Automatic Feature Learning for Predicting Vulnerable Software Components

Effective monitoring of tool wear status can improve productivity and reduce losses. In previous studies, extensive feature selection was required when using the traditional machine learning method. The gating mechanism in the traditional long short-term memory (LSTM) model may incur information loss and a weaker representation of global sequential dependencies in handling long sequences. This paper aims to enhance the performance of the LSTM model in tool wear prediction by combining feature and temporal attention. Firstly, the original vibration signal is divided into sub-sequences and related features extracted. Secondly, the ability to capture global sequential dependencies using the LSTM model is improved by feature and temporal attention. Finally, a fully connected layer is used to predict tool wear values. Compared to traditional LSTM, the proposed method performs best in three evaluation metrics, RMSE, MAE, and the coefficient of determination.

This paper presents a new complexity metric for Object-Oriented (OO) design measurement to find at the design stage whether the classes become more complex, Moderate complex or less complex. The proposed metric is theoretically evaluated against the Weyuker’s properties as well as empirically evaluated against three open source software system. Furthermore, for validating the validity of new complexity metric, the paper has also presented the comparison of proposed metric with some well known complexity metrics like Weighted Method per Class (WMC) metric of Chidamber and Kemerer (CK), Class Complexity (CC) metric of Balasubramanian, and Complexity Metric for OO Design (CMOOD) metric of Rajnish and Bhattacherjee (RB) against the same three open source software system..Automated tool were used to generate the metric values and for analyzing the results, IBM SPSS software used. The results in this paper indicates that the new complexity metric is correlated well with existing complexity metrics and may be used as predictors of complexity of class.

Traffic safety has been thought of as a basic feature of transportation, recent developments in civil aviation have emphasized the need for risk identification and safety prediction. This study aims to increase en-route flight safety through the development of prediction models for flight conflicts. Firstly, flight conflicts time series and traffic parameters are extracted from historical ADS-B data. In the second step, a Long Short-Term Memory (LSTM) model is trained to make a one-step-ahead prediction on the flight conflict time series. The results show that the LSTM model has the greatest prediction effect (MAE 0.3901) with comparison to other models. Based on that, we add traffic parameters (volume, density, velocity) into the LSTM model as new input variables and issue a comprehensive analysis of the relative predictive power of traffic parameters. The accuracy of prediction model is validated with a mean error of less than 3%. Based on the improvements of model performance brought by traffic parameters, LSTM models with a single traffic parameter are proposed for further discussion. The results illustrate that volume is the most important factor in promoting prediction accuracy and density has an advantage of improvement in the aspect of model stability.

Software aging is a phenomenon in which long-running software systems show an increasing failure rate and/or progressive performance degradation. Due to their nature, Aging-Related Bugs (ARBs) are hard to discover during software testing and are also challenging to reproduce. Therefore, automatically predicting ARBs before software release can help developers reduce ARB impact or avoid ARBs. Many bug prediction approaches have been proposed, and most of them show effectiveness in within-project prediction settings. However, due to the low presence and reproducing difficulty of ARBs, it is usually hard to collect sufficient training data to build an accurate prediction model. A recent work proposed a method named Transfer Learning based Aging-related bug Prediction (TLAP) for performing cross-project ARB prediction. Although this method considerably improves cross-project ARB prediction performance, it has been observed that its prediction result is affected by several key factors, such as the normalization methods, kernel functions, and machine learning classifiers. Therefore, this paper presents the first empirical study to examine the impact of these factors on the effectiveness of cross-project ARB prediction in terms of single-factor pattern, bigram pattern, and triplet pattern and validates the results with the Scott-Knott test technique. We find that kernel functions and classifiers are key factors affecting the effectiveness of cross-project ARB prediction, while normalization methods do not show statistical influence. In addition, the order of values in three single-factor patterns is maintained in three bigram patterns and one triplet pattern to a large extent. Similarly, the order of values in the three bigram patterns is also maintained in the triplet pattern.

