In the domain of security, vulnerabilities frequently remain undetected even after their exploitation. In this work, vulnerabilities refer to publicly disclosed flaws documented in Common Vulnerabilities and Exposures (CVE) reports. Establishing a connection between attacks and vulnerabilities is essential for enabling timely incident response, as it provides defenders with immediate, actionable insights. However, manually mapping attacks to CVEs is infeasible, thereby motivating the need for automation. This paper evaluates 14 state-of-the-art (SOTA) sentence transformers for automatically identifying vulnerabilities from textual descriptions of attacks. Our results demonstrate that the multi-qa-mpnet-base-dot-v1 (MMPNet) model achieves superior classification performance when using attack Technique descriptions, with an F 1 -score of 89.0, precision of 84.0, and recall of 94.7. Furthermore, it was observed that, on average, 56% of the vulnerabilities identified by the MMPNet model are also represented within the CVE repository in conjunction with an attack, while 61% of the vulnerabilities detected by the model correspond to those cataloged in the CVE repository. A manual inspection of the results revealed the existence of 275 predicted links that were not documented in the MITRE repositories. Consequently, the automation of linking attack techniques to vulnerabilities not only enhances the detection and response capabilities related to software security incidents but also diminishes the duration during which vulnerabilities remain exploitable, thereby contributing to the development of more secure systems. • Automated vulnerability detection using 14 state-of-the-art sentence transformer models. • multi-qa-mpnet-base-dot-v1 achieves an F1 score of 89.0, outperforming other models (e.g., MiniLM, BERT). • Attack technique information yields the highest accuracy (57.3%) for vulnerability prediction. • 275 missing links between attack techniques and vulnerabilities identified through manual validation. • Open-source code and dataset provided to enable reproducible mapping from attacks to CVEs.

Professional Burnout Syndrome (PBS) among health-care professionals has been considered a threat to both staff well-being and patient safety, especially in a high-stress medical environment. While robotics and AI have been increasingly integrated into healthcare, their impact on PBS has not been explored in detail yet. Therefore, this paper proposes a real-time PBS detection framework for healthcare professionals using emotion recognition. This framework includes a deep learning-based emotion detection system for humanoid companion robots, which then correlates emotional trends with the Circumplex model to identify burnout risk. Our experimental evaluation results across five deep learning architectures, MobileNet, RegNetY, Swin Transformer, ConvNeXt V2, and EVA-02, show a highest accuracy of 74.05% on a public emotion dataset. These results demonstrate the feasibility of integrating such systems into healthcare workflows for early PBS warnings. Also, this work suggests a human-in-the-loop diagnostic model, where robotic emotion detection complements clinical expertise by providing proactive support, strengthening workforce resilience, and maintaining the quality of patient care.

The Internet of Things (IoT) has rapidly evolved, integrating networked intelligence into a web of things, servers, and cloudlets. Although there are various tools and approaches for software testing, the broader field of IoT testing presents unique challenges due to the heterogeneity of devices, large-scale deployments, dynamic environments, and real-time needs. This paper presents our approach to developing a multi-stage testing framework for the IoTempower framework, addressing the challenges of testing a versatile and evolving open-source Internet-of-Things framework used extensively in educational settings and beyond. The framework incorporates compilation testing, integration testing, and system testing with a focus on regression testing. This multi-stage testing approach allows us to validate the framework’s functionality at various granularities, from the correct compilation of individual drivers to the seamless interaction of deployed hardware. This approach aims to proactively identify and prevent regressions, facilitating the integration of new features and enhancements without losing our scope of providing a real hands-on IoT experience in the classroom.

Vulnerabilities in software security can remain undiscovered even after being exploited. Linking attacks to vulnerabilities helps experts identify and respond promptly to the incident. This paper introduces VULDAT, a classification tool using a sentence transformer MPNET to identify system vulnerabilities from attack descriptions. Our model was applied to 100 attack techniques from the ATT&CK repository and 685 issues from the CVE repository. Then, we compare the performance of VULDAT against the other eight state-of-the-art classifiers based on sentence transformers. Our findings indicate that our model achieves the best performance with F1 score of 0.85, Precision of 0.86, and Recall of 0.83. Furthermore, we found 56% of CVE reports vulnerabilities associated with an attack were identified by VULDAT, and 61% of identified vulnerabilities were in the CVE repository.

