pag.bib

% Program Analysis Group bibliography
% (Actually, only papers that do not include Michael Ernst as a coauthor.
% Blame either megalomania or a pre-existing directory organization that
% puts those files in ernst.bib.)

% This file (and ernst.bib) is processed by the bibtex2web program.  See
%   https://homes.cs.washington.edu/~mernst/software/bibtex2web.html
% for an explanation of the fields.


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%% 1995
%%%

@Article{McCartneyGS1995,
  author = 	 "T. Paul McCartney and Kenneth J. Goldman and David E. Saff",
  title = 	 "EUPHORIA: End-user construction of direct manipulation
                  user interfaces for distributed applications",
  journal = 	 "Software Concepts and Tools",
  year = 	 1995,
  volume =	 16,
  number =	 4,
  pages =	 "147--159",
  month =	 dec,
  downloadsnonlocal =
    "http://www.cs.wustl.edu/cs/playground/papers/wucs-95-29.ps PostScript",
  abstract =
   "The Programmers' Playground is a software library and run-time system for
    creating distributed multimedia applications from collections of reusable
    software modules. This paper presents the design and implementation of
    EUPHORIA, Playground's user interface management system. Implemented as a
    Playground module, EUPHORIA allows end-users to create direct manipulation
    graphical user interfaces (GUIs) exclusively through the use of a graphics
    editor. No programming is required. At run-time, attributes of the GUI
    state can be exposed and connected to external Playground modules, allowing
    the user to visualize and directly manipulate state information in remote
    Playground modules. Features of EUPHORIA include real-time direct
    manipulation graphics, constraint-based editing and visualization,
    imaginary alignment objects, user-definable types, and user-definable
    widgets with alternative representations.",
  category = "Software engineering",
  summary =
   "EUPHORIA allows end-users to construct GUIs for distributed applications
    using only a graphics editor, with no programming.  Visual elements are
    related to each other and the application state by constraints which can
    be visualized and directly edited.",
  nonPAG = 1,
}


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%% 2001
%%%

@MastersThesis{Dean01,
  author = 	 "Laura Dean",
  title = 	 "Improved Simulation of {Input}/{Output} Automata",
  school = 	 MITEECS,
  year = 	 2001,
  address =	 MITaddr,
  month =	 Sep,
  basefilename = "ioa-simulator-dean-mengthesis",
  abstract =
   "The IOA Simulator is part of a collection of tools for developing and
    analyzing distributed algorithms. This thesis describes several
    improvements to the Simulator: adding new data type implementations,
    sharing data types with the IOA Code Generator, improving the Simulator's
    documentation, and adding an interface to Daikon, an invariant-discovery
    tool. These improvements should increase the Simulator's usability as a
    tool in writing and verifying algorithms for distributed systems.",
  category =     "Verification",
  summary =
   "The IOA language is used for modeling algorithms for distributed systems in
    the Input-Output Automaton style.  This thesis presents extensions to the
    IOA Simulator, which is an interpreter for the IOA language.  The extensions
    make the Simulator more useful for testing and verification.",
}


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%% 2002
%%%

@MastersThesis{Harder02:thesis,
  author = 	 "Michael Harder",
  title = 	 "Improving Test Suites via Generated Specifications",
  school = 	 MITEECS,
  year = 	 2002,
  address =	 MITaddr,
  month =	 may,
  supersededby = "Harder02:TR",
  basefilename = "improve-testsuite-harder-mengthesis",
  abstract =
   "This thesis presents a specification-based technique for generating,
    augmenting, and minimizing test suites.  The technique is automatic
    but assumes the existence of a test case generator.  The technique
    dynamically induces specifications from test suite executions.  Test
    suites can be generated by adding cases until the induced
    specification stops changing.  The resulting test suites have better
    fault detection than suites of the same size with 100\% branch
    coverage.  Augmenting an existing test suite, such as a code-covering
    suite, also increases its fault detection.  Minimizing test suites
    while holding the generated specification constant compares favorably
    to previously-known techniques.
    \par
    These positive results can be explained by two insights, which the
    thesis also justifies experimentally.  First, given an a priori
    specification (an oracle), the specification coverage of a test
    suite compares the suite's induced specification with the oracle.
    Experiments show that specification coverage is correlated with fault
    detection, even when test suite size and code coverage are held
    constant.  Second, when tests are added at random to a suite,
    specification coverage increases rapidly, then levels off at a high
    value.  Even without knowing the ideal specification that would be
    induced by all possible tests, it is possible to produce a
    specification very near that one.
    \par
    The thesis's test suite generation and augmentation technique increases
    the specification coverage of the test suite, but without knowing the
    oracle specification and without examining the code.  In addition to
    improving fault detection, the technique generates a specification
    close to the oracle, which has many benefits in itself.",
  category = "Testing",
  summary =
   "This thesis proposes a technique for selecting test cases that is
    similar to structural code coverage techniques, but operates in the
    semantic domain of program behavior rather than in the lexical domain
    of program text.  The technique outperforms branch coverage in test suite
    size and in fault detection.",
  usesDaikon =   1,
}

@TechReport{Harder02:TR,
  author = 	 "Michael Harder",
  title = 	 "Improving test suites via generated specifications",
  institution =  MITLCS,
  year = 	 2002,
  number =	 848,
  address = 	 MITaddr,
  month = 	 jun # "~4,",
  note =         "Revision of author's Master's thesis",
  supersededby = "HarderME03",
  basefilename = "improve-testsuite-tr848",
  abstract =
   "This thesis presents a specification-based technique for generating,
    augmenting, and minimizing test suites.  The technique is automatic
    but assumes the existence of a test case generator.  The technique
    dynamically induces specifications from test suite executions.  Test
    suites can be generated by adding cases until the induced
    specification stops changing.  The resulting test suites have better
    fault detection than suites of the same size with 100\% branch
    coverage.  Augmenting an existing test suite, such as a code-covering
    suite, also increases its fault detection.  Minimizing test suites
    while holding the generated specification constant compares favorably
    to previously-known techniques.
    \par
    These positive results can be explained by two insights, which the
    thesis also justifies experimentally.  First, given an a priori
    specification (an oracle), the specification coverage of a test
    suite compares the suite's induced specification with the oracle.
    Experiments show that specification coverage is correlated with fault
    detection, even when test suite size and code coverage are held
    constant.  Second, when tests are added at random to a suite,
    specification coverage increases rapidly, then levels off at a high
    value.  Even without knowing the ideal specification that would be
    induced by all possible tests, it is possible to produce a
    specification very near that one.
    \par
    The thesis's test suite generation and augmentation technique increases
    the specification coverage of the test suite, but without knowing the
    oracle specification and without examining the code.  In addition to
    improving fault detection, the technique generates a specification
    close to the oracle, which has many benefits in itself.",
  category = "Testing",
  summary =
   "This thesis proposes a technique for selecting test cases that is
    similar to structural code coverage techniques, but operates in the
    semantic domain of program behavior rather than in the lexical domain
    of program text.  The technique outperforms branch coverage in test suite
    size and in fault detection.",
  usesDaikon =   1,
}


@MastersThesis{Nimmer02:thesis,
  author = 	 "Jeremy W. Nimmer",
  title = 	 "Automatic Generation and Checking of Program Specifications",
  school = 	 MITEECS,
  year = 	 2002,
  address =	 MITaddr,
  month =	 May,
  supersededby = "Nimmer02:TR852 A revised version",
  usesDaikon =   1,
}

@TechReport{Nimmer02:TR852,
  author = 	 "Jeremy W. Nimmer",
  title = 	 "Automatic Generation and Checking of Program Specifications",
  institution =  MITLCS,
  year = 	 2002,
  number =	 852,
  address = 	 MITaddr,
  month = 	 jun # "~10,",
  note =         "Revision of author's Master's thesis",
  supersededby = "NimmerE02:ISSTA A revised version,NimmerE02:FSE A revised version",
  basefilename = "tr852",
  abstract =
   "This thesis introduces the idea of combining automatic generation and
    checking of program specifications, assesses its efficacy, and suggests
    directions for future research.
    \par
    Specifications are valuable in many aspects of program development,
    including design, coding, verification, testing, and maintenance.
    They also enhance programmers' understanding of code.  Unfortunately,
    written specifications are usually absent from programs, depriving
    programmers and automated tools of their benefits.
    \par
    This thesis shows how specifications can be accurately recovered using
    a two-stage system: propose likely specifications using a
    dynamic invariant detector, and then confirm the likely specification
    using a static checker.  Their combination overcomes the weaknesses of
    each: dynamically detected properties can provide goals for static
    verification, and static verification can confirm properties proposed
    by a dynamic~tool.
    \par
    Experimental results demonstrate that the dynamic component of
    specification generation is accurate, even with limited test suites.
    Furthermore, a user study indicates that imprecision during generation
    is not a hindrance when evaluated with the help of a static checker.
    We also suggest how to enhance the sensitivity of our system by
    generating and checking context-sensitive properties.",
  category = "Verification",
  usesDaikon =   1,
}


@MastersThesis{Rolfe02,
  author = 	 "Alex Rolfe",
  title = 	 "Code Versioning in a Workflow Management System",
  school = 	 MITEECS,
  year = 	 2002,
  address =	 MITaddr,
  month =	 May,
  basefilename = "workflow-rolfe-mengthesis",
  abstract =	
   "Workflow systems implement process definitions in laboratory, office, and
    industrial settings. In many cases, the process definition is implicit in
    the ad-hoc software written for a particular task. In other cases, a
    generic framework provides basic functionality and structure, offering
    quicker development and advanced features. Few workflow systems handle
    changes in the process definition or the implementing code.  This work
    shows that complicated workflow processes can be composed of a few simple
    primitives and that changes in the workflow structure and code can be
    managed effectively.",
  category =     "Miscellaneous",
  summary =
   "Workflow systems permit high-level definition of code for managing some
    physical process.  This thesis proposes and implements a workflow system
    that permits process definitions and implementing code to be changed, and
    multiple versions of the process and code to be active simultaneously.",
}


