@article {springerlink:10.1007/s10664-012-9199-7,
	title = {Software Bertillonage},
	journal = {Empirical Software Engineering},
	year = {2012},
	note = {10.1007/s10664-012-9199-7},
	pages = {1-43},
	publisher = {Springer Netherlands},
	abstract = {Deployed software systems are typically composed of many pieces, not all of which may have been created by the main development team. Often, the provenance of included components{\textemdash}such as external libraries or cloned source code{\textemdash}is not clearly stated, and this uncertainty can introduce technical and ethical concerns that make it difficult for system owners and other stakeholders to manage their software assets. In this work, we motivate the need for the recovery of the provenance of software entities by a broad set of techniques that could include signature matching, source code fact extraction, software clone detection, call flow graph matching, string matching, historical analyses, and other techniques. We liken our provenance goals to that of Bertillonage, a simple and approximate forensic analysis technique based on bio-metrics that was developed in 19th century France before the advent of fingerprints. As an example, we have developed a fast, simple, and approximate technique called anchored signature matching for identifying the source origin of binary libraries within a given Java application. This technique involves a type of structured signature matching performed against a database of candidates drawn from the Maven2 repository, a 275 GB collection of open source Java libraries. To show the approach is both valid and effective, we conducted an empirical study on 945 jars from the Debian GNU/Linux distribution, as well as an industrial case study on 81 jars from an e-commerce application. },
	issn = {1382-3256},
	doi = {10.1007/s10664-012-9199-7},
	url = {http://dx.doi.org/10.1007/s10664-012-9199-7},
	author = {Davies, Julius and German, Daniel and Michael Godfrey and Hindle, Abram}
}
@conference {1314,
	title = {Apples vs. oranges?},
	booktitle = {Proceedings of the 8th working conference on Mining software repositories - MSR {\textquoteright}11},
	year = {2011},
	note = {"In this MSR challenge report, we compare the source code of two in- dustrial grade Integrated Development Environments (IDE): Netbeans, developed by Oracle Corporation, and Eclipse, developed by the Eclipse Foundation. In the same spirit as [1], our goal is not to identify how similar or different they are, but to identify differences that, if not taken into consideration, might result in biased, and potentially erroneous conclusions."},
	month = {05/2011},
	pages = {246-249},
	publisher = {ACM Press},
	organization = {ACM Press},
	address = {New York, New York, USA},
	abstract = {We attempt to compare the source code of two Java IDE systems: Netbeans and Eclipse. The result of this experiment shows that many factors, if ignored, could risk a bias in the results, and we posit various observations that should be taken into consideration to minimize such risk.

},
	keywords = {eclipse, netbeans, source code},
	isbn = {9781450305747},
	doi = {10.1145/1985441.1985483},
	author = {Davies, Julius and Daniel M. German}
}
@conference {955,
	title = {Perspectives on bugs in the Debian bug tracking system},
	booktitle = {2010 7th IEEE Working Conference on Mining Software Repositories (MSR 2010)2010 7th IEEE Working Conference on Mining Software Repositories (MSR 2010)},
	year = {2010},
	pages = {86 - 89},
	publisher = {IEEE},
	organization = {IEEE},
	address = {Cape Town, South Africa},
	abstract = {Bugs in Debian differ from regular software bugs. They are usually associated with packages, instead of software modules. They are caused and fixed by source package uploads instead of code commits. The majority are reported by individuals who appear in the bug database once, and only once. There also exists a small group of bug reporters with over 1,000 bug reports each to their name. We also explore our idea that a high bug-frequency for an individual package might be an indicator of popularity instead of poor quality.},
	keywords = {bug reports, debian, msr challenge, popularity},
	isbn = {978-1-4244-6802-7},
	doi = {10.1109/MSR.2010.5463288},
	attachments = {https://flosshub.org/sites/flosshub.org/files/86bugs-debian.pdf},
	author = {Davies, Julius and Hanyu Zhang and Nussbaum, Lucas and Daniel M. German}
}
