No description available.

Three of the most widely studied software dependency types are the structural, logical and semantic dependencies. Logical dependencies capture the degree of co-change between software artifacts. Semantic dependencies capture the degree to which artifacts, comments and names are related. Structural dependencies capture the dependencies in the source code of artifacts. Prior studies show that a combination of dependency analysis (e.g., semantic and logical analysis) improves accuracy when predicting which artifacts are likely to be impacted by ripple effects of software changes (though not to a large extent) compared to individual approaches. In addition, some dependencies could be hidden dependencies when an analysis of one dependency type (e.g., logical) does not reveal artifacts only linked by another dependency type (semantic). While previous studies have focused on combining dependency information with minimal benefits, this Thesis explores the consistency of these measurements, and whether hidden dependencies arise between artifacts, and in any of the axes studied. In this Thesis, 79 Java projects are empirically studied to investigate (i) the direct influence and the degree of overlap between dependency types on three axes (logical - structural (LSt); logical - semantic (LSe); structural - semantic (StSe)) (structural, logical and semantic), and (ii) the presence of hidden coupling on the axes. The results show that a high proportion of hidden dependencies can be detected on the LSt and StSe axes. Notwithstanding, the LSe axis shows a much smaller proportion of hidden dependencies. Practicable refactoring methods to mitigate hidden dependencies are proposed in the Thesis and discussed with examples.

Developing a large software system involves many complicated, varied, and inter-dependent tasks, and these tasks are typically implemented using a combination of defined processes, semi-automated tools, and ad hoc practices. Stakeholders in the development process --- including software developers, managers, and customers --- often want to be able to track the actual practices being employed within a project. For example, a customer may wish to be sure that the process is ISO 9000 compliant, a manager may wish to track the amount of testing that has been done in the current iteration, and a developer may wish to determine who has recently been working on a subsystem that has had several major bugs appear in it. However, extracting the software development processes from an existing project is expensive if one must rely upon manual inspection of artifacts and interviews of developers and their managers. Previously, researchers have suggested the live observation and instrumentation of a project to allow for more measurement, but this is costly, invasive, and also requires a live running project. In this work, we propose an approach that we call software process recovery that is based on after-the-fact analysis of various kinds of software development artifacts. We use a variety of supervised and unsupervised techniques from machine learning, topic analysis, natural language processing, and statistics on software repositories such as version control systems, bug trackers, and mailing list archives. We show how we can combine all of these methods to recover process signals that we map back to software development processes such as the Unified Process. The Unified Process has been visualized using a time-line view that shows effort per parallel discipline occurring across time. This visualization is called the Unified Process diagram. We use this diagram as inspiration to produce Recovered Unified Process Views (RUPV) that are a concrete version of this theoretical Unified Process diagram. We then validate these methods using case studies of multiple open source software systems.

Developing a large software system involves many complicated, varied, and inter-dependent tasks, and these tasks are typically implemented using a combination of defined processes, semi-automated tools, and ad hoc practices. Stakeholders in the development process --- including software developers, managers, and customers --- often want to be able to track the actual practices being employed within a project. For example, a customer may wish to be sure that the process is ISO 9000 compliant, a manager may wish to track the amount of testing that has been done in the current iteration, and a developer may wish to determine who has recently been working on a subsystem that has had several major bugs appear in it. However, extracting the software development processes from an existing project is expensive if one must rely upon manual inspection of artifacts and interviews of developers and their managers. Previously, researchers have suggested the live observation and instrumentation of a project to allow for more measurement, but this is costly, invasive, and also requires a live running project. In this work, we propose an approach that we call software process recovery that is based on after-the-fact analysis of various kinds of software development artifacts. We use a variety of supervised and unsupervised techniques from machine learning, topic analysis, natural language processing, and statistics on software repositories such as version control systems, bug trackers, and mailing list archives. We show how we can combine all of these methods to recover process signals that we map back to software development processes such as the Unified Process. The Unified Process has been visualized using a time-line view that shows effort per parallel discipline occurring across time. This visualization is called the Unified Process diagram. We use this diagram as inspiration to produce Recovered Unified Process Views (RUPV) that are a concrete version of this theoretical Unified Process diagram. We then validate these methods using case studies of multiple open source software systems.