Nowadays, threat reports from cybersecurity vendors incorporate detailed descriptions of attacks within unstructured text. Knowing vulnerabilities that are related to these reports helps cybersecurity researchers and practitioners understand and adjust to evolving attacks and develop mitigation plans. This paper aims to aid cybersecurity researchers and practitioners in choosing attack extraction methods to enhance the monitoring and sharing of threat intelligence. In this work, we examine five feature extraction methods (TF-IDF, LSI, BERT, MiniLM, RoBERTa) and find that Term Frequency-Inverse Document Frequency (TF-IDF) outperforms the other four methods with a precision of 75% and an F1 score of 64%. The findings offer valuable insights to the cybersecurity community, and our research can aid cybersecurity researchers in evaluating and comparing the effectiveness of upcoming extraction methods.

Context: The pull-based development is a modern way to support distributed software development, helping to produce high-quality software with increased involvement from the software development community. Objectives: We investigate the effect of source code quality on Pull Request (PR) acceptance in different programming languages, looking at the quality flaws that can be more relevant. Method: We mine software repositories to analyze over 40K PRs from 100 open-source projects in five different programming languages: Python, Java, Kotlin, Haskell, and C/C++. The code quality of the individual PRs was evaluated using static code analysis. Quality flaws were inputted into classification models to predict PRs acceptance and evaluate the fitting. Results: There is a low impact of code quality on PRs acceptance. No major quality flaws can be used to predict reliably PRs acceptance. Conclusion: Source code quality plays a marginal role in accepting PRs in the analyzed projects. Additional factors might impact the acceptance of PRs, such as the reputation and popularity of the submitters.

Software quality sits at the core of software engineering as a discipline. Yet, although each university software-engineering and the software-development course covers software quality to some extent, practitioners still lament on graduates’ readiness for practise for this very reason—poor quality of their code. As a result, we have engaged university industrial partners in designing a master-degree Software Quality course that puts the key software quality topics in one place.

Software Reliability Growth Models (SRGMs) are based on underlying assumptions which make them typically more suited for quality evaluation of closed-source projects and their development lifecycles. Their usage in open-source software (OSS) projects is a subject of debate. Although the studies investigating the SRGMs applicability in OSS context do exist, they are limited by the number of models and projects considered which might lead to inconclusive results. In this paper, we present an experimental study of SRGMs applicability to a total of 88 OSS projects, comparing nine SRGMs, looking at the stability of the best models on the whole projects, on releases, on different domains, and according to different projects’ attributes. With the aid of the STRAIT tool, we automated repository mining, data processing, and SRGM analysis for better reproducibility. Overall, we found good applicability of SRGMs to OSS, but with different performance when segmenting the dataset into releases and domains, highlighting the difficulty in generalizing the findings and in the search for one-fits-all models.

Recently, microservices have been examined as a solution for reshaping and improving the flexibility, scalability, and maintainability of critical infrastructure systems. However, microservice systems are also suffering from the presence of a substantial number of potentially vulnerable components that may threaten the protection of critical infrastructures. To address the problem, this paper proposes to leverage the concept of antifragility built in a framework for building self-learning microservice systems that could be strengthened by faults and threats instead of being deteriorated by them. To illustrate the approach, we instantiate the proposed approach of autonomous machine learning through an experimental evaluation on a benchmarking dataset of microservice faults.

The fourth industrial revolution and the digital transformation, commonly known as Industry 4.0, is exponentially progressing in recent years. Connected computers, devices, and intelligent machines communicate with each other and interact with the environment to require only a minimum of human intervention. An important issue in Industry 4.0 is the evaluation of the quality of the process in terms of Key Performance Indicators (KPIs). Monte Carlo simulations can play an important role to improve the estimations. However, there is still a lack of clear workflow to conduct the Monte Carlo simulations to improve such estimations. This paper, therefore, proposes a simulation flow for conducting Monte Carlo methods comparison in Industry 4.0 applications. Based on the simulation flow, we compare Monte Carlo (MC) and Markov Chain Monte Carlo (MCMC) methods on the efficiency KPI of Smart Manufacturing data. The experimental results show the applicability of MC and MCMC with Industry 4.0 data and possible limitations of the two simulation methods.

Smart Grids offer multiple benefits: efficient energy provision, quicker recoveries from failures, etc.Nevertheless, there is risk of data tampering, unsolicited modification of the data of the smart meters.The main aim of this paper is to provide a model for processing the smart meter data that flags any energy consumption level that could be indication of data tampering.The proposed model is time-sensitive, allowing for tracking the energy usage along time, thus making possible the detection of long-lasting abnormal levels of energy consumption.Such model can be integrated in an anomaly detection system and in a semantic web reasoner.

Smart Grids (SG) represent one of the key critical infrastructures. Over time, several ontologies were defined in the SG domain to model aspects such as devices and sensors integration, and prosumers’ communication needs. In this paper, we review the state of the art regarding semantic web reasoning in the domain of SGs. We compare five main ontologies in terms of descriptive statistics (e.g., number of axioms), load time and reasoners runtime performance. Results show that not all the ontologies in the SG domain are readily available, and that some of them might be more appropriate for deployment in devices with limited computational resources.