@MastersThesis{Morse02,
  author = 	 "Benjamin Morse",
  title = 	 "A {C/C++} Front End for the {Daikon} Dynamic Invariant Detection System",
  school = 	 MITEECS,
  year = 	 2002,
  address =	 MITaddr,
  month =	 aug,
  basefilename = "cfrontend-morse-mengthesis",
  abstract =
   "The Daikon dynamic invariant detection suite is a system designed to
    extract specifications from programs, in the form of information about
    their variables and their relationships to each other.  It does this by
    instrumenting the source code of a target program, which inserts code
    that directs the program to output the values of its variables and
    other information when run.  This data is then sent to Daikon proper,
    which performs analysis on it and reports invariants about the program
    variables.  Daikon is a useful tool that can suggest invariants beyond
    those provable by current static methods.
    \par
    While the invariant analysis tool is language independent, the front
    ends --- tools that instrument of the user code --- must be written for
    every language to be instrumented.  There is a huge base of
    pre-existing code written in C/C++ for which invariants can be
    discovered.  C/C++ are also widely deployed, comprise a large segment
    of software currently in development, and are therefore valuable
    candidates for analysis.  The key difficulty in instrumenting a
    type-unsafe language like C is that the instrumented program has to
    determine what variables are valid, and to what extent, so that it does
    not output garbage values or cause a segmentation fault by
    dereferencing an invalid pointer.  This thesis details the
    implementation and performance of a Daikon front end for the C and C++
    languages.",
  category = "Static analysis",
  summary =
   "An instrumenter for data structures in C and C++ programs must determine
    whether a given pointer is valid; whether it points to a single element or
    an array; if an array, how large, and how much of it is in use.  This
    thesis solves these and related issues in C/C++ run-time instrumentation.",
}


@MastersThesis{Dodoo02:thesis,
  author = 	 "Nii Dodoo",
  title = 	 "Selecting Predicates for Conditional Invariant Detection Using Cluster Analysis",
  school = 	 MITEECS,
  year = 	 2002,
  address =	 MITaddr,
  month =	 sep,
  basefilename = "predicates-dodoo-mengthesis",
  downloadsnonlocal =
   "https://groups.csail.mit.edu/pag/pubs/predicates-dodoo-mengthesis.ps PostScript",
  abstract =
   "This thesis proposes a new technique for selecting predicates for
    conditional program invariants --- that is, implications of the form
    ``p $\Rightarrow$ q'' whose consequent is true only when the predicate
    is true.  Conditional invariants are prevalent in recursive data
    structures, which behave differently in the base and recursive cases,
    and in many other situations.
    \par
    We argue that inferring conditional invariants in programs can be
    reduced to the task of selecting suitable predicates from which to
    infer these conditional invariants. It is computationally infeasible to
    try every possible predicate for conditional properties, and therefore
    it is necessary to limit possible predicates to only those likely to
    give good results. This thesis describes the use of cluster analysis to
    select suitable predicates for conditional invariant detection from
    program execution traces. The primary thesis is: \emph{if ``natural''
    clusters exist in the values of program execution traces, then
    invariants over these clusters should serve as good predicates for
    conditional invariant detection.}
    \par
    The conditional invariants inferred by cluster analysis can be useful
    to programmers for a variety of tasks. In two experiments, we show that
    they are useful in a static verification task and can help programmers
    identify bugs in software programs, and we compare the results with
    other methods for finding conditional invariants.",
  category = "Static analysis",
  summary =
   "This thesis proposes the use of clustering, an artificial intelligence
    technique, for splitting heterogeneous program analysis data into
    homogeneous parts.  The technique is effective in creating implications of
    the form ``p => q'' that are useful in verification and bug detection.",
  usesDaikon =   1,
}



%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%% 2003
%%%


@MastersThesis{NeWin2003,
  author = 	 "Toh {Ne Win}",
  title = 	 "Theorem-proving distributed algorithms with dynamic analysis",
  school = 	 MITEECS,
  year = 	 2003,
  address =	 MITaddr,
  month =	 may,
  basefilename = "thmprove-newin-mengthesis",
  downloadsnonlocal =
   "https://groups.csail.mit.edu/pag/pubs/thmprove-newin-mengthesis.pdf PDF;
    https://groups.csail.mit.edu/pag/pubs/thmprove-newin-mengthesis.ps PostScript",
  abstract =
   "Theorem provers are notoriously hard to use because of the amount of human
    interaction they require, but they are important tools that can verify
    infinite state distributed systems. We present a method to make
    theorem-proving safety properties of distributed algorithms more productive
    by reducing human intervention.  We model the algorithms as I/O automata,
    render the automata executable, and analyze the test executions with
    dynamic invariant detection. The human work in using a theorem prover is
    reduced because our technique provides two forms of assistance: lemmas
    generated by the dynamic invariant detection for use in the prover; and
    prover scripts, or tactics, generated from our experience with the I/O
    automaton model and the knowledge embedded in the test suite used for
    execution. We test our technique on three case studies:  the Peterson
    2-process mutual exclusion algorithm, a strong caching implementation of
    shared memory, and Lamport's Paxos algorithm for distributed consensus.
    \par
    In the development and implementation of our method, we also improved the
    tools for formal verification of I/O automata and for dynamic invariant
    detection. We describe a new model for specifying I/O automata in the
    Isabelle theorem prover's logic, and prove the soundness of a technique for
    verifying invariants in this model in the Isabelle prover. We develop
    methods for generating proofs of I/O automata for two theorem provers, the
    Larch Prover and Isabelle/HOL. We show methods for executing I/O automata
    for testing, by allowing the execution of some automata defined with
    universal and existential quantifiers that were previously
    non-executable. Lastly, we present improvements to dynamic invariant
    detection in order to make it more scalable | in particular, we show how to
    achieve efficient incremental dynamic invariant detection, where the
    detection tool is only allowed to make one pass over its input executions.",
  category = "Verification",
  summary =
   "This thesis proposes a new methodology, based on dynamic analysis, for
    making theorem-provers easier to use.  The dynamic analysis proposes both
    lemmas that are necessary for a proof, and proof tactics that can be used
    to prove the lemmas.  Case studies with three distributed algorithms and
    two theorem-provers show the technique to be effective.",
  usesDaikon =   1,
}



@MastersThesis{Birka2003:thesis,
  author = 	 "Adrian Birka",
  title = 	 "Compiler-enforced immutability for the {Java} language",
  school = 	 MITEECS,
  year = 	 2003,
  address =	 MITaddr,
  month =	 may,
  supersededby = "Birka2003:TR",
  abstract =
   "This thesis presents the design, implementation, and evaluation of an
    extension to the Java language, ConstJava, that is capable of expressing
    immutability constraints and verifying them at compile time.  The
    specific constraint expressed in ConstJava is that the transitive state of
    the object to which a given reference refers cannot be modified using
    that reference.
    \par
    In addition to the ability to specify and enforce this basic
    constraint, ConstJava includes several other features, such as mutable
    fields, immutable classes, templates, and the const\_cast operator,
    that make ConstJava a more useful language.
    \par
    The thesis evaluates the utility of ConstJava via experiments involving
    writing ConstJava code and converting Java code to ConstJava code.  The
    evaluation of ConstJava shows that the language provides tangible
    benefits in early detection and correction of bugs that would
    otherwise be difficult to catch.  There are also costs associated with
    the use of ConstJava.  These are minimized by ConstJava's backward
    compatibility with Java, and by the high degree of inter-operability
    of the two languages, which allows for a less painful transition from
    Java to ConstJava.",
  category = "Programming language design",
  summary =
   "This thesis presents a language (ConstJava), type system, implementation,
    and evaluation of a safe mechanism for enforcing reference immutability,
    where an immutable pointer may not be used to cause side effects to any
    object reachable from it.",
}


@TechReport{Birka2003:TR,
  author = 	 "Adrian Birka",
  title = 	 "Compiler-enforced immutability for the {Java} language",
  institution =  MITLCS,
  year = 	 2003,
  number =	 "MIT-LCS-TR-908",
  address =	 MITaddr,
  month =	 jun,
  note =         "Revision of Master's thesis",
  supersededby = "BirkaE2004",
  abstract =
   "This thesis presents the design, implementation, and evaluation of an
    extension to the Java language, ConstJava, that is capable of expressing
    immutability constraints and verifying them at compile time.  The
    specific constraint expressed in ConstJava is that the transitive state of
    the object to which a given reference refers cannot be modified using
    that reference.
    \par
    In addition to the ability to specify and enforce this basic
    constraint, ConstJava includes several other features, such as mutable
    fields, immutable classes, templates, and the const\_cast operator,
    that make ConstJava a more useful language.
    \par
    The thesis evaluates the utility of ConstJava via experiments involving
    writing ConstJava code and converting Java code to ConstJava code.  The
    evaluation of ConstJava shows that the language provides tangible
    benefits in early detection and correction of bugs that would
    otherwise be difficult to catch.  There are also costs associated with
    the use of ConstJava.  These are minimized by ConstJava's backward
    compatibility with Java, and by the high degree of inter-operability
    of the two languages, which allows for a less painful transition from
    Java to ConstJava.
    \par
    This technical report is a revision of the author's Master's thesis,
    which was advised by Prof.~Michael D.~Ernst.",
  basefilename = "immutability-tr908",
  category = "Programming language design",
  summary =
   "This thesis presents a language (ConstJava), type system, implementation,
    and evaluation of a safe mechanism for enforcing reference immutability,
    where an immutable pointer may not be used to cause side effects to any
    object reachable from it.",
}

