iTrustInterviews.bib

@article{fritz2014degree,
	author = {Fritz, Thomas and Murphy, Gail C. and Murphy-Hill, Emerson and Ou, Jingwen and Hill, Emily},
	title = {Degree-of-knowledge: Modeling a Developer's Knowledge of Code},
	journal = {ACM Trans. Softw. Eng. Methodol.},
	issue_date = {March 2014},
	volume = {23},
	number = {2},
	month = apr,
	year = {2014},
	issn = {1049-331X},
	pages = {14:1--14:42},
	articleno = {14},
	numpages = {42},
	url = {http://doi.acm.org.prox.lib.ncsu.edu/10.1145/2512207},
	doi = {10.1145/2512207},
	acmid = {2512207},
	publisher = {ACM},
	address = {New York, NY, USA},
	keywords = {Authorship, degree-of-interest, degree-of-knowledge, development environment, expertise, onboarding, recommendation},
} 

@inproceedings{begel2014analyze,
  title={Analyze this! 145 questions for data scientists in software engineering.},
  author={Begel, Andrew and Zimmermann, Thomas},
  booktitle={ICSE},
  pages={12--13},
  year={2014}
}

@inproceedings{viriyakattiyaporn2010spyglass,
	author = {Viriyakattiyaporn, Petcharat and Murphy, Gail C.},
	title = {Improving Program Navigation with an Active Help System},
	booktitle = {Proceedings of the 2010 Conference of the Center for Advanced Studies on Collaborative Research},
	series = {CASCON '10},
	year = {2010},
	location = {Toronto, Ontario, Canada},
	pages = {27--41},
	numpages = {15},
	url = {http://dx.doi.org.prox.lib.ncsu.edu/10.1145/1923947.1923951},
	doi = {10.1145/1923947.1923951},
	acmid = {1923951},
	publisher = {IBM Corp.},
	address = {Riverton, NJ, USA},
} 

@TechReport{barnett2014getMeHere,
	author ={Mike Barnett and Robert DeLine and Akash Lal and Shaz Qadeer},
	month = {February},
	number = {MSR-TR-2014-10},
	title = {Get Me Here: Using Verification Tools to Answer Developer Questions},
	url = {http://research.microsoft.com/apps/pubs/default.aspx?id=208776},
	year = {2014}
}


@inproceedings{latoza2011visualizing,
	title={Visualizing call graphs},
	author={LaToza, Thomas D and Myers, Brad A},
	booktitle={Visual Languages and Human-Centric Computing (VL/HCC), 2011 IEEE Symposium on},
	pages={117--124},
	year={2011},
	organization={IEEE}
}

@inproceedings{latoza2010hard,
  title={Hard-to-answer questions about code},
  author={LaToza, Thomas D and Myers, Brad A},
  booktitle={Evaluation and Usability of Programming Languages and Tools},
  pages={8},
  year={2010},
  organization={ACM}
}

@inproceedings{latoza2010developers,
  title={Developers ask reachability questions},
  author={LaToza, Thomas D and Myers, Brad A},
  booktitle={Proceedings of the 32nd ACM/IEEE International Conference on Software Engineering-Volume 1},
  pages={185--194},
  year={2010},
  organization={ACM}
}

@inproceedings{jovanovic2006pixy,
  title={Pixy: A static analysis tool for detecting web application vulnerabilities},
  author={Jovanovic, Nenad and Kruegel, Christopher and Kirda, Engin},
  booktitle={Security and Privacy, 2006 IEEE Symposium on},
  pages={6--pp},
  year={2006},
  organization={IEEE}
}

@inproceedings{livshits2005finding,
  title={Finding Security Vulnerabilities in Java Applications with Static Analysis.},
  author={Livshits, V Benjamin and Lam, Monica S},
  booktitle={Usenix Security},
  pages={18--18},
  year={2005}
}

@inproceedings{martin2005finding,
  title={Finding application errors and security flaws using PQL: a program query language},
  author={Martin, Michael and Livshits, Benjamin and Lam, Monica S},
  booktitle={ACM SIGPLAN Notices},
  volume={40},
  pages={365--383},
  year={2005},
  organization={ACM}
}

@inproceedings{austin2011one,
  title={One technique is not enough: A comparison of vulnerability discovery techniques},
  author={Austin, Andrew and Williams, Laurie},
  booktitle={Empirical Software Engineering and Measurement (ESEM), 2011 International Symposium on},
  pages={97--106},
  year={2011},
  organization={IEEE}
}

