We propose Contextual History for Adaptive and Simple Exploitation (CHASE), a novel multi-turn method for Large Language Model (LLM) jailbreaking. Rather than directly attack an LLM that may be difficult to jailbreak, CHASE first collects jailbroken histories from an easy-to-jailbreak LLM and then transfers them to the target LLM. Through this history transfer process, CHASE misleads the target LLM into thinking that it is responsible for producing the jailbroken histories and increases the chances of successful jailbreaking by prompting it to continue the conversation. Extensive evaluations on mainstream LLMs show that CHASE consistently achieves higher attack success rates and demands fewer computational resources compared to existing methods.

In an era where mobile devices are ubiquitous, digital distribution platforms such as the Google Play Store have become integral to our daily lives, hosting millions of applications and serving billions of users. Users can leave reviews to provide developers with valuable feedback, including requests for new features and reports of issues. These user reviews play a crucial role in software development, testing, and maintenance by informing developers about user needs and potential problems, which motivates us to revisit a key problem: given user reviews, how can we automatically identify the relevant code snippets from software codebases to assist developers in addressing the reviews? Existing practices to address this problem typically involve calculating the similarity between user reviews and code snippets. However, we identify three key limitations. First, although existing methods show promising results on individual projects, their high performance cannot be generalized across projects. Second, the state-of-the-art approach models the problem as a one-to-one relationship between a user review and code snippets, ignoring the one-to-many relationship that often exists. Third, the state-of-the-art approach focuses solely on the direct relationship between reviews and code snippets, overlooking the interconnections among code snippets themselves, which contain valuable information that can aid in accurately identifying relevant code. To address these limitations and advance the state of the art, we propose YourCoLo , a novel approach that fully leverages contextual information, one-to-many relationships, and inter-code connections. Specifically, YourCoLo is powered by three novel designs: (1) a prompt-enhanced mechanism to incorporate rich project-level context into code localization, (2) a new loss function designed to handle the one-to-many relationships between user reviews and multiple relevant code snippets, and (3) a ranking strategy that considers interconnections among related code snippets. Our experimental evaluation shows that YourCoLo substantially outperforms state-of-the-art models, surpassing CodeBERT, CodeLlama, and GraphCodeBERT by 18.3, 9.3, and 7.7 percentage points at the method level and by 18.4, 7.7, and 7.0 percentage points at the file level (in terms of mean reciprocal rank). In addition, YourCoLo also achieves improvements of 8.8 percentage points and 6.8 percentage points in mean average precision (MAP) at the method and file levels, respectively, compared to the state-of-the-art method. These results underscore YourCoLo ’s effectiveness and its potential to guide developers more accurately toward the code snippets most pertinent to user feedback.

Self-Admitted Technical Debt (SATD) refers to sub-optimal solutions deliberately introduced to accelerate the software development process, often at the expense of software maintainability and sustainability. Therefore, timely identification and repayment of the SATD is critical for the software system. As exploration deepens, it is found that effectively prioritizing the repayment of SATD with more significant impacts on software quality requires not only identifying SATD but also further classifying it. However, existing SATD identification and classification approaches face the following challenges: (1) SATDs originate from diverse sources. Code comments are a widespread source, but recent research has revealed that SATDs can originate from other sources, such as pull requests, issues, and commit messages. Nonetheless, existing approaches primarily target code comments, lacking the capability to analyze SATDs from other sources effectively. (2) SATDs fall into diverse categories. Nonetheless, existing SATD classification approaches fail to address all SATD categories comprehensively and show inadequate performance. (3) Imbalance of existing SATD datasets. Real-world SATD data are scarce, making dataset collection challenging. Moreover, SATD distribution across different sources is uneven, further complicating the construction of high-quality datasets. To alleviate these challenges, this article presents an SATD identification and classification framework named IMPACT . First, IMPACT employs ChatGPT to construct an augmented dataset. Subsequently, it utilizes a pipeline with two fine-tuned language models of different parameter sizes to identify and classify SATD separately. To evaluate the effectiveness of IMPACT, we compare it with three state-of-the-art SATD classification methods and its two foundation models. Experimental results demonstrate that IMPACT outperforms state-of-the-art methods by a large margin, and even surpasses its foundation model GLM-4-9B-Chat. It achieves the optimal average F1 score of 0.697 on the source of pull requests, the most challenging data source. Moreover, experiments on the cross-project test set show that IMPACT demonstrates strong generalizability on unseen project data.

The performance of Large Language Models degrades substantially when generating code for low-resource programming languages. While Retrieval-Augmented Generation (RAG) offers a solution, applying it to this domain presents unique challenges in knowledge retrieval and integration. To address this, we introduce PEARL, a novel framework for lowresource languages. PEARL constructs high-quality knowledge databases and employs a distillation method to train a retriever using the LLM’s own preferences, bypassing the need for manual annotation. By effectively integrating this external knowledge, PEARL improves performance of LLMs on lowresource programming languages. In evaluations across five low-resource languages, PEARL outperformed RAG baselines, increasing average Pass@1 by 22% on LLaMA-3.1-8B-Instruct and 10% on DeepSeek-Coder-6.7B-Instruct.

