{"id":"https://openalex.org/W2942735926","doi":"https://doi.org/10.1145/3290607.3313040","title":"An Observational Investigation of Reverse Engineers' Process and Mental Models","display_name":"An Observational Investigation of Reverse Engineers' Process and Mental Models","publication_year":2019,"publication_date":"2019-04-30","ids":{"openalex":"https://openalex.org/W2942735926","doi":"https://doi.org/10.1145/3290607.3313040","mag":"2942735926"},"language":"en","primary_location":{"id":"doi:10.1145/3290607.3313040","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3290607.3313040","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3290607.3313040","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Extended Abstracts of the 2019 CHI Conference on Human Factors in Computing Systems","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3290607.3313040","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5068333184","display_name":"Daniel Votipka","orcid":"https://orcid.org/0000-0001-9985-250X"},"institutions":[{"id":"https://openalex.org/I66946132","display_name":"University of Maryland, College Park","ror":"https://ror.org/047s2c258","country_code":"US","type":"education","lineage":["https://openalex.org/I66946132"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Daniel Votipka","raw_affiliation_strings":["University of Maryland, College Park, MD, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Maryland, College Park, MD, USA","institution_ids":["https://openalex.org/I66946132"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5047250617","display_name":"Seth M. Rabin","orcid":null},"institutions":[{"id":"https://openalex.org/I66946132","display_name":"University of Maryland, College Park","ror":"https://ror.org/047s2c258","country_code":"US","type":"education","lineage":["https://openalex.org/I66946132"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Seth Rabin","raw_affiliation_strings":["University of Maryland, College Park, MD, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Maryland, College Park, MD, USA","institution_ids":["https://openalex.org/I66946132"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5066289382","display_name":"Kristopher Micinski","orcid":"https://orcid.org/0000-0002-8650-0991"},"institutions":[{"id":"https://openalex.org/I155707491","display_name":"Haverford College","ror":"https://ror.org/04fnrxr62","country_code":"US","type":"education","lineage":["https://openalex.org/I155707491"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Kristopher Micinski","raw_affiliation_strings":["Haverford College, Haverford, PA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Haverford College, Haverford, PA, USA","institution_ids":["https://openalex.org/I155707491"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5038702707","display_name":"Jeffrey S. Foster","orcid":"https://orcid.org/0000-0001-8043-1166"},"institutions":[{"id":"https://openalex.org/I121934306","display_name":"Tufts University","ror":"https://ror.org/05wvpxv85","country_code":"US","type":"education","lineage":["https://openalex.org/I121934306"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jeffrey S. Foster","raw_affiliation_strings":["Tufts University, Medford, MA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tufts University, Medford, MA, USA","institution_ids":["https://openalex.org/I121934306"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5105206771","display_name":"Michelle L. Mazurek","orcid":"https://orcid.org/0000-0003-4151-6428"},"institutions":[{"id":"https://openalex.org/I66946132","display_name":"University of Maryland, College Park","ror":"https://ror.org/047s2c258","country_code":"US","type":"education","lineage":["https://openalex.org/I66946132"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Michelle L. Mazurek","raw_affiliation_strings":["University of Maryland, College Park, MD, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Maryland, College Park, MD, USA","institution_ids":["https://openalex.org/I66946132"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":2.116,"has_fulltext":true,"cited_by_count":17,"citation_normalized_percentile":{"value":0.89950227,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12423","display_name":"Software Reliability and Analysis Research","score":0.9929999709129333,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/reverse-engineering","display_name":"Reverse engineering","score":0.9082726240158081},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7116837501525879},{"id":"https://openalex.org/keywords/program-comprehension","display_name":"Program