Marcus Denker

Nicolas Anquetil

Vincent Aranega

Steven Costiou

Stéphane Ducasse

Anne Etien

Stephane Ducasse

Stephane Ducasse

Christophe Demarey

Damien Pollet

Esteban Lorenzano

Stephane Ducasse

Guillermo Polito

Pablo Tesone

Project-Team RMOD 2021 Activity Report

Keywords: Computer sciences and digital sciences A1.3.3. -Blockchain A2. -Software A2.1. -Programming Languages A2.1.3. -Object-oriented programming A2.1.8. -Aspect-oriented programming A2.1.10. -Domain-specific languages A2.1.12. -Dynamic languages A2.3.1. -Embedded systems A2.5. -Software engineering A2.5.1. -Software Architecture & Design A2.5.3. -Empirical Software Engineering A2.5.4. -Software Maintenance & Evolution A2.6. -Infrastructure software A2.6.3. -Virtual machines Other research topics and application domains B2. -Health B2.7. -Medical devices B5. -Industry of the future B5.9. -Industrial maintenance B6.5. -Information systems B7. -Transport and logistics Software and Data Analysis Platform Software engineering, Meta model, Software visualisation Functional Description: Moose is an extensive platform for software Live programmation objet, Reflective system, Web Application

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

2 Overall objectives

Introduction

RMoD's general vision is defined in two objectives: remodularization and modularity constructs. These two views are the two faces of a same coin: maintenance could be eased with better engineering and analysis tools and programming language constructs could let programmers define more modular applications.

Reengineering and remodularization

While applications must evolve to meet new requirements, few approaches analyze the implications of their original structure (modules, packages, classes) and their transformation to support their evolution. Our research focuses on the remodularization of object-oriented applications. Automated approaches including clustering algorithms are not satisfactory because they often ignore user inputs. Our vision is that we need better approaches to support the transformation of existing software. The reengineering challenge tackled by RMoD is formulated as follows:

How to help remodularize existing software applications?

We are developing analyses and algorithms to remodularize object-oriented applications. This is why we started studying and building tools to support the understanding of applications at the level of packages and modules. This allows us to understand the results of the analyses that we are building.

We seek to create tools to help developers perform large refactoring. How can they keep track of changes in various locations in a system while ensuring integrity of current and new code by uniformally applying new design choices.

Constructs for modular and isolating programming languages

Dynamically-typed programming languages such as JavaScript are getting new attention as illustrated by the large investment of Google in the development of the Chrome V8 JavaScript engine and the development of a new dynamic language DART. This new trend is correlated to the increased adoption of dynamic programming languages for web-application development, as illustrated by Ruby on Rails, PHP and JavaScript. With web applications, users expect applications to be always available and getting updated on the fly. This continuous evolution of application is a real challenge [START_REF] Hicks | Dynamic software updating[END_REF]. Hot software evolution often requires reflective behavior and features. For instance in CLOS and Smalltalk each class modification automatically migrates existing instances on the fly.

At the same time, there is a need for software isolation, i.e., applications should reliably run co-located with other applications in the same virtual machine with neither confidential information leaks nor vulnerabilities. Indeed, often for economical reasons, web servers run multiple applications on the same virtual machine. Users need confined applications. It is important that (1) an application does not access information of other applications running on the same virtual machine and (2) an application authorized to manipulate data cannot pass such authorization or information to other parts of the application that should not get access to it.

Static analysis tools have always been confronted to reflection [START_REF] Furr | Profile-guided static typing for dynamic scripting languages[END_REF]. Without a full treatment of reflection, static analysis tools are both incomplete and unsound. Incomplete because some parts of the program may not be included in the application call graph, and unsound because the static analysis does not take into account reflective features [START_REF] Livshits | DynaMine: finding common error patterns by mining software revision histories[END_REF]. In reflective languages such as F-Script, Ruby, Python, Lua, JavaScript, Smalltalk and Java (to a certain extent), it is possible to nearly change any aspect of an application: change objects, change classes dynamically, migrate instances, and even load untrusted code.

Reflection and isolation concerns are a priori antagonistic, pulling language design in two opposite directions. Isolation, on the one hand, pulls towards more static elements and types (e.g., ownership types). Reflection, on the other hand, pulls towards fully dynamic behavior. This tension is what makes this a real challenge: As experts in reflective programming, dynamic languages and modular systems, we believe that by working on this important tension we can make a breakthrough and propose innovative solutions in resolving or mitigating this tension. With this endeavor, we believe that we are working on a key challenge that can have an impact on future programming languages. The language construct challenge tackled by RMoD is formulated as follows:

What are the language modularity constructs to support isolation?

In parallel we are continuing our research effort on traits 1 by assessing trait scalability and reuse on a large case study and developing a pure trait-based language. In addition, we dedicate efforts to remodularizing a meta-level architecture in the context of the design of an isolating dynamic language. Indeed at the extreme, modules and structural control of reflective features are the first steps towards flexible, dynamic, yet isolating, languages. As a result, we expect to demonstrate that having adequate composable units and scoping units will help the evolution and recomposition of an application.

Research program

Software Reengineering

Strong coupling among the parts of an application severely hampers its evolution. Therefore, it is crucial to answer the following questions: How to support the substitution of certain parts while limiting the impact on others? How to identify reusable parts? How to modularize an object-oriented application?

Having good classes does not imply a good application layering, absence of cycles between packages and reuse of well-identified parts. Which notion of cohesion makes sense in presence of late-binding and programming frameworks? Indeed, frameworks define a context that can be extended by subclassing or composition: in this case, packages can have a low cohesion without being a problem for evolution. How to obtain algorithms that can be used on real cases? Which criteria should be selected for a given remodularization?

To help us answer these questions, we work on enriching Moose, our reengineering environment, with a new set of analyses [START_REF] Ducasse | Using Smalltalk as a Reflective Executable Meta-Language[END_REF][START_REF] Ducasse | Moose: a Collaborative and Extensible Reengineering Environment[END_REF]. We decompose our approach in three main and potentially overlapping steps:

1. Tools for understanding applications 2. Remodularization analyses 3. Software Quality

Tools for understanding applications

Context and Problems

We are studying the problems raised by the understanding of applications at a larger level of granularity such as packages or modules. We want to develop a set of conceptual tools to support this understanding.

Some approaches based on Formal Concept Analysis (FCA) [START_REF] Snelting | Reengineering Class Hierarchies using Concept Analysis[END_REF] show that such an analysis can be used to identify modules. However the presented examples are too small and not representative of real code.

Research Agenda FCA provides an important approach in software reengineering for software understanding, design anomalies detection and correction, but it suffers from two problems: (i) it produces lattices that must be interpreted by the user according to his/her understanding of the technique and different elements of the graph; and, (ii) the lattice can rapidly become so big that one is overwhelmed by the mass of information and possibilities [START_REF] Anquetil | A Comparison of Graphs of Concept for Reverse Engineering[END_REF]. We look for solutions to help people putting FCA to real use.

Remodularization analyses

Context and Problems It is a well-known practice to layer applications with bottom layers being more stable than top layers [START_REF] Martin | Agile Software Development. Principles, Patterns, and Practices[END_REF]. Until now, few works have attempted to identify layers in practice: Mudpie [START_REF] Vainsencher | MudPie: layers in the ball of mud[END_REF] is a first cut at identifying cycles between packages as well as package groups potentially representing layers. DSM (dependency structure matrix) [START_REF] Sangal | Using Dependency Models to Manage Complex Software Architecture[END_REF][START_REF] Sullivan | The Structure and Value of Modularity in SOftware Design[END_REF] seems to be adapted for such a task but there is no serious empirical experience that validates this claim. From the side of remodularization algorithms, many were defined for procedural languages [START_REF] Koschke | Atomic Architectural Component Recovery for Program Understanding and Evolution[END_REF]. However, object-oriented programming languages bring some specific problems linked with late-binding and the fact that a package does not have to be systematically cohesive since it can be an extension of another one [START_REF] Dunsmore | Object-Oriented Inspection in the Face of Delocalisation[END_REF][START_REF] Wilde | Maintenance Support for Object-Oriented Programs[END_REF].

