Performance of the Java security manager

The Java Security Manager is one major security feature of the Java programming language. However, in many Java applications the Security Manager is not enabled because it slows execution time. This paper explores the performance of the Java Security Manager in depth, identifies the permissions with the worst performance and gives advice on how to use the Security Manager in a more efficient way.Our performance test shows that the CPU execution time penalty varies between 5% and 100% per resource access statement. This extreme range is due to the fact that some resource accesses are costly (such as file and socket access) and therefore hide the performance penalty for the access control check almost completely. The time penalty is much more noticeable with access to main memory resources (such as Java objects).In order to achieve reasonable response times, it is of utmost importance to tune garbage collection because the Java Security Manager creates short-lived objects during its permission check. Also, the order of permissions in the policy file can be important.     

一种精确程序最坏执行时间分析方法

Java语言的动态特性使程序的最坏执行时间分析较悲观和难以预测,提出一种精确最坏执行时间分析方法,在高层分析中,引入一种标记方法,对带有标记的Java类文件进行反编译提取控制流程,得到每一个基本块中的Java 字节码指令的最坏情况下的执行次数,在底层分析中,建立结合流水线和高级缓存影响的时间模型,得到每条指令所对应的执行时间,最后结合高层分析和底层分析的结果得到程序的最坏情况下的执行时间。实验表明,该方法可以使对实时Java 程序的最坏情况执行时间预测更加安全和精确。     

WYSIWIB: exploiting fine‐grained program structure in a scriptable API‐usage protocol‐finding process

Bug‐finding tools rely on specifications of what is correct or incorrect code. As it is difficult for a tool developer or user to anticipate all possible specifications, strategies for inferring specifications have been proposed. These strategies obtain probable specifications by observing common characteristics of code or execution traces, typically focusing on sequences of function calls. To counter the observed high rate of false positives, heuristics have been proposed for ranking or pruning the results. These heuristics, however, can result in false negatives, especially for rarely used functions. In this paper, we propose an alternate approach to specification inference, in which the user guides the inference process using patterns of code that reflect the user's understanding of the conventions and design of the targeted software project. We focus on specifications describing the correct usage of API functions, which we refer to as API protocols. Our approach builds on the Coccinelle program matching and transformation tool, which allows a user to construct patterns that reflect the structure of the code to be matched. We evaluate our approach on the source code of the Linux kernel, which defines a very large number of API functions with varying properties. Linux is also critical software, implying that fixing even bugs involving rarely used protocols is essential. In our experiments, we use our approach to find over 3000 potential API protocols, with an estimated false positive rate of under 15% and use these protocols to find over 360 bugs in the use of API functions. Copyright © 2012 John Wiley & Sons, Ltd.     

fine-GRAPE: fine-grained APi usage extractor – an approach and dataset to investigate API usage

An Application Programming Interface (API) provides a set of functionalities to a developer with the aim of enabling reuse. APIs have been investigated from different angles such as popularity usage and evolution to get a better understanding of their various characteristics. For such studies, software repositories are mined for API usage examples. However, many of the mining algorithms used for such purposes do not take type information into account. Thus making the results unreliable. In this paper, we aim to rectify this by introducing fine-GRAPE, an approach that produces fine-grained API usage information by taking advantage of type information while mining API method invocations and annotation. By means of fine-GRAPE, we investigate API usages from Java projects hosted on GitHub. We select five of the most popular APIs across GitHub Java projects and collect historical API usage information by mining both the release history of these APIs and the code history of every project that uses them. We perform two case studies on the resulting dataset. The first measures the lag time of each client. The second investigates the percentage of used API features. In the first case we find that for APIs that release more frequently clients are far less likely to upgrade to a more recent version of the API as opposed to clients of APIs that release infrequently. The second case study shows us that for most APIs there is a small number of features that is actually used and most of these features relate to those that have been introduced early in the APIs lifecycle.     

Assessing the use of slicing-based visualizing techniques on the understanding of large metamodels

ContextMetamodels are cornerstones of various metamodeling activities. Such activities consist of, for instance, transforming models into code or comparing metamodels. These activities thus require a good understanding of a metamodel and/or its parts. Current metamodel editing tools are based on standard interactive visualization features, such as physical zooms.ObjectiveHowever, as soon as metamodels become large, navigating through large metamodels becomes a tedious task that hinders their understanding. So, a real need to support metamodel comprehension appears.MethodIn this work we promote the use of model slicing techniques to build interactive visualization tools for metamodels. Model slicing is a model comprehension technique inspired by program slicing. We show how the use of Kompren, a domain-specific language for defining model slicers, can ease the development of such interactive visualization features.ResultsWe specifically make four main contributions. First, the proposed interactive visualization techniques permit users to focus on metamodel elements of interest, which aims at improving the understandability. Second, these proposed techniques are developed based on model slicing, a model comprehension technique that involves extracting a subset of model elements of interest. Third, we develop a metamodel visualizer, called Explen, embedding the proposed interactive visualization techniques. Fourth, we conducted experiments. showing that Explen significantly outperforms EcoreTools, in terms of time, correctness, and navigation effort, on metamodeling tasks.ConclusionThe results of the experiments, in favor of Explen, show that improving metamodel understanding can be done using slicing-based interactive navigation features.     

