Issue management in market-driven software projects is constantly under time pressure. A limited set of developers must share their time between developing features for the next release and resolving reported issues. Project managers need to find the appropriate balance between a high quality product and fast time to market. We study a telecom company in Sweden developing embedded systems for a consumer market. The project managers report that developers resolve approximately 10% of the issues reported during a project. Consequently, it is critical to properly prioritize the issues to receive the best possible return on investment, and above all to remove all bugs that might impact the market's reception of the product. We use machine learning to investigate what features of an issue report are the best predictors of changes to production code during its corresponding resolution. After removing all features jeopardizing the confidentiality of individual engineers, the issue reports are characterized by 19 features (apart from text). We extract 80,000 issue reports, an equal mix of positive and negative examples, and train a Bayesian Network classifier [2], obtaining 73% classification accuracy. Moreover, it reveals that the feature with the highest predictive value is from which physical site the issue was submitted. The general priority feature however, is only ranked 17 out of 19, whereas the submitting team is ranked 12. Our findings confirm a suspicion in the company: the priority set by the issue submitter is indeed a poor predictor of a future code change.
Adversarial Queueing Theory (AQT) [2] analyzes inherent stability characteristics of network topologies. The common FIFO scheduling policy is shown to be susceptible to arrival patterns that lead to unbounded delay despite seemingly innocent arrival rates [3]. Such an event is called instability. The underlying arrival patterns may arise due to misconfiguration, bad luck, or even as a stealthy denial-of-service attack. As such, instability may be deemed a threat to large computer networks as it may lead to persistently high delay and packet loss. However, until recently, little attention has been given to quantifying the threat level under realistic assumptions. In particular, most of the existing AQT literature makes two unrealistic assumptions: infinite buffers and a synchronous network model. Recent work shows that classical AQT instability events appear harmless without these two assumptions [1]. Classical examples are shown to induce a bounded fraction of packet loss, which is small unless the network utilization is high. Unfortunately, the same work also encounters a new class of traffic patterns, which induce serious levels of packet loss even at medium-low network utilization. The actual threat potential of AQT instability for real-world networks remains inconclusive. For instance, topologies studied in the AQT literature are not directly related to real-world topologies;; AQT effects have never been studied on real hardware; and a general bound on the packet loss, e.g., depending only on network size, remains unknown. Further understanding the practical impact of the AQT predictions thus will require the input of both theorists and practitioners.
In the evolution of Android, the Mandatory Access Control (MAC) at the level of Linux kernel is assuming a central role. In the commonly used Discretionary Access Control (DAC), every resource has an owner that defines who can access the resource. In the MAC schema, instead, the access privileges are defined in a global policy, that is enforced by the kernel. Only the system administrator can change the policy, thus preventing many security threats coming from malicious or misbehaving applications. SELinux is the MAC that has been integrated into Android since version 4.3. Nevertheless it is currently used only to protect system resources from threats originating from applications. Much research studied how to integrate SELinux access control checks into more system components. AppPolicyModules [1] allow developers to ship an SELinux module along with the application or to derive an ad-hoc one based on the permissions requested in the application manifest. This improves the protection of the application resources and permits the realization of the classical least privilege principle. The project SeSQLite [2] integrates SELinux into SQLite databases, both at schema and row level. SQLite is widely used in Android even for system components. SeSQLite permits to state that a contact’s phone number is more sensitive than the e-mail, even if they are in the same table. Finally, SEIntentFirewall [3] leverages SELinux to filter the Intents that an application can send to other applications or to system services. These improvements tighten the security of Android, providing better protection for the system. BODY The Android security ecosystem can greatly benefit from a deeper integration of SELinux Mandatory Access Control into system components.
