An unavoidable amount of money is spent on maintaining existing software systems today. Software maintenance cost generally higher than development cost of the system therefore lowering maintenance cost is highly appreciated in software industry. A significant part of maintenance activities is related to repeating the investigation of problems and applying repeated solutions several times. A software system may contain a common bug in several different places and it might take extra effort and time to fix all existences of this bug. This operation commonly increases the cost of Software Maintenance Activities. Detecting duplicate code fragments can significantly decrease the time and effort therefore the maintenance cost. Clone code detection can be achieved via analyzing the source code of given software system. An abstract syntax tree based clone detector for java systems is designed and implemented through this study. This master thesis examines a software engineering process to create an abstract syntax tree based clone detector for the projects implemented in Java programming language.

Today, universities rely heavily on systems for detecting plagiarism in students’essays and reports. Code submissions however require specific tools. A numberof approaches to finding plagiarisms in code have already been tried, includingtechniques based on comparing textual transformations of code, token strings,parse trees and graph representations. In this master’s thesis, a new system, cojac,is presented which combines textual, tree and graph techniques to detect a broadspectrum of plagiarism attempts. The system finds plagiarisms in C, C++ and Adasource files. This thesis discusses the method used for obtaining parse trees fromthe source code and the abstract syntax tree analysis. For comparison of syntaxtrees, we generate sets of fingerprints, digest forms of trees, which makes thecomparison algorithm more scalable. To evaluate the method, a set of benchmarkfiles have been constructed containing plagiarism scenarios which was analyzedboth by our system and Moss, another available system for plagiarism detection incode. The results show that our abstract syntax tree analysis can effectively detectplagiarisms such as changing the format of the code and renaming of identifiersand is at least as effective as Moss for detecting plagiarisms of these kinds

ASN.1 is a powerful formal notation divided into two parts, a specification of the data and the data itself in binary form. Creating decoders for these files can often be tedious. The purpose of this degree work is to extend current tools at Arctic Group to make an application that decodes a range of different ASN.1 specifications and data. This should be done during runtime, without needing to rebuild the application for each specification, while generating human-readable data and abstracting unwanted information. Two ways to create ASN.1 decoders were identified, and the application was designed taking heavy inspiration from a solution that stores intermediate data in a list. By not including encoding as a feature of the application a few shortcuts could be made, and the desired result could be achieved during runtime. The application was designed to include three parts. The first part was an ASN.1 parser using the Java-based tool ANTLR4. The second part matched the binary data to the information in the specification. The final part was an output formatter that abstracts and prettifies the output data to text files. The result was an application that parses at least three of the most commonly used specifications of the employer and does only have to be rebuilt when a new data type is present in the specifications. Problems arose when matching the data to the ASN.1 specifications, thus the matching and output formatting was only partially implemented. The application was evaluated by testing many different ASN.1 specifications, making sure everything was generated correctly during runtime and extending the parser to support more syntax as it was introduced in new specifications. Although the application did not support any arbitrary ASN.1 specification, it could serve as a foundation for further development to make the application truly generalized. / ASN.1 är en kraftfull formell notation uppdelad i två delar. En specifikation av data och medföljande data i binär form. Att skapa avkodare till dessa filer kan ofta vara tidskrävande. Syftet med det här examensarbetet är att vidareutveckla nuvarande verktyg på Arctic Group till en applikation som avkodar ett flertal olika ASN.1-specifikationer och data. Detta skall göras under körning och skall inte kräva att applikationen byggs om för varje specifikation. Applikationen skall även generera mänskligt läsbar utdata och abstrahera bort oönskad information. Två sätt att bygga en ASN.1-avkodare hittades under förstudien och applikationen designades med inspiration av en lösning som sparar data i en mellanliggande lista. Genom att inte inkludera kodning av data i applikationen kunde genvägar tas och det önskade resultatet kunde uppnås under körning. Applikationen designades med tre delar. Den första delen var en ASN.1-läsare som använde verktyget ANTLR4 byggt i Java, den andra en del som matchade informationen från specifikationen till den binära datan. Den sista delen var en formaterare för utdata som även abstraherade bort oönskad information. Resultatet blev en applikation som korrekt läser av minst tre av de mest använda ASN.1-specifikationerna hos uppdragsgivaren och som bara behöver byggas om då en ny datatyp introduceras i specifikationerna. Problem uppstod vid matching av data till specifikationen vilket ledde till att matchningen och formateringen blev bara delvis implementerat. Applikationen utvärderades genom att testa många olika ASN.1 specifikationer, kontrollera att allt genererades korrekt under körning och att utöka läsaren efterhand för att kunna hantera mer syntax då den introducerades i de nya specifikationerna. Även om applikationen inte än stödjer godtycklig ASN.1-specifikation kan den verka som en bas för vidareutveckling mot en mer komplett generaliserad lösning.

Hybrid is a two-level logical framework that supports higher-order abstract syntax (HOAS), where a specification logic (SL) extends the class of object logics (OLs) we can reason about. We develop a new Hybrid SL and formalize its metatheory, proving weakening, contraction, exchange, and cut admissibility; results that greatly simplify reasoning about OLs in systems providing HOAS. The SL is a sequent calculus defined as an inductive type in Coq and we prove properties by structural induction over SL sequents. We also present a generalized SL and metatheory statement, allowing us to prove many cases of such theorems in a general way and understand how to identify and prove the difficult cases. We make a concrete and measurable improvement to Hybrid with the new SL formalization and provide a technique for abstracting such proofs, leading to a condensed presentation, greater understanding, and a generalization that may be instantiated to other logics.

