Abstract

Studying frequent code vulnerabilities in similar code, such as clones, near-duplicates, forked projects, or libraries, can help in the automated detection of security flaws during the software development process. In this work, we conduct an empirical study on vulnerabilities in C/C++ code to characterize security flaws and find out if the same vulnerabilities exist in applications that share similar code or have the same business logic/domain. We analyze a code vulnerability dataset including315 projects with 3284 security issues in 10,880 functions. Our results show that vulnerable functions in 35% of the most occurring CWEs (software weaknesses types) have similar code, and 23% of projects with the same domain/category have the same vulnerabilities. We observe that the most prevalent vulnerabilities in similar code are Use After Free, Improper Access Control, Cryptographic Issues, 7PK - Security Features, DoubleFree, Cross-site Scripting, and Divide By Zero. These vulnerabilities are, however, less frequent compared to other CWEs across all subjects. Our results suggest that automated vulnerability detection tools that work based on code similarity or abstract patterns can be tailored more towards certain CWEs.

BibTeX

@inproceedings{QRS2021,
title={Vulnerability Analysis of Similar Code},
author={Piran, Azin and Chang, Che-Pin and Milani Fard, Amin},
booktitle={Proceedings of the 21st IEEE International Conference on Software Security and Reliability (QRS)},
year={2021}
}

Abstract

Most of the existing news-based market prediction techniques disregard conceptual and emotional relations in the news stream. In this work, we consider the conceptual relationship between news documents using contextualized latent concept modeling as well as leveraging news sentiment and technical indicators. We present our approach as an open-source RESTFul API. We build a corpus of financial news related to currency pairs in the Foreign Exchange and Cryptocurrencies markets. Next, we apply BERT-based embedding to generate word vectors, cluster the vectors to create latent economic concepts, and propose a document representation based on the distribution of words on these concepts as well as news sentiment. We use a recurrent convolutional neural network to jointly use BERT-based text representation and technical indicators embedding for market time series prediction. We further augment our model with technical indicators using another recurrent layer. The experimental results show the superiority of our method compared to the baselines. Our MarketNews dataset, news crawler, and MarketPredict APIs are available for public use.

BibTeX

@inproceedings{farimani2021leveraging, title={Leveraging Latent Economic Concepts and Sentiments in the News for Market Prediction}, author={Farimani, Saeede Anbaee and Jahan, Majid Vafaei and Fard, Amin Milani and Haffari, Gholamreza}, booktitle={2021 IEEE 8th International Conference on Data Science and Advanced Analytics (DSAA)}, pages={1--10}, year={2021}, organization={IEEE} }

Abstract

Multifractal detrended cross-correlation analysis (MFDCCA) is largely used to analyze non-stationary financial time series. Existing methods for such analysis utilize the time series itself as the detrending function with a polynomial. We propose a technique for a more accurate removal of local trends, called indicator-based MFDCCA (IMFDCCA), which leverages market technical indicators to better determine correlations between financial time series. We evaluated our method on pair trading in the Foreign Exchange Market (Forex) and our results show that the proposed IMFDCCA compared to the MFDCCA reduces the RMSE for the Hurst exponent estimation by 30%.

BibTeX

@inproceedings{alamatian2021,
title={Using Market Indicators to Eliminate Local Trends for Financial Time Series Cross-Correlation Analysis},
doi = {10.21428/594757db.8d600287},
author={Alamatian, Zohreh and Vafaei Jahan, Majid and Milani Fard, Amin},
booktitle={Proceedings of the 34th Canadian Conference on Artificial Intelligence (Canadian AI)},
url = {https://caiac.pubpub.org/pub/jtymmz06},
year={2021}
}

Abstract

Predicting the performance of a blockchain application during the design phase is difficult and evaluation after it is built could be expensive. The ability to simulate a blockchain network during the design stage in order to evaluate it is therefore a necessity. In this paper, we present a simulator for blockchain applications, called SIMBA (SIMulator for Blockchain Applications). SIMBA extends an existing simulator by adding the Merkle tree feature to blockchain nodes to improve efficiency and allowing more realistic evaluations not possible with the base tool to be performed. Results of our experiments show that the inclusion of Merkle trees has a high impact of up to 30 times reduction in the verification time of block transactions without an impact on block propagation delay. Since block verification is a critical part of the computational load of nodes on the network, this performance improvement significantly affects the overall performance of each node and consequently the entire network.