Automated generation of data structures is useful for tasks such as software testing, which explores large spaces of valid test inputs. Efficient exhaustive generation of structures with complex properties remains a significant challenge. Such properties are not only defined with types, e.g. being a tree, but also specific constraints, e.g. the tree is balanced. Prior approaches that rely on constraint solving are expressive for generating complex structures but incur significant performance penalties, while those that rely on explicit construction lack the necessary expressiveness. Recent results affirm that achieving best of both worlds, namely both expressiveness and efficiency, lies in constraint-based generation, thus refuting common wisdom about its inferior performance due to inevitable backtracking [1]. The hypothesis that constructive approaches—which treat generators as building blocks and achieve generation of complex structures with composition— can support an equally expressive definitions while being more efficient, could effectively refute such refutations. We show that complex data structures, such as red-black trees and B trees, and even graphs, can be generated exhaustively and orders of magnitude more efficiently, by constructing enumerators within a specific algebra [2]. Our enumerator algebra allows constructing and composing enumerators of any given set of values, while embedding constraints into the construction itself to allow decomposing data structure properties into simpler ones that ultimately avoid backtracking. Enumerators uniquely number all defined structures to make them directly indexable with numbers. Generation of structures performs indexing, which uses numbering schemes defined by mathematical bijections to remain efficient for any enumerator composition within the algebra.
One of the most critical components of a research publication is a thorough literature review. This is a major issue for CS in particular given the rapid pace of developments, the emphasis on interdisciplinary work, and the frequent opportunities to publish in peer-reviewed forums [2]. The flood of papers from the multiplicity of traditional and nontraditional venues emerging in recent years renders the comprehensive literature review a significant challenge. For example: • Good ideas may be lost in the constantly updated sea of publications; • Recursively searching through references is very time-consuming; and • Reference relevance is highly subjective. Manual reference searching does not scale to the modern deluge of knowledge communication. Many current literature databases attempt to ease the process by hyperlinking references. However, HCI research indicates such solutions fundamentally discourage thorough traversals [1]. Other tools such as BiDO link publications, references, and authors in networks to facilitate navigation [3], but fail to consider metadata regarding how publications span fields or the degree of a particular reference’s relevance. We propose portraying CS research in a comprehensive and extensible ontology to provide a method for better navigating research literature across temporal and field boundaries. Unlike existing solutions, the ontology would connect publications, references, and authors with metadata derived from keywords, field classifications, and textual analyses, where edges between papers and references are weighted by relevance. Such a system promises to facilitate tracking the lineage of publications, identifying influential papers in particular fields, highlighting interdisciplinary work, and exposing less well-researched areas. BODY We need a comprehensive and maintainable ontology of CS research to drive scientific progress despite massive knowledge availability.
Validating experimental results in the field of computer systems is a challenging task, mainly due to the many changes in software and hardware that computational environments go through. Determining if an experiment is reproducible entails two separate tasks: re-executing the experiment and validating the results. Existing reproducibility efforts have focused on the former, envisioning techniques and infrastructures that make it easier to re-execute an experiment. By focusing on the latter and analyzing the validation workflow that an experiment re-executioner goes through, we notice that validating results is done on the basis of experiment design and high-level goals, rather than exact quantitative metrics. Based on this insight, we introduce a declarative format for describing the high-level components of an experiment, as well as a language for specifying generic, testable statements that serve as the basis for validation [1,2]. Our language allows to express and validate statements on top of metrics gathered at runtime. We demonstrate the feasibility of this approach by taking an experiment from an already published article and obtain the corresponding experiment specification. We show that, if we had this specification in the first place, validating the original findings would be an almost entirely automated task. If we contrast this with the current state of our practice, where it takes days or weeks (if successful) to reproduce results, we see how making experiment specifications available as part of a publication or as addendum to experimental results can significantly aid in the validation of computer systems research. Acknowledgements: Work performed under auspices of US DOE by LLNL contract DE-AC5207NA27344 ABS-684863 and by SNL contract DE-AC04-94AL85000. BODY Providing declarative statements that describe the outcome of an experiment can significantly improve the task of validating its results. REFERENCES [1] I. Jimenez, C. Maltzahn, J. Lofstead, A. Moody, K. Mohror, R. Arpaci-Dusseau, and A. ArpaciDusseau, “Tackling the reproducibility problem in storage systems research with declarative experiment specifications,” Proceedings of the 10th parallel data storage workshop, New York, NY, USA: ACM, 2015, pp. 25–30. Available at: http://doi.acm.org/10.1145/2834976.2834979. [2] I. Jimenez, “Aver,” 2015. Available at: https://github.com/ivotron/aver. Volume 4 of Tiny Transactions on Computer Science This content is released under the Creative Commons Attribution-NonCommercial ShareAlike License. Permission to make digital or hard copies of all or part of this work is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. CC BY-NC-SA 3.0: http://creativecommons.org/licenses/by-nc-sa/3.0/.
