.png){kind=icon}
返回
How Does Refactoring Impact Security When Improving Quality? A Security-Aware Refactoring Approach
.png){kind=icon}
PRE
AI
DOI：10.1109/TSE.2020.3005995.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
While state of the art of software refactoring research uses various quality attributes to identify refactoring opportunities and evaluate refactoring recommendations, the impact of refactoring on the security of software systems when improving other quality objectives is under-explored. It is critical to understand how a system is resistant to security risks after refactoring to improve quality metrics. For instance, refactoring is widely used to improve the reusability of code, however such an improvement may increase the attack surface due to the created abstractions. Increasing the spread of security-critical classes in the design to improve modularity may result in reducing the resilience of software systems to attacks. In this paper, we investigated the possible impact of improving different quality attributes (e.g., reusability, extendibility, etc.), from the QMOOD model, effectiveness on a set of 8 security metrics defined in the literature related to the data access. We also studied the impact of different refactorings on these static security metrics. Then, we proposed a multi-objective refactoring recommendation approach to find a balance between quality attributes and security based on the correlation results to guide the search. We evaluated our tool on 30 open source projects. We also collected the practitioner perceptions on the refactorings recommended by our tool in terms of the possible impact on both security and other quality attributes. Our results confirm that developers need to make trade-offs between security and other qualities when refactoring software systems due to the negative correlations between them.
Keyword:
Security
Measurement
Tools
Correlation
Software systems
Computer bugs
Quality
critical code
security metrics
attack surface
refactoring
multi-objective search
AI总结
对已上传原文的论文进行重点信息的提取，主要内容包括：简要概述、研究摘要、背景介绍、关键亮点、图文解析、展望与总结。
期刊
IF:
5.6
论文数:
2.9K
被引数:
1.1W
机构
引用论文
An empirical study to improve software security through the application of code refactoring应用代码重构提高软件安全性的实证研究
PREAI
分享收藏分享收藏
Synaptic activity-induced global gene expression patterns in the dentate gyrus of adult behaving rats: Induction of immunity-linked genes.png)
Neuroscience
NeuroscienceIF0
PREAI
分享收藏
查看更多内容