Software security failures are common and the problem is growing. A vulnerability is a weakness in the software that, when exploited, causes a security failure. It is difficult to detect vulnerabilities until they manifest themselves as security failures in the operational stage of the software, because security concerns are often not addressed or known sufficiently early during the Software Development Life Cycle (SDLC). Complexity, coupling, and cohesion (CCC) related software metrics can be measured during the early phases of software development such as design or coding. Although these metrics have been successfully employed to indicate software faults in general, the relationships between CCC metrics and vulnerabilities have not been extensively investigated yet. If empirical relationships can be discovered between CCC metrics and vulnerabilities, these metrics could aid software developers to take proactive actions against potential vulnerabilities in software. In this thesis, we investigate whether CCC metrics can be utilized as early indicators of software vulnerabilities. We conduct an extensive case study on several releases of Mozilla Firefox to provide empirical evidence on how vulnerabilities are related to complexity, coupling, and cohesion. We mine the vulnerability databases, bug databases, and version archives of Mozilla Firefox to map vulnerabilities to software entities. It is found that some of the CCC metrics are correlated to vulnerabilities at a statistically significant level. Since different metrics are available at different development phases, we further examine the correlations to determine which level (design or code) of CCC metrics are better indicators of vulnerabilities. We also observe that the correlation patterns are stable across multiple releases. These observations imply that the metrics can be dependably used as early indicators of vulnerabilities in software. We then present a framework to automatically predict vulnerabilities based on CCC metrics. To build vulnerability predictors, we consider four alternative data mining and statistical techniques – C4.5 Decision Tree, Random Forests, Logistic Regression, and Naïve-Bayes – and compare their prediction performances. We are able to predict majority of the vulnerability-prone files in Mozilla Firefox, with tolerable false positive rates. Moreover, the predictors built from the past releases can reliably predict the likelihood of having vulnerabilities in future releases. The experimental results indicate that structural information from the non-security realm such as complexity, coupling, and cohesion are useful in vulnerability prediction. / Thesis (Master, Electrical & Computer Engineering) -- Queen's University, 2009-09-24 17:31:36.581

Software practitioners make technical and business decisions based on the understanding they have of their software systems. This understanding is grounded in their own experiences, but can be augmented by studying various kinds of development artifacts, including source code, bug reports, version control meta-data, test cases, usage logs, etc. Unfortunately, the information contained in these artifacts is typically not organized in the way that is immediately useful to developers’ everyday decision making needs. To handle the large volumes of data, many practitioners and researchers have turned to analytics — that is, the use of analysis, data, and systematic reasoning for making decisions. The thesis of this dissertation is that by employing software analytics to various development tasks and activities, we can provide software practitioners better insights into their processes, systems, products, and users, to help them make more informed data-driven decisions. While quantitative analytics can help project managers understand the big picture of their systems, plan for its future, and monitor trends, qualitative analytics can enable developers to perform their daily tasks and activities more quickly by helping them better manage high volumes of information. To support this thesis, we provide three different examples of employing software analytics. First, we show how analysis of real-world usage data can be used to assess user dynamic behaviour and adoption trends of a software system by revealing valuable information on how software systems are used in practice. Second, we have created a lifecycle model that synthesizes knowledge from software development artifacts, such as reported issues, source code, discussions, community contributions, etc. Lifecycle models capture the dynamic nature of how various development artifacts change over time in an annotated graphical form that can be easily understood and communicated. We demonstrate how lifecycle models can be generated and present industrial case studies where we apply these models to assess the code review process of three different projects. Third, we present a developer-centric approach to issue tracking that aims to reduce information overload and improve developers’ situational awareness. Our approach is motivated by a grounded theory study of developer interviews, which suggests that customized views of a project’s repositories that are tailored to developer-specific tasks can help developers better track their progress and understand the surrounding technical context of their working environments. We have created a model of the kinds of information elements that developers feel are essential in completing their daily tasks, and from this model we have developed a prototype tool organized around developer-specific customized dashboards. The results of these three studies show that software analytics can inform evidence-based decisions related to user adoption of a software project, code review processes, and improved developers’ awareness on their daily tasks and activities.

Recent research within the field of Software Engineering have used GitHub, the largest hub for open source projects with almost 20 million users and 57 million repositories, to mine large amounts of source code to get more trustworthy results when developing machine and deep learning models. Mining GitHub comes with many challenges since the dataset is large and the data does not only contain quality software projects. In this project, we try to mine projects from GitHub based on earlier research by others and try to validate the quality by comparing the projects with a small subset of quality projects with the help of software complexity metrics.