As we are designing and evaluating algorithms and analyses to remodularize applications, we also need a way to understand and assess the results we are obtaining.

Research Agenda

We work on the following items:

• Layer identification: We propose an approach to identify layers based on a semi-automatic classification of package and class interrelationships that they contain. However, taking into account the wish or knowledge of the designer or maintainer should be supported.

• Cohesion Metric Assessment: We are building a validation framework for cohesion/coupling metrics to determine whether they actually measure what they promise to. We are also compiling a number of traditional metrics for cohesion and coupling quality metrics to evaluate their relevance in a software quality setting.

Software Quality

Research Agenda Since software quality is fuzzy by definition and a lot of parameters should be taken into account we consider that defining precisely a unique notion of software quality is definitively a Grail in the realm of software engineering. The question is still relevant and important. We work on the two following items:

• Quality models: We studied existing quality models and the different options to combine indicators -often, software quality models happily combine metrics, but at the price of losing the explicit relationships between the indicator contributions. There is a need to combine the results of one metric over all the software components of a system, and there is also the need to combine different metric results for any software component. Different combination methods are possible that can give very different results. It is therefore important to understand the characteristics of each method.

• Bug prevention: Another aspect of software quality is validating or monitoring the source code to avoid the emergence of well known sources of errors and bugs. We work on how to best identify such common errors, by trying to identify earlier markers of possible errors, or by helping identifying common errors that programmers did in the past.

Language Constructs for Modular Design

While the previous axis focuses on how to help remodularizing existing software, this second research axis aims at providing new language constructs to build more flexible and recomposable software. We will build on our work on traits [START_REF] Ducasse | Traits: A Mechanism for fine-grained Reuse[END_REF][START_REF] Schärli | Traits: Composable Units of Behavior[END_REF] and classboxes [START_REF] Bergel | Classbox/J: Controlling the Scope of Change in Java[END_REF] but also start to work on new areas such as isolation in dynamic languages. We will work on the following points: (1) Traits and (2) Modularization as a support for isolation.

Traits-based program reuse

Context and Problems Inheritance is well-known and accepted as a mechanism for reuse in objectoriented languages. Unfortunately, due to the coarse granularity of inheritance, it may be difficult to decompose an application into an optimal class hierarchy that maximizes software reuse. Existing schemes based on single inheritance, multiple inheritance, or mixins, all pose numerous problems for reuse.

To overcome these problems, we designed a new composition mechanism called Traits [START_REF] Ducasse | Traits: A Mechanism for fine-grained Reuse[END_REF][START_REF] Schärli | Traits: Composable Units of Behavior[END_REF]. Traits are pure units of behavior that can be composed to form classes or other traits. The trait composition mechanism is an alternative to multiple or mixin inheritance in which the composer has full control over the trait composition. The result enables more reuse than single inheritance without introducing the drawbacks of multiple or mixin inheritance. Several extensions of the model have been proposed [START_REF] Bergel | Stateful Traits[END_REF][START_REF] Denier | Traits Programming with AspectJ[END_REF][START_REF] Ducasse | User-Changeable Visibility: Resolving Unanticipated Name Clashes in Traits[END_REF][START_REF] Quitslund | Java Traits -Improving Opportunities for Reuse[END_REF] and several type systems were defined [START_REF] Fisher | Statically typed traits[END_REF][START_REF] Liquori | FeatherTrait: A Modest Extension of Featherweight Java[END_REF][START_REF] Reppy | A Foundation for Trait-based Metaprogramming[END_REF][START_REF] Smith | Chai: Typed Traits in Java[END_REF].

Traits are reusable building blocks that can be explicitly composed to share methods across unrelated class hierarchies. In their original form, traits do not contain state and cannot express visibility control for methods. Two extensions, stateful traits and freezable traits, have been proposed to overcome these limitations. However, these extensions are complex both to use for software developers and to implement for language designers.

Research Agenda: Towards a pure trait language We plan distinct actions: (1) a large application of traits, (2) assessment of the existing trait models and (3) bootstrapping a pure trait language.

• To evaluate the expressiveness of traits, some hierarchies were refactored, showing code reuse [START_REF] Black | Applying Traits to the Smalltalk Collection Hierarchy[END_REF].

However, such large refactorings, while valuable, may not exhibit all possible composition problems, since the hierarchies were previously expressed using single inheritance and following certain patterns. We want to redesign from scratch the collection library of Smalltalk (or part of it). Such a redesign should on the one hand demonstrate the added value of traits on a real large and redesigned library and on the other hand foster new ideas for the bootstrapping of a pure traitbased language.

In particular we want to reconsider the different models proposed (stateless [START_REF] Ducasse | Traits: A Mechanism for fine-grained Reuse[END_REF], stateful [START_REF] Bergel | Stateful Traits and their Formalization[END_REF], and freezable [START_REF] Ducasse | User-Changeable Visibility: Resolving Unanticipated Name Clashes in Traits[END_REF]) and their operators. We will compare these models by ( 1) implementing a trait-based collection hierarchy, (2) analyzing several existing applications that exhibit the need for traits. Traits may be flattened [START_REF] Nierstrasz | Flattening Traits[END_REF]. This is a fundamental property that confers to traits their simplicity and expressiveness over Eiffel's multiple inheritance. Keeping these aspects is one of our priority in forthcoming enhancements of traits.

• Alternative trait models. This work revisits the problem of adding state and visibility control to traits. Rather than extending the original trait model with additional operations, we use a fundamentally different approach by allowing traits to be lexically nested within other modules. This enables traits to express (shared) state and visibility control by hiding variables or methods in their lexical scope. Although the traits' "flattening property" no longer holds when they can be lexically nested, the combination of traits with lexical nesting results in a simple and more expressive trait model. We formally specify the operational semantics of this combination. Lexically nested traits are fully implemented in AmbientTalk, where they are used among others in the development of a Morphic-like UI framework.

• We want to evaluate how inheritance can be replaced by traits to form a new object model. For this purpose we will design a minimal reflective kernel, inspired first from ObjVlisp [START_REF] Cointe | Metaclasses are First Class: the ObjVlisp Model[END_REF] then from Smalltalk [START_REF] Goldberg | Smalltalk 80: the Interactive Programming Environment[END_REF].

Reconciling Dynamic Languages and Isolation

Context and Problems More and more applications require dynamic behavior such as modification of their own execution (often implemented using reflective features [START_REF] Kiczales | Efficient Method Dispatch in PCL[END_REF]). For example, F-script allows one to script Cocoa Mac-OS X applications and Lua is used in Adobe Photoshop. Now in addition more and more applications are updated on the fly, potentially loading untrusted or broken code, which may be problematic for the system if the application is not properly isolated. Bytecode checking and static code analysis are used to enable isolation, but such approaches do not really work in presence of dynamic languages and reflective features. Therefore there is a tension between the need for flexibility and isolation.

Research Agenda: Isolation in dynamic and reflective languages

To solve this tension, we will work on Sure, a language where isolation is provided by construction: as an example, if the language does not offer field access and its reflective facilities are controlled, then the possibility to access and modify private data is controlled. In this context, layering and modularizing the meta-level [START_REF] Bracha | Mirrors: design principles for meta-level facilities of object-oriented programming languages[END_REF], as well as controlling the access to reflective features [START_REF] Caromel | A security framework for reflective Java applications[END_REF][START_REF] Caromel | Reflections on MOPs, Components, and Java Security[END_REF] are important challenges. We plan to:

• Study the isolation abstractions available in erights () [START_REF] Miller | Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control[END_REF][START_REF] Miller | Capability-based Financial Instruments[END_REF], and Java's class loader strategies [START_REF] Gong | New security architectural directions for Java[END_REF][START_REF] Liang | Dynamic Class Loading in the Java Virtual Machine[END_REF].

• Categorize the different reflective features of languages such as CLOS [START_REF] Kiczales | The Art of the Metaobject Protocol[END_REF], Python and Smalltalk [START_REF] Rivard | Pour un lien d'instanciation dynamique dans les langages à classes[END_REF] and identify suitable isolation mechanisms and infrastructure [START_REF] Fong | Capabilities as alias control: Secure cooperation in dynamically extensible systems[END_REF].