BibTeX

@inproceedings{SIMBA2020,
author = {Fattahi, Seyed Mehdi and Makanju, Adetokunbo and Milani Fard, Amin},
title = {{SIMBA: An Efficient Simulator for Blockchain Applications},
booktitle = {Proceedings of the International Conference on Dependable Systems and Networks (DSN)},
publisher = {IEEE},
year = {2020}
}

Abstract

Most real-world information networks, such as social networks, are heterogeneous and as such, relationships in these networks can be of different types and hence carry differing semantics. Therefore techniques for link prediction in homogeneous networks cannot be directly applied on heterogeneous ones. On the other hand, works that investigate link prediction in heterogeneous networks do not necessarily consider network dynamism in sequential time intervals. In this work we propose a technique that leverages a combination of latent and topological features to predict a target relationship between two nodes in a dynamic heterogeneous information network. Our technique, called MetaDynaMix, effectively combines meta path-based topology features and inferred latent features that incorporate temporal network changes in order to capture network (1) heterogeneity and (2) temporal evolution, when making link predictions. Our experiment results on two real-world datasets show statistically significant improvement over AUCROC and prediction accuracy compared to the state of the art techniques.

BibTeX

@inproceedings{amin:ecir19,
author = {Milani Fard, Amin and Bagheri, Ebrahim and Wang, Ke},
title = {Relationship Prediction in Dynamic Heterogeneous Information Networks},
booktitle = {Proceedings of the European Conference on Information Retrieval (ECIR)},
publisher = {Springer},
pages = {12 pages},
year = {2019}
}

Abstract

Testing JavaScript code is important. JavaScript has grown to be among the most popular programming languages and it is extensively used to create web applications both on the client and server. We present the first empirical study of JavaScript tests to characterize their prevalence, quality metrics (e.g. code coverage), and shortcomings. We perform our study across a representative corpus of 373 JavaScript projects, with over 5.4 million lines of JavaScript code. Our results show that 22% of the studied subjects do not have test code. About 40% of projects with JavaScript at client-side do not have a test, while this is only about 3% for the purely server-side JavaScript projects. Also tests for server-side code have high quality (in terms of code coverage, test code ratio, test commit ratio, and average number of assertions per test), while tests for client-side code have moderate to low quality. In general, tests written in Mocha, Tape, Tap, and Nodeunit frameworks have high quality and those written without using any framework have low quality. We scrutinize the (un)covered parts of the code under test to find out root causes for the uncovered code. Our results show that JavaScript tests lack proper coverage for event-dependent callbacks (36%), asynchronous callbacks (53%), and DOM-related code (63%). We believe that it is worthwhile for the developer and research community to focus on testing techniques and tools to achieve better coverage for difficult to cover JavaScript code.

BibTeX

@inproceedings{amin:icst17,
author = {Milani Fard, Amin and Mesbah, Ali},
title = {JavaScript: The (Un)covered Parts},
booktitle = {Proceedings of the IEEE International Conference on Software Testing, Verification and Validation (ICST)},
publisher = {IEEE},
pages = {11 pages},
year = {2017}
}

Abstract

In today's web applications, JavaScript code interacts with the Document Object Model (DOM) at runtime. This runtime interaction between JavaScript and the DOM is error-prone and challenging to test. In order to unit test a JavaScript function that has read/write DOM operations, a DOM instance has to be provided as a test fixture. This DOM fixture needs to be in the exact structure expected by the function under test. Otherwise, the test case can terminate prematurely due to a null exception. Generating these fixtures is challenging due to the dynamic nature of JavaScript and the hierarchical structure of the DOM. We present an automated technique, based on concolic execution, which generates test fixtures for unit testing JavaScript functions. Our approach is implemented in a tool called ConFix. Our empirical evaluation shows that ConFix can effectively generate tests that cover DOM-dependent paths. We also find that ConFix yields considerably higher coverage compared to an existing JavaScript input generation technique.