@inproceedings{dukes2013case,
  title={A case study on web application security testing with tools and manual testing},
  author={Dukes, LaShanda and Yuan, Xiaohong and Akowuah, Francis},
  booktitle={Southeastcon, 2013 Proceedings of IEEE},
  pages={1--6},
  year={2013},
  organization={IEEE}
}

@article{chess2004static,
  title={Static analysis for security},
  author={Chess, Brian and McGraw, Gary},
  journal={IEEE Security \& Privacy},
  volume={2},
  number={6},
  pages={76--79},
  year={2004},
  publisher={IEEE Computer Society}
}
@inproceedings{fritz2010using,
  title={Using information fragments to answer the questions developers ask},
  author={Fritz, Thomas and Murphy, Gail C},
  booktitle={Proceedings of the 32nd ACM/IEEE International Conference on Software Engineering-Volume 1},
  pages={175--184},
  year={2010},
  organization={ACM}
}

@inproceedings{chen2002mops,
  title={MOPS: an infrastructure for examining security properties of software},
  author={Chen, Hao and Wagner, David},
  booktitle={Proceedings of the 9th ACM conference on Computer and communications security},
  pages={235--244},
  year={2002},
  organization={ACM}
}

@inbook{hudson2013sorting, 
 author = {William Hudson},
 title = {Card Sorting}, 
 booktitle = {The Encyclopedia of Human-Computer Interaction, 2nd Ed.},  
 publisher = {The Interaction Design Foundation}, 
 year = {2013}, 
 address = {Aarhus, Denmark}
}

@inproceedings{johnson2013don,
  title={Why don't software developers use static analysis tools to find bugs?},
  author={Johnson, Brittany and Song, Yoonki and Murphy-Hill, Emerson and Bowdidge, Robert},
  booktitle={Software Engineering (ICSE), 2013 35th International Conference on},
  pages={672--681},
  year={2013},
  organization={IEEE}
}

@inproceedings{ayewah2008report,
  title={A report on a survey and study of static analysis users},
  author={Ayewah, Nathaniel and Pugh, William},
  booktitle={Proceedings of the 2008 workshop on Defects in large software systems},
  pages={1--5},
  year={2008},
  organization={ACM}
}

@article{ayewah2008using,
  title={Using static analysis to find bugs},
  author={Ayewah, Nathaniel and Hovemeyer, David and Morgenthaler, J David and Penix, John and Pugh, William},
  journal={Software, IEEE},
  volume={25},
  number={5},
  pages={22--29},
  year={2008},
  publisher={IEEE}
}

@inproceedings{khoo2008path,
  title={Path projection for user-centered static analysis tools},
  author={Khoo, Yit Phang and Foster, Jeffrey S and Hicks, Michael and Sazawal, Vibha},
  booktitle={Proceedings of the 8th ACM SIGPLAN-SIGSOFT workshop on Program analysis for software tools and engineering},
  pages={57--63},
  year={2008},
  organization={ACM}
}

@inproceedings{layman2007toward,
  title={Toward reducing fault fix time: Understanding developer behavior for the design of automated fault detection tools},
  author={Layman, Lucas and Williams, Laurie and Amant, Robert St},
  booktitle={Empirical Software Engineering and Measurement, 2007. ESEM 2007. First International Symposium on},
  pages={176--185},
  year={2007},
  organization={IEEE}
}

@article{bessey2010few,
  title={A few billion lines of code later: using static analysis to find bugs in the real world},
  author={Bessey, Al and Block, Ken and Chelf, Ben and Chou, Andy and Fulton, Bryan and Hallem, Seth and Henri-Gros, Charles and Kamsky, Asya and McPeak, Scott and Engler, Dawson},
  journal={Communications of the ACM},
  volume={53},
  number={2},
  pages={66--75},
  year={2010},
  publisher={ACM}
}

@inproceedings{ko2004designing,
  title={Designing the whyline: a debugging interface for asking questions about program behavior},
  author={Ko, Andrew J and Myers, Brad A},
  booktitle={Proceedings of the SIGCHI conference on Human factors in computing systems},
  pages={151--158},
  year={2004},
  organization={ACM}
}

@article{mucslu2012speculative,
  title={Speculative analysis of integrated development environment recommendations},
  author={Mu{\c{s}}lu, K{\i}van{\c{c}} and Brun, Yuriy and Holmes, Reid and Ernst, Michael D and Notkin, David},
  journal={ACM SIGPLAN Notices},
  volume={47},
  number={10},
  pages={669--682},
  year={2012},
  publisher={ACM}
}