@MastersThesis{Brun2003,
  author = 	 "Yuriy Brun",
  title = 	 "Software Fault Identification via Dynamic Analysis and
                  Machine Learning",
  school = 	 MITEECS,
  year = 	 2003,
  address =	 MITaddr,
  month =	 aug # "~16,",
  abstract =
   "I propose a technique that identifies program properties that may
    indicate errors.  The technique generates machine learning models of
    run-time program properties known to expose faults, and applies these
    models to program properties of user-written code to classify and rank
    properties that may lead the user to errors.
    \par
    I evaluate an implementation of the technique, the Fault Invariant
    Classifier, that demonstrates the efficacy of the error finding
    technique.  The implementation uses dynamic invariant detection to
    generate program properties.  It uses support vector machine and
    decision tree learning tools to classify those properties.  Given a
    set of properties produced by the program analysis, some of which are
    indicative of errors, the technique selects a subset of properties
    that are most likely to reveal an error.  The experimental evaluation
    over 941,000 lines of code, showed that a user must examine only the
    2.2 highest-ranked properties for C programs and 1.7 for Java programs
    to find a fault-revealing property.  The technique increases the
    relevance (the concentration of properties that reveal errors) by a
    factor of 50 on average for C programs, and 4.8 for Java programs.",
  supersededby = "BrunE2004",
  basefilename = "faultid-brun-mengthesis",
  downloadsnonlocal =
   "https://groups.csail.mit.edu/pag/pubs/faultid-brun-mengthesis.pdf PDF;
    https://groups.csail.mit.edu/pag/pubs/faultid-brun-mengthesis.ps PostScript",
  category = "Dynamic analysis",
  summary =
   "This thesis shows the efficacy of a technique that performs machine
    learning over correct and incorrect programs, then uses the resulting
    models to identify latent errors in other programs.",
  usesDaikon =   1,
}


@InProceedings{PaluskaSYC2003,
  author = 	 "Justin Mazzola Paluska and David Saff and Tom Yeh and Kathryn Chen",
  title = 	 "Footloose: A Case for Physical Eventual Consistency and Selective Conflict Resolution",
  crossref =     "WMCSA2003",
  pages =	 "170--180",
  abstract =
   "Users are increasingly inundated with small devices with communication
    and storage capabilities.  Unfortunately, the user is still responsible
    for reconciling all of the devices whenever a change is made.  We
    present Footloose, a user-centered data store that can share data and
    reconcile conflicts across diverse devices.  Footloose is an optimistic
    system based on physical eventual consistency{\,---\,}consistency based
    on the movement of devices{\,---\,}and selective conflict
    resolution{\,---\,}which allows conflicts to flow through devices that
    cannot resolve the conflict to devices that can.  Using these
    techniques, Footloose can present consistent views of data on the
    devices closest to the user without user interaction.",
  category = "Miscellaneous",
  basefilename = "footloose-wmcsa2003",
  downloadsnonlocal =
   "http://www.mit.edu/~jmp/research/footloose-wmcsa.pdf PDF;
    http://www.mit.edu/~jmp/research/footloose-wmcsa.ps PostScript;
    http://www.mit.edu/~jmp/research/footloose-wmcsa-presentation.pdf Presentation (PDF)",
  summary =
   "Footloose is a user-centered distributed data store that optimistically
    shares data and reconciles conflicts across diverse, occasionally-connected
    devices."
}


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%% 2004
%%%

@MastersThesis{McCamant2004,
  author = 	 "Stephen McCamant",
  title = 	 "Predicting problems caused by component upgrades",
  school = 	 MITEECS,
  year = 	 2004,
  address =	 MITaddr,
  month =	 jan # "~15,",
  abstract =
   "This thesis presents a new, automatic technique to assess whether
    replacing a component of a software system by a purportedly compatible
    component may change the behavior of the system.
    The technique operates before integrating the new component into the
    system or running system tests, permitting quicker and cheaper
    identification of problems.
    It takes into account the system's use of the component, because a
    particular component upgrade may be desirable in one context but
    undesirable in another.
    No formal specifications are required, permitting detection of
    problems due either to errors in the component or to errors in the
    system.
    Both external and internal behaviors can be compared, enabling
    detection of problems that are not immediately reflected in the
    output.
    \par
    The technique generates an operational abstraction for the old
    component in the context of the system, and one for the new component
    in the context of its test suite.
    An operational abstraction is a set of program properties that
    generalizes over observed run-time behavior.
    Modeling a system as divided into modules, and taking into account the
    control and data flow between the modules, we formulate a logical
    condition to guarantee that the system's behavior is preserved across
    a component replacement.
    If automated logical comparison indicates that the new component does
    not make all the guarantees that the old one did, then the upgrade may
    affect system behavior and should not be performed without further
    scrutiny.
    \par
    We describe a practical implementation of the technique, incorporating
    enhancements to handle non-local state, non-determinism, and missing
    test suites, and to distinguish old from new incompatibilities.
    We evaluate the implementation in case studies using real-world
    systems, including the Linux C library and 48 Unix programs.
    Our implementation identified real incompatibilities among versions of
    the C library that affected some of the programs, and it approved the
    upgrades for other programs that were unaffected by the changes.",
  basefilename = "upgrades-mccamant-smthesis",
  downloadsnonlocal =
   "https://groups.csail.mit.edu/pag/pubs/upgrades-mccamant-smthesis.pdf PDF;
    https://groups.csail.mit.edu/pag/pubs/upgrades-mccamant-smthesis.ps PostScript",
  category = "Dynamic analysis",
  summary =
   "A software upgrade may break a customer's system because of differences
    between it and the vendor's test environment.  This thesis shows how to
    predict such problems without having to integrate and test.",
  usesDaikon =   1,
  supersededby = "McCamant2004:ThesisTR"
}


@MastersThesis{Saff2004,
  author = 	 "David Saff",
  title = 	 "Automated continuous testing to speed software development",
  school = 	 MITEECS,
  year = 	 2004,
  address = 	 MITaddr,
  month = 	 feb # "~3,",
  abstract =
   "Continuous testing is a new feature for software development
    environments that uses excess cycles on a developer's workstation to
    continuously run regression tests in the background, providing rapid
    feedback about test failures as source code is edited.  It is intended
    to reduce the time and energy required to keep code well-tested and
    prevent regression errors from persisting uncaught for long periods of
    time.  The longer that regression errors are allowed to
    linger during development, the more time is wasted debugging and
    fixing them once they are discovered.
    \par
    By monitoring and measuring software projects, we estimate that the
    {\em wasted time}, consisting of this preventable extra fixing cost
    added to the time spent running tests and waiting for them to
    complete, account for 10--15\% of total development time.  We present
    a model of developer behavior that infers developer beliefs from
    developer behavior and predicts behavior in new
    environments{\,---\,}in particular, when changing testing
    methodologies or tools to reduce wasted time.  This model predicts
    that continuous testing would reduce wasted time by 92--98\%, a
    substantial improvement over other evaluated approaches such as automatic
    test prioritization and changing manual test frequencies.
    \par
    A controlled human experiment indicates that continuous testing has a
    statistically significant effect on developer success in completing a
    programming task, without affecting time worked.  Student developers
    using continuous testing were three times more likely to complete a
    task before the deadline than those without.  Most participants found
    continuous testing to be useful and believed that it helped them write
    better code faster, and 90\% would recommend the tool to others.
    \par
    Continuous testing has been integrated into Emacs and Eclipse.  We
    detail the functional and technical design of the Eclipse plug-in,
    which is now publicly released as a beta.",
  category = "Testing",
  supersededby = "SaffE2003 An extended version",
  basefilename = "conttest-saff-smthesis",
  summary =
   "This thesis introduces the notion of continuous testing during development
    and evaluates it via two experiments:  one that observes a developer not
    using continuous testing, and a controlled experiment on college students.",
}


@InProceedings{TipKB2003,
  author = 	 "Frank Tip and Adam Kie{\.z}un and Dirk B{\"a}umer",
  authorASCII =  "Adam Kiezun  Dirk Baumer",
  title = 	 "Refactoring for generalization using type constraints",
  crossref =     "OOPSLA2003",
  pages =	 "13--26",
  abstract =
   "Refactoring is the process of applying behavior-preserving transformations
    (called ``refactorings'') in order to improve a program's design. Associated
    with a refactoring is a set of preconditions that must be satisfied to
    guarantee that program behavior is preserved, and a set of source code
    modifications. An important category of refactorings is concerned with
    generalization (e.g., Extract Interface for re-routing the access to a
    class via a newly created interface, and Pull Up Members for moving members
    into a superclass). For these refactorings, both the preconditions and the
    set of allowable source code modifications depend on interprocedural
    relationships between types of variables. We present an approach in which
    type constraints are used to verify the preconditions and to determine the
    allowable source code modifications for a number of generalization-related
    refactorings. This work is implemented in the standard distribution of
    Eclipse (see www.eclipse.org).",
  category = "Software engineering",
  basefilename = "refactoring-tip-ecoop2003",
  summary =
   "This paper describes the theoretical underpinnings behind two refactorings:
    Extract Interface and Pull Up Members.  The technical mechanism is to use
    type constraints to determine which such changes are permitted.",
}



@TechReport{TipFDK2004,
  author = 	 "Frank Tip and Robert Fuhrer and Julian Dolby and Adam Kie{\.z}un",
  authorASCII =  "Adam Kiezun",
  title = 	 "Refactoring techniques for migrating applications to
                  generic {Java} container classes",
  institution =  "IBM T.J. Watson Research Center",
  year = 	 2004,
  type =	 "IBM Research Report",
  number =	 "RC 23238",
  address =	 "Yorktown Heights, NY, USA",
  month =	 jun # "~2,",
  abstract =
   "Version 1.5 of the Java programming language will include generics, a
    language construct for associating type parameters with classes and
    methods. Generics are particularly useful for creating statically
    type-safe, reusable container classes such that a store of an inappropriate
    type causes a compile-time error, and that no down-casting is needed when
    retrieving elements. The standard libraries released with Java 1.5 will
    include generic versions of popular container classes such as HashMap and
    ArrayList. This paper presents a method for refactoring Java programs that
    use current container classes into equivalent Java 1.5 programs that use
    their new generic counterparts. Our method uses a variation on an existing
    model of type constraints to infer the element types of container objects,
    and it is parameterized by how much, if any, context sensitivity to exploit
    when generating these type constraints. We present both a
    context-insensitive instantiation of the framework and one using a low-cost
    variation on Agesen's Cartesian Product Algorithm. The method has been
    implemented in Eclipse, a popular open-source development environment for
    Java. We evaluated our approach on several small benchmark programs, and
    found that, in all but one case, between 40\% and 100\% of all casts can be
    removed.",
  category =     "Static analysis",
  supersededby = "FuhrerTKDK2005",
  basefilename = "refactoring-tip-rc23238",
  summary =
   "This paper gives a type-constraint-based method for converting non-generic
    uses of Java collections into generic ones.  In its context-sensitive
    version it can also generify methods.  It is implemented in Eclipse.",
}


