02:00 - 02:30

• Learning to Log: Helping Developers Make Informed Logging Decisions

  Logging is a common programming practice of practical importance to collect system runtime information for postmortem analysis. Strategic logging placement is desired to cover necessary runtime information without incurring unintended consequences (e.g., Performance overhead, trivial logs). However, in current practice, there is a lack of rigorous specifications for developers to govern their logging behaviours. Logging has become an important yet tough decision which mostly depends on the domain knowledge of developers. To reduce the effort on making logging decisions, in this paper, we propose a "learning to log" framework, which aims to provide informative guidance on logging during development. As a proof of concept, we provide the design and implementation of a logging suggestion tool, Log Advisor, which automatically learns the common logging practices on where to log from existing logging instances and further leverages them for actionable suggestions to developers. Specifically, we identify the important factors for determining where to log and extract them as structural features, textual features, and syntactic features. Then, by applying machine learning techniques (e.g., Feature selection and classifier learning) and noise handling techniques, we achieve high accuracy of logging suggestions. We evaluate Log Advisor on two industrial software systems from Microsoft and two open-source software systems from Git Hub (totally 19.1M LOC and 100.6K logging statements). The encouraging experimental results, as well as a user study, demonstrate the feasibility and effectiveness of our logging suggestion tool. We believe our work can serve as an important first step towards the goal of "learning to log".

Jieming Zhu; Pinjia He; Qiang Fu; Hongyu Zhang; Michael R. Lyu; Dongmei Zhang

The Chinese University of Hong Kong, Hong Kong; Microsoft Research, China

02:30 - 03:00

• Mining Apps for Abnormal Usage of Sensitive Data

  What is it that makes an app malicious? One important factor is that malicious apps treat sensitive data differently from benign apps. To capture such differences, we mined 2,866 benign Android applications for their data flow from sensitive sources, and compare these flows against those found in malicious apps. We find that (a) for every sensitive source, the data ends up in a small number of typical sinks, (b) these sinks differ considerably between benign and malicious apps, (c) these differences can be used to flag malicious apps due to their abnormal data flow, and (d) malicious apps can be identified by their abnormal data flow alone, without requiring known malware samples. In our evaluation, our MUDFLOW prototype correctly identified 86.4% of all novel malware, and 90.1% of novel malware leaking sensitive data.

Vitalii Avdiienko; Konstantin Kuznetsov; Alessandra Gorla; Andreas Zeller; Steven Arzt; Siegfried Rasthofer; Eric Bodden

Saarland University, Germany; TU Darmstadt, Germany

03:00 - 03:30

• Tracking Static Analysis Violations over Time to Capture Developer Characteristics

  Many interesting questions about the software quality of a code base can only be answered adequately if fine-grained information about the evolution of quality metrics over time and the contributions of individual developers is known. We present an approach for tracking static analysis violations (which are often indicative of defects) over the revision history of a program, and for precisely attributing the introduction and elimination of these violations to individual developers. As one application, we demonstrate how this information can be used to compute "fingerprints" of developers that reflect which kinds of violations they tend to introduce or to fix. We have performed an experimental study on several large open-source projects written in different languages, providing evidence that these fingerprints are well-defined and capture characteristic information about the coding habits of individual developers.

Max Schaefer; Arthur Baars; Anders Henriksen; Pavel Avgustinov; Galen Menzel; Oege de Moor; Julian Tibble; Greg Lavender

Semmle Ltd., UK