La Tesis investiga técnicas ágiles dentro del paradigma declarativo para dar solución a dos problemas: el análisis de programas y la inferencia de especificaciones a partir de programas escritos en lenguajes multiparadigma y en lenguajes imperativos con tipos, objetos, estructuras y punteros. Respecto al estado actual de la tesis, la parte de análisis de programas ya está consolidada, mientras que la parte de inferencia de especificaciones sigue en fase de desarrollo activo. La primera parte da soluciones para la ejecución de análisis de punteros especificados en Datalog. En esta parte se han desarrollado dos técnicas de ejecución de especificaciones en dicho lenguaje Datalog: una de ellas utiliza resolutores de sistemas de ecuaciones booleanas, y la otra utiliza la lógica de reescritura implementada eficientemente en el lenguaje Maude. La segunda parte desarrolla técnicas de inferencia de especificaciones a partir de programas. En esta parte se han desarrollado dos métodos de inferencia de especificaciones. El primer método se desarrolló para el lenguaje lógico-funcional Curry y permite inferir especificaciones ecuacionales mediante interpretación abstracta de los programas. El segundo método está siendo desarrollado para lenguajes imperativos realistas, y se ha aplicado a un subconjunto del lenguaje de programación C. Este método permite inferir especificaciones en forma de reglas que representan las distintas relaciones entre las propiedades que el estado de un programa satisface antes y después de su ejecución. Además, estas propiedades son expresables en términos de las abstracciones funcionales del propio programa, resultando en una especificación de muy alto nivel y, por lo tanto, de más fácil comprensión. / Feliú Gabaldón, MA. (2013). Logic-based techniques for program analysis and specification synthesis [Tesis doctoral no publicada]. Universitat Politècnica de València. https://doi.org/10.4995/Thesis/10251/33747 / TESIS

Program checking is indisputably important, especially if originating in formal methods. VeriFIT at FIT BUT uses custom Code Listener (CL) infrastructure modularly interconnecting the front-end, typically a code parser adapter, and the back-end, typically an analyser. Our aim is to offer a former as a compact alternative to existing GCC compiler plug-in. This adapter uses linearized code mediated by sparse library for static analysis of programs in C. According to the experiments with one of the main CL analysers, Predator tool and its tests suite, our product - clsp program - is successful successful in roughly 75% of cases in comparison with the GCC plug-in. Further improvements are expected.