• Assess different isolation models (access rights, capabilities [START_REF] Saltzer | The Protection of Information in Computer Systems[END_REF] etc.) and identify the ones adapted to our context as well as different access and right propagation.

• Define a language based on the decomposition and restructuring of the reflective features [START_REF] Bracha | Mirrors: design principles for meta-level facilities of object-oriented programming languages[END_REF],

the use of encapsulation policies as a basis to restrict the interfaces of the controlled objects [START_REF] Schärli | Object-oriented Encapsulation for Dynamically Typed Languages[END_REF],

the definition of method modifiers to support controlling encapsulation in the context of dynamic languages.

An open question is whether, instead of providing restricted interfaces, we could use traits to grant additional behavior to specific instances: without trait application, the instances would only exhibit default public behavior, but with additional traits applied, the instances would get extra behavior. We will develop Sure, a modular extension of the reflective kernel of Smalltalk (since it is one of the languages offering the largest set of reflective features such as pointer swapping, class changing, class definition etc.) [START_REF] Rivard | Pour un lien d'instanciation dynamique dans les langages à classes[END_REF].

Application domains 4.1 Programming Languages and Tools

Many of the results of RMoD are improving programming languages or development tools for such languages. As such the application domain of these results is as varied as the use of programming languages in general. Pharo, the language that RMoD develops, is used for a very broad range of applications. From pure research experiments to real world industrial use (the Pharo Consortium has more than 25 company members).

Examples are web applications, server backends for mobile applications or even graphical tools and embedded applications

Software Reengineering

Moose is a language-independent environment for reverse and re-engineering complex software systems. Moose provides a set of services including a common meta-model, metrics evaluation and visualization. As such Moose is used for analyzing software systems to support understanding and continuous development as well as software quality analysis.

Social and environmental responsibility

Footprint of research activities

The main environmental footprint of RMoD is related to international travel. Meeting researchers in person is indispensable for research.

We try to reduce travel by using online meetings as much as possible. The team tries to reduce impact of daily local travel by the use of local transport and biking to work.

Impact of research results

Our work on language runtimes has potential impact to reduce energy consumption.

Reengineering can be understood as a kind of "recycling". Our tools allow companies to use systems for a longer time, reducing environmental impact of software that is created as a new project.

All software we develop as part of our research is released as Open Source, all our publications are available in the HAL archive. Profiling Code Cache Behaviour via Events Virtual machine performance tuning for a given application is an arduous and challenging task. For example, parametrizing the behaviour of the JIT compiler machine code caches affects the overall performance of applications while being rather obscure for final users not knowledgeable about VM internals. Moreover, VM components are often heavily coupled and changes in some parameters may affect several seemingly unrelated components and may have unclear performance impacts. Therefore, choosing the best parametrization requires to have precise information. We present Vicoca, a tool that allows VM users and developers to obtain detailed information about the behaviour of the code caches and their interactions with other virtual machine components. We present a complex optimization problem due to the heavy interaction of components in the Pharo VM, and we explain it using Vicoca. The information produced by the tool allows developers to produce an optimized configuration for the VM. Vicoca is based on event recording that are manipulated during offline analysis.

Partners

Vicoca not only allows us to understand this given problem, but it opens the door to future work such as automatic detection of application characteristics, identification of performance issues, and automatic hinting. [START_REF] Tesone | Profiling Code Cache Behaviour via Events[END_REF] Cross-ISA Testing of the Pharo VM: Lessons Learned While Porting to ARMv8. Testing and debugging a Virtual Machine is a laborious task without the proper tooling. This is particularly true for VMs with JIT compilation and dynamic code patching for techniques such as inline caching. In addition, this situation is getting worse when the VM builds and runs on multiple target architectures. We report on several lessons we learned while testing the Pharo VM, particularly during the port of its Cogit JIT compiler to the AArch64 architecture. The Pharo VM presented already a simulation environment that is very handy to simulate full executions and live-develop the VM. However, this full simulation environment makes it difficult to reproduce short and simple testing scenarios. We extended the pre-existing simulation environment with a testing infrastructure and a methodology that allow us to have fine-grained control of testing scenarios, making tests small, fast, reproducible, and cross-ISA. We report on how this testing infrastructure allowed us to cope with two different development scenarios: (1) porting the Cogit JIT compiler to AArch64 without early access to real hardware and (2) debugging memory corruptions due to GC bugs. A debugging approach for live Big Data applications. Many frameworks exist for programmers to develop and deploy Big Data applications such as Hadoop Map/Reduce and Apache Spark. However, very little debugging support is currently provided in those frameworks. When an error occurs, developers are lost in trying to understand what has happened from the information provided in log files. Recently, new solutions allow developers to record& replay the application execution, but replaying is not always affordable when hours of computation need to be re-executed. We present an online approach that allows developers to debug Big Data applications in isolation by moving the debugging session to an external process when a halting point is reached. We introduce IDRA MR , our prototype implementation in Pharo. IDRA MR centralizes the debugging of parallel applications by introducing novel debugging concepts, such as composite debugging events, and the ability to dynamically update both the code of the debugged application and the same configuration of the running framework. We validate our approach by debugging both application and configuration failures for two driving scenarios. The scenarios are implemented and executed using Port, our Map/Reduce framework for Pharo, also introduced. [

3]

Time-Traveling Debugging Queries: Faster Program Exploration. Efficiently debugging a program requires program comprehension. To acquire it, developers explore the program execution, a task often performed using interactive debuggers. Unfortunately, exploring a program execution through standard interactive debuggers is a tedious and costly task. We propose Time-Traveling Queries (TTQs) to ease program exploration. TTQs is a mechanism that automatically explores program executions to collect execution data. This data is used to time-travel through execution states, facilitating the exploration of program executions. We built a set of key TTQs based on typical questions developers ask when trying to understand programs. We conducted a user study with 34 participants to evaluate the impact of our queries on program comprehension activities. Results show that, compared to traditional debugging tools, TTQs significantly improve developers' precision, while reducing required time and efforts when performing program comprehension tasks. [START_REF] Willembrinck | Time-Traveling Debugging Queries: Faster Program Exploration[END_REF] Practical Online Debugging of Spark-like applications. Apache Spark is a framework widely used for writing Big Data analytics applications that offers a scalable and fault-tolerant model based on rescheduling failing tasks on other nodes. While this is well-suited for hardware and infrastructure errors, it is not for application errors as they will reappear in the rescheduled tasks. As a result, applications are killed, losing all the progress and forcing developers to restart them from scratch. Despite the popularity of such a failure-recovery model, understanding and debugging Sparklike applications remain challenging. When an error occurs, developers need to analyze huge log files or undergo timeconsuming replays to find the bug. To address these concerns, we present an online debugging approach tailored to Big Data analytics applications. Our approach includes local debugging of remote parallel exceptions through dynamic local checkpoints, extended with domain-specific debugging operations and live code updating functionality. To deal with data-cleaning errors, we extend our model to easily allow developers to automatically ignore exceptions that happen at runtime. We validate our solution through performance benchmarks that show how our debugging approach is comparable or better than state-oftheart debugging solutions for Big Data. Furthermore, we conduct a user study to compare our approach with another state-of-theart debugging approach, and results show a lower time to find the solution to a bug using our approach, as well as a generally good perception of the features of the debugger. [START_REF] Marra | Practical Online Debugging of Spark-like applications[END_REF] Reflectivipy: building python debuggers with sub-method, partial behavioral reflection. Building debugging tools is hard and requires powerful tools and libraries. In object-oriented technologies, it is common to use fine-grained reflection to implement debuggers. In this tool presentation, we describe how partial behavioral reflection applied to sub-elements of a method helps in the implementation of advanced debugger features. As an example, we present an implementation of object-centric breakpoints in python. [ Rotten Green Tests in Java, Pharo and Python: An Empirical Study. Rotten Green Tests are tests that pass, but not because the assertions they contain are true: a rotten test passes because some or all of its assertions are not actually executed. The presence of a rotten green test is a test smell, and a bad one, because the existence of a test gives us false confidence that the code under test is valid, when in fact that code may not have been tested at all. This article reports on an empirical evaluation of the tests in a corpus of projects found in the wild. We selected approximately one hundred mature projects written in each of Java, Pharo, and Python. We looked for rotten green tests in each project, taking into account test helper methods, inherited helpers, and trait composition. Previous work has shown the presence of rotten green tests in Pharo projects; the results reported here show that they are also present in Java and Python projects, and that they fall into similar categories. Furthermore, we found code bugs that were hidden by rotten tests in Pharo and Python. We also discuss two test smells-missed fail and missed skip-that arise from the misuse of testing frameworks, and which we observed in tests written in all three languages. [START_REF] Aranega | Rotten Green Tests in Java, Pharo and Python: An Empirical Study[END_REF] Reuse in component-based prototyping: an industrial experience report from 15 years of reuse. At Thales Defense Mission Systems, software products first go through an industrial prototyping phase. We elaborate evolutionary prototypes which implement complete business behavior and fulfill functional requirements. We elaborate and evolve our solutions directly with end-users who act as stake-holders in the products' design. Prototypes also serve as models for the final products development. Because software products in the defense industry are developed over many years, this prototyping phase is crucial. Therefore, reusing software is a high-stakes issue in our activities. Component-oriented development helps us to foster reuse throughout the life cycle of our products. The work presented in our paper [START_REF] Laborde | Reuse in component-based prototyping: an industrial experience report from 15 years of reuse[END_REF] stems from 15 years of experience in developing prototypes for the defense industry. We directly reuse component implementations to build new prototypes from existing ones. We reuse component interfaces transparently in multiple prototypes, whatever the underlying implementation solutions. This kind of reuse spans prototypes and final products which are deployed on different execution platforms. We reuse non-component legacy software that we integrate in our component architectures. In this case, we seamlessly augment standard classes