Este trabalho de tese apresenta o Modelo Presença Plus (PPlus) para identificação de pistas textuais denotadoras de presença social em interações discursivas feitas por alunos em fóruns e chats educacionais. O grau de presença social (PS) é um indicativo de como os sujeitos interagem entre si e com o ambiente de aprendizagem; sendo considerado, na literatura, significativo para o desenvolvimento de relacionamentos e fortalecimento de sentimento de pertencimento no grupo. O trabalho se baseia na vertente Pragmática da Linguística, campo que enfatiza a importância de se considerar o contexto de produção dos eventos comunicativos e a dinâmica dialógica entre os interlocutores. Considerando que o mapeamento das interações dos discentes para detectar e avaliar seu grau de presença pode se constituir uma tarefa complexa e morosa para tutores de cursos a distância, desenvolveu-se um software para realizar o processamento automático das mensagens eletrônicas visando torná-lo uma funcionalidade a ser adicionada a ambientes virtuais de ensino e aprendizagem (AVEAs). Apesar de alguns impasses referentes, particularmente, aos aspectos sintáticos dos textos, os resultados obtidos no processamento, por lexicometria, das postagens foram satisfatoriamente semelhantes aos levantados na análise manual. O modelo PPlus e a escala de graus de PS foram também testados em um segundo ambiente disponibilizado na plataforma Moodle, tendo apresentado resultados equivalentes. A sondagem com professores e tutores de cursos a distância forneceu dados que corroboram a proposta de uma ferramenta a ser inserida em AVEAs de modo a facilitar o acompanhamento de estados afetivos, grau de envolvimento e interação entre os participantes no e com o ambiente. / This thesis presents Presence Plus (PPLus), a model for identifying indicators of social presence in text-based interactions made by students in educational forums and chats. The degree of social presence (SP) can be an indicator of how individuals interact among themselves and with the learning environment, and is considered by the literature to be relevant for the development of relationships and the strengthening of the sense of belonging in the group. This study is based on Pragmatics, an area of Linguistics that emphasizes the importance of the context in communicative events and the dialogic dynamics among speakers. Considering that mapping students’ interactions, as well as detecting and evaluating their degree of SP, may be a complex and time-consuming task in distance learning tutoring, a software was developed to do the automatic processing of posts, aiming at making it a possible functionality in virtual learning environments (VLEs). Despite the few conflicting results, mostly related to textual syntactic relations, data from processing tests using lexicometrics were satisfactorily similar to those obtained by manual analysis. The PPlus model and the SP scale were also tested in a different course in the Moodle platform. Results from this experiment presented equally positive data. Feedback from the questionnaire answered by teachers and tutors working in distance learning courses support the proposal of a tool that may facilitate their assessment of affective states, involvement and text-based interaction dents within the environment.

Submitted by Rodrigo Souza (rodrigorgs@gmail.com) on 2015-08-10T11:52:14Z No. of bitstreams: 1 rodrigo-thesis-final.pdf: 3966742 bytes, checksum: a3ca54b041cfdc2f5dad0f568b6d3a61 (MD5) / Made available in DSpace on 2015-08-10T11:52:14Z (GMT). No. of bitstreams: 1 rodrigo-thesis-final.pdf: 3966742 bytes, checksum: a3ca54b041cfdc2f5dad0f568b6d3a61 (MD5) / Introdução: A escrita de mudanças no código-fonte para corrigir defeitos ou implementar novas funcionalidades é uma tarefa importante no desenvolvimento de software, uma vez que contribui para evoluir um sistema de software. Nem todas as mudanças, no entanto, são aceitas na primeira tentativa. Mudanças inadequadas podem ser rejeitadas por causa de problemas encontrados durante a revisão de código, durante o teste automatizado, ou durante o teste manual, possivelmente resultando em retrabalho. Nosso objetivo é entender melhor a associação estatística entre diferentes tipos de rejeição --- revisões de código negativas, commits suplementares, reversão de commits e reabertura de tíquetes ---, caracterizar seus impactos em um projeto e entender como elas são afetadas por certas mudanças de processo. Para este fim, esta tese apresenta uma análise de três grandes projetos de software livre desenvolvidos pela Mozilla Foundation, os quais sofreram mudanças significativas no seu processo, como a adoção de lançamentos frequentes. Métodos: Para perseguir nosso objetivo, nos baseamos em tíquetes e commits de um período de mais de quatro anos do histórico dos projetos. Computamos métricas sobre a ocorrência de diversos tipos de rejeição de mudanças e medimos o tempo que leva tanto para submeter uma mudança quanto para rejeitar mudanças inapropriadas. Além disso, validamos nossos resultados com desenvolvedores da Mozilla. Resultados: Descobrimos que técnicas usadas em estudos anteriores para detectar mudanças inadequadas são imprecisas; por isso, propusemos uma técnica alternativa. Determinamos que mudanças inadequadas são um problema relevante e diário, que afeta cerca de 18% de todos os tíquetes em um projeto. Também descobrimos que, quando a Mozilla adotou lançamentos frequentes, embora a proporção de commits revertidos tenha aumentado, as reversões foram realizadas mais cedo no processo. / Background: Writing source code changes to fix bugs or implement new features is an important software development task, as it contributes to evolve a software system. Not all changes are accepted in the first attempt, though. Inappropriate changes can be rejected because of problems found during code review, automated testing, or manual testing, possibly resulting in rework. Our objective is to better understand the statistical association between different types of rejection---negative code reviews, supplementary commits, reverts, and issue reopening---to characterize their impacts within a project, and to understand how they are affected by certain process changes. To this end, this thesis presents an analysis of three large open source projects developed by the Mozilla Foundation, which underwent significant changes in their process, such as the adoption of rapid releases. Methods: To pursue our objective, we analyzed issues and source code commits from over four years of the projects' history. We computed metrics on the occurrence of multiple types of change rejection and measured the time it takes both to submit a change and to reject inappropriate changes. Furthermore, we validated our findings by discussing them with Mozilla developers. Results: We found that techniques used in previous studies to detect inappropriate changes are imprecise; because of that, we proposed an alternative technique. We determined that inappropriate changes are a relevant, daily problem, that affects about 18% of all issues in a project. We also discovered that, under rapid releases, although the proportion of reverted commits at Mozilla increased, the reverts were performed earlier in the process.