@MastersThesis{Lin2004,
  author =	 "Lee Lin",
  title =	 "Improving adaptability via program steering",
  school = 	 MITEECS,
  year = 	 2004,
  address =	 MITaddr,
  month =	 aug # "~12,",
  abstract =
   "A multi-mode software system contains several distinct modes of
    operation and a controller for deciding when to switch between modes.
    Even when developers rigorously test a multi-mode system before
    deployment, they cannot foresee and test for every possible usage
    scenario.  As a result, unexpected situations in which the program
    fails or underperforms (for example, by choosing a non-optimal mode)
    may arise.  This research aims to mitigate such problems by training
    programs to select more appropriate modes during new situations.  The
    technique, called program steering, creates a new mode selector by
    learning and extrapolating from previously successful experiences.
    Such a strategy, which generalizes the knowledge that a programmer has
    built into the system, may select an appropriate mode even when the
    original programmer had not considered the scenario.  We applied the
    technique on simulated fish programs from MIT's Embodied Intelligence
    class and on robot control programs written in a month-long
    programming competition.  The experiments show that the technique is
    domain independent and that augmenting programs via program steering
    can have a substantial positive effect on their performance in new
    environments.",
  supersededby = "LinE2004",
  basefilename = "steering-lin-mengthesis",
  downloadsnonlocal =
   "https://groups.csail.mit.edu/pag/pubs/steering-lin-mengthesis.pdf PDF;
    https://groups.csail.mit.edu/pag/pubs/steering-lin-mengthesis.ps PostScript",
  category =     "Dynamic analysis",
  summary =
   "Program steering selects modalities for a program that may operate in
    several modes.  This thesis's experiments show that program steering can
    substantially improve performance in unanticipated situations.",
  usesDaikon = 1,
}


@MastersThesis{Donovan2004,
  author = 	 "Alan A. A. Donovan",
  title = 	 "Converting {Java} programs to use generic libraries",
  school = 	 MITEECS,
  year = 	 2004,
  address = 	 MITaddr,
  month = 	 sep,
  abstract =
   "Java 1.5 will include a type system (called JSR-14) that supports
    parametric polymorphism, or generic classes. This will bring many benefits
    to Java programmers, not least because current Java practise makes heavy
    use of logically-generic classes, including container classes. Translation
    of Java source code into semantically equivalent JSR-14 source code
    requires two steps: parameterisation (adding type parameters to class
    definitions) and instantiation (adding the type arguments at each use of a
    parameterised class). Parameterisation need be done only once for a class,
    whereas instantiation must be performed for each client, of which there are
    potentially many more. Therefore, this work focuses on the instantiation
    problem. We present a technique to determine sound and precise JSR-14 types
    at each use of a class for which a generic type specification is
    available. Our approach uses a precise and context-sensitive pointer
    analysis to determine possible types at allocation sites, and a
    set-constraint-based analysis (that incorporates guarded, or conditional,
    constraints) to choose consistent types for both allocation and declaration
    sites. The technique safely handles all features of the JSR-14 type system,
    notably the raw types (which provide backward compatibility) and
    `unchecked' operations on them. We have implemented our analysis in a tool
    that automatically inserts type arguments into Java code, and we report its
    performance when applied to a number of real-world Java programs.",
  basefilename = "generics-donovan-smthesis",
  downloadsnonlocal =
   "https://groups.csail.mit.edu/pag/pubs/generics-donovan-smthesis-2004.pdf PDF;
    https://groups.csail.mit.edu/pag/pubs/generics-donovan-smthesis-2004.ps PostScript",
  supersededby = "DonovanKTE2004 An extended version",
  category =     "Static analysis",
  summary =
   "When type parameters are added to library code, client code should be
    upgraded to supply parameters at each use of library classes.  This
    paper presents a sound and precise combined pointer and type-based
    analysis that does so.",
}


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%% 2005
%%%


@InProceedings{Saff2005,
  author = 	 "David Saff",
  title = 	 "Test factoring: Focusing test suites on the test at hand",
  crossref =     "ICSE2005",
  pages = 	 "",
  NOabstract =   "",
  supersededby = "SaffE2004:mock-creation A summary",
  basefilename = "test-factoring-doctoral-icse2005",
  downloadsnonlocal =
   "https://groups.csail.mit.edu/pag/pubs/test-factoring-doctoral-icse2005.pdf PDF;
    https://groups.csail.mit.edu/pag/pubs/test-factoring-doctoral-icse2005.ps PostScript",
  category =     "Testing",
  summary =
   "This one-page doctoral symposium summary outlines the motivation behind
    test factoring:  automatically converting each slow-running system tests
    into a collection of fast-running unit tests.",
}






@MastersThesis{Williams2005,
  author = 	 "Amy Lynne Williams",
  title = 	 "Static Detection of Deadlock for {Java} Libraries",
  school = 	 MITEECS,
  year = 	 2005,
  address = 	 MITaddr,
  month = 	 may,
  category =     "Static analysis",
  supersededby = "WilliamsTE2005 An extended version",
  summary =
   "This thesis gives a technique for determining whether any invocation of
    a library can lead to deadlock in the client program; it can also be
    extended to the closed-world (whole-program) case.",
}



@InProceedings{FuhrerTKDK2005,
  author = 	 "Robert Fuhrer and Frank Tip and Adam Kie{\.z}un and
                  Julian Dolby and Markus Keller",
  authorASCII =  "Adam Kiezun",
  title = 	 "Efficiently refactoring {Java} applications to use generic
                  libraries",
  crossref =     "ECOOP2005",
  pages = 	 "71--96",
  abstract =
   "Java~1.5 generics enable the creation of reusable container classes with
    compiler-enforced type-safe usage. This eliminates the need for potentially
    unsafe down-casts when retrieving elements from containers. We present a
    refactoring that replaces raw references to generic library classes with
    parameterized references. The refactoring infers actual type parameters for
    allocation sites and declarations using an existing framework of type
    constraints, and removes casts that have been rendered redundant. The
    refactoring was implemented in Eclipse, a popular open-source development
    environment for Java, and laid the grounds for a similar refactoring in the
    forthcoming Eclipse 3.1 release. We evaluated our work by refactoring
    several Java programs that use the standard collections framework to use
    Java 1.5's generic version instead. In these benchmarks, on average,
    48.6\% of the casts are removed, and 91.2\% of the compiler warnings
    related to the use of raw types are eliminated. Our approach distinguishes
    itself from the state-of-the-art [8] by being more scalable, by its ability
    to accommodate user-defined subtypes of generic library classes, and by
    being incorporated in a popular integrated development environment.",
  category =     "Static analysis",
  basefilename = "genericlibs-tip-ecoop2005",
  summary =
   "This paper gives a type-constraint-based method for converting non-generic
    uses of Java collections into generic ones.  In its context-sensitive
    version it can also generify methods.  It is implemented in Eclipse.",
}


@TechReport{McCamantM2005:TR,
  author = 	 "Stephen McCamant and Greg Morrisett",
  title = 	 "Efficient, verifiable binary sandboxing for a {CISC} architecture",
  institution =  MITCSAIL,
  year = 	 2005,
  number =	 {2005-030},
  note =         {(also MIT LCS TR \#988)},
  address =	 MITaddr,
  month =	 may,
  abstract =
   "Executing untrusted code while preserving security requires
    enforcement of {\em memory} and {\em control-flow safety} policies:
    untrusted code must be prevented from modifying memory or executing
    code except as explicitly allowed.
    Software-based fault isolation (SFI) or ``sandboxing'' enforces
    those policies by rewriting the untrusted code at the level of
    individual instructions.
    However, the original sandboxing technique of Wahbe et al.\ is
    applicable only to RISC architectures, and other previous work is
    either insecure, or has been not described in enough detail to give
    confidence in its security properties.
    We present a novel technique that allows sandboxing to be easily
    applied to a CISC architecture like the IA-32.
    The technique can be verified to have been applied at load time, so
    that neither the rewriting tool nor the compiler needs to be
    trusted.
    We describe a prototype implementation which provides a robust
    security guarantee, is scalable to programs of any size, and has
    low runtime overheads.
    Further, we give a machine-checked proof that any program approved
    by the verification algorithm is guaranteed to respect the desired
    safety property.",
  supersededby = "McCamantM2006",
  NOTbasefilename = "pittsfield-tr988",
  downloadsnonlocal =
   "https://groups.csail.mit.edu/pag/pubs/pittsfield-tr988.pdf PDF;
    https://groups.csail.mit.edu/pag/pubs/pittsfield-tr988.ps PostScript;
    http://hdl.handle.net/1721.1/30542 DSpace",
  category = "Security",
  summary =
   "This report describes an instruction-level rewriting technique to
   enforce memory and control-flow safety.  A prototype implementation
   demonstrates the technique's scalability, and a machine-checked
   proof formalizes its security guarantee.",
}


@MastersThesis{Pacheco2005,
  author = 	 "Carlos Pacheco",
  title =	 "Eclat: Automatic generation and classification of test inputs",
  school = 	 MITEECS,
  year = 	 2005,
  address =	 MITaddr,
  month =	 jun,
  abstract =
   "This thesis describes a technique that selects, from a large set of test
    inputs, a small subset likely to reveal faults in the software under test.
    The technique takes a program or software component, plus a set of correct
    executions---say, from observations of the software running properly, or
    from an existing test suite that a user wishes to enhance.  The technique
    first infers an operational model of the software's operation.  Then,
    inputs whose operational pattern of execution differs from the model in
    specific ways are suggestive of faults.  These inputs are further reduced
    by selecting only one input per operational pattern. The result is a small
    portion of the original inputs, deemed by the technique as most likely to
    reveal faults.  Thus, the technique can also be seen as an error-detection
    technique.
    \par
    The thesis describes two additional techniques that complement test input
    selection.  One is a technique for automatically producing an oracle (a set
    of assertions) for a test input from the operational model, thus
    transforming the test input into a test case.  The other is a
    classification-guided test input generation technique that also makes use
    of operational models and patterns.  When generating inputs, it filters out
    code sequences that are unlikely to contribute to legal inputs, improving
    the efficiency of its search for fault-revealing inputs.
    \par
    We have implemented these techniques in the Eclat tool, which generates
    unit tests for Java classes. Eclat's input is a set of classes to test and
    an example program execution---say, a passing test suite. Eclat's output is
    a set of JUnit test cases, each containing a potentially fault-revealing
    input and a set of assertions at least one of which fails.  In our
    experiments, Eclat successfully generated inputs that exposed
    fault-revealing behavior; we have used Eclat to reveal real errors in
    programs.  The inputs it selects as fault-revealing are an order of
    magnitude as likely to reveal a fault as all generated inputs.",
  supersededby = "PachecoE2005 An extended version",
  basefilename = "pacheco-testing-msthesis",
  category =     "Testing",
  summary =
   "This thesis presents an automatic mechanism for selecting tests that are
    likely to expose errors---tests whose run-time behavior is maximally
    different from succeeding runs.  The thesis also gives techniques for
    test input generation and for converting a test input into a test case.",
}