From GWT to Angular: An Experiment Report on Migrating a Legacy Web Application. Berger-Levrault is an international company that developed applications in GWT for more than 10 years. However, GWT is no longer actively maintained, with only one major update since 2015. To avoid being stuck with legacy technology, the company decided to migrate its applications to Angular. However, because of the size of the applications (more than 500 web pages per application), rewriting from scratch is not desirable. To ease the migration, we designed a semi-automated migration approach that helps developers migrate applications' front-end from GWT to Angular and a tool that performs the migration. We present our approach and tool. We validated the approach on concrete application migration and compared its benefits to redeveloping the application manually. We report that the semi-automated migration offers an effort reduction over a manual migration. Finally, we present recommendations for future migration projects. [START_REF] Verhaeghe | From GWT to Angular: An Experiment Report on Migrating a Legacy Web Application[END_REF] GUI visual aspect migration: a framework agnostic solution. With the generalization of mobile devices and Web applications, GUI frameworks evolve at a fast pace: JavaFX replaced Swing, Angular 8 replaced Angular 1.4 which had replaced GWT (Google Web Toolkit. This situation forces organizations to migrate their applications to modern frameworks regularly so they do not become obsolete. There has been research in the past on automatic GUI migration. However, and concurrently, large organisations' applications use many dierent technologies. For example, the IT company with which we are working, Berger-Levrault, wishes to migrate applications written in generic programming language (Java/GWT), proprietary 4th generation languages (VisualBasic 6, PowerBuilder), or markup languages (Silverlight). Furthermore, one must expect that in a few years time, new frameworks will appear and new migrations will be required. Thus, there is a need for a language-agnostic migration approach allowing one to migrate various legacy GUI to the latest technologies. None of the existing solutions allow to deal with such a variety of GUI framework. They also typically focus on a subpart of the migration (i.e.how to extract a specific GUI framework) ignoring the re-engineering/forward-engineering part of the migration (which is straightforward for a single technology). This makes it difficult to adapt these solutions to other GUI frameworks. We propose an approach to migrate the GUI part of applications. It is based on meta-models to represent the visual element structure and layout. We detail how to create both the GUI extractors and generators, with guidelines to support new markup and programming languages. We evaluate our approach by implementing three extractors and generators for web-based or desktop-based user interfaces defined with generic programming languages (Java, Pharo, TypeScript) or markup languages (XML, HTML). We comment case studies on five applications, opened and closed source, of different sizes. The implementations of our generic approach detect 99% of the widgets and identify (i.e.determine the type of the widget) of them. We give examples of the migrated GUIs, both successful and not. [START_REF] Verhaeghe | GUI visual aspect migration: a framework agnostic solution[END_REF] Risk and Complexity Assessment on the Context of Language Migration. Language Migration is a highly risky and complex process. Many authors have provided different ways to tackle down the problem, but it still not completely resolved, even-more it is considered almost impossible on many circumstances. Despite the approaches and solutions available, no work has been done on measuring the risks and complexity of a migration process based on the technological gap. In this article we contribute a first iteration on Language Migration complexity metrics, we apply and interpret metrics on an industrial project. We end the article with a discussion and proposing future works. [START_REF] Bragagnolo | Risk and Complexity Assessment on the Context of Language Migration[END_REF] Report From The Trenches A Case Study In Modernizing Software Development Practices. One factor of success in software development companies is their ability to deliver good quality products, fast. For this, they need to improve their software development practices. We work with a medium-sized company modernizing its development practices. The company introduced several practices recommended in agile development. If the benefits of these practices are well documented, the impact of such changes on the developers is less well known. We follow this modernization before and during the COVID-19 outbreak. We present an empirical study of the perceived benefit and drawback of these practices as well as the impact of COVID-19 on the company's employees. One of the conclusions, is the additional difficulties created by obsolete technologies to adapt the technology itself and the development practices it encourages to modern standards. [START_REF] Honoré | Report From The Trenches A Case Study In Modernizing Software Development Practices[END_REF] Software Migration: A Theoretical Framework. Software migration has been a research subject for a long time. Major research and industrial implementations were conducted, shaping not only the techniques available nowadays, but also a good part of Software evolution jargon. To understand systematically the literature and grasp the major concepts is challenging and time-consuming. Even more, research evolves, and it does based on the assumption that many words (such as migration) have a single well-known meaning that we all share. Since since these words meanings are rarely explicit, and their usage heterogeneous, these words end up polluted with multiple and many times opposite or incompatible meanings. In our quest to understand, share and contribute in this domain, we recognize this situation as a problem. To tackle down this problem we propose a taxonomy on the sub-ject as a theoretical framework grounded on a systematic literature review. In this study we contribute a bottomup taxonomy that links from the object of a migration to the procedure nature migration, passing by migration drivers, objectives and approaches. We contribute a classification of all our readings, and a list of research directions discovered on the process of this study. [25] [22] Migrating GUI behavior: from GWT to Angular In a collaboration with Berger-Levrault, a major IT company, we are working on the migration of GWT applications to Angular. We focus on the GUI aspect of this migration which requires a framework switch (GWT to Angular) and a programming language switch (Java to TypeScript). Previous work identified that the GUI can be split into the UI structure and the GUI behavioral code. GUI behavioral code is the code executed when the user interacts with the UI. Although the migration of UI structure has already been studied, the migration of the GUI behavioral code has not.

To help developers during the migration of their applications, we propose a generic approach in four steps that uses a meta-model to represent the GUI behavioral code. This approach includes a separation of the GUI behavioral code into events (caller code) and the code executed when an event is fired (called code). We present the approach and its implementation for a real industrial case study. The application comprises 470 Java (GWT) classes representing 56 web pages. We give examples of the migrated code. We evaluate the quality of the generated code with standard tools (SonarQube, codelizer) and compare it to another Java to TypeScript converter. The results show that our code has 53% fewer warnings and rule violations for SonarQube, and 99% fewer for codelizer. [START_REF] Verhaeghe | Migrating GUI behavior: from GWT to Angular[END_REF]

BlockChain and Smart Data

Participants Stéphane Ducasse, Giuseppe Pierro.

