Jason A. Osborne

Evaluating Complexity, Code Churn, and Developer Activity Metrics as Indicators of Software Vulnerabilities

Security inspection and testing require experts in security who think like an attacker. Security experts need to know code locations on which to focus their testing and inspection efforts. Since vulnerabilities are rare occurrences, locating vulnerable code locations can be a challenging task. We investigated whether software metrics obtained from source code and development history are discriminative and predictive of vulnerable code locations. If so, security experts can use this prediction to prioritize security inspection and testing efforts. The metrics we investigated fall into three categories: complexity, code churn, and developer activity metrics. We performed two empirical case studies on large, widely used open-source projects: the Mozilla Firefox web browser and the Red Hat Enterprise Linux kernel. The results indicate that 24 of the 28 metrics collected are discriminative of vulnerabilities for both projects. The models using all three types of metrics together predicted over 80 percent of the known vulnerable files with less than 25 percent false positives for both projects. Compared to a random selection of files for inspection and testing, these models would have reduced the number of files and the number of lines of code to inspect or test by over 71 and 28 percent, respectively, for both projects.

Predicting failures with developer networks and social network analysis

Software fails and fixing it is expensive. Research in failure prediction has been highly successful at modeling software failures. Few models, however, consider the key cause of failures in software: people. Understanding the structure of developer collaboration could explain a lot about the reliability of the final product. We examine this collaboration structure with the developer network derived from code churn information that can predict failures at the file level. We conducted a case study involving a mature Nortel networking product of over three million lines of code. Failure prediction models were developed using test and post-release failure data from two releases, then validated against a subsequent release. One models prioritization revealed 58% of the failures in 20% of the files compared with the optimal prioritization that would have found 61% in 20% of the files, indicating that a significant correlation exists between file-based developer network metrics and failures.

System test case prioritization of new and regression test cases

Test case prioritization techniques have been shown to be beneficial for improving regression-testing activities. With prioritization, the rate of fault detection is improved, thus allowing testers to detect faults earlier in the system-testing phase. Most of the prioritization techniques to date have been code coverage-based. These techniques may treat all faults equally. We build upon prior test case prioritization research with two main goals: (1) to improve user-perceived software quality in a cost effective way by considering potential defect severity and (2) to improve the rate of detection of severe faults during system-level testing of new code and regression testing of existing code. We present a value-driven approach to system-level test case prioritization called the prioritization of requirements for test (PORT). PORT prioritizes system test cases based upon four factors: requirements volatility, customer priority, implementation complexity, and fault proneness of the requirements. We conducted a PORT case study on four projects developed by students in advanced graduate software testing class. Our results show that PORT prioritization at the system level improves the rate of detection of severe faults. Additionally, customer priority was shown to be one of the most important prioritization factors contributing to the improved rate of fault detection.

Transcriptional analysis of Pinus sylvestris roots challenged with the ectomycorrhizal fungus Laccaria bicolor

BackgroundSymbiotic ectomycorrhizal associations of fungi with forest trees play important and economically significant roles in the nutrition, growth and health of boreal forest trees, as well as in nutrient cycling. The ecology and physiology of ectomycorrhizal associations with Pinus sp are very well documented but very little is known about the molecular mechanisms behind these mutualistic interactions with gymnosperms as compared to angiosperms.ResultsUsing a micro-array approach, the relative abundance of 2109 EST transcripts during interaction of Pinus sylvestris roots with the ectomycorrhizal fungus was profiled. The results reveal significant differential expression of a total of 236 ESTs, 96 transcripts differentially abundant after 1 day of physical contact with the fungus, 134 transcripts after 5 days and only 6 after 15 days at early stages of mantle formation on emerging lateral roots. A subset of cell wall modification and stress related genes was further assessed by quantitative reverse transcription PCR at late stages of mycorrhizal development coinciding with Hartig net formation. The results reveal down regulation of gene transcripts involved in general defence mechanism (e.g. antimicrobial peptide) as well as those involved in cell wall modification (e.g. glycine rich protein, xyloglucan endo transglycosylase).ConclusionThis study constitutes the first attempt to characterize the transcriptome of the plant partner in the Pinus sylvestris – Laccaria bicolor model system. We identified 236 ESTs which are potentially important for molecular regulation of a functional symbiotic association in conifer host. The results highlight similarities with other studies based on angiosperm model systems, nevertheless some differences were found in the timing and spatial scale of gene regulation during ectomycorrhiza development in gymnosperms. The present study has identified a number of potentially important molecular events responsible for the initiation and regulation of biochemical, physiological and morphological changes during development of a fully functional symbiosis that are relevant for gymnosperm hosts.

Mesenchymal stem cell-seeded collagen matrices for bone repair: effects of cyclic tensile strain, cell density, and media conditions on matrix contraction in vitro.