Software Defined Networking (SDN) is an emerging architecture, which allows networks to be centralized and programmable, aiding researchers in implementing complex network algorithms and policies. While SDN is widely used in LANs, it has also been deployed in WAN environments [2]. Like Tor, Decoy Routing [3] aids users to circumvent censorship on the Internet. While Tor uses onion routing, Decoy Routing uses some designated routers within the censored network, to divert traffic between the blocked destination and the client. Decoy Routing is faster than Tor as the former does away with multiple cryptographic operations. As the traditional routers are not programmable, Decoy Routers are either servers with router software, or routers with proxy servers connected to them. In either case, such routers slow down traffic, nor is it scalable to manage them. We use SDN-based routers for Decoy Routing. In our work, we propose an SDN-based Decoy Routing protocol, without losing any of its Decoy Routing capabilities [1]. Our protocol is equally secure as the original Decoy Routing protocol. Adversaries have used traffic analysis for attacking Tor and Decoy Routing. These routers have used traffic engineering to defend against these attacks. Thus, programmability of routers eliminates the need for servers or proxies, and the controller-based architecture gives us a consistent and centralized view of the Decoy Routing topology in the WAN. Although centralized, the SDN architecture and its implementation are robust. This central view of the network makes traffic engineering scalable [2]. BODY Against existing censorship circumvention protocols, we propose SDN-based Decoy Routing that is faster and resilient to traffic analysis.
A trie data structure stores an ordered set of keys; the branching structure of a trie depends on the lexical properties of its keys independent of the order of insertion. Compact implementations of PATRICIA binary tries called crit-bit trees [2] have just two words of overhead per item stored. A hash array mapped trie (HAMT) [1] has wide fan-out, indexing each tree node using several hashed key bits; each node is compressed using the population count of a bitmap to omit NULL child pointers. Bagwell sketches an un-hashed pure trie variant of HAMT in section 5 but doesn’t eliminate redundant single-child nodes like crit-bit trees. Our contribution, QP tries [3], are similar to crit-bit trees but test 5 bits per indirection instead of 1, using the HAMT bitmap POPCNT trick to keep overhead to at most two 64 bit words per item. QP tries prefetch the child pointer array while calculating which child is next; this reduces indirection latency and increases performance by about 5%. QP tries have variable-sized nodes, so stress memory allocation more than crit-bit tries, but are usually much cheaper in other respects. We created similar implementations of QP tries and crit-bit trees, and benchmarked them using lists of: English words; identifiers in the BIND9 source code; domain names from a university; Alexa top million domain names. We measured average: trie depth; space overhead per item; mutation and search time. BODY Typical QP trie depth is 0.35-0.40 space is 0.5-0.6 time is 0.6-0.8 of equivalent crit-bit tree.
