Our thesis is that software repositories contain latent information that can be mined to enable quantitative decision making. The decision-making process in software development and maintenance is mostly dependent on software practitioner's experience and intuition. For example, developers use their experiences when prioritizing bug fixes, managers allocate development and testing resources based on their intuition and so on. Often these human driven decisions lead to wasted resources

and increased cost of building and maintaining large complex software systems. The fundamental problem that motivates this dissertation is the lack of techniques that can automate decision-making process in software engineering. As data mining techniques became more mature, mining software repositories has emerged as a novel methodology to analyze the massive amounts of data

created during software development process. Significant, repeatable patterns and behaviours in software development can be identified as a result of this mining which are often used for predicting various aspects of software development and maintenance, such as

predicting defect-prone releases, software quality, or bug fix time.

In this dissertation we show techniques to effectively mine software repositories, identify significant patterns during software development and maintenance, and recommend actionable aspects that can automate the decision-making process in software engineering.

We demonstrate efficient techniques to use the information stored in software repositories and produce results to guide software practitioners so that they can depend less on their intuition and experience and more on actual data.

To this end, in this dissertation, we make several contributions.

First, we perform several empirical studies to characterize information

needs of software developers and managers in the context of decision making during software development and maintenance. For example, we study what kinds of decision-making problems are important to software practitioners on a daily basis. Second, to facilitate analysis of various types of decision-making problems using a common platform, we design a generic mixed-graph model to capture associations of different software elements. We illustrate how we can build different types of hyper-edges on this mixed-graph to quantify amorphous behaviour and dependencies among various software elements. Third, to demonstrate the effectiveness of our framework, we formalize a set of four important decision-making problems that are challenging to address with the state-of-the-art. We show that our framework can achieve high-levels of prediction accuracies for different types of decision-making problems when tested on large, widely-used, real-world, long-lived software projects.

The smartphone ecosystem encompasses smartphones' hardware and software platform, applications (apps) running on top of the platform, as well the infrastructural components. As the smartphone ecosystem is becoming an important part of our daily life, it is essential to profile, understand and, ultimately, secure the devices and the information they collect and manipulate. To this end, we pave the way for understanding and improving the smartphone ecosystem by designing useful tools, performing measurement studies and security analysis.

In this dissertation, we describe several key steps that help us understand and improve the Android smartphone ecosystem. First, we present the results of a long-term evolution study on Android permission system, the basic security mechanism in Android OS, is defined and used in practice; our results indicate that the Android permission system is becoming less secure over time. Second, we present a systematic approach and tool, named ProfileDroid, that enables multi-layer profiling of Android apps. ProfileDroid has a myriad of applications including behavioral app fingerprinting, enhancing users' understanding and control of app behavior, improving user experience, assessing performance and security implications. Finally, the Bring Your Own Handheld-device (BYOH) phenomenon presents novel management challenges to network administrators. We propose a systematic approach, Brofiler, for profiling the behavior of BYOHs along four dimensions: (a) protocol and control plane, (b) data plane, (c) temporal behavior, and (d) across dimensions using the H-M-L model by considering the different levels of intensity in each dimension. Using profiles from Brofiler, a network administrator can develop effective policies for managing BYOHs.

Debugging is a tedious and time-consuming process for software developers. Therefore, providing effective and efficient debugging tools is essential for improving programmer productivity. Existing tools for debugging suffer from various drawbacks -- general-purpose debuggers provide little guidance for the programmers in locating the

bug source while specialized debuggers require knowledge of the type of bug encountered. This dissertation makes several advances in debugging leading to effective, efficient, and extensible framework for interactive debugging of singlethreaded programs and deterministic debugging of multithreaded programs.

This dissertation presents the Qzdb debugger for singlethreaded programs that raises the abstraction level of debugging by introducing high-level and powerful state alteration and state inspection capabilities. Case studies on 5 real reported bugs in 5 popular real programs demonstrate its effectiveness. To support integration of specialized debugging algorithms into Qzdb, a

new approach for constructing debuggers is developed that employs declarative specification of bug conditions and their root causes, and automatic generation of debugger code. Experiments show that about 3,300 lines of C code are generated automatically from only 8 lines of specification for 6 memory bugs. Thanks to the effective generated bug locators, for the 8 real-worlds bugs we have applied our approach to, users have to examine just 1 to 16 instructions. To reduce the runtime overhead of dynamic analysis used during debugging, relevant input analysis is developed and employed to carry out input simplification and execution simplification which reduce the length of analyzed execution by reducing the input size and limiting the analysis to subset of the execution. Experiments show that relevant input analysis based input simplification algorithm is both efficient and effective -- it only requires 11% to 21% test runs of that needed by standard delta debugging algorithm and generates even smaller inputs.

Finally, to demonstrate that the above approach can also be used for debugging multithreaded programs, this dissertation presents DrDebug, a deterministic and cyclic debugging framework. DrDebug allows efficient debugging by tailoring the scope of replay to a buggy execution region and an execution slice of a buggy region. Case studies of real reported concurrency bugs show that the buggy execution region size is less than 1 million instructions and the lengths of buggy execution region and execution slice are less than

15% and 7% of the total execution respectively.