Call graph analysis: Leveraging public test suites

Call graphs are useful tools for representing method relationships within software projects and correlations between dependencies. Although static analysis is a prevalent method for call graph construction, it has its limitations such as struggling with handling dynamic features and lambda expressions. In this research, we introduced an approach...

Crowd-sourced Collection and Analysis of Software Packages

The escalating complexity of software systems in the digital age heavily relies on reusable code collections(packages) for their development and operation. Despite the numerous advantages of pre-existing libraries, managing dependencies can be intricate and time-consuming. This thesis focuses on enhancing package management tools through a...

How to remove dependencies from large software projects with confidence

Dependency management is an important task in software maintenance. However, identifying and removing unused dependencies takes a lot of effort from developers as existing tools may discover many false positives which are challenging to distinguish. This paper proposes a decision framework to improve unused dependency detection. It is applied to...

Präzi: from package-based to call-based dependency networks

Modern programming languages such as Java, JavaScript, and Rust encourage software reuse by hosting diverse and fast-growing repositories of highly interdependent packages (i.e., reusable libraries) for their users. The standard way to study the interdependence between software packages is to infer a package dependency network by parsing...

Removing dependencies from large software projects: Are you really sure?

When developing and maintaining large software systems, a great deal of effort goes into dependency management. During the whole lifecycle of a software project, the set of dependencies keeps changing to accommodate the addition of new features or changes in the running environment. Package management tools are quite popular to automate this...

Effectiveness of using call graphs to detect propagated vulnerabilities

Nowadays software development greatly relies upon using third-party source code. A logical consequence is that vulnerabilities from such sources can be propagated to applications making use of those. Tools like Dependabot can alert developers about packages they use, which entail vulnerabilities. Such alerts oftentimes turn out to be false...

Runtime analysis of Android apps based on their behaviour

In the modern world, Smartphones are everywhere and Android is the most used operating system. <br/>To protect these devices against malicious actions, the behaviour of Android apps needs to be studied.<br/><br/>Current tooling does not provide complete insight into the behaviour of an Android app.<br/>A tool was built to observe what goes on...

Tooling to Detect Unwanted Thread Exits in Rust

Technolution is a company that specializes in building embedded and information systems, in which software plays a key role. Recently, Technolution is transitioning from the use of C in embedded systems, to Rust, a relatively new programming language developed by Mozilla. By design, Rust provides the programmer with higher security and...

Software Ecosystem Call Graph for Dependency Management

A popular form of software reuse is the use of open source software libraries hosted on centralized code repositories, such as Maven or npm. Developers only need to declare dependencies to external libraries, and automated tools make them available to the workspace of the project. Recent incidents, such as the Equifax data breach and the leftpad...