This study develops a ship propeller diagnostic system to address the issue of insufficient ship maintenance capacity and enhance operational efficiency. It uses the Remaining Useful Life (RUL) prediction technology to establish a sensing platform for ship propellers to capture vibration signals during ship operations. The Diagnosis and RUL Prediction Model is designed to assess bearing aging status and the RUL of the propeller. The synchronized signal reshaping technology is employed in the Diagnosis and RUL Prediction Model to process the original vibration signals as input to the model. The vibration signals obtained are used to analyze the temporal and spectral energy of propeller bearings. Exponential functions are used to generate the health index as model outputs. Model inputs and outputs are simultaneously input into a Long Short-Term Memory (LSTM) model for training, culminating as the Diagnosis and RUL Prediction Model. Compared to Recurrent Neural Network and Support Vector Regression models used in previous studies, the Diagnosis and RUL Prediction Model developed in this study achieves a Mean Squared Error (MSE) of 0.018 and a Mean Absolute Error (MAE) of 0.039, demonstrating outstanding performance in prediction results and computational efficiency. This study integrates the Diagnosis and RUL Prediction Model, bearing aging experimental data, and real-world vibration measurements to develop the diagnosis and RUL prediction system for ship propellers. Experiments with ship propellers show that when the bearing of the propeller enters the worn stage, this diagnostic system for ship propellers can accurately determine the current status of the bearing and its remaining useful life. This study offers a practical solution to insufficient ship maintenance capacity and contributes to improving the operational efficiency of ships.

Regression modelling of software quality: empirical investigation

Software vulnerabilities may lead to crucial security risks in software systems. Thus, prioritization of the vulnerabilities is an important task for security teams, and assessing how severe the vulnerabilities are would help teams during fixing and maintenance activities. We replicated a prior work which aims to predict the severity of software vulnerabilities by grouping vulnerabilities into different severity levels. We follow their approach on feature extraction using word embeddings, and on prediction model using Convolutional Neural Networks (CNNs). In addition, Long Short Term Memory (LSTM) and Extreme Gradient Boosting (XGBoost) models are used. We also extend the replicated work by aiming to predict severity scores rather than levels. We carried out two experiments for predicting severity levels and severity scores of 82,974 vulnerabilities. On predicting the severity levels, our LSTM and CNN models perform similarly with an F1 score of 0.756 F1 score and 0.752, respectively. On predicting the severity scores, LSTM, CNN and XGBoost models perform 16.14%, 17.03%, 18.91% MAPE values, respectively.

Current desktop and server computers run on firmware that is compatible to the UEFI standard[37] and responsible for ini- tializing the hardware and loading a bootloader, e.g. GRUB[8]. The bootloader then prepares the early boot environment and hands control over to the operating system. Modern bootloaders provide many features and functionalities such as interactive scripting languages which results in large code bases – GRUB consists of 300 thousand lines of C/C++ and 64 thousand lines of assembly code. It is not surprising that numerous memory safety violations have been detected in various existing bootloaders[39]. We think many of these issues can be addressed by writing a bootloader in Rust. In this paper we present the design and implementation of tow- boot – a bootloader written in Rust for Multiboot 1 and 2 kernels on UEFI-based x86 / x86_64 systems.

Prediction of software defects works well within projects as long as there is a sufficient amount of data available to train any models. However, this is rarely the case for new software projects and for many companies. So far, only a few have studies focused on transferring prediction models from one project to another. In this paper, we study cross-project defect prediction models on a large scale. For 12 real-world applications, we ran 622 cross-project predictions. Our results indicate that cross-project prediction is a serious challenge, i.e., simply using models from projects in the same domain or with the same process does not lead to accurate predictions. To help software engineers choose models wisely, we identified factors that do influence the success of cross-project predictions. We also derived decision trees that can provide early estimates for precision, recall, and accuracy before a prediction is attempted.