Evaluating Machine-Learning Techniques for Detecting Smart Ponzi Schemes. Ethereum is one of the most popular platforms for exchanging cryptocurrencies as well as the most established for peer to peer programming and smart contracts publishing [START_REF] Marra | A debugging approach for live Big Data applications[END_REF]. The versatility of the Solidity language allows developers to program general-purpose smart contracts. Among the various smart contracts, there may be some fraudulent ones, whose purpose is to steal Ether from the network participants. A notorious example of such cases are Ponzi schemes, i.e. a financial frauds that require investors to be repaid through the investments of others who have just entered the scheme. Within the Ethereum blockchain, several contracts have been identified as being Ponzi schemes. We propose a machine learning model that uses textual classification techniques to recognize contracts emulating the behavior of a Ponzi scheme.

Starting from a contracts dataset containing exclusively Ponzi schemes uploaded between 2016 and 2018, we built models able to properly classify Ponzi schemes contracts. We tested several models, some of which returned an overall accuracy of 99% on classification. The best model turned out to be the linear Support Vector Machine and the Multinomial Naive Bayes model, which provides the best results in terms of metrics evaluation. [START_REF] Ibba | Evaluating Machine-Learning Techniques for Detecting Smart Ponzi Schemes[END_REF] Smart-Graph: Graphical Representations for Smart Contract on the Ethereum Blockchain. The Ethereum blockchain enables executing and recording smart contracts. The smart contracts can facilitate, verify, and implement the negotiation between multiple parties, also guaranteeing transactions without a traditional legal entity. Many tools supporting the smart contracts development in different areas are flourishing because in Ethereum blockchain valuable assets are often involved. Some of the tools help the developer to find security vulnerabilities via static and/or dynamic analysis or to reduce the Gas fees consumption. Despite the plethora of such tools, there is no tool supporting smart contracts evaluation and analysis via a graphical representation for expert developers. [11] Analysis of Source Code Duplication in Ethreum Smart Contracts. The practice of writing smart contracts for the Ethereum blockchain is quite recent and still in development. A blockchain developer should expect constant changes in the security software field, as new bugs and security risks are discovered, and new good practices are developed. Following the security practices accepted in the blockchain community is not enough to ensure the writing of secure smart contracts. We discusses the advantages and the disadvantages of code duplication in the Ethereum blockchain ecosystem. [START_REF] Pierro | Analysis of Source Code Duplication in Ethreum Smart Contracts[END_REF] A User-Oriented Model for Oracles' Gas Price Prediction The Ethereum blockchain is a distributed database of transactions, where the Gas Oracles suggest the users the Gas price's categories to get a transaction recorded. We xplore the idea that the Gas Oracles are based on a data-centered model which does not provide users with a reliable prediction. We present an empirical study to test the reliability of the existing Gas Oracles from both the points of view of the Gas price predictions and the existing categories. The study reveals that the Gas Oracles' predictions fail more often than advertised and shows that the Gas price categories do not correspond to the categories set by the users. Therefore we propose a user-oriented model for the Oracles' Gas price prediction, based on two Gas price categories actually corresponding to the users' interests and a new method to estimate the Gas price. The new method, performing the Poisson regression at smaller intervals of time, predicts the Gas price to pay with a lower margin of error when compared to the actual one. The predictions based on the user-oriented model thus provide the users with a more effective Gas price to set. [START_REF] Pierro | A User-Oriented Model for Oracles' Gas Price Prediction[END_REF] 9 Bilateral contracts and grants with industry

ANR JCJC OCRE

• From 2022 to 2024

• Partners: RMoD, SmArtSE (UCAQ, Quebec), UX Prototyping (Thales DMS, Brest).

• Participants: Steven Costiou, Marcus Denker.

• The objectives of the OCRE project are to study the fundamental and practical limits that hinder the implementation, the evaluation, and the adoption of object-centric debugging. We propose to build the first generation of object-centric debuggers, in order to identify and evaluate its real benefits to OOP debugging. We argue that these debuggers have the potential to drastically lower the cost (time and effort) of tracking and understanding hard bugs in OOP. 11 Dissemination

Participants The Whole Team.

Promoting scientific activities 11.1.1 Scientific events: organisation

Due to COVID, many evebts had to be cancelled.

Chair of conference program committees

• Anne Etien was PC chair of IWOR21 • Licence: Vincent Aranega, Meta, Université de Lille, 10h

• Licence: Vincent Aranega, Programmation C, 45h

• Master: Vincent Aranega, Concepts et paradigmes de programmation par la pratique, 120h

• Master: Vincent Aranega, Langages et Modèles Dédiés, 30h

• Master: Vincent Aranega, Méta-Modélisation, 30h • The booklet Concurrent Programming in Pharo was released [START_REF] Ducasse | Concurrent Programming in Pharo[END_REF].

Education

• A new version of the MOOC for Pharo was released (Stéphane Ducasse) for its fourth iteration. mooc.pharo.org.

Interventions

• Multiple public remote Pharo Sprints in Lille.

12 Scientific production

Publications of the year

International journals

1•

  Team members, visitors, external collaborators Research Scientists • Stéphane Ducasse [Team leader, Inria, Senior Researcher, HDR] • Steven Costiou [Inria, Researcher] • Marcus Denker [Inria, Researcher] Faculty Members • Nicolas Anquetil [Université de Lille, Associate Professor, HDR] • Vincent Aranega [Université de Lille, Associate Professor] • Anne Etien [Université de Lille, Professor, HDR] • Damien Pollet [Université de Lille, Associate Professor, until Sep 2021] PhD Students • Nour Jihene Agouf [Arolla SAS, CIFRE] • Santiago Bragagnolo [Berger-Levrault, CIFRE] • Thomas Dupriez [Université de Lille, until Sep 2021] • Carolina Hernandez Phillips [Inria, until Sep 2021] • Aless Hosry [Inria, from Oct 2021] • Mahugnon Honore Houekpetodji [Cim] • Pierre Misse-Chanabier [Inria] • Theo Rogliano [Inria] • Iona Thomas [Inria, from Nov 2021] • Benoit Verhaeghe [Berger-Levrault, CIFRE] • Maximilian Ignacio Willembrinck Santander [Inria] • Oleksandr Zaitsev [Arolla SAS] Technical Staff • Christophe Demarey [Inria, Engineer, 60%] • Sebastian Jordan Montano [Inria, Engineer, from Jul 2021] • Sebastijan Kaplar [Berger-Levrault, Engineer, from Oct 2021] • Soufyane Labsari [Inria, Engineer, from Oct 2021] • Esteban Lorenzano [Inria (Pharo Consortium), Engineer] • Hernan Morales [Inria, Engineer, until Feb 2021] • Nahuel Palumbo [Inria, Engineer, from Dec 2021] • Abderrahmane Seriai [Berger-Levrault, Engineer, from Oct 2021] • Pablo Tesone [Inria (Pharo Consortium), Engineer] • Clotilde Toullec [Inria, Engineer] Interns and Apprentices • Luc Bigand [Inria, from May 2021 until Aug 2021] • Bastien Degardins [Université de Lille, from Apr 2021 until Aug 2021] • Maxime Desmont [Inria, from Oct 2021] • Clement Dutriez [Inria, from Feb 2021 until Jul 2021] • Leo Frere [Université de Lille, from Apr 2021 until Aug 2021] • Lyna Grangaud [Inria, from Oct 2021] • Reda Idtaleb [Université de Lille, from Apr 2021 until Aug 2021] • Mohamed Jedny [Inria, from Oct 2021] • Soufyane Labsari [Université de Lille, from Apr 2021 until Sep 2021] • Theo Lanord [Inria, from Apr 2021 until Aug 2021] • Axel Marlard [Inria, from May 2021 until Aug 2021] • Ilyas Ouardi [Inria, until Feb 2021] • Younoussa Sow [Inria, from Oct 2021] • Iona Thomas [Inria, from Jun 2021 until Sep 2021] Quentin Ducasse [École Nationale Supérieure de Techniques Avancées, Jun 2021] • Carolina Hernandez Phillips [NC, from Oct 2021 until Nov 2021] • Giuseppe Pierro [Université de Cagliari Sardaigne -Italie, until Mar 2021] • Gordana Rakic [Université de Novi Sad -Serbie, Oct 2021] External Collaborators • Luc Fabresse [École des Mines de Douai, until Jun 2021] • Guillermo Polito [CNRS]

[13] 8 . 3

 83 Dynamic Languages: Debugging Participants Guillermo Polito, Matteo Marra, Maximilian Willembrinck, Steven Costiou, Anne Etien, Stéphane Ducasse, Vincent Aranega, Marcus Denker.

