MAVIS: A Visualization Tool for Cohesion-based Bad Smell Inspection

•

0 likes•577 views

This document introduces MAVIS, a visualization tool to assist with inspecting cohesion-based code smells detected by bad smell detection tools. It summarizes an empirical study that found many detected smells were false positives and manual inspection was required. MAVIS visualizes metrics to expose smell symptoms and links the visualization to code to aid inspection. Two case studies found MAVIS reduced inspection effort for 1/3 of candidates.

Technology

MAVIS: A Visualization Tool
for Cohesion-based Bad Smell Inspection

Lee Wei Mar (馬立偉), Ming Lun Lee (李明倫)
and Hewijin Christine Jiau (焦惠津)

Institute of Computer and Communication Engineering, NCKU
國立成功大學電腦與通信工程研究所

Speaker: Lee Wei Mar (馬立偉)
Date: 07/08/2011

Outline

• Introduction
• Empirical Investigation
• MAVIS Visualization Tool
• Evaluation
• Conclusion

2

Introduction

• Cohesion-based Bad Smells are structural deficiencies that violet “high
cohesion and low coupling principle”
– Feature Envy
– God Class
– Long Method

• Cohesion-based bad smells are common refactoring targets during
software evolution

• Many bad smell detection (BSD) tools have been developed for suggesting
cohesion-based bad smell candidates
– The judgment of candidates still relies on developers’ expertise

3

Empirical Investigation

• Utilizing two BSD tool, InCode and JDeodorant, for bad smell removal

• Conduction steps
1. Use BSD tool in finding Feature Envy candidates on a in Lab project: CARE
2. For each feature envy candidates, a developer inspect source code to answer
a. Is it an Feature Envy?
b. If it is a Feature Envy, can it be resolved by Move Method (MM)?

• The data from two studies are analyzed

4

Empirical Investigation (cont.)

• The data from two studies are analyzed

• Observations

5

Empirical Investigation (cont.)

• The data from two studies are analyzed

• Observations
– A large number of bad smell candidates are detected by BSD tools

6

MAVIS Visualization Tool

• MAVIS (Metric Abstraction VISualization) aims to
– provide visualization for inspecting cohesion-based bad smell
candidates returned by BSD tools

– visualize metric abstractions, the linkage between software code
structure and software metrics, for exposing the bad smell symptoms

– link visualization to corresponding code for locating symptomatic code
during code inspection

10

MAVIS Visualization Tool

• Data accessing metric abstractions
• ATLD: Access to local data
• ATFD: Access to foreign data

• Message passing metric abstractions
• LMP: Local message passing
• MPC: Message passing coupling

12

Evaluation (cont.)

• Inspecting candidates with MAVIS
– Subjects
• HSQLDB / 199 KLOC
• JEdit / 133 KLOC

– Utilized BSD tool
• JDeodorant

15

Evaluation (cont.)

• Half of the candidates are false
positives

16

Evaluation (cont.)

• Half of the candidates are false
positives

• 1/3 of the candidates can be directly
judged using MAVIS visualization

• The code inspection effort for these
candidates are eliminated

17

Conclusion

• Cohesion-based bad smell removal is a human intensive activity that
requires supports for decision making

• MAVIS is proposed for assisting cohesion-based bad smell inspection
– visualizing metric sensitive structural information
– navigating code through metric abstractions

• Two case studies are performed to confirm the effectiveness of MAVIS
– 1/3 of the source code inspection effort are reduced by using MAVIS

18

Thank You
Lee Wei Mar (馬立偉)
lwmar@nature.ee.ncku.edu.tw
Database & Software Engineering Lab, NCKU
國立成功大學
資料庫暨軟體工程實驗室

The document presents a multi-objective approach to automate software refactoring using evolutionary algorithms. It formulates refactoring as a multi-objective optimization problem to improve code quality, preserve semantics, and maximize reuse of past development history. An evaluation on two open source projects shows the approach corrects most defects while maintaining high refactoring precision compared to existing techniques. Future work includes leveraging refactoring histories from multiple systems and improving context-based similarity measures.

Do They Really Smell Bad? A Study on Developers' Perception of Bad Code Smells

Fabio Palomba

In the last decade several catalogues have been defined to characterize bad code smells, i.e., symptoms of poor design and implementation choices. On top of such catalogues, researchers have defined methods and tools to automatically detect and/or remove bad smells. Nevertheless, there is an ongoing debate regarding the extent to which developers perceive bad smells as serious design problems. Indeed, there seems to be a gap between theory and practice, i.e., what is believed to be a problem (theory) and what is actually a problem (practice). This paper presents a study aimed at providing empirical evidence on how developers perceive bad smells. In this study, we showed to developers code entities—belonging to three systems— affected and not by bad smells, and we asked them to indicate whether the code contains a potential design problem, and if any, the nature and severity of the problem. The study involved both original developers from the three projects and outsiders, namely industrial developers and Master students. The results provide insights on characteristics of bad smells not yet explored sufficiently. Also, our findings could guide future research on approaches for the detection and removal of bad smells.

A Multi-Objective Refactoring Approach to Introduce Design Patterns and Fix A...

Ali Ouni

This document presents a multi-objective search-based software engineering approach to recommend refactorings that introduce design patterns, fix anti-patterns, and improve software quality attributes. The approach uses NSGA-II genetic algorithm to evolve refactoring solutions. An empirical evaluation on 4 open-source Java systems shows the approach outperforms existing techniques in fixing anti-patterns and introducing design patterns while improving quality. Future work includes expanding the types of patterns addressed and developing interactive refactoring support.