@inproceedings{servant2012history,
  title={History slicing: assisting code-evolution tasks},
  author={Servant, Francisco and Jones, James A},
  booktitle={Proceedings of the ACM SIGSOFT 20th International Symposium on the Foundations of Software Engineering},
  pages={43},
  year={2012},
  organization={ACM}
}

@inproceedings{yoon2013visualization,
  title={Visualization of fine-grained code change history},
  author={Yoon, YoungSeok and Myers, Brad A and Koo, Sebon},
  booktitle={Visual Languages and Human-Centric Computing (VL/HCC), 2013 IEEE Symposium on},
  pages={119--126},
  year={2013},
  organization={IEEE}
}

@inproceedings{kononenko2012automatically,
  title={Automatically locating relevant programming help online},
  author={Kononenko, Oleksii and Dietrich, David and Sharma, Rahul and Holmes, Reid},
  booktitle={Visual Languages and Human-Centric Computing (VL/HCC), 2012 IEEE Symposium on},
  pages={127--134},
  year={2012},
  organization={IEEE}
}

@article{manadhata2011attack,
  title={An attack surface metric},
  author={Manadhata, Pratyusa K and Wing, Jeannette M},
  journal={Software Engineering, IEEE Transactions on},
  volume={37},
  number={3},
  pages={371--386},
  year={2011},
  publisher={IEEE}
}

@inproceedings{bartel2012automatically,
  title={Automatically securing permission-based software by reducing the attack surface: an application to android},
  author={Bartel, Alexandre and Klein, Jacques and Le Traon, Yves and Monperrus, Martin},
  booktitle={Proceedings of the 27th IEEE/ACM International Conference on Automated Software Engineering},
  pages={274--277},
  year={2012},
  organization={ACM}
}

@article{letovsky1987cognitive,
  title={Cognitive processes in program comprehension},
  author={Letovsky, Stanley},
  journal={Journal of Systems and software},
  volume={7},
  number={4},
  pages={325--339},
  year={1987},
  publisher={Elsevier}
}

@book{glaser2009discovery,
  title={The discovery of grounded theory: Strategies for qualitative research},
  author={Glaser, Barney G and Strauss, Anselm L},
  year={2009},
  publisher={Transaction Publishers}
}

@article{canas1994mental,
  title={Mental models and computer programming},
  author={Ca{\~n}as, Jos{\'e} Juan and Bajo, Maria Teresa and Gonzalvo, Pilar},
  journal={International Journal of Human-Computer Studies},
  volume={40},
  number={5},
  pages={795--811},
  year={1994},
  publisher={Elsevier}
}

@inproceedings{burkhardt1997mental,
  title={Mental representations constructed by experts and novices in object-oriented program comprehension},
  author={Burkhardt, Jean-Marie and D{\'e}tienne, Fran{\c{c}}oise and Wiedenbeck, Susan},
  booktitle={Proceedings of the Human-Computer Interaction Conference},
  pages={339--346},
  year={1997},
  organization={Springer}
}

@misc{ghosh2001method,
  title={Method for generating a Java bytecode data flow graph},
  author={Ghosh, Sanjoy},
  year={2001},
  month=may # "~15",
  publisher={Google Patents},
  note={US Patent 6,233,733}
}

@article{ferrante1987program,
  title={The program dependence graph and its use in optimization},
  author={Ferrante, Jeanne and Ottenstein, Karl J and Warren, Joe D},
  journal={ACM Transactions on Programming Languages and Systems (TOPLAS)},
  volume={9},
  number={3},
  pages={319--349},
  year={1987},
  publisher={ACM}
}


@inproceedings{murphy2010trust,
  title={What is trust in a recommender for software development?},
  author={Murphy, Gail C and Murphy-Hill, Emerson},
  booktitle={Proceedings of the 2nd International Workshop on Recommendation Systems for Software Engineering},
  pages={57--58},
  year={2010},
  organization={ACM}
}

@inproceedings{murphy2011peer,
  title={Peer interaction effectively, yet infrequently, enables programmers to discover new tools},
  author={Murphy-Hill, Emerson and Murphy, Gail C},
  booktitle={Proceedings of the ACM 2011 conference on Computer supported cooperative work},
  pages={405--414},
  year={2011},
  organization={ACM}
}