Listener latency profiling: Measuring the perceptible performance of interactive Java applications

When developers need to improve the performance of their applications, they usually use one of the many existing profilers. These profilers generally capture a profile that represents the execution time spent in each method. The developer can thus focus her optimization efforts on the methods that consume the most time. In this paper we argue that this type of profile is insufficient for tuning interactive applications. Interactive applications respond to user events, such as mouse clicks and key presses. The perceived performance of interactive applications is directly related to the response time of the program.In this paper we present listener latency profiling, a profiling approach with two distinctive characteristics. First, we call it latency profiling because it helps developers to find long latency operations. Second, we call it listener profiling because it abstracts away from method-level profiles to compute the latency of the various listeners. This allows a developer to reason about performance with respect to listeners, also called observers, the high level abstraction at the core of any interactive Java application.We present our listener latency profiling approach, describe LiLa, our implementation, validate it on a set of microbenchmarks, and evaluate it on a complex real-world interactive application. We then perform case studies where we use LiLa to tune the perceptible performance of two interactive applications, and we show that LiLa is able to pinpoint performance problems even if their causes are embedded in the largest interactive Java application we are aware of.     

Dynamic analysis of Java program concepts for visualization and profiling

Concept assignment identifies units of source code that are functionally related, even if this is not apparent from a syntactic point of view. Until now, the results of concept assignment have only been used for static analysis, mostly of program source code. This paper investigates the possibility of using concept information within a framework for dynamic analysis of programs. The paper presents two case studies involving a small Java program used in a previous research exercise, and a large Java virtual machine (the popular Jikes RVM system). These studies investigate two applications of dynamic concept information: visualization and profiling. The paper demonstrates two different styles of concept visualization, which show the proportion of overall time spent in each concept and the sequence of concept execution, respectively. The profiling study concerns the interaction between runtime compilation and garbage collection in Jikes RVM. For some benchmark cases, we are able to obtain a significant reduction in garbage collection time. We discuss how this phenomenon might be harnessed to optimize the scheduling of garbage collection in Jikes RVM.     

Dynamic load‐balancing mechanism for distributed Java applications

Program environments or operating systems generally leave the decision on the allocation of program entities to the developer, offering either placement directives, or tools available through the manipulation of a graphical interface. These approaches cannot always take into account the dynamic behavior of applications, dynamicity in the execution environment or the heterogeneity of the execution platform. Transparent deployment algorithms are necessary for automizing and optimizing application distribution. The Adaptive Distributed Applications in Java (ADAJ) project deals with placement and migration of Java objects. It automatically deploys parallel Java applications on a cluster of workstations using monitoring information about the application behavior. The transparency obtained through the integration of these tools in the middleware makes such an environment easy to use and improves efficiency. Copyright © 2005 John Wiley & Sons, Ltd.     

Execution trace analysis through massive sequence and circular bundle views

An important part of many software maintenance tasks is to gain a sufficient level of understanding of the system at hand. The use of dynamic information to aid in this software understanding process is a common practice nowadays. A major issue in this context is scalability: due to the vast amounts of information, it is a very difficult task to successfully navigate through the dynamic data contained in execution traces without getting lost.In this paper, we propose the use of two novel trace visualization techniques based on the massive sequence and circular bundle view, which both reflect a strong emphasis on scalability. These techniques have been implemented in a tool called Extravis. By means of distinct usage scenarios that were conducted on three different software systems, we show how our approach is applicable in three typical program comprehension tasks: trace exploration, feature location, and top-down analysis with domain knowledge.     

Jass — Java with Assertions

Design by Contract, proposed by Meyer for the programming language Eiffel, is a technique that allows run-time checks of specification violation and their treatment during program execution. Jass, Java with assertions, is a Design by Contract extension for Java allowing to annotate Java programs with specifications in the form of assertions. The Jass tool is a pre-compiler that translates annotated into pure Java programs in which compliance with the specification is dynamically tested. Besides the standard Design by Contract features known from classical program verification (e.g. pre- and postconditions, invariants), Jass additionally supports refinement, i.e. subtyping, checks and the novel concept of trace assertions. Trace assertions are used to monitor the dynamic behaviour of objects in time.     