@InProceedings{Perkins2005,
  author =	 "Jeff H. Perkins",
  title =	 "Automatically generating refactorings to support {API} evolution",
  crossref =     "PASTE2005",
  pages = 	 "111--114",
  basefilename = "refactor-deprecated-paste2005",
  downloadsnonlocal =
    "https://groups.csail.mit.edu/pag/pubs/refactor-deprecated-paste2005.pdf PDF;
     https://groups.csail.mit.edu/pag/pubs/refactor-deprecated-paste2005.ps PostScript",
  category =     "Dynamic analysis",
  summary =
   "This paper proposes an extremely simple source code analysis that
    performs as well as more complicated analyses in permitting client code
    to be refactored in response to library changes.",
  abstract =
   "When library APIs change, client code should change in response, in order
    to avoid erroneous behavior, compilation failures, or warnings.  Previous
    research has introduced techniques for generating such client
    refactorings.  This paper improves on the previous work by proposing a
    novel, lightweight technique that takes advantage of information that
    programmers have already inserted in the code rather than forcing them to
    use a different tool to re-express it.  The key idea is to replace calls
    to deprecated methods by their bodies, when those bodies consist of calls
    to the replacement code.  This approach has several benefits.  It
    requires no change in development practice, since programmers already
    adjust method bodies and/or write example code, and there are no new
    tools or languages to learn.  It does not require distribution of new
    artifacts, and a tool to apply it can be lightweight.  A second
    contribution of the paper is a programming methodology that permits
    non-behavior-preserving refactorings, as when correcting library errors
    or adjusting semantics, to be tested and applied.",
}


@Misc{GuoM2005,
  author = 	 "Philip Guo and Stephen McCamant",
  authorASCII =  "Adam Kiezun",
  title = 	 "Annotation-less unit type inference",
  howpublished = "\url{http://ocw.mit.edu/courses/electrical-engineering-and-computer-science/6-883-program-analysis-fall-2005/projects/unit_type_infere.pdf}",
  month = 	 dec # "~14,",
  year = 	 2005,
  omitfromcv = 1,
}


@Misc{ArtziKPP2005,
  author = 	 "Shay Artzi and Adam Kie{\.z}un and Carlos Pacheco and Jeff Perkins",
  authorASCII =  "Adam Kiezun",
  title = 	 "Automatic generation of unit regression tests",
  howpublished = "\url{https://groups.csail.mit.edu/pag/6.883/projects/unit-regression-tests.pdf}",
  month = 	 dec # "~16,",
  year = 	 2005,
  omitfromcv = 1,
  supersededby = "ArtziEGKPP2006",
}


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%% 2006
%%%

@InProceedings{McCamantM2006,
  author =	 "Stephen McCamant and Greg Morrisett",
  title =	 "Evaluating {SFI} for a {CISC} Architecture",
  crossref =     "USENIXSec2006",
  pages = 	 "209--224",
  basefilename = "pittsfield-usenix2006",
  downloadsnonlocal =
    "https://groups.csail.mit.edu/pag/pubs/pittsfield-usenix2006.pdf PDF;
     https://groups.csail.mit.edu/pag/pubs/pittsfield-usenix2006.ps PostScript",
  category =     "Security",
  summary =
   "This paper describes an instruction-level rewriting technique to
   enforce memory and control-flow safety.  A prototype implementation
   demonstrates the technique's scalability, and a machine-checked
   proof formalizes its security guarantee.",
  abstract =
   "Executing untrusted code while preserving security requires that the
    code be prevented from modifying memory or executing code except as
    explicitly allowed. Software-based fault isolation (SFI) or
    ``sandboxing'' enforces such a policy by rewriting the untrusted code
    at the instruction level.
    However, the original sandboxing technique of Wahbe et al.\ is
    applicable only to RISC architectures, and most other previous work is
    either insecure, or has been not described in enough detail to give
    confidence in its security properties.
    We present a new sandboxing technique that can be applied to a CISC
    architecture like the IA-32, and whose application can be checked
    at load-time to minimize the TCB.
    We describe an implementation which provides a robust security
    guarantee and has low runtime overheads (an average of 21\% on the
    SPECint2000 benchmarks).
    We evaluate the utility of the technique by applying it to untrusted
    decompression modules in an archive tool, and its safety by
    constructing a machine-checked proof that any program approved by the
    verification algorithm will respect the desired safety property.",
}

@MastersThesis{Guo2006,
  author = 	 "Philip Jia Guo",
  title = 	 "A Scalable Mixed-Level Approach to Dynamic Analysis of {C} and {C++} Programs",
  school = 	 MITEECS,
  year = 	 2006,
  address = 	 MITaddr,
  month = 	 may # "~5,",
  abstract =
   "This thesis addresses the difficult task of constructing robust and
    scalable dynamic program analysis tools for programs written in
    memory-unsafe languages such as C and C++, especially those that are
    interested in observing the contents of data structures at run time. In
    this thesis, I first introduce my novel mixed-level approach to dynamic
    analysis, which combines the advantages of both source- and binary-based
    approaches. Second, I present a tool framework that embodies the
    mixed-level approach. This framework provides memory safety guarantees,
    allows tools built upon it to access rich source- and binary-level
    information simultaneously at run time, and enables tools to scale to
    large, real-world C and C++ programs on the order of millions of lines of
    code. Third, I present two dynamic analysis tools built upon my framework
    --- one for performing value profiling and the other for performing dynamic
    inference of abstract types --- and describe how they far surpass previous
    analyses in terms of scalability, robustness, and applicability. Lastly, I
    present several case studies demonstrating how these tools aid both humans
    and automated tools in several program analysis tasks: improving human
    understanding of unfamiliar code, invariant detection, and data structure
    repair.",
  basefilename = "guo-mixedlevel-mengthesis",
  downloadsnonlocal =
    "https://groups.csail.mit.edu/pag/pubs/guo-mixedlevel-mengthesis.pdf PDF",
  category =  "Dynamic analysis",
  summary = 	
   "This thesis introduces a mixed-level approach and toolkit for constructing
    dynamic analyses that combines the benefits of source-level and binary-level
    approaches.  It also presents two dynamic analysis tools --- for value
    profiling and for inferring abstract types.",
}

@TechReport{McCamant2006,
  author = 	 "Stephen McCamant",
  title = 	 "A Machine-Checked Safety Proof for a {CISC}-Compatible {SFI} Technique",
  institution =  MITCSAIL,
  year = 	 2006,
  number =	 {2006-035},
  address =	 MITaddr,
  month =	 may,
  abstract =
   "Executing untrusted code while preserving security requires that the
    code be prevented from modifying memory or executing instructions
    except as explicitly allowed.  Software-based fault isolation (SFI) or
    ``sandboxing'' enforces such a policy by rewriting code at the
    instruction level.  In previous work, we developed a new SFI technique
    that is applicable to CISC architectures such as the Intel IA-32,
    based on enforcing additional alignment constraints to avoid
    difficulties with variable-length instructions.  This report describes
    a machine-checked proof we developed to increase our confidence in the
    safety provided by the technique.  The proof, constructed for a
    simplified model of the technique using the ACL2 theorem proving
    environment, certifies that if the code rewriting has been checked to
    have been performed correctly, the resulting program cannot perform a
    dangerous operation when run.  We describe the high-level structure of
    the proof, then give the intermediate lemmas with interspersed
    commentary, and finally evaluate the process of the proof's
    construction.",
  NOTbasefilename = "pittsfield-proof-tr06-035",
  downloadsnonlocal =
   "https://groups.csail.mit.edu/pag/pubs/pittsfield-proof-tr06-035.pdf PDF;
    https://groups.csail.mit.edu/pag/pubs/pittsfield-proof-tr06-035.ps PostScript;
    http://hdl.handle.net/1721.1/32546 DSpace",
  category = "Security",
  summary =
   "This report summarizes a machine-checked proof in ACL2 of the safety
    of a technique to enforce memory and control-flow safety for x86
    binaries by machine-code rewriting.",
}

@MastersThesis{Tschantz2006,
  author = 	 "Matthew S. Tschantz",
  title = 	 "Javari: Adding Reference Immutability to {Java}",
  school = 	 MITEECS,
  year = 	 2006,
  address = 	 MITaddr,
  month = 	 aug,
  abstract =
   "This paper describes a programming language, Javari, that is capable
    of expressing and enforcing immutability constraints.  The specific
    constraint expressed is that the abstract state of the object to which
    an immutable reference refers cannot be modified using that reference.
    The abstract state is (part of) the transitively reachable state: that
    is, the state of the object and all state reachable from it by
    following references.  The type system permits explicitly excluding
    fields from the abstract state of an object.  For a statically
    type-safe language, the type system guarantees reference immutability.
    If the language is extended with immutability downcasts, then run-time
    checks enforce the reference immutability constraints.
    \par
    The type system is distinguishes the notions of assignability and
    mutability; integrates with Java 5's generic types and with
    multi-dimensional arrays; provides a mutability polymorphism approach
    to avoiding code duplication; has type-safe support for reflection and
    serialization. This paper describes a core calculus including formal
    type rules for the language.
    \par
    Additionally, this paper describes a type inference algorithm that can
    be used convert existing Java programs to Javari.  Experimental
    results from a prototype implementation of the algorithm are
    presented.",
  supersededby = "TschantzE2005 An extended version",
  basefilename = "tschantz-refimmut-mengthesis",
  downloadsnonlocal =
    "https://groups.csail.mit.edu/pag/pubs/tschantz-refimmut-mengthesis.pdf PDF",
  category = "Programming language design",
  summary = 	
   "Javari extends Java 5 to express reference immutability constraints.  The
    type guarantees are deep (transitive) but users can exclude parts of
    the state.  The thesis includes type rules and  a type inference algorithm.",
}


