In modern software systems, early and accurate vulnerability detection is crucial. Traditional Static Analysis Tools (SATs) highlight potential security issues, providing fine-grained information including lines of code and vulnerability categories; however, they are hindered by a large number of false alarms. On the other hand, Artificial Intelligence (AI)-based Vulnerability Prediction (VP) has emerged as a promising alternative for vulnerability identification in software products. Nevertheless, current VP methods face important limitations, such as the granularity level of the predictions, since VP is commonly conducted at the file or function level. In this study, we examine whether the utilization of AI-based vulnerability prediction as a filtering mechanism for static analysis alerts could reduce the number of false alarms, leading to more practical Static Application Security Testing (SAST). The results of the analysis show that this approach improves the practicality of static analysis, reducing false positives, with the impact on the detection accuracy being small.

The rise of Large Language Models (LLMs) has provided new directions for addressing downstream text classification tasks, such as vulnerability prediction, where segments of the source code are classified as vulnerable or not. Several recent studies have employed transfer learning in order to enhance vulnerability prediction taking advantage of the prior knowledge of the pre-trained LLMs. In the current study, different Transformer-based pre-trained LLMs are examined and evaluated with respect to their capacity to predict vulnerable software components. In particular, we fine-tune BERT, GPT-2, and T5 models, as well as their code-oriented variants namely CodeBERT, CodeGPT, and CodeT5 respectively. Subsequently, we assess their performance and we conduct an empirical comparison between them to identify the models that are the most accurate ones in vulnerability prediction.

Vulnerability prediction is an important mechanism for secure software development, as it enables the early identification and mitigation of software vulnerabilities. Vulnerability Prediction Models (VPMs) are Machine Learning (ML) models able to detect potentially vulnerable software components based on information retrieved from their source code. Despite the notable advancements in the field of vulnerability prediction, especially with the utilization of Deep Learning (DL) and text mining techniques, current literature still lacks a highly accurate, reliable, and practical VPM. Recently, the Large Language Models (LLMs), which have demonstrated remarkable capabilities in text understanding and processing, have started being utilized for vulnerability prediction, demonstrating highly promising results. The purpose of the present paper is to explore the utilization of LLMs in the field of vulnerability detection, identify challenges and open issues that still need to be addressed, and potentially propose directions for future research. Our analysis suggests that while LLM-based VPMs have outperformed traditional DL approaches in vulnerability prediction, significant challenges still need to be addressed to be considered sufficiently accurate, reliable, and practical.

Abstract Monitoring technical debt (TD) is considered highly important for software companies, as it provides valuable information on the effort required to repay TD and in turn maintain the system. When it comes to TD repayment, however, developers are often overwhelmed with a large volume of TD liabilities that they need to fix, rendering the procedure effort demanding. Hence, prioritizing TD liabilities is of utmost importance for effective TD repayment. Existing approaches rely on the current TD state of the system; however, prioritization would be more efficient by also considering its future evolution. To this end, the present work proposes a practical approach for prioritization of TD liabilities by incorporating information retrieved from TD forecasting techniques, emphasizing on the class‐level granularity to provide highly actionable results. Specifically, the proposed approach considers the change proneness and forecasted TD evolution of software artifacts and combines it with proper visualization techniques, to enable the early identification of classes that are more likely to become unmaintainable. To demonstrate and evaluate the approach, an empirical study is conducted on six real‐world applications. The proposed approach is expected to facilitate developers better plan refactoring activities, in order to manage TD promptly and avoid unforeseen situations long term.

The evolution of cyberattacks has been significantly impacted by the rise of Artificial Intelligence (AI). In particular, AI-driven attacks leverage Machine Learning (ML) and Deep Learning (DL) methods to automate tasks like identifying vulnerabilities, crafting convincing phishing emails, and evading conventional security measures. These cyberattacks can adapt in real time, making them more elusive and challenging to detect. Furthermore, AI has enabled the development of AI-powered malware that can learn and evolve, making it even more dangerous. As AI continues to evolve, both attackers and defenders are engaged in a relentless arms race, with cybersecurity professionals striving to harness AI for threat detection and response while cybercriminals seek to exploit AI’s capabilities for their malicious purposes. This ongoing battle underscores the need for proactive and adaptive cybersecurity strategies to mitigate the evolving threats posed by AI-driven cyberattacks. Based on the aforementioned remarks, it is evident that efficient and adaptable countermeasures are necessary. In this paper, we focus our attention on Cyber Threat Intelligence (CTI) mechanisms. CTI is the process of collecting, analysing, and sharing information about potential cybersecurity threats to help organisations proactively defend against cyberattacks. In particular, after providing an overview of the CTI use cases, a brief analysis of existing solutions follows, highlighting the current trends and directions for future work in this research field.

Developing modern secure and low-energy applications in a short time imposes new challenges and creates the need of designing new software tools to assist developers in all phases of application development. The design of such tools cannot be considered a trivial task, as they should be able to provide optimization of multiple quality requirements. In this paper, we introduce the SDK4ED platform, which incorporates advanced methods and tools for measuring and optimizing maintainability, dependability and energy. The presented solution offers a com-plete tool-flow for providing indicators and optimization meth-ods with emphasis on embedded software. Effective forecasting models and decision-making solutions are also implemented to improve the quality of the software, respecting the constraints imposed on maintenance standards, energy consumption limits and security vulnerabilities. The use of the SDK4ED platform is demonstrated in a healthcare embedded application.

We study programs which operate in the presence of possible failures and which must be restarted from the beginning after each failure. In such systems checkpointsare introduced to reduce the large costs of program restarts when failures occur. Here we suggest that checkpoints should be introduced in a manner which assures effective reliability, while reducing both the computational overhead as much as possible, but also to save energy. We compute the total average program execution time in the presence of checkoints so as to limit the re-execution time of the program from the most recent checkpoint. We also study the total energy cnsumption of the program under the same conditions, and formulate an optimization problem to minimize a wighted sum of both average computation time and energy. This approach is placed in the context of Application Level Checkpointing and Restart (ALCR). We then focus on checkpoints placed at the beginning of a loop, and derive the optimum placement of checkpoints to minimize a weighted combination of the program's execution time and energy consumption. Numerical results are presented to illustrate the analysis. Finally we describe a software tool with a graphical interface that has been designed to assist a system designer in choosing the optimum checkpoint for a given program as a function of different failure rates and other parameters.