10. 5

 5 Regional initiatives CPER DATA 2: Smart Data Participants: Marcus Denker, Stéphane Ducasse, Ronnie Salgado Funding to work on exploring advanced data models integrating provisions for traceability, revocation and ownership.

:

  BetaNine, Reveal, Inceptive, Netstyle, Feenk, ObjectProfile, GemTalk Systems, Greyc Université de Caen -Basse-Normandie, Université de Berne, Yesplan, RMod, Sensus, Université de Bretagne Occidentale, École des Mines de Douai, ENSTA, Uqbar foundation Argentina, ZWEIDENKER, Life-Ware, JPMorgan Chase, KnowRoaming, ENIT, Spesenfuchs, FINWorks, Esug, FAST, Ingenieubüro Schmidt, Projector Software, HRWorks, Inspired.org, Palantir Solutions, High Octane, Soops, Osoco, Ta Mère SCRL, University of Yaounde 1, Software Quality Laboratory, University of Novi Sad, Software Institute Università della Svizzera italiana, Universdad Nacional de Quilmes, UMMISCO IRD, Université technique de Prague Pillar is a markup syntax and associated tools to write and generate documentation and books. Pillar is currently used to write several books and other documentation. It is used in the tools developed by Feenk.com.

	7.1.3 Pillar
	Keywords: HTML, LaTeX, HTML5
	Functional Description:

URL: https://github.com/Pillar-markup/pillar Contact: Stephane Ducasse Partner: Feenk 8 New results 8.1 Dynamic Languages: Language Features Participants Steven Costiou, Marcus Denker, Théo Rogliano, Guillermo Polito, Stéphane Ducasse, Vincent Aranega.

Analyzing Permission Transfer Channels for Dynamically Typed Languages. Communicating Sequential Process (CSP) is nowadays a popular concurrency model in which threads/processes communicate by exchanging data through channels. Channels help in orchestrating concurrent processes but do not solve perse data races. To prevent data races in the channel model, many programming languages rely on type systems to express ownership and behavioural restrictions such as immutability. However, dynamically-typed languages require run-time mechanisms because of the lack of type information at compile-time. We propose to augment channels with four different permission transfer semantics. We explore two mechanisms to implement such permission transfers at run time: write barriers and partial-read barriers. To validate our approach we implemented a channel framework in Pharo, and we extended it with different permission transfer semantics. We report on performance measurements of both (a) the transfer overhead on a single object and on a graph of objects, and (b) the per-object access overhead incurred by ownership checks. This work stands as a cornerstone of future work on adaptive optimizations for permission transfer channels.

[START_REF] Rogliano | Analyzing Permission Transfer Channels for Dynamically Typed Languages[END_REF]

Tool demo:

fine-grained run-time reflection in Python with Reflectivipy.

  Reflectivipy is a Python implementation of sub-method, partial behavioral reflection (SPBR). SPBR provides selective reflection operations applicable to sub-elements of methods (e.g., sub-expressions). SPBR helps in run-time code instrumentation with various application, from advanced debugging to hot patching of running programs. We briefly describe SPBR and its Reflectivipy API and implementation. We illustrate Reflectivipy through

two examples: first we build and demonstrate a basic object-centric debugger and describe how SPBR favors its implementation and second, we hot patch a running REST server.

[START_REF] Aranega | Tool demo: fine-grained run-time reflection in Python with Reflectivipy[END_REF]

8.

2 Dynamic Languages: Virtual Machines Participants Guillermo

  Polito, Stéphane Ducasse, Pablo Tesone, Théo Rogliano, Pierre Misse-Chanabier, Carolina Phillips.

	Static

Basic Block Reordering Heuristics for Implicit Control Flow in Baseline JITs.

  Baseline JIT compilers in dynamically-typed languages often use techniques such as static type predictions to optimize common execution paths using static heuristics. Such compilations exhibit implicit slow paths, defined by the language implementation and not by a developer, representing uncommon execution paths e.g., automatic type coercions, type validations and operation reifications. At run time implicit slow paths need to be jumped over and penalize overall execution. Removing implicit slow paths from the main execution path requires code reordering techniques. However, such heuristics are generally designed to work with profiling information. Based on the insight that implicit slow paths are known at compile-time, and thus do not require runtime-profiles, we experimented with two different code reordering algorithms: Pettis-Hansen Bottom-Up augmented with static code layout heuristics, and a slow-to-end heuristic.Our results show that many micro-benchmarks improve their run time by 1.2x. Benchmarks governed by more expensive computations such as message sends or garbage collections show in general no visible performance improvement nor degradations, while very few cases show degradations of up to 1.2x. We show that such static heuristics have low performance impact at compile-time and have great potential when static type predictions are present in the JIT compiler.[START_REF] Polito | Static Basic Block Reordering Heuristics for Implicit Control Flow in Baseline JITs[END_REF]

  Industrial R&D collaboration with Dr. Eric Le Pors, lead prototyping architect at Thales DMS (Brest). We work on 1) unanticipated object-centric debugging of HMI prototypes 2) we study the practices of Thales with software component reuse and its impact on their development process. Nicolas Anquetil, Santiago Bragagnolo, Stéphane Ducasse, Anne Etien, Benoît Verhaeghe From 2017, ongoing. Collaboration with the software editor Berger-Levrault about software architecture remodularization. The collaboration started with an end study project exploring the architecture used in the company in order to later migrate from GWT to Angular since GWT will not be backward supported anymore in the next versions. A PhD CIFRE thesis finished in 2021. S. Bragagnolo started a CIFRE in 2020 Stéphane Ducasse, Anne Etien, Oleksandr Zaitsev, Nour Jihene Agouf. We are collaborating with the council company, Arolla, about software evolution. Arolla has daily problems with identifying architecture, design, and deviations from those artefacts. The goal of Oleksandr's CIFRE (started in 2019) thesis is to experiment with different machine learning techniques that can help us automate the process of library migration. A new CIFRE PhD (from 2021) is based around the study of visualisation techniques that can help us understand legacy systems. Honore Mahugnon Houekpetodji, Stéphane Ducasse, Nicolas Anquetil, from 2019. A PhD started in 2019. We work on the analysis of PowerBuilder applications. PhD: Honore Mahugnon Houekpetodji Analyse multi-facettes et operationnelle pour la transformation des systèmes d'information. ses, millions of methods). We collaborate since the beginning of 2021 with the ARCAD team of the Lab-STICC in Bretagne (Prof L. Lagadec.) We started at the beginning of the year with a common workshop between the two teams looking for collaboration points. G. Polito and P. Tesone are now collaborating with the PhD of Q. Ducasse on Just-In-Time compiler technology for extensible ISA processors such as RISC-V.

	www.cost.eu/actions/CA19135
	10.4 National initiatives
	IMT Douai
	Collaboration with Prof L. Fabresse and Prof. N. Bouraqadi. The PhDs of P. Tesone, P. Misse, T. Rogliano
	and C. Hernandez are joint PhD with the team of IMT Douai.
	ARCAD' Lab-STICC, Brest, France
	Thales DMS, Brest, France
	Participants: Steven Costiou, from 2020.
	Berger Levrault, France
	Participants: Siemens AG, Germany
	Participants: Stéphane Ducasse, Anne Etien, Nicolas Anquetil
	The Siemens Digital Industry Division approached our team to help them restructure a large legacy
	systems.
	CIFRE Arolla, France
	Participants: Nicolas Anquetil, CIM, France
	Participants: Pharo Consortium
	From 2012, ongoing.
	The Pharo Consortium was founded in 2012 and is growing constantly. consortium.pharo.org.
	Lifeware AG, Switzerland
	Participants: Esteban Lorenzano, Marcus Denker, Stéphane Ducasse, ongoing.
	In collaboration with the Pharo Consortium, we improve Pharo. The goal is to be able to work with very
	large systems (>100K classes).