Anomaly detection plays a significant role in the area of Smart Grids: many algorithms were devised and applied, from intrusion detection to power consumption anomalies identification. In this paper, we focus on detecting anomalies from smart meters power consumption data traces. The goal of this paper is to replicate to a much larger dataset a previously proposed approach by Chou and Telaga (2014) based on ARIMA models. In particular, we investigate different model training approaches and the distribution of anomalies, putting forward several lessons learned. We found the method applicable also to the larger dataset. Fine-tuning the parameters showed that adopting an accumulating window strategy did not bring benefits in terms of RMSE. While a 2s rule seemed too strict for anomaly identification for the dataset.

Data analytics and data science play a significant role in nowadays society. In the context of smart grids, the collection of vast amounts of data has seen the emergence of a plethora of data analysis approaches. In this article, we conduct a systematic mapping study aimed at getting insights about different facets of SG data analysis: application subdomains (e.g., power load control), aspects covered (e.g., forecasting), used techniques (e.g., clustering), tool support, research methods (e.g., experiments/simulations), and replicability/reproducibility of research. The final goal is to provide a view of the current status of research. Overall, we found that each subdomain has its peculiarities in terms of techniques, approaches, and research methodologies applied. Simulations and experiments play a crucial role in many areas. The replicability of studies is limited concerning the provided implemented algorithms, and to a lower extent due to the usage of private datasets.

Big data processing in the Smart Grid context has many large-scale applications that require real-time data analysis (e.g., intrusion and data injection attacks detection, electric device health monitoring).In this paper, we present a big data platform for anomaly detection of power consumption data.The platform is based on an ingestion layer with data densification options, Apache Flink as part of the speed layer and HDFS/KairosDB as data storage layers.We showcase the application of the platform to a scenario of power consumption anomaly detection, benchmarking different alternative frameworks used at the speed layer level (Flink, Storm, Spark).

Transaction processing is a critical aspect of modern software systems. Such criticality increased over the years with the emergence of microservices, calling for appropriate management of transactions across separated application domains, ensuring the whole system can recover and operate in a possible degraded state. The Saga pattern emerged as a way to define compensating actions in the context of long-lived transactions. In this work, we discuss the relation between traditional transaction processing models and the Saga pattern targeting specifically the distributed environment of reactive microservices applications. In this context, we provide a comparison of the current state of transaction support in four Java-based enterprise application frameworks for microservices support: Axon, Eventuate Event Sourcing (ES), Eventuate Tram, and MicroProfile Long Running Actions (LRA).

Reliability is an essential attribute of mission-and safety-critical systems. Software Reliability Growth Models (SRGMs) are regression-based models that use historical failure data to predict the reliability-related parameters. At the moment, there is no dedicated tool available that would be able to cover the whole process of SRGMs data preparation and application from issue repositories, discouraging replications and reuse in other projects. In this paper, we introduce STRAIT, a free and open-source tool for automatic software reliability growth analysis which utilizes data from issue repositories. STRAIT features downloading, filtering and processing of data from provided issue repositories for use in multiple SRGMs, suggesting the best fitting SRGM with multiple data snapshots to consider software evolution. The tool is designed to be highly extensible, in terms of additional issue repositories, SRGMs, and new data filtering and processing options. Quality engineers can use STRAIT for the evaluation of their software systems. The research community can use STRAIT for empirical studies which involve evaluation of new SRGMs or comparison of multiple SRGMs.

Context: Software code reviews are an important part of the development process, leading to better software quality and reduced overall costs. However, finding appropriate code reviewers is a complex and time-consuming task. Goals: In this paper, we propose a large-scale study to compare performance of two main source code reviewer recommendation algorithms (RevFinder and a Naive Bayes-based approach) in identifying the best code reviewers for opened pull requests. Method: We mined data from Github and Gerrit repositories, building a large dataset of 51 projects, with more than 293K pull requests analyzed, 180K owners and 157K reviewers. Results: Based on the large analysis, we can state that i) no model can be generalized as best for all projects, ii) the usage of a different repository (Gerrit, GitHub) can have impact on the the recommendation results, iii) exploiting sub-projects information available in Gerrit can improve the recommendation results.

Context: Lean development has been often proposed as an adaptation to agile for scaling-up to larger contexts.Goals: we wanted to better understand the "agile-to-lean" transformation, in terms of: i) reported benefits, ii) challenges faced, iii) metrics used.Method: we performed a Systematic Literature Review (SLR) about "agile-to-lean" transformations.Results: reduced lead time, improved flow, continuous improvement, and improved defect fix rate were the main reported benefits.Adaptation to lean thinking, teaching the lean mindset, identification of the concept of waste, and scaling flexibility were the main challenges.Lead time was the most reported metric.