@TechReport{Tschantz2006:TR,
  author = 	 "Matthew S. Tschantz",
  title = 	 "Javari: Adding Reference Immutability to {Java}",
  institution =  MITCSAIL,
  year = 	 2006,
  number = 	 "MIT-CSAIL-TR-2006-059",
  address = 	 MITaddr,
  month = 	 sep # "~5,",
  abstract =
   "This paper describes a programming language, Javari, that is capable
    of expressing and enforcing immutability constraints.  The specific
    constraint expressed is that the abstract state of the object to which
    an immutable reference refers cannot be modified using that reference.
    The abstract state is (part of) the transitively reachable state: that
    is, the state of the object and all state reachable from it by
    following references.  The type system permits explicitly excluding
    fields from the abstract state of an object.  For a statically
    type-safe language, the type system guarantees reference immutability.
    If the language is extended with immutability downcasts, then run-time
    checks enforce the reference immutability constraints.
    \par
    The type system is distinguishes the notions of assignability and
    mutability; integrates with Java 5's generic types and with
    multi-dimensional arrays; provides a mutability polymorphism approach
    to avoiding code duplication; has type-safe support for reflection and
    serialization. This paper describes a core calculus including formal
    type rules for the language.
    \par
    Additionally, this paper describes a type inference algorithm that can
    be used convert existing Java programs to Javari.  Experimental
    results from a prototype implementation of the algorithm are
    presented.",
  basefilename = "tschantz-refimmut-tr059",
  downloadsnonlocal =
    "https://groups.csail.mit.edu/pag/pubs/tschantz-refimmut-tr059.pdf PDF",
  supersededby = "TschantzE2005 An extended version",
  category = "Programming language design",
  summary = 	
   "Javari extends Java 5 to express reference immutability constraints.  The
    type guarantees are deep (transitive) but users can exclude parts of
    the state.  The thesis includes type rules and  a type inference algorithm.",
}


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%% 2007
%%%

@MastersThesis{Xiao2007,
  author = 	 "Chen Xiao",
  title = 	 "Performance Enhancements for a Dynamic Invariant Detector",
  school = 	 MITEECS,
  year = 	 2007,
  address = 	 MITaddr,
  month = 	 feb,
  abstract =
   "Dynamic invariant detection is the identification of the likely properties
    about a program based on observed variable values during program
    execution. While other dynamic invariant detectors use a brute force
    algorithm, Daikon adds powerful optimizations to provide more scalable
    invariant detection without sacrificing the richness of the reported
    invariants. Daikon improves scalability by eliminating redundant
    invariants. For example, the suppression optimization allows Daikon to
    delay the creation of invariants that are logically implied by other true
    invariants. Although conceptually simple, the implementation of this
    optimization in Daikon has a large fixed cost and scales polynomially with
    the number of program variables.
    \par
    I investigated performance problems in two implementations of the
    suppression optimization in Daikon and evaluated several methods for
    improving the algorithm for the suppression optimization: optimizing
    existing algorithms, using a hybrid, context-sensitive approach to maximize
    the effectiveness of the two algorithms, and batching applications of the
    algorithm to lower costs. Experimental results showed a 10\% runtime
    improvement in Daikon runtime. In addition, I implemented an oracle to
    verify the implementation of these improvements and the other optimizations
    in Daikon.",
  usesDaikon = 1,
  basefilename = "xiao-invdetopt-mengthesis",
  downloadsnonlocal =
    "https://groups.csail.mit.edu/pag/pubs/xiao-invdetopt-mengthesis.pdf PDF",
  category =  "Specification inference",
  summary = 	
   "As an optimization, the Daikon invariant detector suppresses (does not
    instantiate or check) potential invariants that are implied by
    instantiated/checked ones.  This thesis investigates optimizations to
    this suppression mechanism.",
}



@MastersThesis{Glasser2007,
  author = 	 "David Samuel Glasser",
  title = 	 "Test factoring with \texttt{amock}: Generating readable unit tests from system tests",
  school = 	 MITEECS,
  year = 	 2007,
  address = 	 MITaddr,
  month = 	 aug # "~21,",
  abstract =
   "Automated unit tests are essential for the construction of reliable
    software, but writing them can be tedious. If the goal of test generation
    is to create a lasting unit test suite (and not just to optimize execution
    of system tests), it is essential that generated tests can be understood by
    the developers that will be running them, so that they can tell the
    difference between real and spurious failures. amock is a system which
    automatically generates human-readable JUnit regression tests that use mock
    objects to simulate the behavior of individual objects dynamically observed
    during a system test execution.",
  basefilename = "glasser-testfactor-mengthesis",
  downloadsnonlocal =
    "https://groups.csail.mit.edu/pag/pubs/glasser-testfactor-mengthesis.pdf PDF",
  category =  "Testing",
  summary =
   "Test factoring converts a long system test into many short unit tests.
    This thesis extends previous work by creating unit tests that are
    readable, modifiable, and maintainable by programmers.",
}


@InProceedings{KimZWZ2007,
  author = 	 "Sunghun Kim and Thomas Zimmermann and E. James {Whitehead, Jr.} and Andreas Zeller",
  title = 	 "Predicting faults from cached history",
  crossref =     "ICSE2007",
  pages = 	 "489--498",
  abstract =
   "We analyze the version history of 7 software systems to predict the most
    fault prone entities and files.  The basic assumption is that faults do not
    occur in isolation, but rather in bursts of several related faults.
    Therefore, we cache locations that are likely to have faults: starting from
    the location of a known (fixed) fault, we cache the location itself, any
    locations changed together with the fault, recently added locations, and
    recently changed locations. By consulting the cache at the moment a fault
    is fixed, a developer can detect likely fault-prone locations. This is
    useful for prioritizing verification and validation resources on the most
    fault prone files or entities. In our evaluation of seven open source
    projects with more than 200,000 revisions, the cache selects 10\% of the
    source code files; these files account for 73\%--95\% of faults---a
    significant advance beyond the state of the art.",
  basefilename = "predict-faults-icse2007",
  downloadsnonlocal =
    "https://groups.csail.mit.edu/pag/pubs/predict-faults-icse2007.pdf PDF",
  category =  "Mining software repositories",
  summary = 	
   "Faults often co-occur, so when one is fixed, another one may be lurking
   nearby.  Using this intuition, this paper aims to identify a small
   number of files that contain most of the faults in a program.",
}
@inproceedings{KimZWZ2008,
 author = {Sunghun Kim and Thomas Zimmermann and E. James Whitehead, Jr. and Andreas Zeller},
 title = {Predicting faults from cached history},
 booktitle = {ISEC '08: Proceedings of the 1st conference on India software engineering conference},
 year = {2008},
 isbn = {978-1-59593-917-3},
 pages = {15--16},
 address = {Hyderabad, India},
 doi = {https://doi.acm.org/10.1145/1342211.1342216},
 supersededby = "KimZWZ2007 A summary"
 }


@InProceedings{Saff2007:OOPSLA2007demo,
  author = 	 "David Saff",
  title = 	 "Theory-infected:  Or how {I} learned to stop worrying and love universal quantification",
  crossref =     "OOPSLACompanion2007",
  pages = 	 "846--847",
  abstract =
   "Writing developer tests as software is built can provide peace of mind.  As
    the software grows, running the tests can prove that everything still works
    as the developer envisioned it.  But what about the behavior the developer
    failed to envision?  Although verifying a few well-picked scenarios is
    often enough, experienced developers know bugs can often lurk even in
    well-tested code, when correct but untested inputs provoke obviously wrong
    responses.  This leads to worry.
    \par
    We suggest writing \emph{Theories} alongside developer tests, to specify
    desired universal behaviors.  We will demonstrate how writing theories
    affects test-driven development, how new features in JUnit can verify
    theories against hand-picked inputs, and how a new tool, Theory Explorer,
    can search for new inputs, leading to a new, less worrisome approach to
    development.",
  basefilename = "test-theory-demo-oopsla2007",
  downloadsnonlocal = "https://groups.csail.mit.edu/pag/pubs/test-theory-demo-oopsla2007.pdf PDF",
  category =  "Testing",
  summary =
    "A theory is a generalized unit test --- a predicate that should be true
    for any object or combination of objects that may exist.  This demo
    presents theories and tools that support them to improve testing.",
}



@InProceedings{Saff2007:OOPSLA2007poster,
  author = 	 "David Saff",
  title = 	 "From developer's head to developer tests:  Characterization, theories, and preventing one more bug",
  crossref =     "OOPSLACompanion2007",
  pages = 	 "811--812",
  abstract =
   "Unit testing frameworks like JUnit are a popular and effective way to
    prevent developer bugs.  We are investigating two ways of building on
    these frameworks to prevent more bugs with less effort.  First,
    \emph{characterization} tools summarize observations over a large
    number of executions, which can be checked by developers, and added to
    the test suite if they specify intended behavior.  Second,
    \emph{theories} are developer-written statements of correct behavior
    over a large set of inputs, which can be automatically verified.  We
    outline an integrated toolset for characterization and theory-based
    testing, and frame further research into their usefulness.",
  basefilename = "test-theory-poster-oopsla2007",
  downloadsnonlocal = "https://groups.csail.mit.edu/pag/pubs/test-theory-poster-oopsla2007.pdf PDF",
  category =  "Testing",
  summary =
   "This poster discusses two ways to aid testers:  generalized assertions
   called theories that must hold for any data structure created by a program,
   and characterization tools that infer such generalized assertions.",
}


