International Journal of Software Engineering and Knowledge Engineering

During the process of software development, a significant challenge revolves around accurately estimating the associated costs. The primary goal of project managers is to ensure the delivery of a highly trustworthiness product that aligns with the designated budgetary constraints. Nonetheless, the trustworthiness of software hinges upon a range of distinct attributes. When implementing a budget allocation scheme to enhance these attributes, conflicts among them may arise. Thus, it becomes imperative to select an appropriate allocation scheme that effectively mitigates conflict-associated costs. In this paper, we will define the conflict costs and establish costs estimation models. The difficulty coefficient constraint for improving attributes is established. Subsequently, we will analyze the relative importance weights of these attributes. Drawing upon the conflict costs, importance weights, and difficulty coefficient constraint, we present an algorithm to determine an appropriate budget allocation scheme, which can minimize conflict-associated costs. Finally, we provide an illustrative example that demonstrates the practicability of our proposed algorithm. This research offers valuable insights to software managers, aiding them in the reasonable allocation of budgetary resources, thereby maximizing overall benefits.

Defect prediction research has been conducted for more than 40 years, with the goal of estimating the defect-prone blocks of source code. Prior studies, however, had two major limitations: (1) coarse-grained defect prediction results and (2) weak long-term dependencies modeling. As a result, developers need to review the prediction results to figure out which function or even which line of code produced the issue. In this study, we present OdegVul, a novel statement-level defect prediction model, to address these concerns. To capture both semantic and structural relationships between statements, a statement representation framework combining deep learning and graph neural networks is designed. Then the long-term dependencies between statements are encoded as a partial differential equation of a graph neural network. Through the experiment of 32 releases of 9 open-source Java projects, we found that semantic and structural dependencies are crucial to statement-level defect prediction. OdegVul outperforms other state-of-the-art (SOTA) predictors and achieves reasonable performance in cross-project statement-level defect prediction scenarios. The finer granularity of predicting results reduces the developer’s workforce in reviewing the prediction results and increases the practicality of the defect prediction model. The source code of OdegVul is available at https://github.com/CoderYinDaqiang/OdegVul.

Model-based testing provides an effective means for ensuring the quality of Android apps. Nevertheless, existing models that focus on event sequences and abstract them into Finite State Machines (FSMs) may lack precision and determinism because of the different data values of events that can result in various states of Android applications. To address this issue, a novel model based on Extended Finite State Machines (EFSMs) for Android apps is proposed in this paper. The approach leverages machine learning to infer data constraints on events and annotates them on state transitions, leading to a more precise and deterministic model. Additionally, a state abstraction strategy is presented to further refine the model. Besides, test diversity plays a vital role in enhancing test suite effectiveness. To achieve high coverage and fault detection, test cases are generated from the EFSM model with the help of a Genetic Algorithm (GA), guided by test diversity. To evaluate the effectiveness of our approach, this paper carries out experiments on 93 open-source apps. The results show that our approach performs better in code coverage and crash detection than the existing open-source model-based testing tools. Particularly, the 19 unique crashes that involve complex data constraints are detected by our approach.

To avoid costly security patching after software deployment, security-by-design techniques (e.g. threat analysis) are adopted in organizations to find and mitigate security issues before the system is ever implemented. Organizations are ramping up such (heavily manual) activities, but there is a global gap in the security workforce. Favorable performance indicators would result in cost savings for organizations with scarce security experts. However, past empirical studies were inconclusive regarding some performance indicators of threat analysis techniques, thus practitioners have little evidence for choosing the technique to adopt. To address this issue, we replicated a controlled experiment with STRIDE. Our study aimed to measure and compare the performance indicators (productivity and precision) of two STRIDE variants (per-element and per-interaction). Since we made some similar observations to the original study, we conclude that the two approaches are not different enough to make a practical impact. To this end, the choice of which variant to adopt should be informed by the needs of the organization performing threat analysis. We conclude by discussing some of the unexplored yet relevant topic domains in the context of STRIDE that will be considered in future work.

Malware developers often employ code obfuscation techniques to conceal their malicious functionality, making it challenging to detect and analyze such software. While various de-obfuscation techniques exist, the majority of them require prior knowledge of the obfuscation tools and techniques in use. Identifying the specific obfuscation tools or algorithms applied to the obfuscated code is thus of vital importance, which, however, typically demands in-depth expert knowledge and substantial efforts. Therefore, this paper presents DeObA, a deep learning (DL) driven approach for the precise and efficient detection of obfuscation algorithms on the fine-grained function-level code snippets. To comprehensively capture unique patterns or features of different obfuscation algorithms from code, DeObA works on multiple distinct code views, encompassing token sequences, abstract syntax trees (AST) and program dependency graphs (PDG), which will reflect the code’s lexical morphology, syntactic and structural aspects. After individually collecting obfuscation-indicative features with well-matched DL encoder from each code view, a self-attention-based fusion strategy is performed on these features to produce an integrated, dense, yet feature-rich vector. This vector is then fed into a softmax classification layer for prediction. Due to the lack of a moderately sized dataset, a large obfuscation corpus is curated with 7 different obfuscation tools and a total of 12 obfuscation algorithms on 39,070 C/C$++$ functions. The experimental evaluations conducted on the dataset exhibit a distinguished detection performance of DeObA, which achieve accuracy rates of 99.90% and 99.19% on the obfuscation tool detection and obfuscation algorithm detection tasks, respectively. The ablation study also confirms the active role of considering multiple distinct code views and the effectiveness of the designed self-attention-based fusion strategy.

The MPFR and CR-LIBM math libraries are frequently utilized due to their ability to generate correctly rounded results for all double-precision inputs. However, it is worth noting that MPFR has a slower average performance, while CR-LIBM achieves correct rounding over two iterations, rendering it less stable. In addition, CR-LIBM has a poor performance in handling the worst-case of correct rounding. This paper implements a correctly rounded elementary function library called SCR-LIBM in double-precision, which is stable and efficient. Our key idea is to divide subdomains and use the low-degree Taylor polynomial to approximate the elementary function in each subdomain. We simulate the high-precision representation based on the double–double data format, and use the error-free transformation and Double-double algorithm to control the error in the process of polynomial approximation and output compensation. Our approach ensures that the elementary function is correctly rounded, without the need for redundant iterations. The experimental evaluation shows that the average performance of elementary functions implemented in SCR-LIBM is 8.534 times faster than that of MPFR, and 2.492 times faster than that of CR-LIBM when dealing with the worst-case of correct rounding. What’s more, our SCR-LIBM is more stable than CR-LIBM.