Front Cover Caption: The cover image is based on the Research Article Learning to predict test effectiveness by Morteza Zakeri-Nasrabadi and Saeed Parsa https://doi.org/10.1002/int.22722.

The high cost of the test can be dramatically reduced, provided that the coverability as an inherent feature of the code under test is predictable. This article offers a machine learning model to predict the extent to which the test could cover a class in terms of a new metric called Coverageability. The prediction model consists of an ensemble of four regression models. The learning samples consist of feature vectors, where features are source code metrics computed for a class. The samples are labeled by the Coverageability values computed for their corresponding classes. We offer a mathematical model to evaluate test effectiveness in terms of size and coverage of the test suite generated automatically for each class. We extend the size of the feature space by introducing a new approach to define submetrics in terms of existing source code metrics. Using feature importance analysis on the learned prediction models, we sort sources code metrics in the order of their impact on the test effectiveness. As a result of which we found the class strict cyclomatic complexity as the most influential source code metric. Our experiments with our prediction models on a large corpus of Java projects containing about 23,000 classes demonstrate the Mean Absolute Error (MAE) of 0.032, Mean-Squared Error (MSE) of 0.004, and an R2 score of 0.855. Compared with the state-of-the-art coverage prediction models, our models improve MAE, MSE, and an R2 score by 5.78%, 2.84%, and 20.71%, respectively.

Service identification plays a key role in the design of service-oriented systems. There are non-model-based and model-based methods for extracting services from business processes. These methods suggest a set of mostly descriptive solutions that do not pay sufficient attention to service design guidelines and the conceptual relations between tasks. The challenge is to develop an algorithm to automatically identify services from business processes to simplify the analysis and reduce the gap between information technology and business needs. In this paper, we develop a semi-automated service identification method that addresses this gap. This method incorporates the Goal, Data, and Business Process Models (BPM) to identify services based on related tasks, shared data, and business requirements. It advances previous methods by simultaneously considering both semantic and structural relations between tasks which permits better and more accurate identification of services. Moreover, the proposed method considers the principles of service design such as internal cohesion of service methods, loose coupling of services, and reusability of the identified services.

The rapid increase in the number of malicious programs has made malware forensics a daunting task and caused users’ systems to become in danger. Timely identification of malware characteristics including its origin and the malware sample family would significantly limit the potential damage of malware. This is a more profound risk in Cyber-Physical Systems (CPSs), where a malware attack may cause significant physical damage to the infrastructure. Due to limited on-device available memory and processing power in CPS devices, most of the efforts for protecting CPS networks are focused on the edge layer, where the majority of security mechanisms are deployed. Since the majority of advanced and sophisticated malware programs are combining features from different families, these malicious programs are not similar enough to any existing malware family and easily evade binary classifier detection. Therefore, in this article, we propose a novel multilabel fuzzy clustering system for malware attack attribution. Our system is deployed on the edge layer to provide insight into applicable malware threats to the CPS network. We leverage static analysis by utilizing Opcode frequencies as the feature space to classify malware families. We observed that a multilabel classifier does not classify a part of samples. We named this problem the instance coverage problem. To overcome this problem, we developed an ensemble-based multilabel fuzzy classification method to suggest the relevance of a malware instance to the stricken families. This classifier identified samples of VirusShare, RansomwareTracker, and BIG2015 with an accuracy of 94.66%, 94.26%, and 97.56%, respectively.

Most malware producers bypass signature‐based detections through obfuscation techniques. Therefore, in order to provide proactive and real‐time protection, the researchers have begun to develop strategies for behaviour‐based detection. Despite of being a popular and promising non‐deterministic solution to detect various forms of malware families, behavioural modelling techniques suffer from relatively high false positive rate in malware detection. To overcome this problem, the authors shall seek for identifying patterns, representing malicious intent in all instances of a malware family. In this study, they propose a new technique based on discriminative graph mining techniques to identify discriminative subgraphs. The subgraphs represent behavioural patterns in each malware family. Their evaluation results demonstrate an average of 91% accuracy in detection of malicious programme behaviours, with no false positive.

In this paper, a novel business process engineering method based on quality assessment is proposed. In the proposed method, a goal model is used to estimate the operational costs of business processes. Goals scenarios in the goal model of desired information systems are applied as a basis for estimating the design cost. Qualities of business requirements models and business process models are also estimated. Based on the quality metrics, the process of business process modeling is examined. Then, using XOR operator in the goal model, a simple and direct mapping of the goal model to the business process model is introduced. Common activities in the business process model are further factored and summarized using pre- and post-factoring operations. The proposed business process modeling method is language-independent. An ICT office in Mazandaran Power Distribution Company is used as a case study to exemplify QABPEM. Our evaluation results demonstrates the capability of the proposed method compared with the existing ones.

In this paper, a Model Driven Architecture (MDA) approach is applied to Semi-automatically translate sequential programs into corresponding distributed code. The novelty of our work is the use of MDA in the process of translating serial into distributed code. The transformation comprises automatic generation of platform independent and then platform specific models from the sequential code. In order to generate the PIM, a meta-model defining the overall architecture of the resultant distributed code is developed. The meta-model is used as a basis for the development of platform independent models (PIM) for the resultant distributed code. A set of transformation rules are defined to transform the resulted PIM into a corresponding platform-specific model. These transformation rules can be modified by the user, depending on the details of the underlying middle-ware applied for the distribution. The platform independent model provides a better understanding of the distributed code and helps the programmer to modify the code more easily.

Despite the emphasis on removing gap between software models and implementation code, there has been made little effort to apply software tools to enforce access control models directly into program code. In this paper the design and implementation of an access control policy enforcement environment is described. Within this environment, view-based access control policies defined in XML Metadata Interchange format are translated into view policy language. The view policy language primitives are then easily translated into Java primitives. At last, these primitives are enforced into Java program code to be secured. Two major benefits of applying the proposed approach for modeling and enforcement of access control policies are rapid development of view-based customized applications and secure enforcement of ordered chain of methods' executions.

Doing changes and adding new requirement to existing software systems, turns their primary architecture and force a huge expenditure. It is time and cost consummating. Today for preventing this problem, the method of reengineering is used. One of most known and common kind of reengineering is comparing current architecture with primary architecture or another known suitable sample. The described method in this paper is comparing Globus software architecture with implemented systems under grid. This comparison first reveals the developed software systems weaknesses and then explains incorrect usage of Globus pieces. Finally using the offered implemented sample in this paper, success level of reverse engineering to find problems in developed systems is identified and the offered method will be tested as well.