ABSTRACT Users of software applications use issue tracking systems (ITSs) to file enhancement reports, which leads to a large quantity of user requests. These reports play a pivotal role in shaping software requirements and continuous product improvement. However, the manual evaluation of these reports by developers and maintainers can be a time‐consuming and labor‐intensive process due to the constant influx of enhancement requests. Timely handling and implementation of these enhancement reports are crucial for enhancing user satisfaction and product competitiveness. In response to this challenge, research has concentrated on automated methods to predict which enhancement reports are likely to gain approval, aiming to maximize the value extracted from user feedback. Nevertheless, existing approaches still fall short in delivering practical results. In this paper, we introduce a novel creator profile‐based approach designed to uncover the dependency between creators' identity and the value of enhancement reports, ultimately enhancing prediction accuracy. Firstly, we present the concept of a “creator profile” and outline a comprehensive methodology for generating creator profiles from the dataset. We then demonstrate how creator profiles can be effectively applied to the task of predicting the approval of enhancement reports. Subsequently, we assess the performance of our approach using a dataset of 40,551 enhancement reports collected from ITSs. The experimental results indicate a substantial improvement over the existing state of the art, particularly in predicting approved reports. For cross‐application prediction, the accuracy reaches 80.7%, while for non–cross‐application prediction, the overall accuracy is 83.6%. In essence, with the proposed approach, over 80% of user requests can be automatically identified for exacting valuable user requirements, which significantly reduces labor costs. The replication package is available at https://github.com/feifeiniu‐se/approval_prediction .

With the development of large-scale artificial intelligence services, edge devices are becoming essential providers of data and computing power. However, these edge devices are not immune to malicious attacks. Federated learning (FL), while protecting privacy of decentralized data through secure aggregation, struggles to trace adversaries and lacks optimization for heterogeneity. We discover that FL augmented with Differentiable Architecture Search (DARTS) can improve resilience against backdoor attacks while compatible with secure aggregation. Based on this, we propose a federated neural architecture search (NAS) framwork named SLNAS. The architecture of SLNAS is built on three pivotal components: a server-side search space generation method that employs an evolutionary algorithm with dual encodings, a federated NAS process based on DARTS, and client-side architecture tuning that utilizes Gumbel softmax combined with knowledge distillation. To validate robustness, we adapt a framework that includes backdoor attacks based on trigger optimization, data poisoning, and model poisoning, targeting both model weights and architecture parameters. Extensive experiments demonstrate that SLNAS not only effectively counters advanced backdoor attacks but also handles heterogeneity, outperforming defense baselines across a wide range of backdoor attack scenarios.

Background . Code search aims to find the most relevant code snippet in a large codebase based on a given natural language query. An accurate code search engine can increase code reuse and improve programming efficiency. The focus of code search is how to represent the semantic similarity of code and query. With the development of code pre-trained models, the pattern of using numeric feature vectors (embeddings) to represent code semantics and using vector distance to represent semantic similarity has replaced traditional string matching methods. The quality of semantic representations is critical to the effectiveness of downstream tasks such as code search. Currently, the state-of-the-art (SOTA) learning method uses the contrastive learning paradigm. The objective of contrastive learning is to maximize the similarity between matching code and query (positive samples) and minimize the similarity between mismatched pairs (negative samples). To increase the reusing of negative samples, prior contrastive learning approaches use a large queue (memory bank) to store embeddings. Problem . However, there is still a lot of room for improvement in using negative examples for code search: ① Due to the random selection of negative samples, semantic representations learned by existing models cannot distinguish similar codes well. ② Since semantic vectors in the memory bank are reused from previous inference results and then directly used for loss function calculation without gradient descent, the model cannot effectively learn the negative sample semantic information. Method . To solve the above problems, we propose a contrastive learning code search model with hard negative mining called CoCoHaNeRe: ❶ To enable the model to distinguish similar codes, we introduce hard negative examples into contrastive training, which are negative examples in the codebase that are most similar to positive examples. As a result, hard negative examples are most likely to make the model make mistakes. ❷ To improve the learning efficiency of negative samples during training, we add all hard negative examples to the model's gradient descent process. Result . To verify the effectiveness of CoCoHaNeRe, we conducted experiments on large code search datasets with six programming languages, as well as similar retrieval tasks code clone detection and code question answering. Experimental results show that our model achieves SOTA performance. In the code search task, the average MRR score of CoCoHaNeRe exceeds CodeBERT, GraphCodeBERT, and UniXcoder by 11.25%, 8.13%, and 7.38%, respectively. It has also made great progress in code clone detection and code question answering. In addition, our method performs well in different programming languages and code pre-training models. Furthermore, qualitative analysis shows that our model effectively distinguishes high-order semantic differences between similar codes.

Most automated program repair methods rely on test cases to determine the correctness of the generated patches. However, due to the incompleteness of available test suites, some patches that pass all the test cases may still be incorrect. This issue is known as the patch overfitting problem. Overfitting problem is a longstanding problem in automated program repair. Due to overfitting patches, the patches obtained by automated program repair tools require further validation to determine their correctness. Researchers have proposed many methods to automatically assess the correctness of patches, but no systematic review provides a detailed introduction to this problem, the existing solutions, and the challenges. To address this deficiency, we systematically review the existing approaches to patch correctness assessment. We first offer a few examples of overfitting patches to acquire a more detailed understanding of this problem. We then propose a comprehensive categorization of publicly available techniques and datasets, examine the commonly used evaluation metrics, and perform an in-depth analysis of the effectiveness of the existing models in addressing the challenge of overfitting. Based on our analysis, we provided the difficulties encountered by current methodologies, alongside the possible avenues for future research exploration.