comprehension","score":0.6451078653335571},{"id":"https://openalex.org/keywords/documentation","display_name":"Documentation","score":0.6221728324890137},{"id":"https://openalex.org/keywords/debugging","display_name":"Debugging","score":0.5994036197662354},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.5751793384552002},{"id":"https://openalex.org/keywords/malware-analysis","display_name":"Malware analysis","score":0.5146545171737671},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.46007615327835083},{"id":"https://openalex.org/keywords/obfuscation","display_name":"Obfuscation","score":0.46006500720977783},{"id":"https://openalex.org/keywords/software-documentation","display_name":"Software documentation","score":0.44885796308517456},{"id":"https://openalex.org/keywords/static-program-analysis","display_name":"Static program analysis","score":0.42162367701530457},{"id":"https://openalex.org/keywords/source-code","display_name":"Source code","score":0.4149722456932068},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.40507936477661133},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.391020268201828},{"id":"https://openalex.org/keywords/software-development","display_name":"Software development","score":0.24919113516807556},{"id":"https://openalex.org/keywords/software-development-process","display_name":"Software development process","score":0.24058619141578674},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.21794971823692322},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.19740504026412964},{"id":"https://openalex.org/keywords/software-system","display_name":"Software system","score":0.17472481727600098},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.13716229796409607}],"concepts":[{"id":"https://openalex.org/C207850805","wikidata":"https://www.wikidata.org/wiki/Q269608","display_name":"Reverse engineering","level":2,"score":0.9082726240158081},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7116837501525879},{"id":"https://openalex.org/C2777561058","wikidata":"https://www.wikidata.org/wiki/Q2652119","display_name":"Program comprehension","level":4,"score":0.6451078653335571},{"id":"https://openalex.org/C56666940","wikidata":"https://www.wikidata.org/wiki/Q788790","display_name":"Documentation","level":2,"score":0.6221728324890137},{"id":"https://openalex.org/C168065819","wikidata":"https://www.wikidata.org/wiki/Q845566","display_name":"Debugging","level":2,"score":0.5994036197662354},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.5751793384552002},{"id":"https://openalex.org/C2779395397","wikidata":"https://www.wikidata.org/wiki/Q15731404","display_name":"Malware analysis","level":3,"score":0.5146545171737671},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.46007615327835083},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.46006500720977783},{"id":"https://openalex.org/C81587897","wikidata":"https://www.wikidata.org/wiki/Q181702","display_name":"Software documentation","level":5,"score":0.44885796308517456},{"id":"https://openalex.org/C137287247","wikidata":"https://www.wikidata.org/wiki/Q1329550","display_name":"Static program analysis","level":4,"score":0.42162367701530457},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.4149722456932068},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.40507936477661133},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.391020268201828},{"id":"https://openalex.org/C529173508","wikidata":"https://www.wikidata.org/wiki/Q638608","display_name":"Software development","level":3,"score":0.24919113516807556},{"id":"https://openalex.org/C180152950","wikidata":"https://www.wikidata.org/wiki/Q2904257","display_name":"Software development process","level":4,"score":0.24058619141578674},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.21794971823692322},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.19740504026412964},{"id":"https://openalex.org/C149091818","wikidata":"https://www.wikidata.org/wiki/Q2429814","display_name":"Software system","level":3,"score":0.17472481727600098},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.13716229796409607}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3290607.3313040","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3290607.3313040","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3290607.3313040","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Extended Abstracts of the 2019 CHI Conference on Human Factors in Computing Systems","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3290607.3313040","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3290607.3313040","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3290607.3313040","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Extended