Evaluating SZZ Implementations Through a Developer-informed Oracle (ICSE 2021)

Giovanni Rosa

The SZZ algorithm for identifying bug-inducing changes has been widely used to evaluate defect prediction techniques and to empirically investigate when, how, and by whom bugs are introduced. Over the years, researchers have proposed several heuristics to improve the SZZ accuracy, providing various implementations of SZZ. However, fairly evaluating those implementations on a reliable oracle is an open problem: SZZ evaluations usually rely on (i) the manual analysis of the SZZ output to classify the identified bug-inducing commits as true or false positives; or (ii) a golden set linking bug-fixing and bug-inducing commits. In both cases, these manual evaluations are performed by researchers with limited knowledge of the studied subject systems. Ideally, there should be a golden set created by the original developers of the studied systems. We propose a methodology to build a "developer-informed" oracle for the evaluation of SZZ variants. We use Natural Language Processing (NLP) to identify bug-fixing commits in which developers explicitly reference the commit(s) that introduced a fixed bug. This was followed by a manual filtering step aimed at ensuring the quality and accuracy of the oracle. Once built, we used the oracle to evaluate several variants of the SZZ algorithm in terms of their accuracy. Our evaluation helped us to distill a set of lessons learned to further improve the SZZ algorithm. Giovanni Rosa (University of Molise), Luca Pascarella (Università della Svizzera italiana), Simone Scalabrino (University of Molise), Rosalia Tufano (Università della Svizzera Italiana), Gabriele Bavota (Software Institute, USI Università della Svizzera italiana), Michele Lanza (Software Institute, USI Università della Svizzera italiana), Rocco Oliveto (University of Molise), * Live Presentation: https://www.youtube.com/watch?v=ZiuAaysj_Sk * IEEE Digital Library: https://www.computer.org/csdl/proceedings-article/icse/2021/029600a436/1sEXo2zV4OI

Detection of Seed Methods for Quantification of Feature Confinement

Andrzej Olszak

This document proposes an approach to automatically detect "seed methods" for quantifying feature confinement in object-oriented programs. Seed methods are starting points of feature control flows. The approach ranks methods based on popular names and size of static control flow slices. It was evaluated on 14 Java programs against ground truth slices, finding 79% intersection on average. The approach was also applied to track how feature confinement in Checkstyle evolved over 10 years and 27 releases, despite a doubling of lines of code.

Smells Like Teen Spirit: Improving Bug Prediction Performance using the Inten...

Fabio Palomba

Code smells are symptoms of poor design and implementation choices. Previous studies empirically assessed the impact of smells on code quality and clearly indicate their negative impact on maintainability, including a higher bug-proneness of components affected by code smells. In this paper we capture previous findings on bug-proneness to build a specialized bug prediction model for smelly classes. Specifically, we evaluate the contribution of a measure of the severity of code smells (i.e., code smell intensity) by adding it to existing bug prediction models and comparing the results of the new model against the baseline model. Results indicate that the accuracy of a bug prediction model increases by adding the code smell intensity as predictor. We also evaluate the actual gain provided by the intensity index with respect to the other metrics in the model, including the ones used to compute the code smell intensity. We observe that the intensity index is much more important as compared to other metrics used for predicting the buggyness of smelly classes.

PhD Symposium 2014

Fabio Palomba

The document discusses detecting and removing bad code smells from source code. It describes a tool called HIST that uses change history information to detect code smells. The tool extracts change history from version control logs, analyzes the code changes, and uses the information to detect five types of code smells: divergent change, shotgun surgery, parallel inheritance, blob, and feature envy. An evaluation of HIST shows it improves on static code analysis techniques in detecting these code smells, with F-measure scores for detection ranging from 64-92% compared to 0-48% for static analysis alone. The document concludes by discussing some of the researcher's ongoing and future work related to code smells and refactoring.

Icsm20.ppt

Yann-Gaël Guéhéneuc

This document summarizes the findings of a tertiary review on code smells and refactoring. It analyzed 40 secondary studies on the topic. Key findings include: 1) Common refactoring topics investigated were opportunities, techniques and tools, while common smell topics were detection, descriptions and support tools. 2) Popular smell detection tools were CCFinder and Jdeodorant, while there were fewer refactoring tools. 3) The relationship between smells and refactoring is complex, as not all smells require refactoring and refactoring can sometimes negatively impact quality. The review identified implications for practitioners, researchers and educators, as well as open issues in the field.

The document proposes a methodology called PropER-Doc to assist API providers in collecting and recommending proper code examples for documentation. PropER-Doc uses code search engines to locate code that potentially uses a given API element, and then applies recommendation assistants to help inspect, annotate, and select candidate examples according to their appropriateness and significance of API usage. The methodology aims to reduce the manual effort required of API providers for code example construction.

KCB101 storyboard MK AN

ash2007080

A Scripting Environment for Refactoring Process Execution

立偉馬

This document introduces Refactoring Commando, a scripting environment for assisting the execution of refactoring processes. It provides a unified command line interface and APIs to cascade different refactoring tools. Refactoring Commando allows batching of repetitive tasks and reusing developed procedures. An example usage scenario demonstrates how it can be used to detect and remove feature envy in a project by finding affected methods, inspecting them with MAVIS, constructing a refactoring plan, and previewing and applying changes.

Cdma

sanjib_agrawala

This document describes the design of a DS-CDMA transmitter using VHDL and an FPGA. It discusses the design of the transmitter's key components like the PN code generator and BPSK modulator. The PN code generator uses a 16-stage linear feedback shift register with a specific feedback polynomial to generate codes. The transmitter blocks were designed separately in VHDL and then combined and implemented on an FPGA board. The transmitter is capable of transmitting data at rates up to 2 Mbps using a 40 MHz carrier frequency.

USING FINANCIAL STATEMENTS INFORMATION

Doulat panah

This document discusses financial statement analysis and the time value of money. It covers: - Reasons for analyzing financial statements like performance evaluation and checking projections. - Benchmarking methods like comparing to peers or historical trends. - Calculating future value over time using compound interest formulas for single deposits or regular cash flows. - How present value considers the time value of money by discounting future cash flows.

Online Marketing in Singapore - Hipponetwork

HippoNetwork.com

Yields of mortgage backed securities

Ali Ünal

Mortgage-backed securities (MBS) are created when mortgages are pooled together and sold as securities. There are two main types of MBS: mortgage pass-through securities, where payments are passed through to investors, and mortgage-backed derivatives like CMOs that create multiple classes of securities. Government agencies like Fannie Mae and Freddie Mac purchase mortgages from lenders and pool them to issue MBS to expand the secondary mortgage market. Yields on MBS can be calculated in different ways, such as monthly cash flow yield based on interest and principal payments, or bond equivalent yield which compares the yield to a bond of similar maturity.