Este trabalho de tese apresenta o Modelo Presença Plus (PPlus) para identificação de pistas textuais denotadoras de presença social em interações discursivas feitas por alunos em fóruns e chats educacionais. O grau de presença social (PS) é um indicativo de como os sujeitos interagem entre si e com o ambiente de aprendizagem; sendo considerado, na literatura, significativo para o desenvolvimento de relacionamentos e fortalecimento de sentimento de pertencimento no grupo. O trabalho se baseia na vertente Pragmática da Linguística, campo que enfatiza a importância de se considerar o contexto de produção dos eventos comunicativos e a dinâmica dialógica entre os interlocutores. Considerando que o mapeamento das interações dos discentes para detectar e avaliar seu grau de presença pode se constituir uma tarefa complexa e morosa para tutores de cursos a distância, desenvolveu-se um software para realizar o processamento automático das mensagens eletrônicas visando torná-lo uma funcionalidade a ser adicionada a ambientes virtuais de ensino e aprendizagem (AVEAs). Apesar de alguns impasses referentes, particularmente, aos aspectos sintáticos dos textos, os resultados obtidos no processamento, por lexicometria, das postagens foram satisfatoriamente semelhantes aos levantados na análise manual. O modelo PPlus e a escala de graus de PS foram também testados em um segundo ambiente disponibilizado na plataforma Moodle, tendo apresentado resultados equivalentes. A sondagem com professores e tutores de cursos a distância forneceu dados que corroboram a proposta de uma ferramenta a ser inserida em AVEAs de modo a facilitar o acompanhamento de estados afetivos, grau de envolvimento e interação entre os participantes no e com o ambiente. / This thesis presents Presence Plus (PPLus), a model for identifying indicators of social presence in text-based interactions made by students in educational forums and chats. The degree of social presence (SP) can be an indicator of how individuals interact among themselves and with the learning environment, and is considered by the literature to be relevant for the development of relationships and the strengthening of the sense of belonging in the group. This study is based on Pragmatics, an area of Linguistics that emphasizes the importance of the context in communicative events and the dialogic dynamics among speakers. Considering that mapping students’ interactions, as well as detecting and evaluating their degree of SP, may be a complex and time-consuming task in distance learning tutoring, a software was developed to do the automatic processing of posts, aiming at making it a possible functionality in virtual learning environments (VLEs). Despite the few conflicting results, mostly related to textual syntactic relations, data from processing tests using lexicometrics were satisfactorily similar to those obtained by manual analysis. The PPlus model and the SP scale were also tested in a different course in the Moodle platform. Results from this experiment presented equally positive data. Feedback from the questionnaire answered by teachers and tutors working in distance learning courses support the proposal of a tool that may facilitate their assessment of affective states, involvement and text-based interaction dents within the environment.