In recent years, pre-trained language models have seen significant success in natural language processing and have been increasingly applied to code-related tasks. Code intelligence tasks have shown promising performance with the support of code pre-trained language models. Pre-processing code simplification methods have been introduced to prune code tokens from the model’s input while maintaining task effectiveness. These methods improve the efficiency of code intelligence tasks while reducing computational costs. Post-prediction code simplification methods provide explanations for code intelligence task outcomes, enhancing the reliability and interpretability of model predictions. However, comprehensive evaluations of these methods across diverse code pre-trained model architectures and code intelligence tasks are lacking. To assess the effectiveness of code simplification methods, we conduct an empirical study integrating these code simplification methods with various pre-trained code models across multiple code intelligence tasks. Our empirical findings suggest that developing task-specific code simplification methods would be beneficial. Then, we recommend leveraging post-prediction methods to summarize prior knowledge, which can pre-process code simplification strategies. Moreover, establishing more evaluation mechanisms for code simplification is crucial. Finally, we propose incorporating code simplification methods into the pre-training phase of code pre-trained models to enhance their program comprehension and code representation capabilities.

Recent years have seen a rise in Neural Program Repair (NPR) systems in the software engineering community, which adopt advanced deep learning techniques to automatically fix bugs. Having a comprehensive understanding of existing systems can facilitate new improvements in this area and provide practical instructions for users. However, we observe two potential weaknesses in the current evaluation of NPR systems: ① published systems are trained with varying data, and ② NPR systems are roughly evaluated through the number of totally fixed bugs. Questions such as what types of bugs are repairable for current systems cannot be answered yet. Consequently, researchers cannot make target improvements in this area and users have no idea of the real affair of existing systems. In this article, we perform a systematic evaluation of the existing nine state-of-the-art NPR systems. To perform a fair and detailed comparison, we (1) build a new benchmark and framework that supports training and validating the nine systems with unified data and (2) evaluate re-trained systems with detailed performance analysis, especially on the effectiveness and the efficiency. We believe our benchmark tool and evaluation results could offer practitioners the real affairs of current NPR systems and the implications of further facilitating the improvements of NPR.

The Masked Language Modeling (MLM) task is widely recognized as one of the most effective pre-training tasks and currently derives many variants in the Software Engineering (SE) field. However, most of these variants mainly focus on code representation without distinguishing between different code token types, while some focus on a specific type, such as code identifiers. Indeed, various code token types exist, and there is no evidence that only identifiers can improve PTMs. Thus, to improve PTMs through different types, we conducted an extensive study to evaluate how different type-specific masking tasks can affect PTMs. First, we extract five code token types, convert them into type-specific masking tasks, and generate their combinations. Second, we pre-train CodeBERT and PLBART using combinations and fine-tuned them on four SE downstream tasks. Experimental results show that type-specific masking tasks can enhance CodeBERT and PLBART on all downstream tasks. Furthermore, we discuss topics related to low-resource datasets, conflicting PTMs that original pre-training tasks conflict with our methods, the cost and performance of our methods, factors that impact the performance of our methods, and applying our methods on state-of-the-art PTMs. These discussions comprehensively analyze the strengths and weaknesses of different type-specific masking tasks.

Pre-trained models (PTMs) have succeeded in various software engineering (SE) tasks following the “pre-train then fine-tune” paradigm. As fully fine-tuning all parameters of PTMs can be computationally expensive, a potential solution is parameter-efficient fine-tuning (PEFT), which freezes PTMs while introducing extra parameters. Although PEFT methods have been applied to SE tasks, researchers often focus on specific scenarios and lack a comprehensive comparison of PTMs from different aspects such as field, size, and architecture. To fill this gap, we have conducted an empirical study on six PEFT methods, eight PTMs, and four SE tasks. The experimental results reveal several noteworthy findings. For example, model architecture has little impact on PTM performance when using PEFT methods. Additionally, we provide a comprehensive discussion of PEFT methods from three perspectives. First, we analyze the effectiveness and efficiency of PEFT methods. Second, we explore the impact of the scaling factor hyperparameter. Finally, we investigate the application of PEFT methods on the latest open source large language model, Llama 3.2. These findings provide valuable insights to guide future researchers in effectively applying PEFT methods to SE tasks.

With the rapid expansion of mobile internet usage, the prevalence of the Android operating system on smartphones is steadily growing. However, improper utilization of the Intent mechanism within Android applications can result in security vulnerabilities. Presently, the majority of Android security testing methods, which rely heavily on fuzzing, are predominantly focused on UI interactions, lacking sufficient testing capabilities for Intents. The motivation of this paper is to find a more effective testing method to improve the security detection capabilities of Intents. This paper introduces an Intent fuzzing method based on genetic mutation principles. Initially, we establish an Intent seed library using a text classification model, followed by employing Jaccard distance and minimum edit distance to refine high-quality seeds. Subsequently, we augment the seeds through extensive mutation using genetic algorithms, generating numerous test cases that exhibit structural similarity but contain varied content. During testing, we compare the state before and after Intent testing using image similarity to detect anomalies. Experimental results demonstrate that this method effectively enhances test coverage and identifies potential issues in edge cases. This approach offers an efficient means of conducting Intent security testing and enhances Android app robustness and security.