Social media

Mary Valles

The document provides a list of 22 social media tools and marketing examples of how major companies are using each tool, such as blogs, social networks, online video, and more. It encourages companies to consider all the tools and get started with social media marketing right away instead of overanalyzing. Some comments discuss starting with objectives and strategy before tools, and that the document is not truly a social media marketing plan but rather a list of tools and examples.

Immunitytheory

Rakesh S

This document provides an overview of immunology and the immune system. It defines key terms like immunity, immune system, and immunology. It describes the basic functions of the immune system, which are to protect the body from microbes, tumors, and remove dead or abnormal cells. The immune system contains both innate immunity, which provides immediate non-specific defense, and acquired adaptive immunity which has antigen-specific responses and immunological memory. The document outlines the basic subjects and concepts in immunology including cell-mediated defenses, antibodies, hypersensitivities, immunodeficiencies and transplantation.

Informe tecnico marzo 2016

Gerardo Manuel Durán Pérez

Bangun Datar Layang layang Jihan Nabilah

8. Evangelina

Lynzgel

Este documento presenta información sobre varias bandas de música incluyendo sus años de actividad, géneros musicales principales y algunas de sus canciones más populares. Resume la información sobre 11 bandas diferentes con detalles sobre su periodo de actividad que va desde la década de 1990 hasta la actualidad, los géneros musicales como pop punk, rock alternativo y metal, y sus canciones más conocidas.

Jihan Nabilah Ekayono Putri Persentasi Bab Cahaya Kelas 8

Jihan Nabilah

20161126_Blender step2

naotaro0123

Blackboard DevCon 2012 - Ensuring Code Quality

Noriaki Tatsumi

This document discusses the importance of code quality and Blackboard's initiatives to ensure high quality code. It emphasizes that code quality matters to increase robustness, maintainability, and reduce costs. Blackboard uses Sonar to measure code quality metrics over time, find code duplications, and check for rule violations. Static code analysis is also important to find and address bugs and quality issues early. The document outlines Blackboard's code quality processes and rules, and proposes creating community resources to help third-party developers improve their code quality.

Design and Development of an Efficient Malware Detection Using ML

Siva krishnam raju Patsamatla

Enormous growth and generation of data is happening in every day from various sources. The generated data is presented in various formats, i.e., in structured, unstructured, semi-structured, pdfs, docs, csvs, and raw file formats. All these files are not genuine or pure in all scenarios cause which is generated from identified and unidentified sources. The modern malware is designed with mutation characteristics, that means, it can change its behavior based on the properties of physical file. It is a contraction from malicious software. The tremendous growth of the data is very helpful to the malware designers to execute the malware files such as Virus, Trojans, and Ransomware in any file. The formation of modern malware poses a variety of challenges to the antivirus industries. In this paper, we are going to induce a system with a lightweight model to accurately detect the malware for industrial use with high accuracy. In this, we are identifying nine different types of malwares like Ramnit, Lollipop, Kelihos_ver3, Vundo, etc., on huge amount of data (0.5 TB) that is provided by Microsoft.

Discovering Flaws in Security-Focused Static Analysis Tools for Android using...

Kevin Moran

Mobile application security has been one of the major areas of security research in the last decade. Numerous application analysis tools have been proposed in response to malicious, curious, or vulnerable apps. However, existing tools, and specifically, static analysis tools, trade soundness of the analysis for precision and performance, and are hence soundy. Unfortunately, the specific unsound choices or flaws in the design of these tools are often not known or well-documented, leading to a misplaced confidence among researchers, developers, and users. This paper proposes the Mutation-based soundness evaluation (μSE) framework, which systematically evaluates Android static analysis tools to discover, document, and fix, flaws, by leveraging the well-founded practice of mutation analysis. We implement μSE as a semi-automated framework, and apply it to a set of prominent Android static analysis tools that detect private data leaks in apps. As the result of an in-depth analysis of one of the major tools, we discover 13 undocumented flaws. More importantly, we discover that all 13 flaws propagate to tools that inherit the flawed tool. We successfully fix one of the flaws in cooperation with the tool developers. Our results motivate the urgent need for systematic discovery and documentation of unsound choices in soundy tools, and demonstrate the opportunities in leveraging mutation testing in achieving this goal.

Open Source Security for Newbies - Best Practices

Black Duck by Synopsys

Uncertainty, Risk, and Information Value in Software Requirements and Archite...

Emmanuel Letier

Slides from the ICSE 2014 presentation E. Letier, D. Stefan, E. T. Barr, Uncertainty, Risk, and Information Value in Software Requirements and Architecture, Proc. 36th International Conference on Software Engineering 2014 (ICSE 2014). Uncertainty complicates early requirements and architecture decisions and may expose a software project to significant risk. Yet software architects lack support for evaluating uncertainty, its impact on risk, and the value of reducing uncertainty before making critical decisions. We propose to apply decision analysis and multi-objective optimisation techniques to provide such support. We present a systematic method allowing software architects to describe uncertainty about the impact of alternatives on stakeholders' goals; to calculate the consequences of uncertainty through Monte-Carlo simulation; to shortlist candidate architectures based on expected costs, benefits and risks; and to assess the value of obtaining additional information before deciding. We demonstrate our method on the design of a system for coordinating emergency response teams. Our approach highlights the need for requirements engineering and software cost estimation methods to disclose uncertainty instead of hiding it.

COSC 426 Lect. 7: Evaluating AR Applications

Mark Billinghurst

Webinar–Delivering a Next Generation Vulnerability Feed

Synopsys Software Integrity Group

The Synopsys Cybersecurity Research Center (CyRC) has a dedicated team of security analysts who specialize in sourcing, curating, and analyzing open source software vulnerabilities. The team delivers a customer-focused vulnerability feed comprising open source vulnerability reports called BDSAs (Black Duck Security Advisories). These reports are timely, accurate, and packed with relevant actionable information. In this webinar, Siobhan Hunter, security research lead, reveals why the high-quality content of the BDSA feed is best in class, with examples of how our BDSA feed compares with the NVD and insights into how we discover and deliver valuable vulnerability information for our customers every day. For more information, please visit our website at https://www.synopsys.com/cyrc

___ qr code ________ lims (1)

Naowal Siripatana

This document discusses integrating QR codes into a Laboratory Information Management System (LIMS) used by the Centralized Equipment Department (CED) at Prince of Songkla University. It outlines problems with the current LIMS, such as customers frequently calling for results. The proposed solution is to generate QR codes for samples submitted to the CED and have customers scan the codes to access test results online. This would reduce data entry errors and allow customers to check results without contacting staff. Diagrams show how QR codes would be integrated at different steps of the testing process to automatically generate and deliver result reports. Future work may involve developing a mobile app for tracking and expanding the system to document and inventory management.