BibTeX

@inproceedings{amin:ase15,
author = {Milani Fard, Amin and Mesbah, Ali and Wohlstadter, Eric},
title = {Generating Fixtures for JavaScript Unit Testing},
booktitle = {Proceedings of the IEEE/ACM International Conference on Automated Software Engineering (ASE)},
publisher = {ACM},
pages = {190--200},
year = {2015}
}

Abstract

Testing aims at detecting (regression) bugs in production code. However, testing code is just as likely to contain bugs as the code it tests. Buggy test cases can silently miss bugs in the production code or loudly ring false alarms when the production code is correct. We present the first empirical study of bugs in test code to characterize their prevalence and root cause categories. We mine the bug repositories and version control systems of 211 Apache Software Foundation (ASF) projects and find 5,556 test-related bug reports. We (1) compare properties of test bugs with production bugs, such as active time and fixing effort needed, (2) qualitatively study 443 randomly sampled test bug reports in detail and categorize them based on their impact and root causes, (3) run FindBugs on the test code of the latest version of the projects to discover potential (undiscovered) bugs. Our results show that (1) around half of all the projects had bugs in their test code; (2) the majority of test bugs are false alarms, i.e., test fails while the production code is correct, while a minority of these bugs result in silent horrors, i.e., test passes while the production code is incorrect; (3) incorrect and missing assertions are the dominant root cause of silent horror bugs; (4) semantic (25%), flaky (21%), environment-related (18%) bugs are the dominant root cause categories of false alarms; (5) the majority of false alarm bugs happen in the exercise portion of the tests, and (6) developers contribute more actively to fixing test bugs and test bugs are fixed sooner compared to production bugs.

BibTeX

@inproceedings{arash:icsme15,
author = {Vahabzadeh, Arash and Milani Fard, Amin and Mesbah, Ali},
title = {An Empirical Study of Bugs in Test Code},
booktitle = {Proceedings of the International Conference on Software Maintenance and Evolution (ICSME)},
publisher = {IEEE Computer Society},
pages = {101--110},
year = {2015}
}

Abstract

To test web applications, developers currently write test cases in frameworks such as Selenium. On the other hand, most web test generation techniques rely on a crawler to explore the dynamic states of the application. The first approach requires much manual effort, but benefits from the domain knowledge of the developer writing the test cases. The second one is automated and systematic, but lacks the domain knowledge required to be as effective. We believe combining the two can be advantageous. In this paper, we propose to (1) mine the human knowledge present in the form of input values, event sequences, and assertions, in the human-written test suites, (2) combine that inferred knowledge with the power of automated crawling, and (3) extend the test suite for uncovered/unchecked portions of the web application under test. Our approach is implemented in a tool called Testilizer. An evaluation of our approach indicates that Testilizer (1) outperforms a random test generator, and (2) on average, can generate test suites with improvements of up to 150 percent in fault detection rate and up to 30 precent in code coverage, compared to the original test suite.

BibTeX

@inproceedings{amin:ase14,
author = {Milani Fard, Amin and Mirzaaghaei, Mehdi and Mesbah, Ali},
title = {Leveraging Existing Tests in Automated Test Generation for Web Applications},
booktitle = {Proceedings of the IEEE/ACM International Conference on Automated Software Engineering (ASE)},
publisher = {ACM},
pages = {67--78},
year = {2014}
}

Abstract

Dynamic exploration techniques play a significant role in automated web application testing and analysis. However, a general web application crawler that exhaustively explores the states can become mired in limited specific regions of the web application, yielding poor functionality coverage. In this paper, we propose a feedback-directed web application exploration technique to derive test models. While exploring, our approach dynamically measures and applies a combination of code coverage impact, navigational diversity, and structural diversity, to decide a-priori (1) which state should be expanded, and (2) which event should be exercised next to maximize the overall coverage, while minimizing the size of the test model. Our approach is implemented in a tool called FeedEx. We have empirically evaluated the efficacy of FeedEx using six web applications. The results show that our technique is successful in yielding higher coverage while reducing the size of the test model, compared to classical exhaustive techniques such as depth-first, breadth-first, and random exploration.