Digital forensics is a security research field that has evolved with the advancement of digital technologies, such as computer and network technology. With the emergence of complex forensic environments, such as those found in the IoT and cloud computing, investigators are required to possess higher technical capabilities and knowledge. Completing digital forensics tasks more effectively has become a challenge. Therefore, this paper proposes a blockchain-based collaborative crowdsourcing platform for digital forensics. Through collaborating on the crowdsourcing platform, professional investigators can enhance the supervision of the digital forensics process, reduce the difficulty of digital forensics tasks, and improve their quality. In addition, we introduce blockchain technology to maintain the credibility of the investigation process. We have developed a smart contract and conducted experiments based on Ethereum. The experimental results show that our solution is feasible.

While the majority of existing pre-trained models from code learn source code features such as code tokens and abstract syntax trees, there are some other works that focus on learning from compiler intermediate representations (IRs). Existing IR-based models typically utilize IR features such as instructions, control and data flow graphs (CDFGs), call graphs, etc. However, these methods confuse variable nodes and instruction nodes in a CDFG and fail to distinguish different types of flows, and the neural networks they use fail to capture long-distance dependencies and have over-smoothing and over-squashing problems. To address these weaknesses, we propose FAIR, a Flow type-Aware pre-trained model for IR that involves employing (1) a novel input representation of IR programs; (2) Graph Transformer to address over-smoothing, over-squashing and long-dependencies problems; and (3) five pre-training tasks that we specifically propose to enable FAIR to learn the semantics of IR tokens, flow type information, and the overall representation of IR. Experimental results show that FAIR can achieve state-of-the-art results on four code-related downstream tasks.

To date, over 40 Automated Program Repair (APR) tools have been designed with varying bug-fixing strategies, which have been demonstrated to have complementary performance in terms of being effective for different bug classes. Intuitively, it should be feasible to improve the overall bug-fixing performance of APR via assembling existing tools. Unfortunately, simply invoking all available APR tools for a given bug can result in unacceptable costs on APR execution as well as on patch validation (via expensive testing). Therefore, while assembling existing tools is appealing, it requires an efficient strategy to reconcile the need to fix more bugs and the requirements for practicality. In light of this problem, we propose a Preference-based Ensemble Program Repair framework (P-EPR), which seeks to effectively rank APR tools for repairing different bugs. P-EPR is the first non-learning-based APR ensemble method that is novel in its exploitation of repair patterns as a major source of knowledge for ranking APR tools and its reliance on a dynamic update strategy that enables it to immediately exploit and benefit from newly derived repair results. Experimental results show that P-EPR outperforms existing strategies significantly both in flexibility and effectiveness.

With the rapid development of pre-trained source code models, code search has made fundamental advances. However, a thorough evaluation of the effectiveness of academic code search models in addressing the need of the industry is overlooked. We propose to conduct a ground-breaking evaluation of existing code search models w.r.t. their adaptability, scalability, robustness, and semantic sensitivity. First, we evaluate the influence of the queries’ semantic attributes on searching performance extensively, and design strategies to reduce the impact of the incomplete semantics. Then, we use variants of queries to test the model’s adaptability and robustness. Next, we classify queries to different search purposes to determine the cross-type searching applicability of the models. Finally, we measure the effects of multilingual efficient fine-tuning on the model performance, and provide a reliable way to reduce the costs of developing and deploying code search systems for the industry. These contribute well to narrowing the gap between academic progress and industry requirements of code search.

Code changes are crucial because all code repositories can be viewed as composed of a series of code changes. Recent works on code changes prefer to use pre-trained models (PTMs) to capture the code change representations and have achieved remarkable success. However, these works usually compromise the original code representations of PTMs and ignore the relation of different code-change-related tasks. To boost the existing solutions to code-change-related tasks, we propose a new two-stage Code Change representation learning method using AdapterFusion, which is called CCAF. The first stage is knowledge extraction, where we freeze the parameters of the PTM and fine-tune additional parameters known as adapters. Each adapter acquires knowledge from a specific code-change-related task. The second stage, knowledge composition, employs AdapterFusion to compose the knowledge from all adapters, enhancing the PTM’s performance on a specific code-change-related task. To assess the effectiveness of CCAF, we employ CodeT5 as the base PTM, with its parameters frozen, and apply CCAF to three code-change-related tasks: commit message generation, automated patch correctness assessment, and just-in-time defect prediction. The experimental results indicate that CCAF not only outperforms a fully fine-tuned CodeT5 but also performs comparably to the state-of-the-art method, CCRep.