Viewers also liked

Recommending Proper API Code Examples for Documentation Purpose

立偉馬

KCB101 storyboard MK AN

ash2007080

A Scripting Environment for Refactoring Process Execution

立偉馬

Cdma

sanjib_agrawala

USING FINANCIAL STATEMENTS INFORMATION

Doulat panah

Online Marketing in Singapore - Hipponetwork

HippoNetwork.com

Yields of mortgage backed securities

Ali Ünal

Social media

Mary Valles

Immunitytheory

Rakesh S

Informe tecnico marzo 2016

Gerardo Manuel Durán Pérez

Bangun Datar Layang layang Jihan Nabilah

8. Evangelina

Lynzgel

Jihan Nabilah Ekayono Putri Persentasi Bab Cahaya Kelas 8

Jihan Nabilah

20161126_Blender step2

naotaro0123

Viewers also liked (14)

Recommending Proper API Code Examples for Documentation Purpose

KCB101 storyboard MK AN

A Scripting Environment for Refactoring Process Execution

Cdma

USING FINANCIAL STATEMENTS INFORMATION

Online Marketing in Singapore - Hipponetwork

Yields of mortgage backed securities

Social media

Immunitytheory

Informe tecnico marzo 2016

Bangun Datar Layang layang

8. Evangelina

Jihan Nabilah Ekayono Putri Persentasi Bab Cahaya Kelas 8

20161126_Blender step2

Similar to MAVIS: A Visualization Tool for Cohesion-based Bad Smell Inspection

Blackboard DevCon 2012 - Ensuring Code Quality

Noriaki Tatsumi

Design and Development of an Efficient Malware Detection Using ML

Siva krishnam raju Patsamatla

Discovering Flaws in Security-Focused Static Analysis Tools for Android using...

Kevin Moran

Open Source Security for Newbies - Best Practices

Black Duck by Synopsys

Uncertainty, Risk, and Information Value in Software Requirements and Archite...

Emmanuel Letier

COSC 426 Lect. 7: Evaluating AR Applications

Mark Billinghurst

Webinar–Delivering a Next Generation Vulnerability Feed

Synopsys Software Integrity Group

___ qr code ________ lims (1)

Naowal Siripatana

Continuous, Evolutionary and Large-Scale: A New Perspective for Automated Mob...

Kevin Moran

Mobile app development involves a unique set of challenges including device fragmentation and rapidly evolving platforms, making testing a difficult task. The design space for a comprehensive mobile testing strategy includes features, inputs, potential contextual app states, and large combinations of devices and underlying platforms. Therefore, automated testing is an essential activity of the development process. However, current state of the art of automated testing tools for mobile apps posses limitations that has driven a preference for manual testing in practice. As of today, there is no comprehensive automated solution for mobile testing that overcomes fundamental issues such as automated oracles, history awareness in test cases, or automated evolution of test cases. In this perspective paper we survey the current state of the art in terms of the frameworks, tools, and services available to developers to aid in mobile testing, highlighting present shortcom- ings. Next, we provide commentary on current key challenges that restrict the possibility of a comprehensive, effective, and practical automated testing solution. Finally, we offer our vision of a comprehensive mobile app testing framework, complete with research agenda, that is succinctly summarized along three principles: Continuous, Evolutionary and Large-scale (CEL).

Development, Confusion and Exploration of Honeypot Technology

Antiy Labs

This document discusses the development, status, challenges, and future outlook of honeypot technology. It describes how honeypots have evolved from early experimental systems in the 1990s to integrated production tools today. The document outlines the main categories of honeypots and discusses ongoing technical challenges around simulating targets, analyzing large amounts of data, and security threats. It presents several research initiatives and the Wind-catcher plan to further cultivation and analysis of malware samples using distributed honeypot networks.

Cheap And Efficient Tools Euroia09

Belen Barros Pena

Cheap and efficient user testing tools allow organizations to engage users in design when budgets are limited. Image map prototypes require no coding and can be built in hours, enabling initial user testing of static pages. Combining standard in-lab testing with informal on-site testing allows for more iterative design based on user feedback. This approach provides valuable insights while keeping costs low.

Multivariate Data analysis Workshop at UC Davis 2012

Dmitry Grapov

Introductory Workshop for Multivariate Data Analysis and Visualization Dmitry Grapov1,2,3*, John W Newman1,2 1 Nutrition, University of California Davis, Davis, CA, 2 USDA/ARS Western Human Nutrition Research Center, Davis, CA 3 Designated Emphasis in Biotechnology, University of California Davis, Davis, CA, Next generation “omics” tools are harbingers of the golden age of biology. Biologists are on the cusp of breaking through the veil of complexity surrounding the emergent properties of complex biological systems. However these same rapid technological advances are also transforming the study of biology into a data intensive science. The ever growing gap between data and theory necessitates that biologists become familiar with multivariate computational and visualization methods in order to fully understand their experimental results. We are offering a summer workshop covering introductory concepts and applications of multivariate data analysis (MDA) and visualization techniques. Join us for a week to familiarize yourself with concepts in MDA covering topics in: multiple hypothesis testing, exploratory projection pursuits, multivariate classification and regression modeling, networks and machine learning. Get experience with MDA through hands-on analyses of real-world data using freely available tools. Learn how to make the most of your time and experimental results by quickly understanding your data’s complexity, main features and inter-relationships.

A Large-Scale Empirical Study on the Effects of Code Obfuscations on Android ...