@article{Landis1977agreement,
     jstor_articletype = {research-article},
     title = {The Measurement of Observer Agreement for Categorical Data},
     author = {Landis, J. Richard and Koch, Gary G.},
     journal = {Biometrics},
     jstor_issuetitle = {},
     volume = {33},
     number = {1},
     jstor_formatteddate = {Mar., 1977},
     pages = {pp. 159-174},
     url = {http://www.jstor.org/stable/2529310},
     ISSN = {0006341X},
     abstract = {This paper presents a general statistical methodology for the analysis of multivariate categorical data arising from observer reliability studies. The procedure essentially involves the construction of functions of the observed proportions which are directed at the extent to which the observers agree among themselves and the construction of test statistics for hypotheses involving these functions. Tests for interobserver bias are presented in terms of first-order marginal homogeneity and measures of interobserver agreement are developed as generalized kappa-type statistics. These procedures are illustrated with a clinical diagnosis example from the epidemiological literature.},
     language = {English},
     year = {1977},
     publisher = {International Biometric Society},
     copyright = {Copyright © 1977 International Biometric Society},
}
    
@inproceedings{kim2007prioritizing,
  title={Prioritizing warning categories by analyzing software history},
  author={Kim, Sunghun and Ernst, Michael D},
  booktitle={Mining Software Repositories, 2007. ICSE Workshops MSR'07. Fourth International Workshop on},
  pages={27--27},
  year={2007},
  organization={IEEE}
}

@inproceedings{boogerd2006prioritizing,
  title={Prioritizing software inspection results using static profiling},
  author={Boogerd, Cathal and Moonen, Leon},
  booktitle={Source Code Analysis and Manipulation, 2006. SCAM'06. Sixth IEEE International Workshop on},
  pages={149--160},
  year={2006},
  organization={IEEE}
}

@inproceedings{kremenek2004correlation,
  title={Correlation exploitation in error ranking},
  author={Kremenek, Ted and Ashcraft, Ken and Yang, Junfeng and Engler, Dawson},
  booktitle={ACM SIGSOFT Software Engineering Notes},
  volume={29},
  number={6},
  pages={83--93},
  year={2004},
  organization={ACM}
}

@inproceedings{barik14visual,
    author = {Barik, Titus and Lubick, Kevin and Christie, Samuel and Murphy-Hill, Emerson},
    booktitle = {2nd IEEE Working Conference on Software Visualization},
    citeulike-article-id = {13240168},
    citeulike-linkout-0 = {http://people.engr.ncsu.edu/ermurph3/papers/vissoft14.pdf},
    keywords = {program\_analysis, self},
    posted-at = {2014-06-23 15:12:34},
    priority = {2},
    title = {How Developers Visualize Compiler Messages: A Foundational Approach to Notification Construction},
    url = {http://people.engr.ncsu.edu/ermurph3/papers/vissoft14.pdf},
    year = {2014},
    note = {To appear.}
}

@inproceedings{parnin2012programmer,
	title={Programmer information needs after memory failure},
	author={Parnin, Chris and Rugaber, Spencer},
	booktitle={Program Comprehension (ICPC), 2012 IEEE 20th International Conference on},
	pages={123--132},
	year={2012},
	organization={IEEE}
}

@inproceedings{murphy-Hill2012fluency,
	author = {Murphy-Hill, Emerson and Jiresal, Rahul and Murphy, Gail C.},
	title = {Improving Software Developers' Fluency by Recommending Development Environment Commands},
	booktitle = {Proceedings of the ACM SIGSOFT 20th International Symposium on the Foundations of Software Engineering},
	series = {FSE '12},
	year = {2012},
	isbn = {978-1-4503-1614-9},
	location = {Cary, North Carolina},
	pages = {42:1--42:11},
	articleno = {42},
	numpages = {11},
	url = {http://doi.acm.org/10.1145/2393596.2393645},
	doi = {10.1145/2393596.2393645},
	acmid = {2393645},
	publisher = {ACM},
	address = {New York, NY, USA},
	keywords = {IDEs, commands, discovery, software developers}
} 

@article{phang2009triaging,
	title={Triaging Checklists: a Substitute for a PhD in Static Analysis},
	author={Phang, Khoo Yit and Foster, Jeffrey S and Hicks, Michael and Sazawal, Vibha},
	journal={Evaluation and Usability of Programming Languages and Tools (PLATEAU) PLATEAU 2009},
	year={2009}
}


@article{wiedenbeck1993mental,
author = {Wiedenbeck, S. and Fix, V. and Scholtz, J.},
journal = {International Journal of Man-Machine Studies},
number = {5},
pages = {793--812},
title = {{Characteristics of the mental representations of novice and expert programmers: an empirical study}},
volume = {39},
year = {1993}
}

@inproceedings{nielsen2002getting,
  title={Getting access to what goes on in people's heads?: reflections on the think-aloud technique},
  author={Nielsen, Janni and Clemmensen, Torkil and Yssing, Carsten},
  booktitle={Proceedings of the second Nordic conference on Human-computer interaction},
  pages={101--110},
  year={2002},
  organization={ACM}
}