GT Debugging working group of the CNRS GDR GPL from

  2020 Steven Costiou is leader of the GT Debugging working group of the CNRS GDR GPL. This working group aims to gather any researcher, engineer or GDR team interested in software debugging problems.

	Member of the conference program committees
	• Anne Etien: ICSE 2021, ICSME 2021, SANER (ERA track) 2022
	• Marcus Denker: CERCIRAS 2021
	• Vincent Aranega: ICPC 2021, ICSOFT 2021, SLE 2021
	• Stéphane Ducasse: ECOOP 2022
	Reviewer
	• Vincent Aranega: SANER 2022
	• Steven Costiou: SANER 2022
	11.1.2 Journal
	• Stéphane Ducasse: Ecoop 2022
	• Stéphane Ducasse: IST Journal
	• Stéphane Ducasse: Infosid
	• Anne Etien: Empirical Software Engineering Journal
	• Nicolas Anquetil -Empirical Software Engineering Journal
	• Nicolas Anquetil -Information and Software Technology Journal
	• Nicolas Anquetil -IET Software Journal
	• Nicolas Anquetil -Journal of Software: Evolution and Process
	11.1.3 Leadership within the scientific community
	GT GLIA working group of the CNRS GDR GPL
	from 2020
	Anne Etien is co-leader of the GT GLIA working group of the Cnrs GDR-GPL (Software Engineering and
	artificial intelligence)
	11.1.4 Scientific expertise
	• Nicolas Anquetil, "Crédit Impôt Recherche" expert evaluation for MINISTÈRE DE L'ENSEIGNEMENT
	SUPÉRIEUR, DE LA RECHERCHE ET DE L'INNOVATION
	• Stéphane Ducasse, "Crédit Impôt Recherche" expert evaluation for MINISTÈRE DE L'ENSEIGNEMENT
	SUPÉRIEUR, DE LA RECHERCHE ET DE L'INNOVATION
	11.1.5 Research administration
	• Anne Etien animates the thematic group of Software Engineering and is member of scientific
	council of CRIStAL lab.

• Nicolas Anquetil was chair of Software evolution track for QUATIC 2021

• Anne Etien: Directrice des Études de la L3 MIAGE, Université de Lille 11.

2 Teaching -Supervision -Juries 11.2.1 Teaching •

  Master: Stéphane Ducasse, Programmation orientée objet, Centrale Lille, 5h CM 5hTD • Master: Stéphane Ducasse, Meta, Université de Lille, 12hTD • Licence: Anne Etien, Introduction à la programmation, 40h, L1, Université de Lille • Licence: Anne Etien, projet, 24h, L2, Université de Lille • Licence: Anne Etien, Conception orientée objet, 18, L3, Université de Lille • Licence: Anne Etien, Bases de données relationnelles, 16h, L3, Université de Lille • Licence: Anne Etien, Génie Logiciel, 27h, L3, Université de Lille • Master: Anne Etien, Bases de données avancées, 30h, M1, Université de Lille • Master: Anne Etien, Metamodelisation, 30h, M2, Université de Lille • Licence: Vincent Aranega, Programmation avancée, Polytech Lille, 35h

Popularization 11.3.1 Internal or external Inria responsibilities •

  • Master: Steven Costiou, Programmation orientée objet, Centrale Lille, 5h CM 5hTD • Master: Steven Costiou, Conception et modélisation objet, Polytech Lille, 12h CM 12hTD • Master: Steven Costiou, Fondamentaux du debugging, Université de Lille, 10hCM 14hTD • Licence: Nicolas Anquetil, Conception OO Avancée, 48h, L2, IUT-A, Université de Lille, France • Licence: Nicolas Anquetil, Programation Mobile, 30h, L2, IUT-A, Université de Lille, France • Licence: Nicolas Anquetil, Projets Agiles, 12h, L2, IUT-A, Université de Lille, France • Licence: Nicolas Anquetil, Interfaces Hommes-Machines, 32h, L2, IUT-A, Université de Lille, France 11.2.2 Supervision • PhD: Benoît Verhaeghe, Support à l'automatisation de la migration d'interface d'applications Web : le cas de GWT vers Angular, Oct 21, 2021, Anne Etien, Nicolas Anquetil [20] • PhD: Carolina Hernández, Tools for MicroKernels, Nov 5, 2021. Guillermo Polito and Luc Fabresse [19] • PhD in progress: Oleksandr Zaitsev, Machine Learning-Based Tools to Support Software Evolution, started Jul 2019, Stéphane Ducasse, Nicolas Anquetil • PhD in progress: Théo Rogliano, On multiple language kernel, started Oct 2019, Stéphane Ducasse, Luc Fabresse • PhD in progress: Pierre Misse-Chanabier, Modular, green, versatile Virtual Machines, started Oct 2019, Stéphane Ducasse, Noury Bouraqadi • PhD in progress: Mahugnon Honoré Houekpetodji, Multi-Facet Actionable for Information System Rejuvenation, SPI Lille, France, Stéphane Ducasse, Nicolas Anquetil, Nicolas Dias, Jérome Sudich • PhD in progress: Santiago Bragagnolo Migration de programmes légataires vers des architectures Web: le cas de de la migration de programmes Microsoft Access vers Angular / Microservices, CIFRE Berger-Levrault, Stéphane Ducasse, Nicolas Anquetil. • PhD in progress: Maximilian Ignacio Willembrinck Santander, Scriptable Time-Traveling Debuggers, since october 2020, Inria, Anne Etien, Steven Costiou Anne Etien is elected member of the center committee of Inria Lille Nord Europe center.

	11.2.3 Juries
	Anne Etien
	• Zakaria Ournani, Université de Lille, 7 Nov 2021
	• Quentin Perez, Mines d'Ales, 13 Dec 2021
	• Elles Cherfa, Université Bretagne Sud, 16 Dec 2021
	11.3

• Marcus Denker is a member of the AGOS board (Section culture) of Inria Lille

11.3.2 Articles and contents

• books.pharo.org contains two collections of books a technological one and a textbook one. Both collections are edited by S. Ducasse.

Traits are groups of methods that can be composed orthogonally to simple inheritance. Contrary to mixin, the class has the control of the composition and conflict management.

Inria contact: Stéphane Ducasse

Summary: Systemic changes in the past decades have pushed software systems into all aspects of our lives, from our homes to our cars to our factories. These systems, both legacy (e.g., handling contracts for the Dept of Defense of the USA since 1958) and very recent (e.g., running the latest smart factory in France in 2019), are difficult to understand by software engineers because of their intrinsic complexity. These engineers need help understanding the systems they must adapt to the new requirements of our time. The proposed associate team considers three research directions to support the software engineers maintaining and evolving large software systems: (a) system analyses and (b) debugging for (c) program comprehension. (a) Complex algorithms often act or are perceived by software engineers as black boxes because of their intrinsic and accidental complexity, both in architecture, design, and implementation. We will develop new software analyses to support algorithm understanding. (b) Previous debugging techniques assume a unique software engineer performing a solitary debugging session. We will work on a language allowing software engineers to build their own debuggers to fit their collaborative debugging strategies. (c) Previous work on program comprehension proposed views to address one single problem at a given moment of the comprehension process. They only provide a subset of the information required by software engineers. We want to propose an approach to adapt and combine views using meta-data.

Inria international partners

University of Chile, Chile Participants: Stéphane Ducasse.

A. Bergel is working on software analyses. The Moose platform heavily uses Roassal developed in the team of Bergel. We will continue our collaboration. We will use their knowledge on profilers. Prof. J.P. Sandoval is taking a new position in Chile. We co-supervised master students and received interns. We are working on supporting transformations and refactorings as well as recovering variable names.

University of Novi Sad, Serbia

Participants: Stéphane Ducasse, Anne Etien, Nicolas Anquetil, Vincent Aranega. We started to collaborate with two groups of the University of Novi Sad ( G. Rakic and G. Milosavljevic). We hope post COVID will let us restart our efforts.

Vrije Universiteit Brussel (VUB), Belgium -SOFT

Participants: Guillermo Polito, Matteo Marra. We collaborate since several years with the Soft team (previously PROG) of the Vrije Universiteit Brussels (Prof E. Gonzalez Boix). We got a large number of exchanges between our two teams -this was slowed down because of COVID. G. Polito co-supervises the PhD of M. Marra with E. Gonzales Boix on debugging map reduce applications.