Abstract In the formal procedure of Chinese civil cases, the textual materials provided by different parties describe the development process of the cases. It is a difficult but necessary task to extract the key information for the cases from these textual materials and to clarify the dispute focus of related parties. Currently, officers read the materials manually and use methods, such as keyword searching and regular matching, to get the target information. These approaches are time‐consuming and heavily depend on prior knowledge and the carefulness of the officers. To assist the officers in enhancing working efficiency and accuracy, we conduct a case study of detecting disputes from Chinese divorce cases based on proposing a Two‐Round‐Labeling (TRL) event extracting technique in this article. We implement the Judicial Intelligent Assistant (JIA) system according to the proposed approach to (1) automatically extract focus events from divorce case materials, (2) align events by identifying co‐reference among them, and (3) detect conflicts among events brought by the plaintiff and the defendant. With the JIA system, it is convenient for judges to determine the disputed issues in Chinese divorce cases. Experimental results demonstrate that the proposed approach and system can obtain the focus of Chinese divorce cases and detect conflicts more effectively and efficiently compared with the existing method.

Sketching is a common way to depict design ideas freely. Augmented reality technology extends the human–computer interaction space from the screen to the real world, providing a new application space for 3D sketching. However, due to the difficulty of depth perception, it is difficult for sketching strokes to maintain good planar and spatial consistency, making drawing 3D sketches in AR challenging. In this article, we propose FMASketch—a method of drawing mid-air sketches similar to building blocks. The auxiliary surfaces can ensure that the strokes drawn by users can always stay on the same plane as drawing in 2D space. Gestures are used to stitch together multiple drawing planes, and the strokes on the planes form a 3D sketch, which is very similar to how 3D modeling is done on the desktop by drawing different views and assembling them. Experiments have verified the effectiveness of the auxiliary surface generation method and gesture operations in this article. The mid-air sketching method is easy to learn and provides a new idea for rapid modeling in AR scenarios.

Abstract Due to the high cost of repairing defective programs, many researches focus on automatic program repair (APR). In recent years, the new trend of APR is to apply neural networks to mine the relations between defective programs and corresponding patches automatically, which is known as neural program repair (NPR). The community, however, ignores some important properties that could impact the applicability of NPR systems, such as robustness. For semantic‐identical buggy programs, NPR systems may produce totally different patches. In this paper, we propose an evaluation tool named RobustNPR, the first NPR robustness evaluation tool. RobustNPR employs several mutators to generate semantic‐identical mutants of defective programs. For an original defective program and its mutant, it checks two aspects of NPR: (a) Can NPR fix mutants when it can fix the original defective program? and (b) can NPR generate semantic‐identical patches for the original program and the mutant? Then, we evaluate four SOTA NPR models and analyze the results. From the results, we find that even for the best‐performing model, 20.16% of the repair success is unreliable, which indicates that the robustness of NPR is not perfect. In addition, we find that the robustness of NPR is correlated with model settings and other factors.

Abstract Code summarization is to provide a high‐level comment for a code snippet that typically describes the function and intent of the given code. Recent years have seen the successful application of data‐driven code summarization. To improve the performance of the model, numerous approaches use abstract syntax trees (ASTs) to represent the structural information of the code, which is considered by most researchers to be the main factor that distinguishes code from natural language. Then, such data‐driven methods are trained on large‐scale labeled datasets to obtain a model with strong generalization capabilities that can be applied to new examples. Nevertheless, we argue that state‐of‐the‐art approaches suffer from two key weaknesses: (1) inefficient encoding of ASTs; (2) reliance on a large labeled corpus for model training. As a result, such drawbacks lead to (1) oversized model, slow training, information loss and instability; (2) inability to be applied to programming languages with only a small amount of labeled data. In light of these weaknesses, we propose PassSum, a code summarization approach that addresses the aforementioned weaknesses via (1) a novel input representation which contains an efficient AST encoding method; (2) introducing three pretraining objectives and pretraining our model with a large amount of (easy‐to‐obtain) unlabeled data under the guidance of self‐supervised learning. Experimental results on code summarization for Java, Python, and Ruby methods demonstrate the superiority of PassSum to state‐of‐the‐art methods. Further experiments demonstrate that the input representation we use has both temporal and spatial advantages in addition to performance leadership. In addition, pretraining is also shown to make the model more generalizable with less labeled data, and also to speed up the convergence of the model during training.

Mobile Edge Computing (MEC) is a promising solution to enhance the computing capability of resource-limited networks. A fundamental problem in MEC is efficiently offloading tasks from user devices to edge servers. However, there still exists a gap to deploy in real-world environments: 1) traditional centralized approaches needs complete information of edge network, ignoring the communication costs generated by synchronization, 2) previous works do not consider concurrent computation on edge servers, which may cause dynamic changes in the environment, and 3) the scheduling algorithm should deliver individualized decisions for different users independently and with high efficiency To solve this mismatch, we studied a multi-user task offloading problem where user devices make offloading decisions independently. We consider the concurrent execution of tasks and formulate a non-divisible and delay-aware task offloading problem to jointly minimize the dropped task ratio and long-term latency. We propose a decentralized task scheduling algorithm based on DRL that makes offloading decisions without knowing the information of other user devices. We employ Double-DQN, Dueling-DQN, Prioritized Replay Memory, and Recurrent Neural Network (RNN) techniques to improve the algorithm's performance. The results of simulation experiments show that our method can significantly reduce the long-term latency and dropped task ratio compared to the baseline algorithms.