Type I collagen is the most abundant extracellular matrix protein in bone and contains arginine- glycine-aspartic acid sequences that promote cell adhesion and proliferation. We have previously shown that human mesenchymal stem cells (hMSCs) seeded in three-dimensional (3D) collagen gels upregulate BMP-2 mRNA expression in response to tensile strain, indicative of osteogenesis. Therefore, collagen could be a promising scaffold material for functional bone tissue engineering using hMSCs. However, high contraction of the collagen gels by hMSCs poses a challenge to creating large, tissue-engineered bone constructs. The effects of cyclic tensile strain, medium (with and without dexamethasone), and hMSC seeding density on contraction of collagen matrices have not been investigated. hMSCs were seeded in 3D collagen gels and subjected to cyclic tensile strain of 10% or 12% for 4 h/day at a frequency of 1 Hz in osteogenic-differentiating or complete MSC growth media for up to 14 days. Viability of hMSCs was not affected by strain or media conditions. While initial seeding density affected matrix contraction alone, there was a high interdependence of strain and medium on matrix contraction. These findings suggest a correlation between hMSC proliferation and osteogenic differentiation on collagen matrix contraction that is affected by media, cell-seeding density, and cyclic tensile strain. It is vital to understand the effects of culture conditions on collagen matrix contraction by hMSCs in order to consider hMSC-seeded collagen constructs for functional bone tissue engineering in vitro.

Prioritizing software security fortification throughcode-level metrics

Limited resources preclude software engineers from finding and fixing all vulnerabilities in a software system. We create predictive models to identify which components are likely to have the most security risk. Software engineers can use these models to make measurement-based risk management decisions and to prioritize software security fortification efforts, such as redesign and additional inspection and testing. We mined and analyzed data from a large commercial telecommunications software system containing over one million lines of code that had been deployed to the field for two years. Using recursive partitioning, we built attack-prone prediction models with the following code-level metrics: static analysis tool alert density, code churn, and count of source lines of code. One model identified 100% of the attack-prone components (40% of the total number of components) with an 8% false positive rate. As such, the model could be used to prioritize fortification efforts in the system.

Examining the compatibility of student pair programmers

Pair programming has been shown to be beneficial for both students and teaching staff in university courses. A two-phased study of 1350 students was conducted at North Carolina State University from 2002-2005 to determine if teaching staff can proactively form compatible pairs based upon any of the following factors: personality type, learning style, skill level, programming self esteem, work ethic, or time management preference. We examined compatibility among freshmen, advanced undergraduate and graduate student pair programmers. We have found that overall 93% of students are compatible with their partners. Students notably preferred to pair with a partner that he or she perceived to be of similar or higher skill level to them, which can be predicted by grouping students with similar grade point average. Additionally, pairs comprised of a sensor and an intuitor learning style seem to be compatible, and pairs with differing work ethic are generally not compatible

Early estimation of software quality using in-process testing metrics: a controlled case study

In industrial practice, information on post-release field quality of a product tends to become available too late in the software development process to affordably guide corrective actions. An important step towards remediation of this problem of late information lies in the ability to provide an early estimation of software post-release field quality. This paper presents the use of a suite of in-process metrics that leverages the software testing effort to provide (1) an estimation of potential software field quality in early software development phases, and (2) the identification of low quality software programs. A controlled case study conducted at North Carolina State University provides initial indication that our approach is effective for making an early assessment of post-release field quality.

KI-impregnated oyster shell as a solid catalyst for soybean oil transesterification.

Research on inexpensive and green catalysts is needed for economical production of biodiesel. The goal of the research was to test KI-impregnated calcined oyster shell as a solid catalyst for transesterification of soybean oil. Specific objectives were to characterize KI-impregnated oyster shell, determine the effect of reaction variables and reaction kinetics. The catalyst was synthesized by impregnating KI on calcined oyster shells. X-ray diffraction analysis indicated the presence of portlandite and potassium iodide on the surface and a 31-fold increase in surface as a result of calcination and KI impregnation. Under the conditions tested, ideal reaction variables were 1 mmol g(-1) for catalyst loading, 50 °C for temperature, 10:1 for methanol/oil, and 4h for reaction time. The transesterification followed a first-order reaction (k=0.4385 h(-1)). The option of using oyster shell for the production of transesterification catalysts could have economic benefits to the aquaculture industry in the US.

Towards increasing the compatibility of student pair programmers

As pair programming is used widely in software engineering education, instructors may wish to proactively form pairs to increase the likelihood of compatible pairs. A study involving 361 software engineering students was carried out at North Carolina State University to understand and predict pair compatibility. We have found that students are compatible with partners whom they perceive of similar skill, although instructors cannot proactively manage this perception. Pairing of two minority students is more likely and mixed gender pairs are less likely to be compatible. Additionally, pairing of students with similar actual skill level as measured by midterm grades in class, GPA, and SAT/GRE scores also likely results in compatible pairs. Our research addresses the following challenges faced by instructors in software engineering: 1) organizational concern in pairing of students; 2) increasing the retention rates of female and minority students in classes; and 3) proactively forming mutually-compatible pairs.