Open Innovation (OI) has attracted scholarly interest from a wide range of disciplines since introduced by Chesbrough, i.e. ”a paradigm that assumes that firms can and should use external ideas as well as internal ideas, and internal and external paths to market, as they look to advance their technology”. However, OI remains unexplored for software engineering (SE), although widespread in practice through Open Source Software (OSS). We studied the relation between SE and OI and in particular how OSS tools impact on software-intensive organization’s innovation capability. We surveyed the literature on SE and OI and found that studies conclude that start-ups have higher tendency to opt for OI compared to established companies. The literature also suggests that firms assimilating external knowledge into their internal R&D activities, have higher likelihood of gaining financial advantages. In a case study, we observed how OSS tools Jenkins and Gerrit enabled open innovation. We mined software commits to identify major contributors, found them be affiliated to Sony Mobile, contacted five of them for interviews about their and their employer’s principles and practices with respect to OI and tools, which they gave a consistent view of. Our findings indicate that the company’s transition to OI was part of a major paradigm shift towards OSS, while the adoption of open tools was driven bottom up by engineers with support from management. By adopting OI, Sony Mobile achieved freed-up developers’ time, better quality assurance, inner source initiatives, flexible development environment, faster releases and upgrades. Particularly, the introduction of a test framework was proposed by Sony Mobile but implemented by other contributors. However, the benefits are gained through investing significant attention and resources to the OSS community in terms of technical contributions and leadership. (Less)
Following up on previous analyses [1], we examine the geospatial and thematic data in GeoNames [2]. It is the largest freely available gazetteer – a geographical thesaurus – with a worldwide coverage. One measure of interestingness for a country can be its number of populated places represented as pages in Wikipedia. In GeoNames, on average only 20% of populated places, i.e., cities, towns, villages, etc. have a link to Wikipedia. This clearly shows that not all places are created equal in terms of interestingness. Of the multitude of interesting lessons, we pick one that matches the small nature of this paper. For simplicity, we define a ‘small’ country as one which has a population that is within the first quartile of all global population numbers (1.76×105 inhabitants). For all 63 identified small countries, we compare populated places with links to Wikipedia to the remaining countries. We hypothesise that small countries may show a significant higher percentage than large ones in their linkage. First, there are not that many populated places and they carry a higher significance or interest. Second, for larger countries, more very small places may have been added to GeoNames. Of course this argument is about relative coverage; absolute coverage of small countries is less than 1% of populated places or Wikipedia links on a world scale. This finding can inform reasoning about biases in information density and coverage on a world scale, for example for small or developing countries. BODY Places in small countries are three times as likely to be linked to Wikipedia with 41% of coverage compared to 13% for larger countries.
There is pressure for more and better control over personal data in cloud environments. Cloud tenants are increasingly burdened with data management obligations [3], and therefore require assurance of proper data handling throughout the whole-system. We believe a simple technical mechanism can contribute to such guarantees. Decentralised Information Flow Control (DIFC) is a data-centric mandatory access control scheme that guarantees non-interference across security contexts, based on lattices defined by secrecy and integrity properties. Every data flow is continuously monitored to guarantee the enforcement of (decentrally) specified policies. We demonstrated that DIFC can constrain data flows throughout an entire cloud platform [2]. A simple DIFC constraint confines the flow of data within a security context. Simple constraints can guarantee complex workflow, for example to ensure that data is anonymised before crossing security contexts for disclosure to third parties. We considered the enforcement of some cloud legal requirements [3]. We showed that information captured during DIFC enforcement allows the generation of a provenance-like directed graph representing whole-system data exchange [1]. This coupling of policy enforcement with the capture of audit data allows system “noise” to be removed, so that only the information relevant to the policies in place is recorded. These graphs can be queried to reveal whether system behaviour accords with particular data management obligations. For instance, from data gathered at run-time, we show it can be ascertained that there is no path in which personal data was transferred to another tenant without being anonymised [1]. BODY Complex policy can be built upon simple primitives enforced on every data flow. Enforcement data can be captured to demonstrate compliance.
Information in digital forms is shared over the Internet between users belonging to different organisations. Such information differs in value based on the nature of the application. Eg. patient medical reports have high value while a book shared for translation from one language to another, or an insurance application form have less value. In scenarios such as rural business process outsourcing, users are geographically distributed throughout the country in cities, towns and villages [1]. The network may be intermittent due to physical link failures or administrative policies which disallow external access during certain periods of time. Many users employ mobile data networks resulting in intermittent connections. With traditional server-based access control, users in such scenarios would not be able to access information when the network is disconnected. We propose an access control system that allows continuous access based on the principle of good-enough security. This principle states that “everything should be made as secure as necessary, but not securer” [2]. Our approach to achieve good-enough security is to decompose objects into smaller objects (doblets) such that the value of each doblet is low, each user is assigned only some doblets, and permissions are bound to the doblet before sharing. Authorisation is done using object-bound permissions during network disconnection. Our access control model extends the role-based access control (RBAC) model [3] to support simplified, dynamic, network-aware permissions along with the ease of administration. BODY Network-aware access control systems can provide good-enough security for sharing information with low value over intermittent network.