Université de Chicoutimi au Quebec, Canada

Participants: Steven Costiou, Stéphane Ducasse, from 2020. We collaborate with F. Petrillo, who builds cloud infrastructures for large-scale evaluation of debuggers.

We use these infrastructures for the empirical evaluation of our debugging tools.

University of Zurich, Switzerland

Participants: Steven Costiou, Stéphane Ducasse, from 2020. We collaborate with A. Bachelli on large-scale evaluations of debugging tools. This collaboration involves 3 researchers and 2 PhD students.

Instituto Federal de Educação Ciência e Tecnologia do Ceará, Brazil

Parcipants: Vincent Aranega, from 2020. Collaboration with Pr. Antonio Wendell de Oliveira Rodrigues on smart language and DSL for live coding semi-autonomous physical systems (drones).

University of Cagliari

International research visitors

We had not many visitors in 2021 due to COVID.


Steffen Wendzel
email: wendzel@hs-worms.de

Luca Caviglione
email: luca.caviglione@cnr.it

Aleksandra Mileva
email: aleksandra.mileva@ugd.edu.mk

Jean-Francois Lalande
email: jean-francois.lalande@irisa.fr

Wojciech Mazurczyk
email: wojciech.mazurczyk@pw.edu.pl

Keywords: Replicability, Experimental Design, Research Methodology, Cyber Security, Security Datasets ACM CCS: Social and professional topics, Computing methodologies, General and reference → Cross-computing tools

This special issue presents five articles that address the topic of replicability and scientific methodology in information security research, featuring two extended articles from the 2021 International Workshop on Information Security Methodology and Replication Studies (IWSMR). This special issue also comprises two distinguished dissertations.

scientific community is increasing as later contributions often require to replicate, modify or extend previous experiments. Replicating a study is also of independent interest, as black box techniques, for example, based on artificial intelligence technologies, are often employed for evaluating detection and classification methods. For all these reasons, this special issue focuses on contributions to formalize methods for comparing and evaluating research methods in information security.

In addition to open-access initiatives from major publishers for security-related articles, data and software used for published studies are becoming submission or postproceedings artifacts. As an example, the ACSAC conference introduced in 2017 an artifact submission track for evaluating the software and data, helping with reproducing experiments of a published contribution. Some projects and publishers have also created repositories such as IEEE DataPort or Zenodo to create digital identifiers associated with the data submission. Behind these initiatives, an emerging trend is to enhance the management of the data, to increase the reusability by a third party [START_REF] Wilkinson | The FAIR Guiding Principles for scientific data management and stewardship[END_REF]. This general principle, called the FAIR guiding principle, remains to be adapted for the particularity of data related to security.

This special issue desires to foster the progress in research on the scientific methodology of information security, in all aspects related to data, methods and guidelines that can help to replicate security experiments. In particular, we intend to improve the links between sub-domains of information security research and to propose to revisit existing research data and results by reproducing past experiments.

Articles of this special issue

This special issue covers extended articles of selected work presented during the Third International Workshop on Information Security Methodology and Replication Studies (IWSMR'21) workshop, co-located with the ARES'21 conference. Furthermore, articles from an open call on infor-mation security research methodology and replicability in cybersecurity were included in this special issue. Out of the ten submissions, three have finally been accepted for publication (acceptance rate: 33.3 %). Moreover, this special issue covers two distinguished dissertations.

The first two articles are extended versions of IWSMR'21 publications. Carina Heßeling and Jörg Keller study replicability challenges for chaotic pseudo random number generators. The authors discuss the uncertainties regarding the rounding mode in arithmetic hardware and propose a structured description in numerical experiments to address this issue.

Rafael Copstein, Egil Karlsen, Jeff Schwartzentruber, Nur Zincir-Heywood and Malcolm Heywood evaluate three feature extraction and three clustering methods (K-Means, DBSCAN and EM) on four security datasets for anomaly detection in the context of log abstraction.

One of the articles from the open call was also accepted. Aaron Weathersby and Mark Washington perform a replication study of an original article by Mireles et al. [START_REF] Mireles | Extracting attack narratives from traffic datasets[END_REF], in which the authors extracted attack narratives from individual cyber alerts within a network dataset. Weathersby et al. additionally extend this previous work by integrating suggestions of the original authors in their study.

The two accepted distinguished dissertation articles provide the following contributions. Guido Schmitz analyzes whether Single Sign-on (SSO) protocols used in the web actually meet their required security and privacy goals. His work has shown critical vulnerabilities in SSO protocols and provides remedies.

Finally, the work from Daniel Demmler shows how real-world applications of secure multi-party computation and private information retrieval can be executed in an efficient manner with realistic input sizes.

  Prof. Dr. Aleksandra Mileva Faculty of Computer Science, University "Goce Delcev", St. "Krste Misirkov" 10-A, Štip, Republic of N. Macedonia aleksandra.mileva@ugd.edu.mk Prof. Dr. Aleksandra Mileva received the B. Sc., M. Sc., and Ph. D. degrees from Ss. Cyril and Methodius University in Skopje, Macedonia. She is currently a Full Professor with the Faculty of Computer Science, University Goce Delcev, Štip, Macedonia, where she is also the Head of the Laboratory of Computer Security and Computer Forensics. Her research interests include computer and network security, digital steganography, the IoT protocols and security, cryptography, computer forensics, and quasigroups theory. Since 2019, she has been a member of the EURASIP Data Forensics and Security TAC. She was with the management committee of two COST actions IC1201: BETTY and IC1306: Cryptography for Secure Digital Interaction. She is also member of the editorial boards of the Journal of Cyber Security and Mobility, and Mathematics, Computer Science and Education. Prof. Dr. Jean-Francois Lalande CentraleSupélec/Inria, IRISA, av. de la Boulaie, CS 47601 F-35576 Cesson-Sévigné, France jean-francois.lalande@irisa.fr Prof. Dr. Jean-Francois Lalande is Full Professor at CentraleSupélec. He is also part of the CIDRE team of Inria, in the IRISA laboratory. He received his Ph. D. degree in computer science from University of Nice Sophia-Antipolis, France. He was recruited as a permanent Associate Professor with the INSA Centre Val de Loire in 2005, in the LIFO laboratory. From September 2013 to August 2015, he moved to Inria (Rennes) as a delegated researcher and worked with the CIDRE team. In 2016, he obtained his habilitation to supervize research, from the University of Orléans. In 2019, he joined CentraleSupélec as Full Professor. His areas of interest are the security of operating systems, embedded software and mobile applications. He works on malware analysis, access control policies, intrusion detection tools and software code analysis. For the last 10 years, Jean-Francois Lalande co-authored more than 30 papers in journals, conferences, book chapters and workshops with international peer review and proceedings. Prof. Dr. Wojciech Mazurczyk Warsaw University of Technology, Nowowiejska 15/19, 00-665 Warsaw, Poland wojciech.mazurczyk@pw.edu.pl Prof. Dr. Wojciech Mazurczyk is a University Professor with Institute of Computer Science, Faculty of Electronics and Information Technology, Warsaw University of Technology (WUT), Poland. He received his B. Sc. (2003), M. Sc. (2004), Ph. D. (2009, with honours) and D. Sc. (habilitation, 2014) all in Telecommunications from WUT. He also is an author or co-author of 2 books, over 200 papers, 2 patent applications and over 35 invited talks. He has been involved in many international and domestic research projects as a principal investigator or as a senior researcher. He served as a guest editor of many special issues devoted to network security (among others: IEEE TDSC, IEEE S&P, IEEE Commag). He has been serving as Technical Program Committee Member of (among others): RAID, IEEE GLOBECOM, IEEE ICC, IEEE LCN, IEEE CNS, ACSAC, ARES and ACM IH&MMSec. From 2016 Editor-in-Chief of an open access Journal of Cyber Security and Mobility. Between 2018 and 2020 he was an Associate Editor of the IEEE TIFS and MCN Series Editor for the IEEE ComMag.