Visualizing the runtime behavior of embedded network systems: A toolkit for TinyOS

TinyOS is an effective platform for developing lightweight embedded network applications. But the platform’s lean programming model and power-efficient operation come at a price: TinyOS applications are notoriously difficult to construct, debug, and maintain. The development difficulties stem largely from a programming model founded on events and deferred execution. In short, the model introduces non-determinism in the execution ordering of primitive actions — an issue exacerbated by the fact that embedded network systems are inherently distributed and reactive. The resulting set of possible execution sequences for a given system is typically large and can swamp developers’ unaided ability to reason about program behavior.In this paper, we present a visualization toolkit for TinyOS 2.0 to aid in program comprehension. The goal is to assist developers in reasoning about the computation forest underlying a system under test and the particular branches chosen during each run. The toolkit supports comprehension activities involving both local and distributed runtime behavior. The constituent components include (i) a full-featured static analysis and instrumentation library, (ii) a selection-based probe insertion system, (iii) a lightweight event recording service, (iv) a trace extraction and reconstruction tool, and (v) three visualization front-ends. We demonstrate the utility of the toolkit using both standard and custom system examples and present an analysis of the toolkit’s resource usage and performance characteristics.     

Agents for case-based software reuse

The effective reuse of previously engineered components has become a core activity in any object-oriented software development project. The task is, however, often problematic when it comes to actual retrieval and understanding of the class library in, e.g., Java. Newcomers, especially, in a software company or novices in Java programming will need time to obtain a good overview of available components. This article explores the use of intelligent agents in a case-based tool for software reuse. By introducing agent support to the retrieval mechanism of the tool we show how retrieval efficiency may be improved. The cooperating agents assist the user in retrieval of code for potential reuse in an automated way and in the background. This makes it possible for the developer to concentrate fully on her task. The tool aids in program understanding and adaptation. Thus, it allows an exploratory approach to program development and increases reuse efficiency.     

Platform‐independent profiling in a virtual execution environment

Virtual execution environments, such as the Java virtual machine, promote platform‐independent software development. However, when it comes to analyzing algorithm complexity and performance bottlenecks, available tools focus on platform‐specific metrics, such as the CPU time consumption on a particular system. Other drawbacks of many prevailing profiling tools are high overhead, significant measurement perturbation, as well as reduced portability of profiling tools, which are often implemented in platform‐dependent native code. This article presents a novel profiling approach, which is entirely based on program transformation techniques, in order to build a profiling data structure that provides calling‐context‐sensitive program execution statistics. We explore the use of platform‐independent profiling metrics in order to make the instrumentation entirely portable and to generate reproducible profiles. We implemented these ideas within a Java‐based profiling tool called JP. A significant novelty is that this tool achieves complete bytecode coverage by statically instrumenting the core runtime libraries and dynamically instrumenting the rest of the code. JP provides a small and flexible API to write customized profiling agents in pure Java, which are periodically activated to process the collected profiling information. Performance measurements point out that, despite the presence of dynamic instrumentation, JP causes significantly less overhead than a prevailing tool for the profiling of Java code. Copyright © 2008 John Wiley & Sons, Ltd.     

Compact visualization of Java program execution

The context of this work is a practical, open‐source visualization system, called JIVE, that supports two forms of runtime visualizations of Java programs – object diagrams and sequence diagrams. They capture, respectively, the current execution state and execution history of a Java program. These diagrams are similar to those found in the UML for specifying design–time decisions. In our work, we construct these diagrams at execution time, thereby ensuring continuity of notation from design to execution. In so doing, a few extensions to the UML notation are proposed in order to better represent runtime behavior. As sequence diagrams can become long and unwieldy, we present techniques for their compact representation. A key result in this paper is a novel labeling scheme based upon regular expressions to compactly represent long sequences and an O(r²) algorithm for computing these labels, where r is the length of the input sequence, based upon the concept of ‘tandem repeats’ in a sequence. Horizontal compaction greatly helps minimize the extent of white space in sequence diagrams by the elimination of object lifelines and also by grouping lifelines together. We propose a novel extension to the sequence diagram to deal with out‐of‐model calls when the lifelines of certain classes of objects are filtered out of the visualization, but method calls may occur between in‐model and out‐of‐model calls. The paper also presents compaction techniques for multi‐threaded Java execution with different forms of synchronization. Finally, we present experimental results from compacting the runtime visualizations of a variety of Java programs and execution trace sizes in order to demonstrate the practicality and efficacy of our techniques. Copyright © 2016 John Wiley & Sons, Ltd.     