The use of multithreading can enhance the performance of a software system. However, its excessive use can degrade the performance. For example, a thread-per-job approach might lead to a large amount of threads with increased associated overheads. In this paper we explore the use of the Parallelism Viewpoint to support one possible strategy to reduce the number of threads, namely finding candidate threads that can be replaced by thread pooling. Thread pooling reduces the large number of threads by reusing threads from an existing pool. As an example we analyze the threads of a precision critical parallelism-intensive electron microscope software system. Results show that the viewpoint provides a profound insight into the threading structure of the system, which helps in reducing the number of threads in a cost-effective way. And, the total time gain along with such reduction is encouraging. viewpoint to identify potential threads for pooling. The motivation behind using the Parallelism Viewpoint for thread analysis is two-fold. First, architecture level analysis is a proven cost-effective approach that provides an opportunity to find and fix issues up-front in the system development (3). Second, the Parallelism Viewpoint provides an in-depth understanding, not only about the thread behaviour but also about associated concerns and stakeholders. Such understanding is essential while making any change in the thread model. In this paper, we describe with the help of an industrial case how the Parallelism Viewpoint can be used to identify threads that are suitable to be replaced with a thread pool. The case is a large and complex parallelism-intensive software system used for electron microscopes. It is a client- server distributed system whose design follows a component-based architecture. It runs on the Microsoft Windows XP operating system. Because of the heterogeneous nature of the machine, its devices come from multiple domains such as electronics, mechanics and physics. The software is responsible for data acquisition and control of these devices. It has a large code base with multi- million lines of code and employs several hundred threads to perform various microscopy functions. We believe that the performance of the software can be enhanced by reducing the number of threads. This can be achieved by replacing them with a small sized thread pool, provided that accurate threads are selected for such replacement. The remainder of this paper is organized as follows. In the next section we briefly describe the building blocks of Parallelism Viewpoint. We outline the analysis approach in section III and apply it on an industrial case in section IV. Section V contains related work, and finally in section VI we draw conclusions and state our future work.

Eliminating vulnerabilities from low-level code is vital for securing software. Static analysis is a promising approach for discovering vulnerabilities since it can provide developers early feedback on the code they write. But, it presents multiple challenges not the least of which is understanding what makes a bug exploitable and conveying this information to the developer. In this paper, we present the design and implementation of a practical vulnerability assessment framework, called [InlineEquation not available: see fulltext.]. Melange performs data and control flow analysis to diagnose potential security bugs, and outputs well-formatted bug reports that help developers understand and fix security bugs. Based on the intuition that real-world vulnerabilities manifest themselves across multiple parts of a program, Melange performs both local and global analyses in stages. To scale upi?źto large programs, global analysis is demand-driven. Our prototype detects multiple vulnerability classes in C and C++ code including type confusion, and garbage memory reads. We have evaluated Melange extensively. Our case studies show that Melange scales upi?źto large codebases such as Chromium, is easy-to-use, and most importantly, capable of discovering vulnerabilities in real-world code. Our findings indicate that static analysis is a viable reinforcement to the software testing tooli?źset.

Short-term traffic flow prediction plays an important role in intelligent transportation system. Numerous researchers have paid much attention to it in the past decades. However, the performance of traditional traffic flow prediction methods is not satisfactory, for those methods cannot describe the complicated nonlinearity and uncertainty of the traffic flow precisely. Neural networks were used to deal with the issues, but most of them failed to capture the deep features of traffic flow and be sensitive enough to the time-aware traffic flow data. In this paper, we propose a deep bi-directional long short-term memory (DBL) model by introducing long short-term memory (LSTM) recurrent neural network, residual connections, deeply hierarchical networks and bi-directional traffic flow. The proposed model is able to capture the deep features of traffic flow and take full advantage of time-aware traffic flow data. Additionally, we introduce the DBL model, regression layer and dropout training method into a traffic flow prediction architecture. We evaluate the prediction architecture on the dataset from Caltrans Performance Measurement System (PeMS). The experiment results demonstrate that the proposed model for short-term traffic flow prediction obtains high accuracy and generalizes well compared with other models.