[ES] Vivimos en una sociedad donde la digitalización está presente en nuestro día a día. Nos despertamos con la alarma de nuestro teléfono móvil, apuntamos nuestras reuniones en nuestro calendario digital, guardamos nuestros archivos en el almacenamiento en la nube, y entramos a las redes sociales prácticamente a diario. Cada una de estas acciones se ejecuta sobre un sistema software que asegura su correcto funcionamiento. Esta digitalización masiva ha hecho que el desarrollo de software se dispare en los últimos años. Durante el ciclo de vida de un sistema software, la etapa de mantenimiento supone un gasto de billones de dólares anuales. La razón detrás de este gasto es la aparición de bugs o errores que no fueron detectados durante la fase de producción del software, y que se traducen en un mal funcionamiento del sistema. Por este motivo, las técnicas de detección y localización de errores como el testeo, la verificación o la depuración son un factor clave para asegurar la calidad del software. Aunque son muchas las técnicas que se utilizan para la depuración, testeo y verificación de sistemas software, esta tesis se centra solo en algunas de ellas. En concreto, esta tesis presenta mejoras en la técnica de fragmentación de programas (depuración), una nueva metodología para hacer testeo de regresión (testeo) y una nueva implementación del modelo de verificación de diseño-por-contrato para el lenguaje de programación Erlang (verificación). Las mejoras propuestas para la técnica de fragmentación de programas incluyen diversas propuestas aplicables a diferentes escenarios: (i) mejoras en la representación y fragmentación de programas orientados a objetos, (ii) mejoras en la representación y fragmentación de estructuras de datos complejas (objetos, vectores, listas, tuplas, registros, etc.), (iii) un nuevo modelo de grafo basado en una representación más detallada de programas, aumentando la expresividad del grafo y generando fragmentos de código más precisos como resultado, y (iv) una nueva técnica para calcular fragmentos mínimos de un programa dado un conjunto específico de posibles valores de entrada. Por otro lado, la nueva metodología para hacer testeo de regresión se denomina testeo de punto de interés, e introduce la posibilidad de comparar automáticamente el comportamiento de un punto cualquiera del código dadas dos versiones del mismo sistema software. Por último, la tesis contiene la nueva implementación del modelo de verificación de programas diseño-por-contrato para el lenguaje de programación Erlang, donde se explican en detalle los nuevos tipos de contratos diseñados para las partes secuencial y concurrente de Erlang. Todos los análisis presentados en esta tesis han sido formalmente definidos y su corrección ha sido probada, asegurando de esta manera que los resultados tendrán el grado de fiabilidad necesario para ser aplicados a sistemas reales. Otra contribución de esta tesis es la implementación de dos herramientas de fragmentación de programas para dos lenguajes de programación diferentes (Java y Erlang), una herramienta para realizar testeo de punto de interés para el lenguaje de programación Erlang y un sistema para ejecutar verificación de diseño-por-contrato en Erlang. Es de destacar que todas las herramientas implementadas a lo largo del desarrollo de esta tesis son herramientas de código abierto y públicamente accesibles, de manera que pueden ser usadas o extendidas por cualquier investigador interesado en este area. / [CA] Vivim en una societat on la digitalització està present al nostre dia a dia. Ens alcem amb l'alarma del nostre telèfon mòbil, apuntem les nostres reunions al nostre calendari digital, guardem els nostres arxius al emmagatzematge al núvol, i entrem a las xarxes socials pràcticament a diari. Cadascuna d'aquestes accions s'executa sobre un sistema programari que assegura el seu correcte funcionament. Aquesta digitalizació massiva ha fet que el desenvolupament de programari es dispare en els últims anys. Durant el cicle de vida de un sistema programari, l'etapa de manteniment suposa una despesa de bilions de dòlars anuals. La raó darrere d'aquesta despesa és l'aparició de bugs o errors que no van ser detectats durant la fase de producció del programari, i que es traduïxen en un mal funcionament del sistema Per este motiu, les tècniques de detecció i localització d'errors com el testeig, la verificació o la depuració són un factor clau per a assegurar la qualitat del programari. Encara que són moltes les tècniques utilitzades per a la depuració, testeig i verificació de sistemes programari, esta tesi es centra només en algunes d'elles. En concret, esta tesi presenta millores en la tècnica de fragmentació de programes (depuració), una nova metodologia per a fer testeig de regressió (testeig) i una nova implementació del model de verificació de disseny-per-contracte per al llenguatge de programació Erlang (verificació). Les millores proposades per a la tècnica de fragmentació de programes inclouen diverses propostes aplicables a diferents escenaris: (i) millores en la representació i fragmentació de programes orientats a objectes, (ii) millores en la representació i fragmentació d'estructures de dades complexes (objectes, vectors, llistes, tuples, registres, etc.), (iii) un nou model de graf basat en una representació més detallada de programes, augmentant l'expressivitat del graf i generant fragments de codi més precisos com a resultat, i (iv) una nova tècnica per a calcular fragments mínims d'un programa donat un conjunt específic de possibles valors d'entrada. D'altra banda, la nova metodologia per a fer testeig de regressió es denomina testeig de punt d'interés, i introduïx la possibilitat de comparar automàticament el comportament d'un punt qualsevol del codi donades dos versions del mateix sistema programari. Finalment, la tesi conté la nova implementació del model de verificació de programes disseny-per-contracte per al llenguatge de programació Erlang, on s'expliquen en detall els nous tipus de contractes dissenyats per a les parts seqüencial i concurrent d'Erlang. Totes les anàlisis presentades en aquesta tesi han sigut formalment definides i la seua correcció ha sigut provada, assegurant d'aquesta manera que els resultats tindran el grau de fiabilitat necessari per a ser aplicats a sistemes reals. Una altra contribució d'aquesta tesi és la implementació de dos ferramentes de fragmentació de programes per a dos llenguatges de programació diferents (Java i Erlang), una ferramenta per a realitzar testeig the punt d'interés per al llenguatge de programació Erlang i un sistema per a executar verificació de disseny-per-contracte a Erlang. Cal destacar que totes les ferramentes implementades al llarg del desenvolupament d'aquesta tesi són ferramentes de codi obert i públicament accessibles, de manera que poden ser usades o esteses per qualsevol investigador interessat en el tema. / [EN] We live in a society where digitalisation is present in our everyday life. We wake up with the alarm of our mobile phone, book our meetings in our digital calendar, save all our media in the cloud storage, and spend time in social networks almost daily. Every one of these tasks is run over a software system that ensures its correct functionality. This massive digitalisation has made software development to shoot up in the last years. During the lifetime of software systems, the maintenance process entails a waste of billions of dollars every year. The cause of this waste is the occurrence of bugs or errors undetected during the software production, which result in a malfunction of the system. For this reason, error detection and localisation techniques, such as testing, verification, or debugging, are a key factor to ensure software quality. Although many different techniques are used for the debugging, testing, and verification of software systems, this thesis focus on only some of them. In particular, this thesis presents improvements in the program slicing technique (debugging field), a new approach for regression testing (testing field), and a new implementation of the design-by-contract verification model for the Erlang programming language (verification field). The improvements proposed for the program slicing technique include several enhancements applicable to different scenarios: (i) improvements in the representation and slicing of object-oriented programs, (ii) enhancements in the representation and slicing of (possibly recursive) complex data structures (objects, arrays, lists, tuples, records, etc.), (iii) a new graph model based on a fine-grained representation of programs that augments the expressivity of the graph and provides more accurate slicing results, and (iv) a new technique to compute minimal slices for a program given a set of specific program inputs. On the other side, the new approach for regression testing is called point of interest testing, and it introduces the possibility of automatically comparing the behaviour of any arbitrary point in the code given two versions of the same software system. Finally, the thesis presents a new implementation of the design-by-contract verification model for the Erlang programming language, where new types of contracts are explained in detail for both the sequential and concurrent parts of Erlang. All the analyses presented here have been formally defined and their correctness have been proved, ensuring that the results will have the reliability degree needed for real-life systems. Another contribution of this thesis is the implementation of two program slicers for two different programming languages (Java and Erlang), a tool to perform point of interest testing for the Erlang programming language, and a system to run design-by-contract verification in Erlang. It is worth mentioning that all the tools implemented in this thesis are open source and publicly available, so they can be used or extended by any interested researcher. / Pérez Rubio, S. (2023). Analysis Techniques for Software Maintenance [Tesis doctoral]. Universitat Politècnica de València. https://doi.org/10.4995/Thesis/10251/193146

