A refactoring is a program transformation that improves the design of the source code, while preserving its behavior. Most modern IDEs offer a number of automated refactorings as editor services. The Rename refactoring is the most-commonly applied refactoring and is used to change the identifier of a program entity such as a variable, a function, or a type. Correctly implementing refactorings is notoriously complex and these state-of-the-art implementations are known to be faulty and too restrictive. When developing a new programming language, it is both difficult and time-consuming to implement sound and complete automated refactoring transformations. Language-parametric definitions of refactorings that can be reused by instantiation with the syntax and semantics of a language, allow the development effort of refactorings to be amortized across language implementations. In this thesis, we developed a language-parametric Rename refactoring algorithm that works on an abstract model of a program's name binding structure. We implemented the algorithm in the Spoofax language workbench, building on the language-parametric representation of name binding with scope graphs and using generic traversals in the Stratego transformation language. We evaluated the algorithm with five different languages implemented in Spoofax, which uses both NaBL2 and Statix to declare their static semantics and name binding rules. As a result, Spoofax now provides an automated Rename refactoring that works for any language developed with the language workbench using NaBL2/Statix.

The cyber arms race has red and blue teams continuously at their toes to keep ahead. Increasingly capable cyber actors breach secure networks at a worrying scale. While network monitoring and analysis should identify blatant data exfiltration attempts, covert channels bypass these measures and facilitate surreptitious information extraction. The many legitimate uses and widespread availability of DNS, the "phone book" of the internet, make it an attractive protocol for such covert channels. Covert DNS storage channels encode information in the payload of outbound DNS queries.

This thesis aims to assess the effectiveness of using machine learning methods to detect covert DNS storage channels. Our literature survey identified distinct differences in 1) algorithm type, either unsupervised anomaly detection or supervised classification, and 2) the information source for features, either isolated DNS queries or query sequences.

We performed experiments with (Extended) Isolation Forest algorithms for anomaly detection and Random Forests for classification, combined with different feature set compositions to evaluate their relative performance. Payload-only features were derived from isolated queries and behavioral features were extracted from time-based or fixed-length sliding windows over per-domain query sequences. We evaluated our models using a large-scale corporate DNS dataset of real-world proportions and a novel dataset of connection tunneling traffic and simulated credit card exfiltration malware.

We found that the majority of experiments were able to achieve high detection rates of 98.6% or more on a variety of storage channel threats, at low false positive rates. Classification models significantly outperform anomaly detection models on threats seen during training. Evaluation on unseen threats, however, revealed that generalization is difficult, provided the limited set of training threats and showed anomaly detection models more capable at detecting a variety of threats than classification models. We furthermore showed that feature sets with a behavioral component consistently outperform payload­-only features, although our experiments were inconclusive regarding the relative performance between composite feature sets.

Given the prevalence of benign storage channels misusing DNS for legitimate data transfer, we recommend rigorous filtering of training data beforehand to improve model optimization and evaluation. Furthermore, extending the malicious training set with DNS command-and-control (C2) malware is a promising future research direction to improve generalization of classification models.

Since the introduction of the Web, online platforms have become a place to share opinions across various domains (e.g., social media platforms, discussion fora or webshops). Consequently, many researchers have seen a need to classify, summarise or categorise these large sets of unstructured user-generated content. A field related to this task is also known as opinion mining in which various applications have focused on sentiment analysis techniques to classify opinionated documents based on sentiment. More recent, researchers have focused on stance classification to classify opinionated documents based on stance in controversial debates. However, in the case of such controversial debates it would be equally interesting to know the underlying reasons behind a stance in order to truly understand a discussion. We can call these underlying reasons as perspectives. Few have focused on distilling such perspectives from text and in this research we aim to explore the use of an unsupervised model - called joint topic models - to perform the task of perspective discovery. We define perspective discovery on a controversial debate as the process of automatically finding and extracting a structured overview of perspectives from unstructured text. The aim is to quantify how well existing joint topic models can extract human understandable perspectives between and within stances for more fine-grained opinion mining on textual debates. To perform this evaluation we propose an evaluation setup with an extensive user study. This setup focuses on the topic model’s clustering ability of perspectives as well as the human understandability of the topic model’s output. Based on the results we may derive that topic models can discover some of the perspectives from text. Moreover, the results suggest that users are not influenced by their pre-existing stance when interpreting the output of topic models.