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%% 2008
%%%

@InProceedings{GodefroidKY2008,
  author = 	 "Patrice Godefroid and Adam Kie{\.z}un and Michael Y. Levin",
  authorASCII =  "Patrice Godefroid and Adam Kiezun and Michael Y. Levin",
  title = 	 "Grammar-based whitebox fuzzing",
  crossref =     "PLDI2008",
  pages = 	 "206--215",
  abstract =
   "Whitebox fuzzing is a form of automatic dynamic test generation, based on
    symbolic execution and constraint solving, designed for security testing of
    large applications. Unfortunately, the current effectiveness of whitebox
    fuzzing is limited when testing applications with highly-structured inputs,
    such as compilers and interpreters. These applications process their inputs
    in stages, such as lexing, parsing and evaluation.  Due to the enormous
    number of control paths in early processing stages, whitebox fuzzing rarely
    reaches parts of the application beyond those first stages.
    \par
    In this paper, we study how to enhance whitebox fuzzing of complex
    structured-input applications with a grammar-based specification of their
    valid inputs. We present a novel dynamic test generation algorithm where
    symbolic execution directly generates grammar-based constraints whose
    satisfiability is checked using a custom grammar-based constraint solver.
    We have implemented this algorithm and evaluated it on a large
    security-critical application, the JavaScript interpreter of Internet
    Explorer 7 (IE7). Results of our experiments show that grammar-based
    whitebox fuzzing explores deeper program paths and avoids dead-ends due to
    non-parsable inputs. Compared to regular whitebox fuzzing, grammar-based
    whitebox fuzzing increased coverage of the code generation module of the
    IE7 JavaScript interpreter from 53\% to 81\% while using three times fewer
    tests.",
  basefilename = "whitebox-fuzzing-PLDI2008",
  OPTdownloads = "",
  OPTdownloadsnonlocal = "",
  category =  "Testing",
  summary =
    "A test generation strategy should produce inputs that satisfy the
    structural requirements of the program under test.  This paper shows how
    to generate inputs conforming to a grammar while satisfying path constraints.",
}



@InProceedings{Bettenburg2008:MSR2008,
  author = 	 "Nicolas Bettenburg and Rahul Premraj and Thomas Zimmermann and Sunghun Kim",
  title = 	 "Extracting Structural Information from Bug Reports",
  crossref =     "MSR2008",
  NEEDpages = 	 "*",
  abstract =
   "In software engineering experiments, the description of bug reports is typically treated as natural language text, although it often contains stack traces, source code, and patches. Neglecting such structural elements is a loss of valuable information; structure usually leads to a better performance of machine learning approaches. In this paper, we present a tool called infoZilla that detects structural elements from bug reports with near perfect accuracy and allows us to extract them. We anticipate that infoZilla can be used to leverage data from bug reports at a different granularity level that can facilitate interesting research in the future.",
  basefilename = "bettenburg-msr-2008",
  category =  "Mining software repositories",
  summary =
   "This paper presents the infoZilla tool, which parses unstructured user
    bug reports.  This will facilitate future research that analyzes bug
    reports.",
}



@Article{Kim2008:TSE,
  author = 	 "Sunghun Kim and E. James {Whitehead, Jr.} and Yi Zhang",
  title = 	 "Classifying Software Changes: Clean or Buggy?",
  journal = 	 TSE,
  year = 	 2008,
  volume =	 34,
  number =	 2,
  pages =	 "181--196",
  month = 	 mar # "/" # apr,
  abstract =
   "This paper introduces a new technique for predicting latent software bugs, called change classification. Change classification uses a machine learning classifier to determine whether a new software change is more similar to prior buggy changes or clean changes. In this manner, change classification predicts the existence of bugs in software changes. The classifier is trained using features (in the machine learning sense) extracted from the revision history of a software project stored in its software configuration management repository. The trained classifier can classify changes as buggy or clean, with a 78 percent accuracy and a 60 percent buggy change recall on average. Change classification has several desirable qualities: 1) The prediction granularity is small (a change to a single file), 2) predictions do not require semantic information about the source code, 3) the technique works for a broad array of project types and programming languages, and 4) predictions can be made immediately upon the completion of a change. Contributions of this paper include a description of the change classification approach, techniques for extracting features from the source code and change histories, a characterization of the performance of change classification across 12 open source projects, and an evaluation of the predictive power of different groups of features.",
  basefilename = "kim-tse-2008",
  category =  "Mining software repositories",
  summary =
   "This paper predicts whether a given software change is likely to contain
    latent bugs.  It uses machine learning to determine whether the change
    is more similar to previous buggy changes or previous non-buggy changes.",
}

@MastersThesis{Quinonez2008,
  author = 	 "Jaime Quinonez",
  title = 	 "Inference of Reference Immutability in {Java}",
  school = 	 MITEECS,
  year = 	 2008,
  address = 	 MITaddr,
  month = 	 may,
  abstract =
   "Javari is an extension of Java that supports reference
    immutability constraints.  Programmers write Javari type
    qualifiers, such as the \texttt{readonly} type qualifier,
    in their programs, and the Javari typechecker detects
    mutation errors (incorrect side effects) or verifies their absence.
    While case studies have demonstrated the practicality and value of
    Javari, a barrier to usability remains in the development process.
    A Javari program will not typecheck unless all the references
    in the APIs of libraries it uses are annotated with Javari
    type qualifiers.  Manually converting existing Java libraries to
    Javari is both tedious and error-prone; the development process
    requires an automated solution.
    \par
    This thesis presents an algorithm for statically inferring reference
    immutability in Javari.  The
    flow-insensitive and context-sensitive algorithm is sound and produces a set
    of qualifiers that typecheck in Javari.  The algorithm is
    precise in that it infers the most \texttt{readonly} qualifiers
    possible; adding any additional \texttt{readonly} qualifiers
    will cause the program to not typecheck.
    A tool, Javarifier, implements this algorithm in order to
    infer the Javari type qualifiers over a set of class files.
    Javarifier can also insert these qualifiers into the
    corresponding source code, if the source code is available.
    \par
    Javarifier automatically converts Java libraries to Javari.  Additionally,
    Javarifier eases the task of converting legacy programs to Javari by
    inferring the mutability of every reference in a program.
    In case studies, Javarifier correctly inferred mutability over Java programs
    of up to 110 KLOC.",
  supersededby = "QuinonezTE2008 An extended version",
  category = "Programming language design",
  summary =
   "This paper presents a precise, scalable, novel algorithm for inference
    of reference immutability (as defined by the Javari language), and an
    experimental evaluation on substantial programs.",
}



@MastersThesis{Papi2008,
  author = 	 "Matthew M. Papi",
  title = 	 "Practical Pluggable Types for {Java}",
  school = 	 MITEECS,
  year = 	 2008,
  address = 	 MITaddr,
  month = 	 may,
  abstract =
   "This paper introduces the Checker Framework, which supports adding
    pluggable type systems to the Java language in a backward-compatible
    way.  A type system designer defines type qualifiers and their
    semantics, and a compiler plug-in enforces the semantics.  Programmers
    can write the type qualifiers in their programs and use the plug-in to
    detect or prevent errors.  The Checker Framework is useful both to
    programmers who wish to write error-free code, and to type system
    designers who wish to evaluate and deploy their type systems.
    \par
    The Checker Framework includes new Java syntax for expressing type
    qualifiers; declarative and procedural mechanisms for writing
    type-checking rules; and support for flow-sensitive local type
    qualifier inference and for polymorphism over types and qualifiers.
    The Checker Framework is well-integrated with the Java language and
    toolset.
    \par
    We have evaluated the Checker Framework by writing five checkers and
    running them on over 600K lines of existing code.  The checkers found
    real errors, then confirmed the absence of further errors in the fixed
    code.  The case studies also shed light on the type systems
    themselves.",
  supersededby = "PapiACPE2008 An extended version containing expanded explanations and also some additional material",
  category =     "Programming language design",
}



@inproceedings{PachecoLB2008,
  author = {Carlos Pacheco and Shuvendu K. Lahiri and Thomas Ball},
  title = {Finding errors in {.NET} with feedback-directed random testing},
  crossref =     "ISSTA2008",
  pages = "87--96",
  abstract =
   "We present a case study in which a team of test engineers at Microsoft
    applied a feedback-directed random testing tool to a critical component of
    the .NET architecture. Due to its complexity and high reliability
    requirements, the component had already been tested by 40 test engineers
    over five years, using manual testing and many automated testing techniques.
    Nevertheless, the feedback-directed random testing tool found errors in the
    component that eluded previous testing, and did so two orders of magnitude
    faster than a typical test engineer (including time spent inspecting the
    results of the tool). The tool also led the test team to discover errors in
    other testing and analysis tools, and deficiencies in previous best-practice
    guidelines for manual testing. Finally, we identify challenges that random
    testing faces for continued effectiveness, including an observed decrease in
    the technique's error detection rate over time.",
  basefilename = "randoop-case-study",
  downloadsnonlocal =
    "http://people.csail.mit.edu/cpacheco/publications/pacheco_finding_errs.pdf PDF",
  category =  "Testing",
  summary =
   "Test engineers at Microsoft used feedback-directed random testing on a
    critical component of the .NET architecture.  Feedback-directed random
    testing tool found new errors, at low developer cost."
}


