How Does Refactoring Impact Security When Improving Quality? A Security-Aware Refactoring Approach
While state of the art of software refactoring research uses various quality attributes to identify refactoring opportunities and evaluate refactoring recommendations, the impact of refactoring on the security of software systems when improving other quality objectives is under-explored. It is critical to understand how a system is resistant to security risks after refactoring to improve quality metrics. For instance, refactoring is widely used to improve the reusability of code, however such an improvement may increase the attack surface due to the created abstractions. Increasing the spread of security-critical classes in the design to improve modularity may result in reducing the resilience of software systems to attacks. In this journal first paper, we investigated for the first time the possible impact of improving different quality attributes (e.g. reusability, extendibility, etc.), from the QMOOD model, effectiveness on a set of 8 security metrics defined in the literature related to the data access. We also studied the impact of different refactorings on these static security metrics. Then, we proposed a multi-objective refactoring recommendation approach to find a balance between quality attributes and security based on the correlation results to guide the search. We evaluated our tool on 30 open source projects. We also collected the practitioner perceptions on the refactorings recommended by our tool in terms of the possible impact on both security and other quality attributes. Our results confirm that developers need to make trade-offs between security and other qualities when refactoring software systems due to the negative correlations between them.
Tue 10 NovDisplayed time zone: (UTC) Coordinated Universal Time change
08:30 - 09:00 | |||
08:30 2mTalk | An Evaluation of Methods to Port Legacy Code to SGX Enclaves Research Papers Kripa Shanker Indian Institute of Science, Bangalore, Arun Joseph Indian Institute of Science, India, Vinod Ganapathy Indian Institute of Science, India DOI Pre-print File Attached | ||
08:33 1mTalk | How Does Refactoring Impact Security When Improving Quality? A Security-Aware Refactoring Approach Journal First Chaima Abid University of Michigan, Marouane Kessentini University of Michigan, Vahid Alizadeh DePaul University, Mouna Dhaouadi University of Michigan, Rick Kazman University of Hawai‘i at Mānoa | ||
08:35 1mTalk | Improving Cybersecurity Hygiene through JIT Patching Industry Papers DOI | ||
08:37 1mTalk | Search-Based Adversarial Testing and Improvement of Constrained Credit Scoring Systems Research Papers Salah Ghamizi University of Luxembourg, Luxembourg, Maxime Cordy University of Luxembourg, Luxembourg, Martin Gubri University of Luxembourg, Luxembourg, Mike Papadakis University of Luxembourg, Luxembourg, Andrey Boystov University of Luxembourg, Luxembourg, Yves Le Traon University of Luxembourg, Luxembourg, Anne Goujon BGL BNP Paribas, Luxembourg DOI Pre-print | ||
08:39 1mTalk | SinkFinder: Harvesting Hundreds of Unknown Interesting Function Pairs with Just One Seed Research Papers Pan Bian Renmin University of China, China, Bin Liang Renmin University of China, China, Jianjun Huang Renmin University of China, China, Wenchang Shi Renmin University of China, China, Xidong Wang Renmin University of China, China, Jian Zhang Institute of Software at Chinese Academy of Sciences, China DOI | ||
08:41 1mTalk | Taking the Middle Path: Learning About Security Through Online Social Interaction Journal First Tamara Lopez The Open University, Thein Tun , Arosha K Bandara The Open University, Mark Levine Lancaster University, Bashar Nuseibeh The Open University (UK) & Lero (Ireland), Helen Sharp The Open University | ||
08:43 17mTalk | Conversations on Security Research Papers Frederico Araujo IBM T.J. Watson Research Center, New York, USA, Kripa Shanker Indian Institute of Science, Bangalore, Pan Bian Renmin University of China, China, Salah Ghamizi SntT - University of Luxembourg, Tamara Lopez The Open University, Chaima Abid University of Michigan, M: Ben Hermann Technical University Dortmund | ||