Recent years have seen the successful application of large pretrained models of source code (CodePTMs) to code representation learning, which have taken the field of software engineering (SE) from task-specific solutions to task-agnostic generic models. By the remarkable results, CodePTMs are seen as a promising direction in both academia and industry. While a number of CodePTMs have been proposed, they are often not directly comparable because they differ in experimental setups such as pretraining dataset, model size, evaluation tasks, and datasets. In this article, we first review the experimental setup used in previous work and propose a standardized setup to facilitate fair comparisons among CodePTMs to explore the impacts of their pretraining tasks. Then, under the standardized setup, we re-pretrain CodePTMs using the same model architecture, input modalities, and pretraining tasks, as they declared and fine-tune each model on each evaluation SE task for evaluating. Finally, we present the experimental results and make a comprehensive discussion on the relative strength and weakness of different pretraining tasks with respect to each SE task. We hope our view can inspire and advance the future study of more powerful CodePTMs.

Recommending APIs is a practical and essential feature of IDEs. Improving the accuracy of API recommendations is an effective way to improve coding efficiency. With the success of deep learning in software engineering, the state-of-the-art (SOTA) performance of API recommendation is also achieved by deep-learning-based approaches. However, existing SOTAs either only consider the API sequences in the code snippets or rely on complex operations for extracting hand-crafted features, all of which have potential risks in under-encoding the input code snippets and further resulting in sub-optimal recommendation performance. To this end, this article proposes to utilize the code understanding ability of existing general code P re- T raining M odels to fully encode the input code snippet to improve the accuracy of API Rec ommendation, namely, PTM-APIRec . To ensure that the code semantics of the input are fully understood and the API recommended actually exists, we use separate vocabularies for the input code snippet and the APIs to be predicted. The experimental results on the JDK and Android datasets show that PTM-APIRec surpasses existing approaches. Besides, an effective way to improve the performance of PTM-APIRec is to enhance the pre-trained model with more pre-training data (which is easier to obtain than API recommendation datasets).

(Source) Code summarization aims to automatically generate summaries/comments for given code snippets in the form of natural language. Such summaries play a key role in helping developers understand and maintain source code. Existing code summarization techniques can be categorized into extractive methods and abstractive methods . The extractive methods extract a subset of important statements and keywords from the code snippet using retrieval techniques and generate a summary that preserves factual details in important statements and keywords. However, such a subset may miss identifier or entity naming, and consequently, the naturalness of the generated summary is usually poor. The abstractive methods can generate human-written-like summaries leveraging encoder-decoder models. However, the generated summaries often miss important factual details. To generate human-written-like summaries with preserved factual details, we propose a novel extractive-and-abstractive framework. The extractive module in the framework performs the task of extractive code summarization, which takes in the code snippet and predicts important statements containing key factual details. The abstractive module in the framework performs the task of abstractive code summarization, which takes in the code snippet and important statements in parallel and generates a succinct and human-written-like natural language summary. We evaluate the effectiveness of our technique, called EACS, by conducting extensive experiments on three datasets involving six programming languages. Experimental results show that EACS significantly outperforms state-of-the-art techniques for all three widely used metrics, including BLEU, METEOR, and ROUGH-L. In addition, the human evaluation demonstrates that the summaries generated by EACS have higher naturalness and informativeness and are more relevant to given code snippets.

(Source) code summarization aims to automatically generate succinct natural language summaries for given code snippets. Such summaries play a significant role in promoting developers to understand and maintain code. Inspired by neural machine translation, deep learning-based code summarization techniques widely adopt an encoder-decoder framework, where the encoder transforms given code snippets into context vectors, and the decoder decodes context vectors into summaries. Recently, large-scale pre-trained models for source code (e.g., CodeBERT and UniXcoder) are equipped with encoders capable of producing general context vectors and have achieved substantial improvements on the code summarization task. However, although they are usually trained mainly on code-focused tasks and can capture general code features, they still fall short in capturing specific features that need to be summarized. In a nutshell, they fail to learn the alignment between code snippets and summaries (code-summary alignment for short). In this paper, we propose a novel approach to improve code summarization based on summary-focused tasks. Specifically, we exploit a multi-task learning paradigm to train the encoder on three summary-focused tasks to enhance its ability to learn code-summary alignment, including unidirectional language modeling (ULM), masked language modeling (MLM), and action word prediction (AWP). Unlike pre-trained models that mainly predict masked tokens in code snippets, we design ULM and MLM to predict masked words in summaries. Intuitively, predicting words based on given code snippets would help learn the code-summary alignment. In addition, existing work shows that AWP affects the prediction of the entire summary. Therefore, we further introduce the domain-specific task AWP to enhance the ability of the encoder to learn the alignment between action words and code snippets. We evaluate the effectiveness of our approach, calledEsale, by conducting extensive experiments on four datasets, including two widely used datasets JCSD and PCSD, a cross-project Java dataset CPJD, and a multilingual language dataset CodeSearchNet. Experimental results show thatEsalesignificantly outperforms state-of-the-art baselines in all three widely used metrics, including BLEU, METEOR, and ROUGE-L. Moreover, the human evaluation proves that the summaries generated byEsaleare more informative and closer to the ground-truth summaries.

Weisong Sun, Yuchen Chen, Guanhong Tao, Chunrong Fang, Xiangyu Zhang, Quanjun Zhang, Bin Luo. Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 2023.