Abstracts of the 2019 CHI Conference on Human Factors in Computing Systems","raw_type":"proceedings-article"},"sustainable_development_goals":[{"score":0.5099999904632568,"id":"https://metadata.un.org/sdg/9","display_name":"Industry, innovation and infrastructure"}],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2942735926.pdf","grobid_xml":"https://content.openalex.org/works/W2942735926.grobid-xml"},"referenced_works_count":12,"referenced_works":["https://openalex.org/W1541063262","https://openalex.org/W1615506555","https://openalex.org/W1658908529","https://openalex.org/W1685057348","https://openalex.org/W1990863537","https://openalex.org/W2022203852","https://openalex.org/W2039831248","https://openalex.org/W2080862045","https://openalex.org/W2119871945","https://openalex.org/W2143244564","https://openalex.org/W2151996389","https://openalex.org/W2608014122"],"related_works":["https://openalex.org/W2170152929","https://openalex.org/W4237759043","https://openalex.org/W4243636538","https://openalex.org/W2646159910","https://openalex.org/W4386387815","https://openalex.org/W2765394967","https://openalex.org/W109909280","https://openalex.org/W2354385412","https://openalex.org/W2011536294","https://openalex.org/W2560252021"],"abstract_inverted_index":{"Reverse":[0],"engineering":[1,33],"is":[2],"a":[3,120,152,191,231],"complex":[4],"task":[5,68],"essential":[6],"to":[7,45,58,65,85,95,106,141,209,265],"several":[8],"software":[9],"security":[10],"jobs":[11],"like":[12],"vulnerability":[13],"discovery":[14],"and":[15,101,130,133,177,201,216,235,261],"malware":[16],"analysis.":[17],"While":[18],"traditional":[19],"program":[20,24,82,138,199,262],"comprehension":[21],"tasks":[22,37],"(e.g.,":[23,70],"maintenance":[25],"or":[26,50],"debugging)":[27],"have":[28,43,57],"been":[29,93],"thoroughly":[30],"studied,":[31],"reverse":[32,39,54,87,127,158,187,228,268],"diverges":[34],"from":[35],"these":[36,112,175,240,253],"as":[38,203,205],"engineers":[40,55,159,188,229],"do":[41],"not":[42],"access":[44],"developers,":[46],"source":[47],"code,":[48],"comments,":[49],"internal":[51],"documentation.":[52],"Further,":[53],"often":[56],"overcome":[59],"countermeasures":[60],"employed":[61],"by":[62],"the":[63,67,97,107,126,148,164,170,178,198,213,267],"developer":[64],"make":[66],"harder":[69],"symbol":[71],"stripping,":[72],"packing,":[73],"obfuscation).":[74],"Significant":[75],"research":[76],"effort":[77],"has":[78,92],"gone":[79],"into":[80],"providing":[81],"analysis":[83,139,263],"tools":[84,113,140],"support":[86,266],"engineers.":[88],"However,":[89],"little":[90],"work":[91],"done":[94],"understand":[96],"way":[98],"they":[99,166,173,243],"think":[100],"analyze":[102],"programs,":[103],"potentially":[104],"leading":[105],"lack":[108],"of":[109,111,151,157,193,219,233],"adoption":[110],"among":[114],"practitioners.":[115],"This":[116],"paper":[117],"reports":[118],"on":[119,190,245],"first":[121],"step":[122],"toward":[123],"better":[124,142],"understanding":[125],"engineer's":[128],"process":[129],"mental":[131],"models":[132],"provides":[134],"directions":[135],"for":[136,221,258],"improving":[137],"fit":[143],"their":[144],"users.":[145],"We":[146],"present":[147],"initial":[149,183],"results":[150],"semi-structured,":[153],"observational":[154],"interview":[155,162],"study":[156],"(n=15).":[160],"Each":[161],"investigated":[163],"questions":[165],"asked":[167],"while":[168],"probing":[169],"program,":[171],"how":[172],"answered":[174],"questions,":[176],"decisions":[179],"made":[180],"throughout.":[181],"Our":[182],"observations":[184],"suggest":[185],"that":[186],"rely":[189,244],"variety":[192],"reference":[194],"points":[195,218],"in":[196],"both":[197],"text":[200],"structure":[202],"well":[204],"its":[206],"dynamic":[207,236],"behavior":[208],"build":[210],"hypotheses":[211],"about":[212],"program's":[214],"function":[215],"identify":[217],"interest":[220],"future":[222],"exploration.":[223],"In":[224],"most":[225],"cases,":[226],"our":[227],"used":[230],"mix":[232],"static":[234],"analysis---mostly":[237],"manually---to":[238],"verify":[239],"hypotheses.":[241],"Throughout,":[242],"intuition":[246],"built":[247],"up":[248],"over":[249],"past":[250],"experience.":[251],"From":[252],"observations,":[254],"we":[255],"provide":[256],"recommendations":[257],"user":[259],"interface":[260],"improvements":[264],"engineer.":[269]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":3},{"year":2023,"cited_by_count":3},{"year":2022,"cited_by_count":1},{"year":2021,"cited_by_count":3},{"year":2020,"cited_by_count":1},{"year":2019,"cited_by_count":1}],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}