The Long-Term Evolution (LTE) architecture is composed by interconnected hardware devices which provide a set of services to the final users, like handling the handoff between different base stations and prioritizing packet flows of premium users. Each device provides one or more of these services, and each service needs the state of the users’ devices in order to be provided. Therefore this state is replicated in several elements of the architecture, and a lot of traffic among the network devices is needed in order to keep its consistency every time an update is needed. This issue is called signaling storm. In order to solve the problem, we need to reduce the replication of the state of users’ devices in the architecture. Our initial analysis of the signals behind the signaling storm has shown that this is possible by refactoring the elements in the LTE core [1]. We are studying the application of Network Function Virtualization and Software-Defined Networking on the LTE network in order to practically realize this refactoring. Our aim is to move most of the functionalities provided in a single logical controller, which instruct the forwarding devices accordingly to its decisions: in this way the replication of the state is limited to the physical elements in which the controller is deployed. We are also analyzing the impact of the publish-subscribe paradigm for keeping consistency of the replicated states in order to overcome the issues of the current request-response mechanism. BODY Refactoring LTE networks opens a gold mine of research problems and provides insights for laying the cornerstone for modular 5G networks.
New data sources are appearing every day. In data integration, one often merges two sources by first computing similarity scores between items, and then selecting a 1-to-1 alignment of maximal weight, e.g. via the Hungarian algorithm for bipartite matching. Often, however, we need to operate on n > 2 sources and go beyond strict 1-to-1 alignments. Instead, we may consider arbitrary weighted links indicating possible identity, as well as one or more groups of sets of items indicating likely distinctness: Within each group of sets, two items in different sets are assumed distinct with some weight. Bipartite matching can then be reduced to the special case of assuming a node is pairwise distinct from all other nodes on the same side. However, this formalism flexibly allows for capturing many other scenarios, and distinctness needn’t be a hard constraint. Making this identity and distinctness evidence consistent, under the standard assumption of transitivity for identity, is NP-hard as well as APX-hard [3]. Still, one can obtain good solutions (with a logarithmic approximation guarantee) using graph flow techniques based on integer linear programming and rounding [3]. These allow us to cut links so that sufficiently distinct nodes are no longer connected. It turns out that this has practical applications in a number of areas. These include combining several different sources into a single knowledge base [2], finding inconsistent links in the Web of Linked Data [1], and turning the different language-specific editions of Wikipedia into a large integrated multilingual lexicon [3]. BODY Reconciling identity vs. distinctness of items from different sources can be NPhard, but approximations enable flexible data integration.
Issue management, a central part of software maintenance, requires much effort for complex software systems. The continuous inflow of issue reports makes it hard for developers to stay on top of the situation, and the threatening information overload makes activities such as duplicate management, Issue Assignment (IA), and Change Impact Analysis (CIA) tedious and error-prone. Still, most practitioners work with tools that act as little more than issue containers. Machine Learning encompasses approaches that identify patterns or make predictions based on empirical data. While humans have limited ability to work with big data, ML instead tends to improve the more training data that is available. Consequently, we argue that the challenge of information overload in issue management appears to be particularly suitable for ML-based tool support. While others have initially explored the area, we develop two ML-based tools, and evaluate them in proprietary software engineering contexts. We replicated [1] for five projects in two companies, and our automated IA obtains an accuracy matching the current manual processes. Thus, as our solution delivers instantaneous IA, an organization can potentially save considerable analysis effort. Moreover, for the most comprehensive of the five projects, we implemented automated CIA in the tool ImpRec [3]. We evaluated the tool in a longitudinal in situ study, i.e., deployment in two development teams in industry. Based on log analysis and complementary interviews using the QUPER model [2] for utility assessment, we conclude that ImpRec offered helpful support in the CIA task. (Less)