Off-the-shelf test cases provide developers with testing knowledge for their reference or reuse, which can help them reduce the effort of creating new test cases. Test case recommendation, a major way of achieving test case reuse, has been receiving the attention of researchers. The basic idea behind test case recommendation is that two similar test targets (methods under test) can reuse each other’s test cases. However, existing test case recommendation techniques either cannot be used in the cross-project scenario, or have low performance in terms of effectiveness and efficiency. In this paper, we propose a novel test case recommendation technique based on multi-level signature matching. The proposed multi-level signature matching consists of three matching strategies with different strict levels, including level-0 exact matching, level-1 fuzzy matching, and level-2 fuzzy matching. For the query test target given by the developer, level-0 exact matching helps to retrieve exact recommendations (test cases), while level-1 and level-2 fuzzy matching contribute to discovering richer relevant recommendations. We further develop a prototype called MuTCR for test case recommendation. We conduct comprehensive experiments to evaluate the effectiveness and efficiency of MuTCR. The experimental results demonstrate that compared with the state-of-the-art, MuTCR can recommend accurate test cases for more test targets. MuTCR is faster than the best baseline by three times based on the time cost. The user study is also performed to prove that the test cases recommended by MuTCR are useful in practice.

In recent years, a novel mobile computing paradigm has been evolving rapidly, with a host app allowing users to install and run mini-apps inside the app itself. However, the current classification mechanism of mini-apps is blurry and coarse-grained, making users unable to clearly understand mini-app functions, which can result in a series of privacy issues. In this study, an automatic convolutional neural network (CNN)-based classification approach is proposed for Wechatmini-apps. The proposed method integrates the static and dynamic features of WeChat mini-apps to achieve precise classification. Our approach was evaluated in a real-world testbed and the results showed that it can effectively classify Wechatmini-apps into proper categories, helping users better understand the functions of WeChat mini-apps while reducing user privacy violations.

A large number of bug reports are created during the evolution of a software system. Locating the source code files that need to be changed in order to fix these bugs is a challenging task. Information retrieval-based bug localization techniques do so by correlating bug reports with historical information about the source code (e.g., previously resolved bug reports, commit logs). These techniques have shown to be efficient and easy to use. However, one flaw that is nearly omnipresent in all these techniques is that they ignore code refactorings. Code refactorings are common during software system evolution, but from the perspective of typical version control systems, they break the code history. For example, a class when renamed then appears as two separate classes with separate histories. Obviously, this is a problem that affects any technique that leverages code history. This paper proposes a refactoring-aware traceability model to keep track of the code evolution history. With this model, we reconstruct the code history by analyzing the impact of code refactorings to correctly stitch together what would otherwise be a fragmented history. To demonstrate that a refactoring aware history is indeed beneficial, we investigated three widely adopted bug localization techniques that make use of code history, which are important components in existing approaches. Our evaluation on 11 open source projects shows that taking code refactorings into account significantly improves the results of these bug localization techniques without significant changes to the techniques themselves. The more refactorings are used in a project, the stronger the benefit we observed. Based on our findings, we believe that much of the state of the art leveraging code history should benefit from our work.

While a large number of pre-trained models of source code have been successfully developed and applied to a variety of software engineering (SE) tasks in recent years, our understanding of these pre-trained models is arguably fairly limited. With the goal of advancing our understanding of these models, we perform the first systematic empirical comparison of 19 recently-developed pre-trained models of source code on 13 SE tasks. To gain additional insights into these models, we adopt a recently -developed 4-dimensional categorization of pre-trained models, and subsequently investigate whether there are correlations between different categories of pre-trained models and their performances on different SE tasks.

Despite the recent advances showing that a model pre-trained on large-scale source code data is able to gain appreciable generalization capability, it still requires a sizeable amount of data on the target task for fine-tuning. And the effectiveness of the model generalization is largely affected by the size and quality of the fine-tuning data, which is detrimental for target tasks with limited or unavailable resources. Therefore, cross-task generalization, with the goal of improving the generalization of the model to unseen tasks that have not been seen before, is of strong research and application value. In this paper, we propose a large-scale benchmark that includes 216 existing code-related tasks. Then, we annotate each task with the corresponding meta information such as task description and instruction, which contains detailed information about the task and a solution guide. This also helps us to easily create a wide variety of “training/evaluation” task splits to evaluate the various cross-task generalization capabilities of the model. Then we perform some preliminary experiments to demonstrate that the cross-task generalization of models can be largely improved by in-context learning methods such as few-shot learning and learning from task instructions, which shows the promising prospects of conducting cross-task learning research on our benchmark. We hope that the collection of the datasets and our benchmark will facilitate future work that is not limited to cross-task generalization.

Online POMDP solvers search for the optimal policy based on multiple simulations. When scaling to large problems, more simulations typically lead to better results, but also more search time, thus it is necessary to make the best of finite simulations. Note that multiple simulations are not equivalent or independent, among which the earlier ones tend to sample randomly, while the later ones can take advantage of the previous results to better balance the exploration and exploitation. Moreover, there may be some possible environmental changes during the planning procedure. For these considerations, we allocate different weights to multiple simulations according to their order and propose a general Decaying Q Value (DQV) method to improve the existing online POMDP planning algorithms. We choose to improve POMCPOW, one of the state-of-the-art algorithms, to verify the effectiveness of the proposed method. Several experiments show that DQV can achieve competitive results on large-scale problems.