This study sought to determine if the 2012 Eighth Grade Summer Reading Camp curriculum was aligned with the students’ needs. To determine if curriculum alignment existed, the researcher completed a qualitative and quantitative study. The qualitative study consisted of interviewing the school district program development team to ascertain how the curriculum was designed. The quantitative segment involved running descriptive statistics for student performance on the Pre-program Benchmark Examination. The determined student knowledge voids were compared to the amount of instructional time spent taught teaching those individual benchmarks to ascertain if the curriculum was aligned with student need. The curriculum was determined to not be aligned with the performance deficiencies of the students.

No description available.

No description available.

With recent advances in electronics and communication technologies, our daily lives are immersed in an environment of Internet-connected smart things. Despite the great convenience brought by the development of these technologies, privacy concerns and security issues are two topics that deserve more attention. On one hand, as smart things continue to grow in their abilities to sense the physical world and capabilities to send information out through the Internet, they have the potential to be used for surveillance of any individuals secretly. Nevertheless, people tend to adopt wearable devices without fully understanding what private information can be inferred and leaked through sensor data. On the other hand, security issues become even more serious and lethal with the world embracing the Internet of Things (IoT). Failures in computing systems are common, however, a failure now in IoT may harm people's lives. As demonstrated in both academic research and industrial practice, a software vulnerability hidden in a smart vehicle may lead to a remote attack that subverts a driver's control of the vehicle. Our approach to the aforementioned challenges starts by understanding privacy leakage in the IoT era and follows with adding defense layers to the IoT system with attackers gaining increasing capabilities. The first question we ask ourselves is "what new privacy concerns do IoT bring". We focus on discovering information leakage beyond people's common sense from even seemingly benign signals. We explore how much private information we can extract by designing information extraction systems. Through our research, we argue for stricter access control on newly coming sensors. After noticing the importance of data collected by IoT, we trace where sensitive data goes. In the IoT era, edge nodes are used to process sensitive data. However, a capable attacker may compromise edge nodes. Our second research focuses on applying trusted hardware to build trust in large-scale networks under this circumstance. The application of trusted hardware protects sensitive data from compromised edge nodes. Nonetheless, if an attacker becomes more powerful and embeds malicious logic into code for trusted hardware during the development phase, he still can secretly steal private data. In our third research, we design a static analyzer for detecting malicious logic hidden inside code for trusted hardware. Other than the privacy concern of data collected, another important aspect of IoT is that it affects the physical world. Our last piece of research work enables a user to verify the continuous execution state of an unmanned vehicle. This way, people can trust the integrity of the past and present state of the unmanned vehicle. / Doctor of Philosophy / The past few years have witnessed a rising in computing and networking technologies. Such advances enable the new paradigm, IoT, which brings great convenience to people's life. Large technology companies like Google, Apple, Amazon are creating smart devices such as smartwatch, smart home, drones, etc. Compared to the traditional internet, IoT can provide services beyond digital information by interacting with the physical world by its sensors and actuators. While the deployment of IoT brings value in various aspects of our society, the lucrative reward from cyber-crimes also increases in the upcoming IoT era. Two unique privacy and security concerns are emerging for IoT. On one hand, IoT brings a large volume of new sensors that are deployed ubiquitously and collect data 24/7. User's privacy is a big concern in this circumstance because collected sensor data may be used to infer a user's private activities. On the other hand, cyber-attacks now harm not only cyberspace but also the physical world. A failure in IoT devices could result in loss of human life. For example, a remotely hacked vehicle could shut down its engine on the highway regardless of the driver's operation. Our approach to emerging privacy and security concerns consists of two directions. The first direction targets at privacy protection. We first look at the privacy impact of upcoming ubiquitous sensing and argue for stricter access control on smart devices. Then, we follow the data flow of private data and propose solutions to protect private data from the networking and cloud computing infrastructure. The other direction aims at protecting the physical world. We propose an innovative method to verify the cyber state of IoT devices.