There is a lot involved in providing a loan as a company, mostly in terms of legalities and risk management. As a lender it is important to have a clear record of the customers applying for a loan, as this helps assessing the risk that comes with providing a loan. Furthermore, it is required by law to know who it is that you are providing a loan to. To achieve this, loan providers gather a variety of personal and financial information. The gathering of such information has traditionally been a time consuming practice, both for the customer and the lender. The customer is required to manually find and submit information, and in turn the lender has to verify that the received information is not fraudulent or incorrect. If collection of personal information, payrolls and credits could be done in an automated way, both the customer and the lender will benefit greatly. We have designed and developed the Customer Verification Engine, the CVE, in order to solve this time consuming process of collecting and submitting documents. The CVE is capable of cleverly combining several external data sources, creating a clear record of the customer. While previously the customer had to manually provide a large set of documents, it is now done at the push of a button. Furthermore, by having a system where the information is retrieved, rather than provided by the customer, the verification becomes significantly more reliable, as there is little to no room for the customer to provide fraudulent information. The CVE is a robust and scalable system that is capable of handling unexpected behavior both in terms of input and connection to external sources. An extensive test suite verifies correct behavior of the CVE under both normal and unexpected circumstances. The information gathered by the CVE will be relied upon to determine whether or not a customer is eligible for a loan. As the CVE will be continued to be worked upon, we have put effort into making it extendable for future developers. Using the extensive documentation and the modularity of the system, it should be straightforward for future developers to add new integrations with external parties to the CVE.

Software development is more than only implementing the functional code. A developer is also responsible for writing code measuring up to certain standards and conventions. These conventions make sure that the code is of a particular quality that improves readability and eases maintainability. Some of these conventions are checked by automated tools. Automated static analysis tools (ASATs) perform an analysis of the source code and issue warnings. ASATs are available for many programming languages and can be used to find functional or maintainability issues. Even though these tools have been proven to be useful during the code development process, developers do not always utilize them. The overload of warnings in large projects and relatively low importance of these warnings are one of the many reasons why they are ignored. In this study, a gamification tool, Checkpoint, is developed based on the GOAL methodology. The purpose of this tool is to gamify the development process pertaining to ASATs to motivate developers. The developers are motivated using various gamification elements during a pretest-posttest pre-experimental experiment. The study tested the usability of the tool and its effectiveness. The experiment showed that gamification has an impact on developer motivation.

Library developers are often unaware of how their library is used exactly in practice. When a library developer changes the internals of a library, this may unintentionally affect or even break the working of the library users' code. While it is possible to detect when a syntactic breaking change occurs, it is not as easy to detect semantic breaking changes, where the implicit contract of a functionality changes, sometimes unbeknownst to the library developer. Because library users rarely test the behaviour they expect of the library, neither the library developer nor the library user will be aware of the new behaviour.

As a library developer, you want to be able to see how a change in your library will affect your users before a new version of the library is deployed. More specifically, you want to gain insight into how users use the library, and want to see if and how changes affect users. This will allow you to determine whether the new version of the library is backwards compatible. Finally, after deploying the breaking changes, you want to notify the affected users of the changes and of a solution to the issue.

Schaapi, a tool for early detection of breaking changes based on API usages, addresses these needs. It mines public repositories for projects using a given library, analyses their usage of the API of that library, and generates tests that capture this behaviour. Finally, it offers a continuous integration service that automatically executes these tests against new versions of the library and warns developers of any potentially breaking changes in functionality. The tool has also been validated against real-world data to demonstrate its performance in realistic usage scenarios and to answer a selection of related research questions.

Using logs to detect and diagnose problems in software systems is no longer a feasible human process. The ever increasing amount of logs produced by present-day systems calls for more advanced techniques to enable log analysis. A great deal of log research has since then been focused on abstracting over log messages, clever analysis techniques and best practices for logging. An overview of the field, however, has not yet been composed. This makes it difficult for practitioners to identify what is relevant for them, and for researchers to determine interesting angles to explore. To this end we present a literature survey on the field of log analysis. In this survey we outline the different techniques and practices introduced by research in the field. We find that the results of the various works do not lend themselves well to comparison, and suggest future steps of research to overcome this lack of clarity. Furthermore, we suggest areas of improvement in terms of the applicability and feasibility of analysis techniques.