Identifying potentially vulnerable locations in a code base is critical as a pre-step for effective vulnerability assessment; i.e., it can greatly help security experts put their time and effort to where it is needed most. Metric-based and pattern-based methods have been presented for identifying vulnerable code. The former relies on machine learning and cannot work well due to the severe imbalance between non-vulnerable and vulnerable code or lack of features to characterize vulnerabilities. The latter needs the prior knowledge of known vulnerabilities and can only identify similar but not new types of vulnerabilities. In this paper, we propose and implement a generic, lightweight and extensible framework, LEOPARD, to identify potentially vulnerable functions through program metrics. LEOPARD requires no prior knowledge about known vulnerabilities. It has two steps by combining two sets of systematically derived metrics. First, it uses complexity metrics to group the functions in a target application into a set of bins. Then, it uses vulnerability metrics to rank the functions in each bin and identifies the top ones as potentially vulnerable. Our experimental results on 11 real-world projects have demonstrated that, LEOPARD can cover 74.0% of vulnerable functions by identifying 20% of functions as vulnerable and outperform machine learning-based and static analysis-based techniques. We further propose three applications of LEOPARD for manual code review and fuzzing, through which we discovered 22 new bugs in real applications like PHP, radare2 and FFmpeg, and eight of them are new vulnerabilities.

Glioblastoma (GBM) is the most common and aggressive primary brain tumour; we aimed to evaluate T2 relaxivity in their follow. Fifty-one newly diagnosed GBM followed at our department after surgery and combined chemo-radiotherapy were included (> 180 days progression-free survival [PFS] as determined by RANO, ≥ 3 MRI examinations in the PFS interval). All data used were prior to progression. T2 relaxation rates (1/T2f) were calculated voxel-wise assuming mono-exponential decay. Whole-brain (WB) values were extracted including skewness, kurtosis, mean, median, 15 and 85 percentile histogram values and variance. We additionally segmented the 1/T2f volumes using a 5 compartment Gaussian mixture model, producing mean, variance and percent per component. To evaluate predictive potential with respect to PFS, we used a deep long short-term memory (LSTM) model in tensorflow (4 timesteps). Twenty subjects were included in the predictive model, as inclusion criteria differed (progression, ≤ 120 days between all MRIs [mean 44.3 days], ≥ 4 PFS MRIs). Two models were tested: a regression model (days to progression) and a classification model (±18 months PFS; models differed in output layer). Both models were run 10 times; mean results are presented. We found WB median 1/T2f correlated with PFS, as values decreased prior to progression. WB median 1/T2f linear regression slopes also differed in progression vs. pseudo-progression. The deep LSTM regression model achieved an R2 of 86%. The deep LSTM classification model achieved a mean macro precision of 85%, recall 84% and F1 accuracy of 84% in classifying progression/no progression at an 18 month cutoff. We found very intriguing results with WB median 1/T2f measurements in distinguishing progression from pseudo-progression, and in suggesting progression despite otherwise unremarkable imaging. A more complex predictive model, using a fully-automated segmentation method followed by deep learning, was very promising. Our results may find utility in the monitoring of GBM patients.

Complexity metrics have been developed for multiple applications such as consumer products, software, trajectory selection and assembly systems. Although existing complexity metrics were developed to reduce product design and development costs, their lack of simplicity in formulation and robustness has limited their applicability. This paper proposes a standard methodology for comparing and evaluating these metrics and introduces dimensions of complexity that should be considered towards the goal of developing a generalizable product complexity measure. To this end, this paper introduces variables that integrate multiple facets of complexity into a single metric. A medical device case study is used to compare the efficiency and robustness of existing complexity measures. The medical device case study also serves as the motivation for the proposed complexity metric due to the complexity of the domain itself and the increasing importance of mitigating healthcare costs. Overall, product complexity metrics can aid medical device development by increasing the understanding about the design and its implications regarding development time and FDA approvals.