learning TOC (Theory of Computation). It covers hypothesis of the basic points with cases and it likewise has Exercise segment in which client can check different speculations for all intents and purposes. It likewise creates drawing of different cases. So the client can learn it adequately and additionally quick. Client can build FA of the string without anyone else and print or fare it for his task work. It has the office of Test to check his score and readiness work. So it is extremely valuable for client as exam arrangement. This Web Application is valuable for the educators and understudies and additionally different clients which are has a place with the Computer Science field. The fundamental reason for this web application is to pick up everything outwardly and graphically. It covers the listed topics given below- Regular Expression, Finite Automata, Context Free Grammar, Push Down Automata, Turing Machine, Exercise of the topics, Mock test.

<strong>Background: </strong>Statistical concepts and techniques are often applied incorrectly, even in mature disciplines such as medicine or psychology. Surprisingly, there are very few works that study statistical problems in software engineering (SE).<strong>Aim: </strong>Assess the existence of statistical errors in SE experiments.<strong>Method: </strong>Compile the most common statistical errors in experimental disciplines. Survey experiments published in ICSE to assess whether errors occur in high quality SE publications.<strong>Results:</strong> The same errors as identified in others disciplines were found in ICSE experiments, where 30% of the reviewed papers included several error types such as: a) missing statistical hypotheses, b) missing sample size calculation, c) failure to assess statistical test assumptions, and d) uncorrected multiple testing. This rather large error rate is greater for research papers where experiments are confined to the validation section. The origin of the errors can be traced back to: a) researchers not having sufficient statistical training, and, b) a profusion of exploratory research.<strong>Conclusions:</strong> This paper provides preliminary evidence that SE research suffers from the same statistical problems as other experimental disciplines. However, the SE community appears to be unaware of any shortcomings in its experiments, whereas other disciplines work hard to avoid these threats. Further research is necessary to find the underlying causes and set up corrective measures, but there are some potentially effective actions and are a priori easy to implement: a) improve the statistical training of SE researchers, and b) enforce quality assessment and reporting guidelines in SE publications.