SensorRE: Provenance support for software reverse engineers. Issue 95 (August 2020)

• Record Type: Journal Article
• Authors: Henry, Wayne C.; Peterson, Gilbert L.
• Is Part Of: Computers & security. Issue 95(2020)
• Publication Date: 2020-08
• Subjects: Software reverse engineering -- Analytic provenance -- Visual analytics -- Software security -- Asynchronous collaboration; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2020.101865
• Languages: English
• ISSNs: 0167-4048

Abstract

Highlights: A semi-structured interview with experts to establish design goals for a support tool. Presentation of a visual analytics tool supporting reverse engineers' sensemaking. A user study evaluating SensorRE. A discussion of new insights and lessons learned. Abstract: Reverse engineering is a time-consuming process essential to software-security tasks such as malware analysis and vulnerability discovery. During the process, an engineer will follow multiple leads to determine how the software functions. The combination of time and possible explanations makes it difficult for the engineers to maintain a context of their findings within the overall task. Analytic provenance tools have demonstrated value in similarly complex fields that require open-ended exploration and hypothesis vetting. This paper introduces SensorRE, the first analytic provenance tool designed to support software reverse engineers. A semi-structured interview with experts led to the design and implementation of the system. As core components, we describe the visual interfaces and their integration within an existing software analysis tool. SensorRE automatically captures user's sensemaking actions and provides a graph and storyboard view to support further analysis. User study results demonstrate that SensorRE is easy to use and that it improved the participants' exploration process.