Code cloning is a common practice in software development, but it poses significant security risks by propagating vulnerabilities across cloned segments. To address this challenge, we introduce SRCVUL, a scalable, precise detection approach that combines program slicing with Locality-Sensitive Hashing to identify vulnerable code clones and recommend patches. SRCVUL builds a database of vulnerability-related slices by analyzing known vulnerable programs and their corresponding patches, indexing each slice's unique structural characteristics as a vulnerability slicing vector. During clone detection, SRCVUL efficiently matches slicing vectors from target programs with those in the database, recommending patches upon identifying similarities. Our evaluation of SRCVUL against three state-of-the-art vulnerable clone detectors demonstrates its accuracy, efficiency, and scalability, achieving 91 % precision and 75 % recall on established vulnerability databases and open-source repositories. These results highlight SRCVUL's effectiveness in detecting complex vulnerability patterns across diverse codebases.

Visualizations are useful in dealing with complex software systems, especially in maintenance and evolution tasks. Software visualization tools can help reduce the cognitive burden on practitioners when trying to understand these systems. However, a major challenge in designing new visualization techniques and tools is evaluating their effectiveness for specific tasks and users. If a visualization tool is not effective for practitioners, they are unlikely to adopt it. Existing evaluation frameworks for visualizations mainly focus on expressiveness, which refers to the ability of the visualization to show all necessary information. However, evaluating the effectiveness of visualizations is an open research problem, especially in terms of quantifying it. To address this problem, we propose a multi-dimensional evaluation framework that focuses on evaluating visualizations in terms of their qualitative, quantitative, and cognitive aspects. The framework includes seven main dimensions and twenty-eight features, with the effectiveness dimension being further subdivided into four sub-dimensions. We validate our framework by using it to evaluate a number of software visualization tools. This validation demonstrates that the framework can be applied to design and evaluate new software visualization techniques and tools.

Model-Driven Software Engineering relies both on domain-expertise as well as software engineering expertise to fully grasp its representative power in modeling complex systems. As is typical in the development of any system, modelers face similar challenges to classic software developers, whether with general modeling concepts or specific features of existing tools such as the Eclipse Modeling Framework. In this work, we aim to understand the issues that modelers face by analyzing discussions from Eclipse's modeling tool forums, MATLAB Central, and Stack Overflow. By performing a qualitative study using an open-coding process, we created a taxonomy of common issues faced by modelers. We considered both difficulty experienced when modeling a system and issues faced using existing modeling tools; these form the basis of our two research questions. Based on the taxonomy, we propose nine suggestions and enhancements, in three overarching groups, to improve the experience of modelers, at all levels of experience.

Model-Driven Software Engineering relies both on domain-expertise as well as software engineering expertise to fully grasp its representative power in modeling complex systems. As is typical in the development of any system, modelers face similar challenges to classic software developers, whether with general modeling concepts or specific features of existing tools such as the Eclipse Modeling Framework. In this work, we aim to understand the issues that modelers face by analyzing discussions from Eclipse's modeling tool forums, MATLAB Central, and Stack Overflow. By performing a qualitative study using an open-coding process, we created a taxonomy of common issues faced by modelers. We considered both difficulty experienced when modeling a system and issues faced using existing modeling tools; these form the basis of our two research questions. Based on the taxonomy, we propose nine suggestions and enhancements, in three overarching groups, to improve the experience of modelers, at all levels of experience.

The capabilities of Android applications have been increasing along with the advancements of the underlying mobile devices. This has allowed developers to include features that require more resources and provide more complex functionality inside mobile apps. An example of this is the usage of Augmented Reality (AR) in mobile applications. AR allows developers to experiment with new immersive experiences for their users in a wide variety of application areas. AR content is often visual and it represents a challenge for users with visual impairments, especially if these features are core to the underlying application. In this paper, we present a preliminary study aimed at investigating accessibility of AR functionalities of mobile applications that are not specifically designed for users with visual impairments (i.e., applications of which these users could be part of the intended audience, but they are not the specific audience). To accomplish this, we conducted a case study with 49 individuals without visual impairment and 5 individuals that are visually impaired, who used 5 applications with AR features. Our results demonstrate that the analyzed apps lack accessibility mechanisms within their AR functionalities.

