Write a Blog >>
ICSE 2020
Wed 24 June - Thu 16 July 2020
Sat 11 Jul 2020 00:36 - 00:48 at Baekje - P25-Fuzzing Chair(s): Marcel Böhme

Defects in infrastructure as code (IaC) scripts can have serious consequences, for example, creating large-scale system outages. A taxonomy of IaC defects can be useful for understanding the nature of defects, and identifying activities needed to fix and prevent defects in IaC scripts. The goal of this paper is to help practitioners improve the quality of infrastructure as code (IaC) scripts by developing a defect taxonomy for IaC scripts through qualitative analysis. We develop a taxonomy of IaC defects by applying qualitative analysis on 1,448 defect-related commits collected from open source software (OSS) repositories of the Openstack organization. We conduct a survey with 66 practitioners to assess if they agree with the identified defect categories included in our taxonomy. We quantify the frequency of identified defect categories by analyzing 80,425 commits collected from 291 OSS repositories spanning across 2005 to 2019.

Our defect taxonomy for IaC consists of eight categories, including a category specific to IaC called idempotency (i.e., defects that lead to incorrect system provisioning when the same IaC script is executed multiple times). We observe the surveyed 66 practitioners to agree most with idempotency. The most frequent defect category is configuration data i.e., providing erroneous configuration data in IaC scripts. Our taxonomy and the quantified frequency of the defect categories can help practitioners to improve IaC script quality by prioritizing verification and validation efforts.

Conference Day
Sat 11 Jul

Displayed time zone: (UTC) Coordinated Universal Time change

00:00 - 01:00
P25-FuzzingTechnical Papers at Baekje
Chair(s): Marcel BöhmeMonash University
00:00
12m
Talk
Typestate-Guided Fuzzer for Discovering Use-after-Free VulnerabilitiesTechnical
Technical Papers
Haijun WangAnt Financial Services Group, China; CSSE, Shenzhen University, China, Xiaofei XieNanyang Technological University, Yi LiNanyang Technological University, Cheng WenShenzhen University, Yuekang LiNanyang Technological University, Yang LiuNanyang Technological University, Singapore, Shengchao QinUniversity of Teesside, Hongxu ChenResearch Associate, Yulei SuiUniversity of Technology Sydney, Australia
Link to publication DOI Pre-print
00:12
12m
Talk
sFuzz: An Efficient Adaptive Fuzzer for Solidity Smart ContractsTechnical
Technical Papers
Tai D. NguyenSingapore Management University, Long H. PhamSingapore University of Technology and Design, Jun SunSingapore Management University, Yun LinNational University of Singapore, Minh Quang TranHo Chi Minh City University of Technology
00:24
12m
Talk
Planning for Untangling: Predicting the Difficulty of Merge ConflictsTechnical
Technical Papers
Caius BrindescuOregon State University, Iftekhar AhmedUniversity of California at Irvine, USA, Rafael LeanoOregon State University, Anita SarmaOregon State University
00:36
12m
Talk
Gang of Eight: A Defect Taxonomy for Infrastructure as Code ScriptsTechnicalArtifact Available
Technical Papers
Akond RahmanTennessee Tech University, Effat FarhanaNorth Carolina State University, Chris ParninNorth Carolina State University, Laurie WilliamsNorth Carolina State University
Pre-print
00:48
12m
Talk
JVM Fuzzing for JIT-Induced Side-Channel DetectionTechnical
Technical Papers
Tegan BrennanUniversity of California, Santa Barbara, Seemanta SahaUniversity of California Santa Barbara, Tevfik BultanUniversity of California, Santa Barbara