Ali Ouni

Do developers update their library dependencies?An empirical study on the impact of security advisories on library migration

Third-party library reuse has become common practice in contemporary software development, as it includes several benefits for developers. Library dependencies are constantly evolving, with newly added features and patches that fix bugs in older versions. To take full advantage of third-party reuse, developers should always keep up to date with the latest versions of their library dependencies. In this paper, we investigate the extent of which developers update their library dependencies. Specifically, we conducted an empirical study on library migration that covers over 4,600 GitHub software projects and 2,700 library dependencies. Results show that although many of these systems rely heavily on dependencies, 81.5% of the studied systems still keep their outdated dependencies. In the case of updating a vulnerable dependency, the study reveals that affected developers are not likely to respond to a security advisory. Surveying these developers, we find that 69% of the interviewees claimed to be unaware of their vulnerable dependencies. Moreover, developers are not likely to prioritize a library update, as it is perceived to be extra workload and responsibility. This study concludes that even though third-party reuse is common practice, updating a dependency is not as common for many developers.

MORE: A multi-objective refactoring recommendation approach to introducing design patterns and fixing code smells

Refactoring is widely recognized as a crucial technique applied when evolving object‐oriented software systems. If applied well, refactoring can improve different aspects of software quality including readability, maintainability, and extendibility. However, despite its importance and benefits, recent studies report that automated refactoring tools are underused much of the time by software developers. This paper introduces an automated approach for refactoring recommendation, called MORE, driven by 3 objectives: (1) to improve design quality (as defined by software quality metrics), (2) to fix code smells, and (3) to introduce design patterns. To this end, we adopt the recent nondominated sorting genetic algorithm, NSGA‐III, to find the best trade‐off between these 3 objectives. We evaluated the efficacy of our approach using a benchmark of 7 medium and large open‐source systems, 7 commonly occurring code smells (god class, feature envy, data class, spaghetti code, shotgun surgery, lazy class, and long parameter list), and 4 common design pattern types (visitor, factory method, singleton, and strategy). Our approach is empirically evaluated through a quantitative and qualitative study to compare it against 3 different state‐of‐the art approaches, 2 popular multiobjective search algorithms, and random search. The statistical analysis of the results confirms the efficacy of our approach in improving the quality of the studied systems while successfully fixing 84% of code smells and introducing an average of 6 design patterns. In addition, the qualitative evaluation shows that most of the suggested refactorings (an average of 69%) are considered by developers to be relevant and meaningful.

c-JRefRec: Change-based identification of Move Method refactoring opportunities

We propose, in this paper, a lightweight refactoring recommendation tool, namely c-JRefRec, to identify Move Method refactoring opportunities based on four heuristics using static and semantic program analysis. Our tool aims at identiying refactoring opportunities before a code change is committed to the codebase based on current code changes whenever the developer saves/compiles his code. We evaluate the efficiency of our approach in detecting Feature Envy smells and recommending Move Method refactorings to fix them on three Java open-source systems and 30 code changes. Results show that our approach achieves an average precision of 0.48 and 0.73 of recall and outperforms a state-of-the-art approach namely JDeodorant.

A Machine Learning-Based Approach to Detect Web Service Design Defects

Design defects are symptoms of poor design and implementation solutions adopted by developers during the development of their software systems. While the research community devoted a lot of effort to studying and devising approaches for detecting the traditional design defects in object-oriented (OO) applications, little knowledge and support is available for an emerging category of Web service interface design defects. Indeed, it has been shown that service designers and developers tend to pay little attention to their service interfaces design. Such design defects can be subjectively interpreted and hence detected in different ways. In this paper, we propose a novel approach, named WS3D, using machine learning techniques that combines Support Vector Machine (SVM) and Simulated Annealing (SA) to learn from real world examples of service design defects. WS3D has been empirically evaluated on a benchmark of Web services from 14 different application domains. We compared WS3D with the state-of-theart approaches which rely on traditional declarative techniques to detect service design defects by combining metrics and threshold values. Results show that WS3D outperforms the the compared approaches in terms of accuracy with a precision and recall scores of 91% and 94%, respectively.

Detecting Android smells using multi-objective genetic programming

The evolution rate of mobile applications is much higher than regular software applications having shorter release deadlines and smaller code base. Mobile applications tend to be evolved quickly by developers to meet several new customer requirements and fix discovered bugs. However, evolving the existing features and design may introduce bad design practices, also called code smells, which can highly decrease the maintainability and performance of these mobile applications. However, unlike the area of object-oriented software systems, the detection of code smells in mobile applications received a very little of attention. Recent, few studies defined a set of quality metrics for Android applications and proposed a support to manually write a set of rules to detect code smells by combining these quality metrics. However, finding the best combination of metrics and their thresholds to identify code smells is left to the developer as a manual process. In this paper, we propose to automatically generate rules for the detection of code smells in Android applications using a multi-objective genetic programming algorithm (MOGP). The MOGP algorithm aims at finding the best set of rules that cover a set of code smell examples of Android applications based on two conflicting objective functions of precision and recall. We evaluate our approach on 184 Android projects with source code hosted in GitHub. The statistical test of our results show that the generated detection rules identified 10 Android smell types on these mobile applications with an average correctness higher than 82% and an average relevance of 77% based on the feedback of active developers of mobile apps.