Cyclic reference counting by typed reference fields

Reference counting strategy is a natural choice for real-time garbage collection, but the cycle collection phase which is required to ensure the correctness for reference counting algorithms can introduce heavy scanning overheads. This degrades the efficiency and inflates the pause time required for garbage collection. In this paper, we present two schemes to improve the efficiency of reference counting algorithms. First, in order to make better use of the semantics of a given program, we introduce a novel classification model to predict the behavior of objects precisely. Second, in order to reduce the scanning overheads, we propose an enhancement for cyclic reference counting algorithms by utilizing strongly-typed reference features of the Java language. We implement our proposed algorithm in Jikes RVM and measure the performance over various Java benchmarks. Our results show that the number of scanned objects can be reduced by an average of 37.9% during cycle collection phase.     

A Platform-Independent Distributed Runtime for Standard Multithreaded Java

JavaSplit is a portable runtime environment for distributed execution of standard multithreaded Java programs. It gains augmented computational power and increased memory capacity by distributing the threads and objects of an application among the available machines. Unlike previous works, which either forfeit Java portability by using a nonstandard Java Virtual Machine (JVM) or compromise transparency by requiring user intervention in making the application suitable for distributed execution, JavaSplit automatically executes standard multithreaded Java on any heterogenous collection of Java-enabled machines. Each machine carries out its part of the computation using nothing but its local standard (unmodified) JVM. Neither the programmer nor the person submitting the program for execution needs to be aware of JavaSplit or its distributed nature. We evaluate the efficiency of JavaSplit on several combinations of operating systems, JVM implementations, and communication hardware.     

采用八叉树和OSG分页结点的海量点云三维可视化

针对现有海量点云可视化方法存在索引构建时间长、内存占用大等问题，研究一种八叉树索引结合OSG分页结点的快速可视化方法，可在占用较小内存的基础上快速建立点云索引并实时调度。采用八叉树索引结构对海量点云进行数据组织，建立各层级的八叉树结点并以文件映射的方式分块保存，对结点文件重组织转换为支持OSG渲染引擎的多分辨率点云数据。采用基于OSG分页结点的实时调度技术，对海量点云进行高质量可视化。与目前两款主流的点云数据处理商业软件进行实验对比分析，结果表明所提方法具有索引建立速度快、内存占用小等优点，同时可视化交互更加流畅，适用于各种配置计算机下海量点云数据的调度管理与实时可视化。     

Onyx: A new Canvas-based tool for visualizing biomedical and health ontologies

Ontologies provide formal, machine-readable, and human-interpretable representations of domain knowledge. Therefore, ontologies have come into question with the development of Semantic Web technologies. People who want to use ontologies need an understanding of the ontology, but this understanding is very difficult to attain if the ontology user lacks the background knowledge necessary to comprehend the ontology or if the ontology is very large. Thus, software tools that facilitate the understanding of ontologies are needed. Ontology visualization is an important research area because visualization can help in the development, exploration, verification, and comprehension of ontologies. This paper introduces the design of a new ontology visualization tool, which differs from traditional visualization tools by providing important metrics and analytics about ontology concepts and warning the ontology developer about potential ontology design errors. The tool, called Onyx, also has advantages in terms of speed and readability. Thus, Onyx offers a suitable environment for the representation of large ontologies, especially those used in biomedical and health information systems and those that contain many terms. It is clear that these additional functionalities will increase the value of traditional ontology visualization tools during ontology exploration and evaluation.     

一种缓冲区溢出攻击的实时检测方法

根据攻击者通常通过修改函数返回地址或函数入口地址来改变程序流程的特点以及ELF文件的结构特点,在调用函数和函数调用返回时对某些特定信息进行处理,以检测出攻击行为。依靠动态程序监控平台pin提供的API函数来编写程序运行时监控工具,提出缓冲区溢出攻击实时检测的方法。实例分析表明该方法具有无需对现有的软、硬件系统进行修改的特点。     

Dynamic Query-Based Debugging of Object-Oriented Programs

Program errors are hard to find because of the cause-effect gap between the instant when an error occurs and when the error becomes apparent to the programmer. Although debugging techniques such as conditional and data breakpoints help in finding errors in simple cases, they fail to effectively bridge the cause-effect gap in many situations. This paper proposes two debuggers that provide programmers with an instant error alert by continuously checking inter-object relationships while the debugged program is running. We call such tool a dynamic query-based debugger. To speed up dynamic query evaluation, our debugger implemented in portable Java uses a combination of program instrumentation, load-time code generation, query optimization, and incremental reevaluation. Experiments and a query cost model show that selection queries are efficient in most cases, while more costly join queries are practical when query evaluations are infrequent or query domains are small. To enable query-based debugging in the middle of program execution in a portable way, our debugger performs efficient Java class file instrumentation. We call such debugger an on-the-fly debugger. Though the on-the-fly debugger has a higher overhead than a dynamic query-based debugger, it offers additional interactive power and flexibility while maintaining complete portability.