BibTeX

@inproceedings{amin:issre13,
author = {Milani Fard, Amin and Mesbah, Ali},
title = {Feedback-directed Exploration of Web Applications to Derive Test Models},
booktitle = {Proceedings of the International Symposium on Software Reliability Engineering (ISSRE)},
publisher = {IEEE Computer Society},
pages = {278--287},
year = {2013}
}

Abstract

JavaScript is a powerful and flexible prototype-based scripting language that is increasingly used by developers to create interactive web applications. The language is interpreted, dynamic, weakly-typed, and has first-class functions. In addition, it interacts with other web languages such as CSS and HTML at runtime. All these characteristics make JavaScript code particularly error-prone and challenging to write and maintain. Code smells are patterns in the source code that can adversely influence program comprehension and maintainability of the program in the long term. We propose a set of 13 JavaScript code smells, collected from various developer resources. We present a JavaScript code smell detection technique called JSNose. Our metric-based approach combines static and dynamic analysis to detect smells in client-side code. This automated technique can help developers to spot code that could benefit from refactoring. We evaluate the smell finding capabilities of our technique through an empirical study. By analyzing 11 web applications, we investigate which smells detected by JSNose are more prevalent.

BibTeX

@inproceedings{amin:scam13,
author = {Milani Fard, Amin and Mesbah, Ali},
title = {{JSNose}: Detecting {JavaScript} Code Smells},
booktitle = {Proceedings of the International Conference on Source Code Analysis and Manipulation (SCAM)},
publisher = {IEEE Computer Society},
pages = {116--125},
year = {2013}
}

Abstract

Link disclosure between two individuals in a social network could be a privacy breach. To limit link disclosure, previous works modeled a social network as an undirected graph and randomized a link over the entire domain of links, which leads to considerable structural distortion to the graph. In this work, we address this issue in two steps. First, we model a social network as a directed graph and randomize the destination of a link while keeping the source of a link intact. The randomization ensures that, if the prior belief about the destination of a link is bounded by some threshold, the posterior belief, given the published graph, is no more than another threshold. Then, we further reduce structural distortion by a subgraph-wise perturbation in which the given graph is partitioned into several subgraphs and randomization of destination nodes is performed within each subgraph. The benefit of subgraph-wise perturbation is that it retains a destination node with a higher retention probability and replaces a destination node with a node from a local neighborhood. We study the trade-off of utility and privacy of subgraph-wise perturbation.

BibTeX

@inproceedings{amin:edbt12,
author = {Milani Fard, Amin and Wang, Ke and Yu, Philip S.},
title = {Limiting Link Disclosure in Social Network Analysis Through Subgraph-wise Perturbation},
booktitle = {Proceedings of the International Conference on Extending Database Technology (EDBT)},
year = {2012},
pages = {109--119},
publisher = {ACM}
}

Abstract

Releasing Web query logs which contain valuable information for research or marketing, can breach the privacy of search engine users. Therefore rendering query logs to limit linking a query to an individual while preserving the data usefulness for analysis, is an important research problem. This survey provides an overview and discussion on the recent studies on this direction.

BibTeX

@article{amin:corr12,
author = {Milani Fard, Amin},
title = {Privacy Preserving Web Query Log Publishing: A Survey on Anonymization Techniques},
journal = {Computing Research Repository (CoRR)},
volume = {abs/1211.2354},
year = {2012}
}

Abstract

Web query log data contain information useful to research; however, release of such data can re-identify the search engine users issuing the queries. These privacy concerns go far beyond removing explicitly identifying information such as name and address, since non-identifying personal data can be combined with publicly available information to pinpoint to an individual. In this work we model web query logs as unstructured transaction data and present a novel transaction anonymization technique based on clustering and generalization techniques to achieve the k-anonymity privacy. We conduct extensive experiments on the AOL query log data. Our results show that this method results in a higher data utility compared to the state-of-the-art transaction anonymization methods.

BibTeX

@inproceedings{amin:secrypt10,
title={An effective clustering approach to web query log anonymization},
author={Milani Fard, Amin and and Wang, Ke},
booktitle={Proceedings of the International Conference on Security and Cryptography (SECRYPT)},
pages={109--119},
year={2010},
organization={IEEE}
}

Abstract

The hidden knowledge in social networks data can beregarded as an important resource for criminal investigations which can help finding the structure and organization of a criminal network. However such network based analysis has not been studied in an applied way and remains mostly a manual process. To assist inspectors and intelligence agencies discover this knowledge, we defined a new problem and then proposed a framework for automated network data analysis and deductionapproach from multiple social networks by converting totransaction dataset, applying association mining, and statistical methods. By applying a game theory concept in a multi-agent model, we try to design a policy for knowledge discovery and inference fusion. This approach enables police stations to build and deploy P2P applications through a unified medium for finding criminals relationship and identifying suspicious guys.