Permission systems are a common security feature in browser extensions and mobile applications to limit their access to resources outside their own process. IDEs such as Visual Studio Code, however, have no such features implemented, and therefore leave extensions with full user permissions. This thesis explores how VS Code extensions access external resources and presents a proof-of-concept tool that emulates a permission system for extensions. This is done through static analysis of extension source code using abstract syntax trees, scanning for usage of Extension API methods and Node.js dependencies. The tool is evaluated and used on 56 popular VS Code extensions to evaluate what resources are most prevalently accessed and how. The study concludes that most extensions use minimal APIs, but often rely on Node.js libraries rather than the API for external functionality. This leads to the conclusion the inclusion of Node.js dependencies and npm packages is the largest hurdle to implementing a permission system for VS Code.

No description available.

Trusted execution environments (TEEs) are an emerging technology that provides a protected hardware environment for processing and storing sensitive information. By using TEEs, developers can bolster the security of software systems. However, incorporating TEE into existing software systems can be a costly and labor-intensive endeavor. Software maintenance—changing software after its initial release—is known to contribute the majority of the cost in the software development lifecycle. The first step of making use of a TEE requires that developers accurately identify which pieces of code would benefit from being protected in a TEE. For large code bases, this identification process can be quite tedious and time-consuming. To help reduce the software maintenance costs associated with introducing a TEE into existing software, this thesis introduces ML-TEE, a recommendation tool that uses a deep learning model to classify whether an input function handles sensitive information or sensitive code. By applying ML-TEE, developers can reduce the burden of manual code inspection and analysis. ML-TEE's model was trained and tested on functions from GitHub repositories that use Intel SGX and on an imbalanced dataset. The accuracy of the final model used in the recommendation system has an accuracy of 98.86% and an F1 score of 80.00%. In addition, we conducted a pilot study, in which participants were asked to identify functions that needed to be placed inside a TEE in a third-party project. The study found that on average, participants who had access to the recommendation system's output had a 4% higher accuracy and completed the task 21% faster. / Master of Science / Improving the security of software systems has become critically important. A trusted execution environment (TEE) is an emerging technology that can help secure software that uses or stores confidential information. To make use of this technology, developers need to identify which pieces of code handle confidential information and should thus be placed in a TEE. However, this process is costly and laborious because it requires the developers to understand the code well enough to make the appropriate changes in order to incorporate a TEE. This process can become challenging for large software that contains millions of lines of code. To help reduce the cost incurred in the process of identifying which pieces of code should be placed within a TEE, this thesis presents ML-TEE, a recommendation system that uses a deep learning model to help reduce the number of lines of code a developer needs to inspect. Our results show that the recommendation system achieves high accuracy as well as a good balance between precision and recall. In addition, we conducted a pilot study and found that participants from the intervention group who used the output from the recommendation system managed to achieve a higher average accuracy and perform the assigned task faster than the participants in the control group.

SOFA 2 is a component system employing hierarchically composed components. It provides ADL-based design, behavior specification using behavior protocols, dynamic reconfiguration of the components, and modeling of the component communication by software connectors. This allows seamless and transparent distribution of component applications. The connectors can be automatically generated, SOFA 2 contains Java connector generator allowing to connect components with Java interfaces. The aim of this thesis is to implement C code generator and integrate it into the current SOFA 2 connector generator framework, so that C connectors can be automatically generated and thus components written in C language can be transparently connected in distributed environment. The proposed C code generator is based on the concept of template transformation, where templates containing mixture of C code and a scripting Domain Specific Language are transformed to a pure C code. Strategic term rewriting method provided by Stratego/XT framework is used for evaluation of the scripts within the templates.

Duplicate code occurs in source files for different reasons. In many cases the motivation for copying the code is laziness of a programmer, or an attempt to use an alien source code. Over the years, multiple methods for detection of the duplicate source code have been developed. Approaches vary in the ways they analyze the code, focusing on different representations of the program. Methods based on the analysis of the syntactic properties of the source code often use abstract syntax trees. By examining the tree representation instead of the textual representation of the code, these methods are able to detect duplicate code that underwent formatting changes as well as changes to the names of identifiers. Duplicate code fragments are discovered by identifying the subtrees of the same shape. After the suspicious parts of the tree are identified, further examination of AST properties determines to what extent the code was copied. In this work we develop a system for duplicate code detection based on AST comparison.

This thesis investigates how XML representation of X++ abstract syntax trees (AST) residing in an XML database can be subject to static code analysis. Microsoft Dynamics 365 for Finance & Operations comprises a large and complex corpus of X++ source code and intuitive ways of visualizing and analysing the state of the code base in terms of software metrics and technical debt are non-existent. A solution is to extend an internal web application and semantic search tool called SocrateX, to calculate software metrics and technical debt. This is done by creating a web service to construct XQuery and XPath code to be queried to the XML database. The values are stored in a relational database and imported to Power BI for intuitive visualization. Software metrics have been chosen based on the amount of previous research and compatibility with the X++ AST, whereas technical debt has been estimated using the SQALE method. This thesis concludes that XML representations of X++ abstract syntax trees are viable candidates for measuring quality of source codes with the use of functional query programming languages.