Modeling & Simulation has played an essential role in supporting the decision-making activities of policymakers for COVID-19. However, a proliferation of models has been noted in the literature, and new models are only more likely to emerge given the shift to long-term management of the disease and the call for highly tailored tools. Having a multiplicity of models can have benefits, for example when contributing to ensembles of models. However, if each model is created from scratch, there is significant redundancy in efforts hence time inefficiency and a heightened risk of bugs. Our study examines the naturally occurring practices of modelers who wrote COVID-19 models in NetLogo to identify redundancy in code and thus suggest reusable ‘building blocks’ that would speed-up the process of model development as well as improving code quality. Based on 28 models, we identified five themes and discussed their transformation into potential building blocks for simulation.

Mutation testing has been widely used to assess the fault-detection effectiveness of a test suite, as well as to guide test case generation or prioritization. Empirical studies have shown that, while mutants are generally representative of real faults, an effective application of mutation testing requires “traditional” operators designed for programming languages to be augmented with operators specific to an application domain and/or technology. The case for Android apps is not an exception. Therefore, in this paper we describe the process we followed to create (i) a taxonomy of mutation operations and, (ii) two tools, MDroid+ and MutAPK for mutant generation of Android apps. To this end, we systematically devise a taxonomy of 262 types of Android faults grouped in 14 categories by manually analyzing 2,023 software artifacts from different sources ( e.g., bug reports, commits). Then, we identified a set of 38 mutation operators, and implemented them in two tools, the first enabling mutant generation at the source code level, and the second designed to perform mutations at APK level. The rationale for having a dual-approach is based on the fact that source code is not always available when conducting mutation testing. Thus, mutation testing for APKs enables new scenarios in which researchers/practitioners only have access to APK files. The taxonomy, proposed operators, and tools have been evaluated in terms of the number of non-compilable, trivial, equivalent, and duplicate mutants generated and their capacity to represent real faults in Android apps as compared to other well-known mutation tools.

Program understanding plays a pivotal role in software maintenance and evolution: a deep understanding of code is the stepping stone for most software-related activities, such as bug fixing or testing. Being able to measure the understandability of a piece of code might help in estimating the effort required for a maintenance activity, in comparing the quality of alternative implementations, or even in predicting bugs. Unfortunately, there are no existing metrics specifically designed to assess the understandability of a given code snippet. In this paper, we perform a first step in this direction, by studying the extent to which several types of metrics computed on code, documentation, and developers correlate with code understandability. To perform such an investigation we ran a study with 46 participants who were asked to understand eight code snippets each. We collected a total of 324 evaluations aiming at assessing the perceived understandability, the actual level of understanding, and the time needed to understand a code snippet. Our results demonstrate that none of the (existing and new) metrics we considered is able to capture code understandability, not even the ones assumed to assess quality attributes strongly related with it, such as code readability and complexity.

Dead code is a bad smell and it appears to be widespread in open-source and commercial software systems. Surprisingly, dead code has received very little empirical attention from the software engineering research community. In this paper, we present a multi-study investigation with an overarching goal to study, from the perspective of researchers and developers, when and why developers introduce dead code, how they perceive and cope with it, and whether dead code is harmful. To this end, we conducted semi-structured interviews with software professionals and four experiments at the University of Basilicata and the College of William & Mary. The results suggest that it is worth studying dead code not only in the maintenance and evolution phases, where our results suggest that dead code is harmful, but also in the design and implementation phases. Our results motivate future work to develop techniques for detecting and removing dead code and suggest that developers should avoid this smell.

Many guidelines have been developed for simulations in general or for agent-based models which support artificial societies. When applying such guidelines to examine existing practices, assessment studies are limited by the artifacts released by modelers. Although code is the final product defining an artificial society, 90% of the code produced is not released hence previous assessments necessarily focused on higher-level items such as conceptual design or validation. We address this gap by collecting 338 artificial societies from two hosting platforms, CoMSES/OpenABM and GitHub. An innovation of our approach is the use of software engineering techniques to automatically examine the models with respect to items such as commenting the code, using libraries, or dividing code into functions. We found that developers of artificial societies code the decision-making of their agents from scratch in every model, despite the existence of several libraries that could be used as building blocks.