@PhdThesis{McCamant2008,
  author = 	 {Stephen Andrew McCamant},
  title = 	 {Quantitative Information-Flow Tracking for Real Systems},
  school = 	 MITEECS,
  year = 	 2008,
  address = 	 MITaddr,
  month =	 may,
  abstract =
   "An information-flow security policy constrains a computer system's
   end-to-end use of information, even as it is transformed in
   computation.  For instance, a policy would not just restrict what
   secret data could be revealed directly, but restrict any output
   that might allow inferences about the secret.  Expressing such a
   policy quantitatively, in terms of a specific number of bits of
   information, is often an effective program-independent way of
   distinguishing what scenarios should be allowed and disallowed.
   \par
   This thesis describes a family of new techniques for measuring how
   much information about a program's secret inputs is revealed by its
   public outputs on a particular execution, in order to check a
   quantitative policy on realistic systems.  Our approach builds on
   dynamic tainting, tracking at runtime which bits might contain
   secret information, and also uses static control-flow regions to
   soundly account for implicit flows via branches and pointer
   operations.  We introduce a new graph model that bounds information
   flow by the maximum flow between inputs and outputs in a flow
   network representation of an execution.  The flow bounds obtained
   with maximum flow are much more precise than those based on
   tainting alone (which is equivalent to graph reachability).  The
   bounds are a conservative estimate of channel capacity: the amount
   of information that could be transmitted by an adversary making an
   arbitrary choice of secret inputs.
   \par
   We describe an implementation named Flowcheck, built using the
   Valgrind framework for x86/Linux binaries, and use it to perform
   case studies on six real C, C++, and Objective C programs, three of
   which have more than 250,000 lines of code.  We used the tool to
   check the confidentiality of a different kind of information
   appropriate to each program.  Its results either verified that the
   information was appropriately kept secret on the examined
   executions, or revealed unacceptable leaks, in one case due to a
   previously unknown bug.",
  summary =
   "This thesis describes all our work on quantitative
   information-flow analysis through mid-2008: the formalization from
   PLAS 2007, the graph-based algorithms and case studies from PLDI
   2008, more details on tainting-based analysis and efficient graph
   algorithms from earlier TRs, and some improved presentation and
   discussion.",
  basefilename = "infoflow-mccamant-phdthesis",
  downloads = "http://people.csail.mit.edu/smcc/projects/secret-flow/flowcheck.html Flowcheck implementation",
  downloadsnonlocal =
   "https://groups.csail.mit.edu/pag/pubs/infoflow-mccamant-phdthesis.pdf PDF;
    https://groups.csail.mit.edu/pag/pubs/infoflow-mccamant-phdthesis.ps PostScript",
  category = "Security",
}




@PhdThesis{PachecoPhD:2009,
  author = 	 "Carlos Pacheco",
  title = 	 "Directed Random Testing",
  school = 	 MITEECS,
  year = 	 2009,
  address = 	 MITaddr,
  month = 	 jun,
  abstract =
   "Random testing can quickly generate many tests, is easy to implement,
    scales to large software applications, and reveals software errors. But it
    tends to generate many tests that are illegal or that exercise the same
    parts of the code as other tests, thus limiting its effectiveness. Directed
    random testing is a new approach to test generation that overcomes these
    limitations, by combining a bottom-up generation of tests with runtime
    guidance. A directed random test generator takes a collection of operations
    under test and generates new tests incrementally, by randomly selecting
    operations to apply and finding arguments from among previously-constructed
    tests. As soon as it generates a new test, the generator executes it, and
    the result determines whether the test is redundant, illegal,
    error-revealing, or useful for generating more tests. The technique outputs
    failing tests pointing to potential errors that should be corrected, and
    passing tests that can be used for regression testing. The thesis also
    contributes auxiliary techniques that post-process the generated tests,
    including a simplification technique that transforms a failing test into a
    smaller one that better isolates the cause of failure, and a
    branch-directed test generation technique that aims to increase the code
    coverage achieved by the set of generated tests.
    \par
    Applied to 14 widely-used libraries (including the Java JDK and the core
    .NET framework libraries), directed random testing quickly reveals many
    serious, previously unknown errors in the libraries. And compared with
    other test generation tools (model checking, symbolic execution, and
    traditional random testing), it reveals more errors and achieves higher
    code coverage. In an industrial case study, a test team at Microsoft using
    the technique discovered in fifteen hours of human effort as many errors as
    they typically discover in a person-year of effort using other testing
    methods.",
  basefilename = "randomtesting-pacheco-phdthesis",
  TODOdownloads = "*",
  downloadsnonlocal =
   "http://sdg.csail.mit.edu/pubs/theses/pacheco-phd-thesis.pdf PDF",
  category =  "Testing",
  summary =
   "Directed random testing combines random testing with model-based testing,
    resulting in better coverage and fewer illegal inputs.  Experiments
    confirm its utility, finding bugs in the Java JDK, .NET framework, etc.",
}


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%% 2010
%%%


@MastersThesis{Rudd2010,
  author = 	 "Robert Andrew Rudd",
  title = 	 "An Improved Scalable Mixed-Level Approach to Dynamic Analysis of C and C++ Programs",
  school = 	 MITEECS,
  year = 	 "2010",
  OPTkey = 	 "",
  OPTtype = 	 "",
  address = 	 MITaddr,
  month = 	 jan,
  OPTnote = 	 "",
  OPTannote = 	 "",
  abstract =
   "In this thesis, I address the challenges of developing tools which use a
    mixed-level approach to dynamic binary analysis. The mixed-level approach
    combines advantages of both source-based and binary-based approaches to
    dynamic analysis, but comes with the added challenge of dealing with the
    implementation details of a specific implementation of the target language.
    This thesis describes the implementation of three existing tools which use
    the mixed-level approach: Fjalar, a C/C++ dynamic analysis framework,
    Kvasir, A C/C++ value profiling tool, and Dyncomp, a tool for inferring the
    abstract types of a C or C++ program.
    \par
    Additionally, this thesis describes the steps I took in increasing the
    maintainability and portability of these tools. I investigated and
    documented platform specific dependencies; I documented the process of
    merging in upstream changes of Valgrind, the Dynamic Binary Instrumenter
    Fjalar is built on, to aid Fjalar in keeping in-sync with Valgrind
    bug-fixes; and I implemented a tool for debugging Dyncomp errors.",
  usesDaikon = "1",
  OPTusesDaikonAsTestSubject = "",
  OPTomitfromcv = "",
  basefilename = "rudd-mixedlevel-mengthesis",
  downloads = "https://dspace.mit.edu/handle/1721.1/61250 PDF",
  OPTdownloadsnonlocal = "",
  OPTsupersededby = "",
  category =  "Dynamic analysis",
  summary =
   "This thesis describes enhancements to the mixed-level approach to
   dynamic binary analysis that was first proposed and implemented by Guo.",
}


@TechReport{Zibin2010:TR:10-05,
  author = 	 "Yoav Zibin",
  title = 	 "{F}eatherweight {O}wnership and {I}mmutability {G}eneric {J}ava {(FOIGJ)} --- technical report",
  titleASCII = 	 "Featherweight Ownership and Immutability Generic Java (FOIGJ) -- Technical Report",
  institution =  "School of Engineering and Computer Science, VUW",
  year = 	 2010,
  number = 	 "10-05",
  address = 	 "Wellington, New Zealand",
  month = 	 mar,
  note =         {\url{http://ecs.victoria.ac.nz/Main/TechnicalReportSeries}},
  supersededby = "Zibin2010:TR:10-16",
  category =  "Static analysis",
}



@TechReport{Zibin2010:TR:10-16,
  author = 	 "Yoav Zibin",
  title = 	 "{F}eatherweight {O}wnership and {I}mmutability {G}eneric {J}ava {(FOIGJ)} --- technical report",
  titleASCII = 	 "Featherweight Ownership and Immutability Generic Java (FOIGJ) -- Technical Report",
  institution =  "School of Engineering and Computer Science, VUW",
  year = 	 2010,
  number = 	 "10-05",
  address = 	 "Wellington, New Zealand",
  month = 	 jul,
  note =         {\url{http://ecs.victoria.ac.nz/Main/TechnicalReportSeries}},
  abstract =
   "This technical report contains proofs that were omitted from our paper
    entitled ``Ownership and Immutability in Generic Java'', which appears
    in OOPSLA 2010.",
  basefilename = "ownership-immutability-tr1016",
  downloads = "https://ecs.wgtn.ac.nz/foswiki/pub/Main/TechnicalReportSeries/ECSTR10-16.pdf PDF",
  category =  "Static analysis",
  summary =
   "This technical report contains proofs that were omitted from our paper
    entitled ``Ownership and Immutability in Generic Java'', which appears
    in OOPSLA 2010.",
}


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%% Submitted
%%%


% LocalWords: MastersThesis MITEECS MITaddr Sep basefilename ioa TR tr dec GUIs
% LocalWords: mengthesis supersededby testsuite usesDaikon TechReport PaluskaSYC
% LocalWords: MITLCS jun HarderME Nimmer NimmerE ISSTA Rolfe Workflow Mazzola
% LocalWords: Versioning workflow rolfe aug cfrontend morse Dodoo Nii Paluska
% LocalWords: sep dodoo downloadsnonlocal PostScript NeWin Toh newin McCartneyGS
% LocalWords: thmprove PDF Paxos HOL Birka ConstJava ConstJava's LCS Yeh WMCSA
% LocalWords: BirkaE const operability Brun Yuriy faultid brun jan feb wmcsa IA
% LocalWords: mccamant smthesis ThesisTR conttest saff InProceedings icse LinE
% LocalWords: TipKB Kie un umer booktitle addr ecoop TipFDK Fuhrer RC Barrus co
% LocalWords: NY HashMap ArrayList Agesen's rc generify Kiezun lin parameterised
% LocalWords: underperforms omitfromcv parameterisation NOabstract FuhrerTDKK
% LocalWords: Markus genericlibs nonPAG BrunE SaffE FuhrerTKDK donovan SFI dfec
% LocalWords: DonovanKTE NEEDpages WilliamsTE McCamantM Wahbe Eclat's ernst TCB
% LocalWords: pittsfield PachecoE pacheco msthesis MITCSAIL USENIXSec usenix IE
% LocalWords: SPECint Jia guo mixedlevel ACL authorASCII Baumer DSpace Misc msr
% LocalWords:  ArtziKPP howpublished ArtziEGKPP TschantzE tschantz refimmut TSE
% LocalWords:  xiao invdetopt KimZWZ Zimmermann bibtex NOTbasefilename amock Yi
% LocalWords:  glasser testfactor oopsla GodefroidKY Godefroid Levin whitebox
% LocalWords:  JavaScript Bettenburg Rahul Premraj bettenburg Zhang apr kim tse
% LocalWords:  typechecker typecheck QuinonezTE PapiACPE PhdThesis Flowcheck
% LocalWords:  PLAS TRs infoflow phdthesis pldi infoZilla