Mahmoud Hammad

The Android platform has been the dominant mobile platform in recent years resulting in millions of apps and security threats against those apps. Anti-malware products aim to protect smartphone users from these threats, especially from malicious apps. However, malware authors use code obfuscation on their apps to evade detection by anti-malware products. To assess the effects of code obfuscation on Android apps and anti-malware products, we have conducted a large-scale empirical study that evaluates the effectiveness of the top anti-malware products against various obfuscation tools and strategies. To that end, we have obfuscated 3,000 benign apps and 3,000 malicious apps and generated 73,362 obfuscated apps using 29 obfuscation strategies from 7 open-source, academic, and commercial obfuscation tools. The findings of our study indicate that (1) code obfuscation significantly impacts Android anti-malware products; (2) the majority of anti-malware products are severely impacted by even trivial obfuscations; (3) in general, combined obfuscation strategies do not successfully evade anti-malware products more than individual strategies; (4) the detection of anti-malware products depend not only on the applied obfuscation strategy but also on the leveraged obfuscation tool; (5) anti-malware products are slow to adopt signatures of malicious apps; and (6) code obfuscation often results in changes to an app’s semantic behaviors.

Application Assessment Techniques

Denim Group

This talk will review a number of application assessment techniques and discuss the types of security vulnerabilities they are best suited to identify as well as how the different approaches can be used in combination to produce more thorough and insightful results. Code review will be compared to penetration testing and the capabilities of automated tools will be compared to manual techniques. In addition, the role of threat modeling and architecture analysis will be examined. The goal is to illuminate assessment techniques that go beyond commodity point-and-click approaches to web application or code scanning. From the OWASP Northern Virginia meeting August 6, 2009.

Software design Project Presentation-1.pptx

krthkkholi

This document outlines a project to develop an advanced vulnerability scanner with an intuitive user interface. It begins with an introduction that states the objective is to create a scanner with enhanced user interaction for more efficient threat detection and mitigation. Next, it discusses the importance of vulnerability scanners, including identifying weaknesses, enabling proactive security, meeting compliance standards, and facilitating incident response. The problem statement notes that traditional scanners have unintuitive interfaces that hinder effective usage and interpretation. The project scope and features are then defined, including network scanning, device identification, port checking, and resetting passwords. Finally, implementation details and the conclusion reiterate how the new scanner will improve user interaction and security through a comprehensive feature set.

Unit no 09_developing sampling plan

Jaipal Dhobale

The document discusses developing a sampling plan for research. It covers defining the target population, identifying the sampling frame, selecting a sampling procedure, and determining sample size. For sampling procedures, it describes nonprobability and probability methods such as convenience, judgment, quota, simple random, systematic, stratified, and cluster samples. It emphasizes that probability samples allow estimating sampling error and making statistical inferences about the population.

Would Static Analysis Tools Help Developers with Code Reviews?

Sebastiano Panichella

Code reviews have been conducted since decades in software projects, with the aim of improving code quality from many different points of view. During code reviews, developers are supported by checklists, coding standards and, possibly, by various kinds of static analysis tools. This paper investigates whether warnings highlighted by static analysis tools are taken care of during code reviews and, whether there are kinds of warnings that tend to be removed more than others. Results of a study conducted by mining the Gerrit repository of six Java open source projects indicate that the density of warnings only slightly vary after each review. The overall percentage of warnings removed during reviews is slightly higher than what previous studies found for the overall project evolution history. However, when looking (quantitatively and qualitatively) at specific categories of warnings, we found that during code reviews developers focus on certain kinds of problems. For such categories of warnings the removal percentage tend to be very high—often above 50% and sometimes 100%. Examples of those are warnings in the imports, regular expression, and type resolution categories. In conclusion, while a broad warning detection might produce way too many false positives, enforcing the removal of certain warnings prior to the patch submission could reduce the amount of effort provided during the code review process.

Presentation on vulnerability analysis

Asif Anik

This document presents SAVI (Static Analysis Vulnerability Indicator), a method for ranking the vulnerability of web applications using static analysis of source code. SAVI combines results from several static analysis tools and vulnerability databases to calculate a metric called Static Analysis Vulnerability Density (SAVD) for each application. The authors tested SAVI on several open source PHP applications and found SAVD correlated significantly with future vulnerability reports, indicating static analysis can help identify post-release vulnerabilities.

Best Practices for Validating a Next-Gen Sequencing Workflow

Golden Helix

Validating an NGS workflow is an iterative process that begins with collaboration with personnel and planning protocols for the entire workflow from sample preparation, sequencing and variant calling, all the way to data analysis and reporting. At Golden Helix, while we do not provide pre-validated black-box workflows, we provide our customers with support to validate workflows in a transparent manner, and assist them in reaching production deadlines. This webcast will be led by members of our Field Application Scientist team, and we will explore some of the best practices for NGS workflow validation that we have observed and helped to implement based on real-world examples from our customer base. Key topics for discussion will include: Sample preparation and collection of adequate case/control data Designing a robust workflow with special considerations for single versus family analyses and phenotypic considerations Generating the desired output for clinical or other reports Real world NGS workflow validation strategies Tune in for tips and strategies that you can deploy when designing and validating your NGS workflow.

Myths and Misperceptions of Open Source Security

Black Duck by Synopsys

This document discusses myths and misperceptions around open source security. It addresses 6 common misperceptions: 1) that security tools can find all open source vulnerabilities, 2) that scanning is best done at the end of development, 3) that the National Vulnerability Database covers all vulnerabilities, 4) that replacing vulnerable components is always the answer, 5) that the "many eyes" theory ensures open source security, and 6) that open source is less secure than commercial software. The document provides details to counter each misperception and emphasizes that all software can have vulnerabilities, and that visibility into what software is used is key to security.

Similar to MAVIS: A Visualization Tool for Cohesion-based Bad Smell Inspection (20)

Blackboard DevCon 2012 - Ensuring Code Quality

Design and Development of an Efficient Malware Detection Using ML

Discovering Flaws in Security-Focused Static Analysis Tools for Android using...

Open Source Security for Newbies - Best Practices

Uncertainty, Risk, and Information Value in Software Requirements and Archite...

COSC 426 Lect. 7: Evaluating AR Applications

Webinar–Delivering a Next Generation Vulnerability Feed

___ qr code ________ lims (1)

Continuous, Evolutionary and Large-Scale: A New Perspective for Automated Mob...

Development, Confusion and Exploration of Honeypot Technology

Cheap And Efficient Tools Euroia09

Multivariate Data analysis Workshop at UC Davis 2012

A Large-Scale Empirical Study on the Effects of Code Obfuscations on Android ...