Abstract Context:Agile software development has nowadays reached wide adoption. However, moving agile to large‐scale contexts is a complex task with many challenges involved.Objective:In this paper, we review practices, challenges, and success factors for scaling agile both from literature and within a large software company, identifying the most critical factors.Method:We conduct a focused literature review to map the importance of scaling practices, challenges, and success factors. The outcome of this focused literature review is used to guide action research within a software company with a view to scaling agile processes.Results:Company culture, prior agile and lean experience, management support, and value unification were found to be key success factors during the action research process. Resistance to change, an overly aggressive roll‐out time frame, quality assurance concerns, and integration into preexisting nonagile business processes were found to be the critical challenges in the scaling process.Conclusion:The action research process allowed to cross‐fertilize ideas from literature to the company's context. Scaling agile within an organization does not need to follow a specific scheme, rather the process can be tailored to the needs while keeping the core values and principles of agile methodologies.

Context: Software Bug Severity Classification can help to improve the software bug triaging process. However, severity levels present a high-level of data imbalance that needs to be taken into account. Aim: We investigate cost-sensitive strategies in multi-class bug severity classification to counteract data imbalance. Method: We transform datasets from three severity classification papers to a common format, totaling 17 projects. We test different cost sensitive strategies to penalize majority classes. We adopt a Support Vector Machine (SVM) classifier that we also compare to a baseline "majority class" classifier. Results: A model weighting classes based on the inverse of instance frequencies yields a statistically significant improvement (low effect size) over the standard unweighted SVM model in the assembled dataset. Conclusions: Data imbalance should be taken more into consideration in future severity classification research papers.

Smart Grids have nowadays gained wide diffusion and relevance. Due to the complexity of the grid, many Smart Grids laboratories have emerged over the years to provide partially virtualized environments for testing and co-simulation testbeds for the modern grid. However, the costs for setting-up Smart Grids laboratories are substantial, representing a barrier for newcomers and for educational purposes. In this paper, we propose an hardware-in-the-loop (HIL) architectural solution based on Arduino and Raspberry PI boards, supported by the Mosaik framework to simulate different Smart Grids scenarios on a small and cost-effective scale. We highlight the educational benefits that the solution can bring for understanding simulations and HIL in an affordable & effective way in an easy-to-deploy environment.

There is an increasing need to introduce some formof automation within the bug triaging process, so that no time is wasted on the initial assignment of issues. However, there is agap in current research, as most of the studies deal with open source projects, ignoring the industrial context and needs. In this paper, we report our experience in dealing with the automation of the bug triaging process within a research-industry cooperation. After reporting the requirements and needs that were set within the industrial project, we compare the analysis results with those from an open source project used frequently in related research (Firefox). In spite of the fact that the projects have different size and development process, the data distributions are similar and the best models as well. We found out that more easily configurable models (such as SVM+TF -- IDF) are preferred, and that top-x recommendations, number of issues per developers, and online learning can all be relevant factors when dealing with an industrial collaboration.

In recent years, we have been witnessing profound transformation of energy distribution systems fueled by Information and Communication Technologies (ICT), towards the so called Smart Grid. However, while the Smart Grid design strategies have been studied by academia, only anecdotal guidance is provided to the industry with respect to increasing the level of grid intelligence. In this paper, we report on a successful project in assisting the industry in this way, via conducting a large anomaly-detection study on the data of one of the power distribution companies in the Czech Republic. In the study, we move away from the concept of single events identified as anomaly to the concept of collective anomaly, that is itemsets of events that may be anomalous based on their patterns of appearance. This can assist the operators of the distribution system in the transformation of their grid to a smarter grid. By analyzing Smart Meters data streams, we used frequent itemset mining and categorical clustering with clustering silhouette thresholding to detect anomalous behaviour. As the main result, we provided to stakeholders both a visual representation of the candidate anomalies and the identification of the top-10 anomalies for a subset of Smart Meters.

Context. In 2007, Aversano et al. [2] analysed the evolution of JHotDraw, ArgoUML, and Eclipse JDT between years 2000-2005 to understand the role of frequently changed design patterns. Goal. In this paper, we perform a replication of the study on more recent versions to control for artifactual results. In particular, we investigate whether maturity of software versions can affect the original results. Method. We perform a re-analysis of the original data to learn and correctly deploy the tools used for data collection and analysis and to control instrumental threats that typically affect a replication. Results/Conclusions. Findings confirm that patterns change more frequently when they play a crucial role in the software and when in newer releases they support more advanced features.