Universal design principles aim to improve accessibility by ensuring product designs consider all users, including those with certain disabilities (e.g., visual impairments). In the case of mobile apps, accessibility is mostly provided by existing features in mobile devices, like TalkBack on Android that reads information to users. However, it is not clear to what extent developers actually implement universal design principles or utilize these technologies to support accessibility of their applications. By performing a mining-based pilot study, we observed developers seldom use Accessibility APIs and there is a limited usage of assistive descriptions. Then, we focused on understanding the perspective of developers through an investigation of posts from StackOverflow. We identified the aspects of accessibility that developers implemented as well as experienced difficulty (or lack of understanding). We performed a formal open-coding of 366 discussions threads with multi-author agreement to create a taxonomy regarding the aspects discussed by developers with respect to accessibility in Android. From the qualitative analysis, we distilled lessons to guide further research and actions in aiding developers with supporting users that require assistive features.

Optimizing mobile apps early on in the development cycle is supposed to be a key strategy for obtaining higher user rankings, more downloads, and higher retention. However, little research has been done with respect to identifying and understanding actual optimization practices performed by developers. In this paper, we present the results of three empirical studies aimed at investigating practices of Android developers towards improving apps performance, by means of micro-optimizations.

Techniques to automatically identify the stereotypes of different software artifacts (e.g., classes, methods, commits) were previously presented. Those approaches utilized the techniques to support comprehension of software artifacts, but those stereotype-based approaches were not designed to consider the structure and purpose of unit tests, which are widely used in software development to increase the quality of source code. Moreover, unit tests are different than production code, since they are designed and written by following different principles and workflows. In this paper, we present a novel approach, called TeStereo, for automated tagging of methods in unit tests. The tagging is based on an original catalog of stereotypes that we have designed to improve the comprehension and navigation of unit tests in a large test suite. The stereotype tags are automatically selected by using static control-flow, data-flow, and API call based analyses. To evaluate the benefits of the stereotypes and the tagging reports, we conducted a study with 46 students and another survey with 25 Apache developers to (i) validate the accuracy of the inferred stereotypes, (ii) measure the usefulness of the stereotypes when writing/understanding unit tests, and (iii) collect feedback on the usefulness of the generated tagging reports.

Software licenses dictate how source code or binaries can be modified, reused, and redistributed. In the case of open source projects, software licenses generally fit into two main categories, permissive and restrictive, depending on the degree to which they allow redistribution or modification under licenses different from the original one(s). Developers and organizations can also modify existing licenses, creating custom licenses with specific permissive/restrictive terms. Having such a variety of software licenses can create confusion among software developers, and can easily result in the introduction of licensing bugs, not necessarily limited to well-known license incompatibilities. In this work, we report a study aimed at characterizing licensing bugs by (i) building a catalog categorizing the types of licensing bugs developers and other stakeholders face, and (ii) understanding the implications licensing bugs have on the software projects they affect. The presented study is the result of the manual analysis of 1,200 discussions related to licensing bugs carried out in issue trackers and in five legal mailing lists of open source communities. Our findings uncover new types of licensing bugs not addressed in prior literature, and a detailed assessment of their implications.

Mutation testing has shown great promise in assessing the effectiveness of test suites while exhibiting additional applications to test-case generation, selection, and prioritization. Traditional mutation testing typically utilizes a set of simple language specific source code transformations, called operators, to introduce faults. However, empirical studies have shown that for mutation testing to be most effective, these simple operators must be augmented with operators specific to the domain of the software under test. One challenging software domain for the application of mutation testing is that of mobile apps. While mobile devices and accompanying apps have become a mainstay of modern computing, the frameworks and patterns utilized in their development make testing and verification particularly difficult. As a step toward helping to measure and ensure the effectiveness of mobile testing practices, we introduce MDroid+, an automated framework for mutation testing of Android apps. MDroid+ includes 38 mutation operators from ten empirically derived types of Android faults and has been applied to generate over 8,000 mutants for more than 50 apps.

Unique challenges arise when testing mobile applications due to their prevailing event-driven nature and complex contextual features (e.g. sensors, notifications). Current automated input generation approaches for Android apps are typically not practical for developers to use due to required instrumentation or platform dependence and generally do not effectively exercise contextual features. To better support developers in mobile testing tasks, in this demo we present a novel, automated tool called CRASHSCOPE. This tool explores a given Android app using systematic input generation, according to several strategies informed by static and dynamic analyses, with the intrinsic goal of triggering crashes. When a crash is detected, CRASHSCOPE generates an augmented crash report containing screenshots, detailed crash reproduction steps, the captured exception stack trace, and a fully replayable script that automatically reproduces the crash on a target device(s). Results of preliminary studies show that CRASHSCOPE is able to uncover about as many crashes as other state of the art tools, while providing detailed useful crash reports and test scripts to developers. Website: www.android-dev-tools.com/crashscope-home Video url: https://youtu.be/ii6S1JF6xDw.