Application Assessment Techniques

Software design Project Presentation-1.pptx

Unit no 09_developing sampling plan

Would Static Analysis Tools Help Developers with Code Reviews?

Presentation on vulnerability analysis

Best Practices for Validating a Next-Gen Sequencing Workflow

Myths and Misperceptions of Open Source Security

Recently uploaded

Introduction of Cybersecurity with OSS at Code Europe 2024

Hiroshi SHIBATA

I develop the Ruby programming language, RubyGems, and Bundler, which are package managers for Ruby. Today, I will introduce how to enhance the security of your application using open-source software (OSS) examples from Ruby and RubyGems. The first topic is CVE (Common Vulnerabilities and Exposures). I have published CVEs many times. But what exactly is a CVE? I'll provide a basic understanding of CVEs and explain how to detect and handle vulnerabilities in OSS. Next, let's discuss package managers. Package managers play a critical role in the OSS ecosystem. I'll explain how to manage library dependencies in your application. I'll share insights into how the Ruby and RubyGems core team works to keep our ecosystem safe. By the end of this talk, you'll have a better understanding of how to safeguard your code.

Digital Marketing Trends in 2024 | Guide for Staying Ahead

Wask

https://www.wask.co/ebooks/digital-marketing-trends-in-2024 Feeling lost in the digital marketing whirlwind of 2024? Technology is changing, consumer habits are evolving, and staying ahead of the curve feels like a never-ending pursuit. This e-book is your compass. Dive into actionable insights to handle the complexities of modern marketing. From hyper-personalization to the power of user-generated content, learn how to build long-term relationships with your audience and unlock the secrets to success in the ever-shifting digital landscape.

Best 20 SEO Techniques To Improve Website Visibility In SERP

Pixlogix Infotech

HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU

panagenda

Webinar Recording: https://www.panagenda.com/webinars/hcl-notes-und-domino-lizenzkostenreduzierung-in-der-welt-von-dlau/ DLAU und die Lizenzen nach dem CCB- und CCX-Modell sind für viele in der HCL-Community seit letztem Jahr ein heißes Thema. Als Notes- oder Domino-Kunde haben Sie vielleicht mit unerwartet hohen Benutzerzahlen und Lizenzgebühren zu kämpfen. Sie fragen sich vielleicht, wie diese neue Art der Lizenzierung funktioniert und welchen Nutzen sie Ihnen bringt. Vor allem wollen Sie sicherlich Ihr Budget einhalten und Kosten sparen, wo immer möglich. Das verstehen wir und wir möchten Ihnen dabei helfen! Wir erklären Ihnen, wie Sie häufige Konfigurationsprobleme lösen können, die dazu führen können, dass mehr Benutzer gezählt werden als nötig, und wie Sie überflüssige oder ungenutzte Konten identifizieren und entfernen können, um Geld zu sparen. Es gibt auch einige Ansätze, die zu unnötigen Ausgaben führen können, z. B. wenn ein Personendokument anstelle eines Mail-Ins für geteilte Mailboxen verwendet wird. Wir zeigen Ihnen solche Fälle und deren Lösungen. Und natürlich erklären wir Ihnen das neue Lizenzmodell. Nehmen Sie an diesem Webinar teil, bei dem HCL-Ambassador Marc Thomas und Gastredner Franz Walder Ihnen diese neue Welt näherbringen. Es vermittelt Ihnen die Tools und das Know-how, um den Überblick zu bewahren. Sie werden in der Lage sein, Ihre Kosten durch eine optimierte Domino-Konfiguration zu reduzieren und auch in Zukunft gering zu halten. Diese Themen werden behandelt - Reduzierung der Lizenzkosten durch Auffinden und Beheben von Fehlkonfigurationen und überflüssigen Konten - Wie funktionieren CCB- und CCX-Lizenzen wirklich? - Verstehen des DLAU-Tools und wie man es am besten nutzt - Tipps für häufige Problembereiche, wie z. B. Team-Postfächer, Funktions-/Testbenutzer usw. - Praxisbeispiele und Best Practices zum sofortigen Umsetzen

Energy Efficient Video Encoding for Cloud and Edge Computing Instances

Alpen-Adria-Universität

Presentation of the OECD Artificial Intelligence Review of Germany

innovationoecd

Artificial Intelligence for XMLDevelopment

Octavian Nadolu

In the rapidly evolving landscape of technologies, XML continues to play a vital role in structuring, storing, and transporting data across diverse systems. The recent advancements in artificial intelligence (AI) present new methodologies for enhancing XML development workflows, introducing efficiency, automation, and intelligent capabilities. This presentation will outline the scope and perspective of utilizing AI in XML development. The potential benefits and the possible pitfalls will be highlighted, providing a balanced view of the subject. We will explore the capabilities of AI in understanding XML markup languages and autonomously creating structured XML content. Additionally, we will examine the capacity of AI to enrich plain text with appropriate XML markup. Practical examples and methodological guidelines will be provided to elucidate how AI can be effectively prompted to interpret and generate accurate XML markup. Further emphasis will be placed on the role of AI in developing XSLT, or schemas such as XSD and Schematron. We will address the techniques and strategies adopted to create prompts for generating code, explaining code, or refactoring the code, and the results achieved. The discussion will extend to how AI can be used to transform XML content. In particular, the focus will be on the use of AI XPath extension functions in XSLT, Schematron, Schematron Quick Fixes, or for XML content refactoring. The presentation aims to deliver a comprehensive overview of AI usage in XML development, providing attendees with the necessary knowledge to make informed decisions. Whether you’re at the early stages of adopting AI or considering integrating it in advanced XML development, this presentation will cover all levels of expertise. By highlighting the potential advantages and challenges of integrating AI with XML development tools and languages, the presentation seeks to inspire thoughtful conversation around the future of XML development. We’ll not only delve into the technical aspects of AI-powered XML development but also discuss practical implications and possible future directions.

Recommendation System using RAG Architecture

fredae14

Programming Foundation Models with DSPy - Meetup Slides

Zilliz

Generating privacy-protected synthetic data using Secludy and Milvus

Zilliz

During this demo, the founders of Secludy will demonstrate how their system utilizes Milvus to store and manipulate embeddings for generating privacy-protected synthetic data. Their approach not only maintains the confidentiality of the original data but also enhances the utility and scalability of LLMs under privacy constraints. Attendees, including machine learning engineers, data scientists, and data managers, will witness first-hand how Secludy's integration with Milvus empowers organizations to harness the power of LLMs securely and efficiently.

