Andrea Fornaia

Combinatorial Interaction Testing of a Java Card Static Verifier

We present a combinatorial interaction testing approach to perform validation testing of a fundamental component for the security of Java Cards: the byte code verifier. Combinatorial testing of all states of the Java Card virtual machine has been adopted as the coverage criteria. We developed a formal model of the Java Card byte code syntax to enable the combinatorial enumeration of well-formed states, and a formal model of the byte code semantic rules to be able to distinguish between well-typed and ill-typed ones, and to derive actual test programs from them. A complete framework has been implemented, enabling fully automated application and evaluation of the conformance tests to any verifier implementation.

Making Android Apps Data-Leak-Safe by Data Flow Analysis and Code Injection

Some support is needed in order to shun the possibility that sensitive data handled by applications are sent to improper destinations. Although apps running on Android OS declare the accessed services, once the user accepts, the application receives complete permissions and may use sensitive data improperly. Some tools have emerged to check data access and flow, however such tools are either based on static analysis or dynamic tracking. The former brings no overhead at run-time, but is less precise, the latter can bring a costly overhead during execution, having to monitor any access to sensitive data and all destinations. Our approach is innovative in that it takes advantage of static analysis and then monitors at run-time only data paths that potentially give sensitive data out. The correspondent tool is tailored to Android environment, tool-chain, libraries, and typical requirements that applications have to satisfy.

Assessing the Correctness of JVM Implementations

We present a study on a significantly large and varied set of freely available Java virtual machines implementations. The aim of the study is to assess their level of conformity to the structural constraints of the Java language specification. In order to do that we set up a refined framework for the automated generation of a conformance checking test suite. In the framework, the test cases are generated by model checking the Java language specifications in order to target each a specific constraint. Complete coverage of all the modeled constraints within a limited number of tests is obtained by means of a combinatorial covering technique. Results obtained from the test suite application are presented and discussed and proved the efficacy and validity of the underlying approach to validation.

Is My Code Easy to Port? Using Taint Analysis to Evaluate and Assist Code Portability

Code portability is a desirable non-functional requirement. The most established metric evaluating it consists of counting the number of instructions that use platform specific APIs. Generally, instructions using APIs are preceded or followed by related code that e.g. prepares some input for a call or analyses the return value. This paper proposes a taint analysis approach to identify code portions that are related by means of data dependence and are connected to a given platform. By considering both direct calls to platform APIs and the data dependence, we provide a more precise and realistic indication of the code that should be considered in case of platform migration. The proposed approach has been used to analyse an industrial application, and gathered results have been examined to show the validity of our proposal.

An AOP-RBPNN approach to infer user interests and mine contents on social media

Usersengaginginonlinesocialnetworksprovidesparsedataaboutthemselves,e.g.byparticipatingin groupstodiscuss some topics, linking to each other, etc. Such sparse data can be carefully used to build both user and group profiles, automatically. We put forward a multi-agent system that collects and analyses data scattered on an online social network. The analysis aims at characterisingbothusers,byinsertingthemintocategories,andgroups,withasetofkeywords.Theuserclassificationtechnology is an especially devised neural network that extracts relevant characteristics from raw data characterising user behaviour, and then provides for unknown users the most likely category. Thanks to the said classification tool, some online activities performed by a given user that are unusual for such a user are automatically detected. Moreover, according to the user interests, contents inserted on public pages, which the user is unaware of, can be automatically found and suggested.

Cloud Services for On-Demand Vehicles Management

Smart cities providing connectivity to users and other advanced services can be leveraged to improve public transport services. This paper proposes a solution that lets citizens request a public vehicle to perform additional stops off the main route, hence achieving a customisation of the transport operator services to better assist users. A cloud infrastructure and a proper distributed architecture have been designed to assess whether user requests can be accepted. The proposed software solution considers viable the requests that can fit to available secondary routes and to other user demands that have been previously accepted. Then, drivers will be alerted in advance in order to adapt their route. DOI: http://dx.doi.org/10.5755/j01.itc.46.4.17331

DeDuCT: A Data Dependence Based Concern Tagger for Modularity Analysis

Modularity of a software system can be assessed once responsibilities of each method and class have been determined. Generally, developers attribute responsibilities to methods and classes manually. This can be problematic given that it relies on developers judgement and effort. This paper proposes an approach to automatically attribute concern tags to each instructions. The approach is based on taint analysis to determine which code lines are related to each other by data dependence. Moreover, Java APIs provide the tags used to mark code lines. The automatic concern tagging that we bring about is used to find out how responsibilities are spread in the code, and then to suggest refactoring activities in case tangling occurs.

VSC Track at WETICE 2016: Summary Report and Preface

This report provides an introduction to the papers accepted for the VSC track at IEEE WETICE 2016, held in Paris (France), from June 13th to 15th, 2016.

Enhancing City Transportation Services Using Cloud Support

Smart cities will provide enhanced monitoring of crucial infrastructure resources, connectivity to users and advanced information services. Thanks to gathered data the quality of traditional services and infrastructures will be improved, and further services can emerge, such as novel urban transportation services. This paper devises a solution that enforces the cooperation between mobile devices and cloud infrastructures with the aim to bring public transportation where the people need it. Thanks to smart phones, sensing user locations, a request for transportation vehicles can be sent to a cloud-based intelligence, which filters and serves requests according to available transport routes, and their adaptation to user needs. Then, the available transportation vehicles will be timely alerted to operate accordingly.

VSC Track Report

This report provides an introduction to the papers accepted for the VSC track at IEEE WETICE 2013.