@article{guest2006many,
	title={How many interviews are enough? An experiment with data saturation and variability},
	author={Guest, Greg and Bunce, Arwen and Johnson, Laura},
	journal={Field methods},
	volume={18},
	number={1},
	pages={59--82},
	year={2006},
	publisher={Sage Publications}
}

@inproceedings{ammar2012empirical,
	title={Empirical Evaluation of Diagrams of the Run-time Structure for Coding Tasks},
	author={Ammar, Nariman and Abi-Antoun, Marwan},
	booktitle={Reverse Engineering (WCRE), 2012 19th Working Conference on},
	pages={367--376},
	year={2012},
	organization={IEEE}
}

@article{mockus2002open,
	author = {Mockus, Audris and Fielding, Roy T. and Herbsleb, James D.},
	title = {Two Case Studies of Open Source Software Development: Apache and Mozilla},
	journal = {ACM Trans. Softw. Eng. Methodol.},
	issue_date = {July 2002},
	volume = {11},
	number = {3},
	month = jul,
	year = {2002},
	issn = {1049-331X},
	pages = {309--346},
	numpages = {38},
	url = {http://doi.acm.org/10.1145/567793.567795},
	doi = {10.1145/567793.567795},
	acmid = {567795},
	publisher = {ACM},
	address = {New York, NY, USA},
	keywords = {Apache, Mozilla, Open source software, code ownership, defect density, repair interval},
} 


@inproceedings{deAlwis2006disorient,
 author = {de Alwis, Brian and Murphy, Gail C.},
 title = {Using Visual Momentum to Explain Disorientation in the Eclipse IDE},
 booktitle = {Proceedings of the Visual Languages and Human-Centric Computing},
 series = {VLHCC '06},
 year = {2006},
 isbn = {0-7695-2586-5},
 pages = {51--54},
 numpages = {4},
 url = {http://dx.doi.org.prox.lib.ncsu.edu/10.1109/VLHCC.2006.49},
 doi = {10.1109/VLHCC.2006.49},
 acmid = {1174652},
 publisher = {IEEE Computer Society},
 address = {Washington, DC, USA},
}

@inproceedings{ko2007information,
	title={Information needs in collocated software development teams},
	author={Ko, Andrew J and DeLine, Robert and Venolia, Gina},
	booktitle={Proceedings of the 29th international conference on Software Engineering},
	pages={344--353},
	year={2007},
	organization={IEEE Computer Society}
}

@misc{FindSecurityBugs,
key ={zzFindSecBugs},
title={Find Security Bugs},
note={\url{http://h3xstream.github.io/find-sec-bugs/}}
}
@misc{FindBugs,
key ={zzFindBugs},
title={FindBugs},
note={\url{http://findbugs.sourceforge.net}}
}
@misc{CodeSonar,
key ={zzCodeSonar},
title={CodeSonar},
note={\url{http://grammatech.com/codesonar}}
} 
@misc{Coverity,
key ={zzCoverity},
title={Coverity},
note={\url{http://coverity.com/}}
}
@misc{iTrust,
key ={zziTrust},
title={iTrust Software System},
note={\blind{\url{http://agile.csc.ncsu.edu/iTrust/wiki/doku.php?id=start}}}
}
@misc{ExperimentalMaterials,
key ={zzExpMaterials},
title={Security Questions Experimental Materials},
note={\blind{\url{http://http://www4.ncsu.edu/~bijohnso/security-questions.html}}}
}
@misc{HIPAA,
key ={zzHIPPA},
title={Hippa Statute},
note={\url{http://hhs.gov/ocr/privacy/}}
}
@misc{SecurityAnalyzers,
key ={zzAnalyzers},
title={NIST Source Code Security Analyzers},
note={\url{http://samate.nist.gov/index.php/Source_Code_Security_Analyzers.html}}
}
@misc{OWASPSCA,
key ={zzOWASP},
title={OWASP Source Code Analysis Tools},
note={\url{http://owasp.org/index.php/Source_Code_Analysis_Tools}}
}
@misc{CodeAnalysis,
key ={zzStatic},
title={Web Application Security Consortium Static Code Analysis Tools},
note={\url{http://projects.webappsec.org/w/page/61622133/StaticCodeAnalysisList}}
}
@misc{OTranscribe,
key ={zzOTranscribe},
title={OTranscribe},
note={\url{http://otranscribe.com}}
}
@misc{OWASP,
key ={zzOWASP2},
title={OWASP},
note={\url{http://owasp.org/index.php/Main_Page}}
}