HCL Notes and Domino License Cost Reduction in the World of DLAU

panagenda

Webinar Recording: https://www.panagenda.com/webinars/hcl-notes-and-domino-license-cost-reduction-in-the-world-of-dlau/ The introduction of DLAU and the CCB & CCX licensing model caused quite a stir in the HCL community. As a Notes and Domino customer, you may have faced challenges with unexpected user counts and license costs. You probably have questions on how this new licensing approach works and how to benefit from it. Most importantly, you likely have budget constraints and want to save money where possible. Don’t worry, we can help with all of this! We’ll show you how to fix common misconfigurations that cause higher-than-expected user counts, and how to identify accounts which you can deactivate to save money. There are also frequent patterns that can cause unnecessary cost, like using a person document instead of a mail-in for shared mailboxes. We’ll provide examples and solutions for those as well. And naturally we’ll explain the new licensing model. Join HCL Ambassador Marc Thomas in this webinar with a special guest appearance from Franz Walder. It will give you the tools and know-how to stay on top of what is going on with Domino licensing. You will be able lower your cost through an optimized configuration and keep it low going forward. These topics will be covered - Reducing license cost by finding and fixing misconfigurations and superfluous accounts - How do CCB and CCX licenses really work? - Understanding the DLAU tool and how to best utilize it - Tips for common problem areas, like team mailboxes, functional/test users, etc - Practical examples and best practices to implement right away

Serial Arm Control in Real Time Presentation

tolgahangng

Columbus Data & Analytics Wednesdays - June 2024

Jason Packer

National Security Agency - NSA mobile device best practices

Quotidiano Piemontese

Monitoring and Managing Anomaly Detection on OpenShift.pdf

Tosin Akinosho

Monitoring and Managing Anomaly Detection on OpenShift Overview Dive into the world of anomaly detection on edge devices with our comprehensive hands-on tutorial. This SlideShare presentation will guide you through the entire process, from data collection and model training to edge deployment and real-time monitoring. Perfect for those looking to implement robust anomaly detection systems on resource-constrained IoT/edge devices. Key Topics Covered 1. Introduction to Anomaly Detection - Understand the fundamentals of anomaly detection and its importance in identifying unusual behavior or failures in systems. 2. Understanding Edge (IoT) - Learn about edge computing and IoT, and how they enable real-time data processing and decision-making at the source. 3. What is ArgoCD? - Discover ArgoCD, a declarative, GitOps continuous delivery tool for Kubernetes, and its role in deploying applications on edge devices. 4. Deployment Using ArgoCD for Edge Devices - Step-by-step guide on deploying anomaly detection models on edge devices using ArgoCD. 5. Introduction to Apache Kafka and S3 - Explore Apache Kafka for real-time data streaming and Amazon S3 for scalable storage solutions. 6. Viewing Kafka Messages in the Data Lake - Learn how to view and analyze Kafka messages stored in a data lake for better insights. 7. What is Prometheus? - Get to know Prometheus, an open-source monitoring and alerting toolkit, and its application in monitoring edge devices. 8. Monitoring Application Metrics with Prometheus - Detailed instructions on setting up Prometheus to monitor the performance and health of your anomaly detection system. 9. What is Camel K? - Introduction to Camel K, a lightweight integration framework built on Apache Camel, designed for Kubernetes. 10. Configuring Camel K Integrations for Data Pipelines - Learn how to configure Camel K for seamless data pipeline integrations in your anomaly detection workflow. 11. What is a Jupyter Notebook? - Overview of Jupyter Notebooks, an open-source web application for creating and sharing documents with live code, equations, visualizations, and narrative text. 12. Jupyter Notebooks with Code Examples - Hands-on examples and code snippets in Jupyter Notebooks to help you implement and test anomaly detection models.

How to use Firebase Data Connect For Flutter

Daiki Mogmet Ito

Main news related to the CCS TSI 2023 (2023/1695)

Jakub Marek

An English 🇬🇧 translation of a presentation to the speech I gave about the main changes brought by CCS TSI 2023 at the biggest Czech conference on Communications and signalling systems on Railways, which was held in Clarion Hotel Olomouc from 7th to 9th November 2023 (konferenceszt.cz). Attended by around 500 participants and 200 on-line followers. The original Czech 🇨🇿 version of the presentation can be found here: https://www.slideshare.net/slideshow/hlavni-novinky-souvisejici-s-ccs-tsi-2023-2023-1695/269688092 . The videorecording (in Czech) from the presentation is available here: https://youtu.be/WzjJWm4IyPk?si=SImb06tuXGb30BEH .

Ocean lotus Threat actors project by John Sitima 2024 (1).pptx

SitimaJohn

Ocean Lotus cyber threat actors represent a sophisticated, persistent, and politically motivated group that poses a significant risk to organizations and individuals in the Southeast Asian region. Their continuous evolution and adaptability underscore the need for robust cybersecurity measures and international cooperation to identify and mitigate the threats posed by such advanced persistent threat groups.

Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...

saastr

5th LF Energy Power Grid Model Meet-up Slides

DanBrown980551

5th Power Grid Model Meet-up It is with great pleasure that we extend to you an invitation to the 5th Power Grid Model Meet-up, scheduled for 6th June 2024. This event will adopt a hybrid format, allowing participants to join us either through an online Mircosoft Teams session or in person at TU/e located at Den Dolech 2, Eindhoven, Netherlands. The meet-up will be hosted by Eindhoven University of Technology (TU/e), a research university specializing in engineering science & technology. Power Grid Model The global energy transition is placing new and unprecedented demands on Distribution System Operators (DSOs). Alongside upgrades to grid capacity, processes such as digitization, capacity optimization, and congestion management are becoming vital for delivering reliable services. Power Grid Model is an open source project from Linux Foundation Energy and provides a calculation engine that is increasingly essential for DSOs. It offers a standards-based foundation enabling real-time power systems analysis, simulations of electrical power grids, and sophisticated what-if analysis. In addition, it enables in-depth studies and analysis of the electrical power grid’s behavior and performance. This comprehensive model incorporates essential factors such as power generation capacity, electrical losses, voltage levels, power flows, and system stability. Power Grid Model is currently being applied in a wide variety of use cases, including grid planning, expansion, reliability, and congestion studies. It can also help in analyzing the impact of renewable energy integration, assessing the effects of disturbances or faults, and developing strategies for grid control and optimization. What to expect For the upcoming meetup we are organizing, we have an exciting lineup of activities planned: -Insightful presentations covering two practical applications of the Power Grid Model. -An update on the latest advancements in Power Grid -Model technology during the first and second quarters of 2024. -An interactive brainstorming session to discuss and propose new feature requests. -An opportunity to connect with fellow Power Grid Model enthusiasts and users.

