179 citations · 805 across the 48 of their papers we have counts for
27 papers · 1 filter
Collaborative Application Security Testing for DevSecOps: An Empirical Analysis of Challenges, Best Practices and Tool Support
Roshan Namal Rajapakse, Mansooreh Zahedi, Muhammad Ali Babar
DevSecOps is a software development paradigm that places a high emphasis on the culture of collaboration between developers (Dev), security (Sec) and operations (Ops) teams to deli…
LogGD:Detecting Anomalies from System Logs by Graph Neural Networks
Yongzheng Xie, Hongyu Zhang, Muhammad Ali Babar
Log analysis is one of the main techniques engineers use to troubleshoot faults of large-scale software systems. During the past decades, many log analysis approaches have been pro…
An Empirical Study of Automation in Software Security Patch Management
Nesara Dissanayake, Asangi Jayatilaka, Mansooreh Zahedi +1
Several studies have shown that automated support for different activities of the security patch management process has great potential for reducing delays in installing security p…
Noisy Label Learning for Security Defects
Roland Croft, M. Ali Babar, Huaming Chen
Data-driven software engineering processes, such as vulnerability prediction heavily rely on the quality of the data used. In this paper, we observe that it is infeasible to obtain…
On the Use of Fine-grained Vulnerable Code Statements for Software Vulnerability Assessment Models
Triet H. M. Le, M. Ali Babar
Many studies have developed Machine Learning (ML) approaches to detect Software Vulnerabilities (SVs) in functions and fine-grained code statements that cause such SVs. However, th…
Why, How and Where of Delays in Software Security Patch Management: An Empirical Investigation in the Healthcare Sector
Nesara Dissanayake, Mansooreh Zahedi, Asangi Jayatilaka +1
Numerous security attacks that resulted in devastating consequences can be traced back to a delay in applying a security patch. Despite the criticality of timely patch application,…
An Investigation into Inconsistency of Software Vulnerability Severity across Data Sources
Roland Croft, M. Ali Babar, Li Li
Software Vulnerability (SV) severity assessment is a vital task for informing SV remediation and triage. Ranking of SV severity scores is often used to advise prioritization of pat…
NLP Methods in Host-based Intrusion Detection Systems: A Systematic Review and Future Directions
Zarrin Tasnim Sworna, Zahra Mousavi, Muhammad Ali Babar
Host based Intrusion Detection System (HIDS) is an effective last line of defense for defending against cyber security attacks after perimeter defenses (e.g., Network based Intrusi…
LogDP: Combining Dependency and Proximity for Log-based Anomaly Detection
Yongzheng Xie, Hongyu Zhang, Bo Zhang +2
Log analysis is an important technique that engineers use for troubleshooting faults of large-scale service-oriented systems. In this study, we propose a novel semi-supervised log-…
Relationships between Software Architecture and Source Code in Practice: An Exploratory Survey and Interview
Fangchao Tian, Peng Liang, Muhammad Ali Babar
Context: Software Architecture (SA) and Source Code (SC) are two intertwined artefacts that represent the interdependent design decisions made at different levels of abstractions -…
An Empirical Study of Developers' Discussions about Security Challenges of Different Programming Languages
Roland Croft, Yongzheng Xie, Mansooreh Zahedi +2
Given programming languages can provide different types and levels of security support, it is critically important to consider security aspects while selecting programming language…
A Grounded Theory of the Role of Coordination in Software Security Patch Management
Nesara Dissanayake, Mansooreh Zahedi, Asangi Jayatilaka +1
Several disastrous security attacks can be attributed to delays in patching software vulnerabilities. While researchers and practitioners have paid significant attention to automat…
Automated Software Vulnerability Assessment with Concept Drift
Triet H. M. Le, Bushra Sabir, M. Ali Babar
Software Engineering researchers are increasingly using Natural Language Processing (NLP) techniques to automate Software Vulnerabilities (SVs) assessment using the descriptions in…
Challenges and solutions when adopting DevSecOps: A systematic review
Roshan N. Rajapakse, Mansooreh Zahedi, M. Ali Babar +1
Context: DevOps has become one of the fastest-growing software development paradigms in the industry. However, this trend has presented the challenge of ensuring secure software de…
Software Security Patch Management -- A Systematic Literature Review of Challenges, Approaches, Tools and Practices
Nesara Dissanayake, Asangi Jayatilaka, Mansooreh Zahedi +1
Context: Software security patch management purports to support the process of patching known software security vulnerabilities. Given the increasing recognition of the importance…
Security Awareness of End-Users of Mobile Health Applications: An Empirical Study
Bakheet Aljedaani, Aakash Ahmad, Mansooreh Zahedi +1
Mobile systems offer portable and interactive computing, empowering users, to exploit a multitude of context-sensitive services, including mobile healthcare. Mobile health applicat…
Challenges in Docker Development: A Large-scale Study Using Stack Overflow
Mubin Ul Haque, Leonardo Horn Iwaya, M. Ali Babar
Docker technology has been increasingly used among software developers in a multitude of projects. This growing interest is due to the fact that Docker technology supports a conven…
An Empirical Study on Developing Secure Mobile Health Apps: The Developers Perspective
Bakheet Aljedaani, Aakash Ahmad, Mansooreh Zahedi +1
Mobile apps exploit embedded sensors and wireless connectivity of a device to empower users with portable computations, context-aware communication, and enhanced interaction. Speci…
A Large-scale Study of Security Vulnerability Support on Developer Q&A Websites
Triet H. M. Le, Roland Croft, David Hin +1
Context: Security Vulnerabilities (SVs) pose many serious threats to software systems. Developers usually seek solutions to addressing these SVs on developer Question and Answer (Q…
Architectural Design Space for Modelling and Simulation as a Service: A Review
Mojtaba Shahin, M. Ali Babar, Muhammad Aufeef Chauhan
Modelling and Simulation as a Service (MSaaS) is a promising approach to deploy and execute Modelling and Simulation (M&S) applications quickly and on-demand. An appropriate softwa…
On the Role of Software Architecture in DevOps Transformation: An Industrial Case Study
Mojtaba Shahin, M. Ali Babar
Development and Operations (DevOps), a particular type of Continuous Software Engineering, has become a popular Software System Engineering paradigm. Software architecture is criti…
PUMiner: Mining Security Posts from Developer Question and Answer Websites with PU Learning
Triet H. M. Le, David Hin, Roland Croft +1
Security is an increasing concern in software development. Developer Question and Answer (Q&A) websites provide a large amount of security discussion. Existing studies have used hu…
An Empirical Study of Architecting for Continuous Delivery and Deployment
Mojtaba Shahin, Mansooreh Zahedi, Muhammad Ali Babar +1
Recently, many software organizations have been adopting Continuous Delivery and Continuous Deployment (CD) practices to develop and deliver quality software more frequently and re…
Understanding the Heterogeneity of Contributors in Bug Bounty Programs
Hideaki Hata, Mingyu Guo, M. Ali Babar
Background: While bug bounty programs are not new in software development, an increasing number of companies, as well as open source projects, rely on external parties to perform t…