Optimizing mobile apps early on in the development cycle is supposed to be a key strategy for obtaining higher user rankings, more downloads, and higher retention. In fact, mobile platform designers publish specific guidelines, and tools aimed at optimizing apps. However, little research has been done with respect to identifying and understanding actual optimization practices performed by developers. In this paper, we present the results of three empirical studies aimed at investigating practices of Android developers towards improving the performance of their apps, by means of micro-optimizations. We mined change histories of 3513 apps to identify the most frequent micro-optimization opportunities in 297K+ snapshots and to understand if (and when) developers implement these optimizations. Then, we performed an in-depth analysis into whether implementing micro-optimizations can help reduce memory/CPU usage. Finally, we conducted a survey with 389 open-source developers to understand how they use micro-optimizations to improve the performance of Android apps. Surprisingly, our results indicate that developers rarely implement micro-optimizations. Also, the impact of the analyzed micro optimization on CPU/memory consumption is negligible in most of the cases. Finally, the results from the survey shed some light into why this happens as well as upon which practices developers rely upon. (C) 2017 Elsevier Inc. All rights reserved.

Open source software licenses determine, from a legal point of view, under which conditions software can be integrated and redistributed. The reason why developers of a project adopt (or change) a license may depend on various factors, e.g., the need for ensuring compatibility with certain third-party components, the perspective towards redistribution or commercialization of the software, or the need for protecting against somebody else's commercial usage of the software. This paper reports a large empirical study aimed at quantitatively and qualitatively investigating when and why developers adopt or change software licenses. Specifically, we first identify license changes in 1,731,828 commits, representing the entire history of 16,221 Java projects hosted on GitHub. Then, to understand the rationale of license changes, we perform a qualitative analysis on 1,160 projects written in seven different programming languages, namely C, C++, C#, Java, Javascript, Python, and Ruby--following an open coding approach inspired by grounded theory--on commit messages and issue tracker discussions concerning licensing topics, and whenever possible, try to build traceability links between discussions and changes. On one hand, our results highlight how, in different contexts, license adoption or changes can be triggered by various reasons. On the other hand, the results also highlight a lack of traceability of when and why licensing changes are made. This can be a major concern, because a change in the license of a system can negatively impact those that reuse it. In conclusion, results of the study trigger the need for better tool support in guiding developers in choosing/changing licenses and in keeping track of the rationale of license changes.

Mutation testing has been widely used to assess the fault-detection effectiveness of a test suite, as well as to guide test case generation or prioritization. Empirical studies have shown that, while mutants are generally representative of real faults, an effective application of mutation testing requires "traditional" operators designed for programming languages to be augmented with operators specific to an application domain and/or technology. This paper proposes MDroid+, a framework for effective mutation testing of Android apps. First, we systematically devise a taxonomy of 262 types of Android faults grouped in 14 categories by manually analyzing 2,023 so ware artifacts from different sources (e.g., bug reports, commits). Then, we identified a set of 38 mutation operators, and implemented an infrastructure to automatically seed mutations in Android apps with 35 of the identified operators. The taxonomy and the proposed operators have been evaluated in terms of stillborn/trivial mutants generated as compared to well know mutation tools, and their capacity to represent real faults in Android apps

From a legal perspective, software licenses govern the redistribution, reuse, and modification of software as both source and binary code. Free and Open Source Software (FOSS) licenses vary in the degree to which they are permissive or restrictive in allowing redistribution or modification under licenses different from the original one(s). In certain cases, developers may modify the license by appending to it an exception to specifically allow reuse or modification under a particular condition. These exceptions are an important factor to consider for license compliance analysis since they modify the standard (and widely understood) terms of the original license. In this work, we first perform a large-scale empirical study on the change history of over 51K FOSS systems aimed at quantitatively investigating the prevalence of known license exceptions and identifying new ones. Subsequently, we performed a study on the detection of license exceptions by relying on machine learning. We evaluated the license exception classification with four different supervised learners and sensitivity analysis. Finally, we present a categorization of license exceptions and explain their implications.