Recently uploaded (20)

Introduction of Cybersecurity with OSS at Code Europe 2024

Digital Marketing Trends in 2024 | Guide for Staying Ahead

Best 20 SEO Techniques To Improve Website Visibility In SERP

HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU

Energy Efficient Video Encoding for Cloud and Edge Computing Instances

Presentation of the OECD Artificial Intelligence Review of Germany

Artificial Intelligence for XMLDevelopment

Recommendation System using RAG Architecture

Programming Foundation Models with DSPy - Meetup Slides

Generating privacy-protected synthetic data using Secludy and Milvus

HCL Notes and Domino License Cost Reduction in the World of DLAU

Serial Arm Control in Real Time Presentation

Columbus Data & Analytics Wednesdays - June 2024

National Security Agency - NSA mobile device best practices

Monitoring and Managing Anomaly Detection on OpenShift.pdf

How to use Firebase Data Connect For Flutter

Main news related to the CCS TSI 2023 (2023/1695)

Ocean lotus Threat actors project by John Sitima 2024 (1).pptx

Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...

5th LF Energy Power Grid Model Meet-up Slides

MAVIS: A Visualization Tool for Cohesion-based Bad Smell Inspection

1. MAVIS: A Visualization Tool for Cohesion-based Bad Smell Inspection Lee Wei Mar (馬立偉), Ming Lun Lee (李明倫) and Hewijin Christine Jiau (焦惠津) Institute of Computer and Communication Engineering, NCKU 國立成功大學電腦與通信工程研究所 Speaker: Lee Wei Mar (馬立偉) Date: 07/08/2011

2. Outline • Introduction • Empirical Investigation • MAVIS Visualization Tool • Evaluation • Conclusion 2

3. Introduction • Cohesion-based Bad Smells are structural deficiencies that violet “high cohesion and low coupling principle” – Feature Envy – God Class – Long Method • Cohesion-based bad smells are common refactoring targets during software evolution • Many bad smell detection (BSD) tools have been developed for suggesting cohesion-based bad smell candidates – The judgment of candidates still relies on developers’ expertise 3

4. Empirical Investigation • Utilizing two BSD tool, InCode and JDeodorant, for bad smell removal • Conduction steps 1. Use BSD tool in finding Feature Envy candidates on a in Lab project: CARE 2. For each feature envy candidates, a developer inspect source code to answer a. Is it an Feature Envy? b. If it is a Feature Envy, can it be resolved by Move Method (MM)? • The data from two studies are analyzed 4

5. Empirical Investigation (cont.) • The data from two studies are analyzed • Observations 5

6. Empirical Investigation (cont.) • The data from two studies are analyzed • Observations – A large number of bad smell candidates are detected by BSD tools 6

7. Empirical Investigation (cont.) • The data from two studies are analyzed • Observations – A large number of bad smell candidates are detected by BSD tools – The developer rejects about 60% of the detected candidates 7

8. Empirical Investigation (cont.) • The data from two studies are analyzed • Observations – A large number of bad smell candidates are detected by BSD tools – The developer rejects about 60% of the detected candidates – Small portion of candidates can be directly removed as suggested by BSD tools 8

9. Empirical Investigation (cont.) • The data from two studies are analyzed • Observations – A large number of bad smell candidates are detected by BSD tools – The developer rejects about 60% of the detected candidates – Small portion of candidates can be directly removed as suggested by BSD tools Tool support is required during bad smell inspection 9

10. MAVIS Visualization Tool • MAVIS (Metric Abstraction VISualization) aims to – provide visualization for inspecting cohesion-based bad smell candidates returned by BSD tools – visualize metric abstractions, the linkage between software code structure and software metrics, for exposing the bad smell symptoms – link visualization to corresponding code for locating symptomatic code during code inspection 10

11. MAVIS Visualization Tool 11

12. MAVIS Visualization Tool • Data accessing metric abstractions • ATLD: Access to local data • ATFD: Access to foreign data • Message passing metric abstractions • LMP: Local message passing • MPC: Message passing coupling 12

13. MAVIS Visualization Tool 13

14. Source Code Navigation in MAVIS 14

15. Evaluation (cont.) • Inspecting candidates with MAVIS – Subjects • HSQLDB / 199 KLOC • JEdit / 133 KLOC – Utilized BSD tool • JDeodorant 15

16. Evaluation (cont.) • Half of the candidates are false positives 16

17. Evaluation (cont.) • Half of the candidates are false positives • 1/3 of the candidates can be directly judged using MAVIS visualization • The code inspection effort for these candidates are eliminated 17

18. Conclusion • Cohesion-based bad smell removal is a human intensive activity that requires supports for decision making • MAVIS is proposed for assisting cohesion-based bad smell inspection – visualizing metric sensitive structural information – navigating code through metric abstractions • Two case studies are performed to confirm the effectiveness of MAVIS – 1/3 of the source code inspection effort are reduced by using MAVIS 18

19. Thank You Lee Wei Mar (馬立偉) lwmar@nature.ee.ncku.edu.tw Database & Software Engineering Lab, NCKU 國立成功大學資料庫暨軟體工程實驗室

MAVIS: A Visualization Tool for Cohesion-based Bad Smell Inspection

Recommended

Recommended

More Related Content

Viewers also liked

Viewers also liked (14)

Similar to MAVIS: A Visualization Tool for Cohesion-based Bad Smell Inspection

Similar to MAVIS: A Visualization Tool for Cohesion-based Bad Smell Inspection (20)

Recently uploaded

Recently uploaded (20)

MAVIS: A Visualization Tool for Cohesion-based Bad Smell Inspection