State explosion in model checking continues to be the primary obstacle to widespread use of software model checking. The large input ranges of variables used in software is the main cause of state explosion. As software grows in size and complexity the problem only becomes worse. As such, model checking research into data abstraction as a way of mitigating state explosion has become more and more important. Data abstractions aim to reduce the effect of large input ranges. This work focuses on a static program analysis technique called dead variable analysis. The goal of dead variable analysis is to discover variable assignments that are not used. When applied to model checking, this allows us to ignore the entire input range of dead variables and thus reduce the size of the explored state space. Prior research into dead variable analysis for model checking does not make full use of dynamic run-time information that is present during model checking. We present an algorithm for intraprocedural dead variable analysis that uses dynamic run-time information to find more dead variables on-the-fly and further reduce the size of the explored state space. We introduce a definition for the maximal state space reduction possible through an on-the-fly dead variable analysis and then show that our algorithm produces a maximal reduction in the absence of non-determinism.

Immersive applications, such as computer gaming, computer vision and video codecs, are an important emerging class of applications with QoS requirements that are difficult to characterize and control using traditional methods. This thesis proposes new techniques reliant on execution-time variance to both characterize and control program behavior. The proposed techniques are intended to be broadly applicable to a wide variety of immersive applications and are intended to be easy for programmers to apply without needing to gain specialized expertise. First, we create new QoS controllers that programmers can easily apply to their applications to achieve desired application-specific QoS objectives on any platform or application data-set, provided the programmers verify that their applications satisfy some simple domain requirements specific to immersive applications. The controllers adjust programmer-identified knobs every application frame to effect desired values for programmer-identified QoS metrics. The control techniques are novel in that they do not require the user to provide any kind of application behavior models, and are effective for immersive applications that defy the traditional requirements for feedback controller construction. Second, we create new profiling techniques that provide visibility into the behavior of a large complex application, inferring behavior relationships across application components based on the execution-time variance observed at all levels of granularity of the application functionality. Additionally for immersive applications, some of the most important QoS requirements relate to managing the execution-time variance of key application components, for example, the frame-rate. The profiling techniques not only identify and summarize behavior directly relevant to the QoS aspects related to timing, but also indirectly reveal non-timing related properties of behavior, such as the identification of components that are sensitive to data, or those whose behavior changes based on the call-context.

The constant modification of software during its life cycle poses many challenges for developers and testers because changes might not behave as expected or may introduce erroneous side effects. For those reasons, it is of critical importance to analyze, test, and validate software every time it changes. The most common method for validating modified software is regression testing, which identifies differences in the behavior of software caused by changes and determines the correctness of those differences. Most research to this date has focused on the efficiency of regression testing by selecting and prioritizing existing test cases affected by changes. However, little attention has been given to finding whether the test suite adequately tests the effects of changes (i.e., behavior differences in the modified software) and which of those effects are missed during testing. In practice, it is necessary to augment the test suite to exercise the untested effects. The thesis of this research is that the effects of changes on software behavior can be computed with enough precision to help testers analyze the consequences of changes and augment test suites effectively. To demonstrate this thesis, this dissertation uses novel insights to develop a fundamental understanding of how changes affect the behavior of software. Based on these foundations, the dissertation defines and studies new techniques that detect these effects in cost-effective ways. These techniques support test-suite augmentation by (1) identifying the effects of individual changes that should be tested, (2) identifying the combined effects of multiple changes that occur during testing, and (3) optimizing the computation of these effects.