Large Language Models (LLMs) have demonstrated remarkable performance in code completion. However, due to the lack of domain-specific knowledge, they may not be optimal in completing code that requires intensive domain knowledge for example completing the library names. Although there are several works that have confirmed the effectiveness of fine-tuning techniques to adapt language models for code completion in specific domains. They are limited by the need for constant fine-tuning of the model when the project is in constant iteration. To address this limitation, in this paper, we propose$k$NM-LM, a retrieval-augmented language model (R-LM), that integrates domain knowledge into language models without fine-tuning. Different from previous techniques, our approach is able to automatically adapt to different language models and domains. Specifically, it utilizes the in-domain code to build the retrieval-based database decoupled from LM, and then combines it with LM through Bayesian inference to complete the code. The extensive experiments on the completion of intra-project and intra-scenario have confirmed that$k$NM-LM brings about appreciable enhancements when compared to CodeGPT and UnixCoder. A deep analysis of our tool including the responding speed, storage usage, specific type code completion, and API invocation completion has confirmed that$k$NM-LM provides satisfactory performance, which renders it highly appropriate for domain adaptive code completion. Furthermore, our approach operates without the requirement for direct access to the language model's parameters. As a result, it can seamlessly integrate with black-box code completion models, making it easy to integrate our approach as a plugin to further enhance the performance of these models.

Developing effective data-driven automated bug-fixing approaches is heavily relying on large bug-fix datasets. However, the granularity of current repository-mined bug-fixing datasets is usually at the function level, without meta-information such as the fault type. In order to alleviate the open challenge of precisely mining code snippets with bugs, their fix, location, and types from open source repositories, in this paper, we propose a flexible, extensible, and automated multilingual bug-fix dataset construction system, that is, the Multilingual Bug-Fix Constructor (MBFC). Furthermore, we release a large-scale and fine-grained Multi-lingual Bug-Fix (M-BF) dataset automatically built using the proposed system, which includes a total of 921,825 Bug-Fix pairs that are from 442,164 different open-source software projects starting from January 2020 to September 2020 in the initial version. It is expected that our system and dataset can benefit the development of innovative and practical program repair methods, thereby improving the efficiency of program debugging and code review processes.

Bug localization is the task of recommending source code locations (typically files) that probably contain the cause of a bug and hence need to be changed to fix the bug. Along these lines, information retrieval-based bug localization (IRBL) approaches have been adopted, which identify the most bug-prone files from the source code space. In current practice, a series of state-of-the-art IRBL techniques leverage the combination of different components, e.g., similar reports, version history, code structure, to achieve better performance. ABLoTS is a recently proposed approach with the core component, TraceScore, that utilizes requirements and traceability information between different issue reports, i.e., feature requests and bug reports, to identify buggy source code snippets with promising results. To evaluate the accuracy of these results and obtain additional insights into the practical applicability of ABLoTS, supporting of future more efficient and rapid replication and comparison, we conducted a replication study of this approach with the original data set and also on an extended data set. The extended data set includes 16 more projects comprising 25,893 bug reports and corresponding source code commits. While we find that the TraceScore component as the core of ABLoTS produces comparable results with the extended data set, we also find that the ABLoTS approach no longer achieves promising results, due to an overlooked side effect of incorrectly choosing a cut-off date that led to training data leaking into test data with significant effects on performance.

Self-supervised learning enables networks to learn discriminative features from massive data itself. Most state-of-the-art methods maximize the similarity between two augmentations of one image based on contrastive learning. By utilizing the consistency of two augmentations, the burden of manual annotations can be freed. Contrastive learning exploits instance-level information to learn robust features. However, the learned information is probably confined to different views of the same instance. In this paper, we attempt to leverage the similarity between two distinct images to boost representation in self-supervised learning. In contrast to instance-level information, the similarity between two distinct images may provide more useful information. Besides, we analyze the relation between similarity loss and feature-level cross-entropy loss. These two losses are essential for most deep learning methods. However, the relation between these two losses is not clear. Similarity loss helps obtain instance-level representation, while feature-level cross-entropy loss helps mine the similarity between two distinct images. We provide theoretical analyses and experiments to show that a suitable combination of these two losses can get state-of-the-art results. Code is available at https://github.com/guijiejie/ICCL.

Security and privacy concerns keep growing with the successful development of Internet of Things (IoT) and the booming deployment of smart homes. IoT devices are utilized cooperatively to enable the interactions between home surroundings and users’ daily lives, containing forensically-valuable information about what happens in smart homes, which can help introduce digital forensics into smart homes to alleviate the growing concerns. However, current IoT devices, apps, and platforms usually do not provide built-in capabilities for digital forensics. To overcome this limitation, we propose a non-intrusive solution (i.e., bringing no modification to IoT devices, apps, and platforms) of digital forensic service to provide Forensics-as-a-Service (FaaS) for smart homes. First, it leverages side-channel analysis on sniffed network traffic to monitor commands, actions, and states of IoT devices. Then, it introduces provenance graphs (i.e., causal graphs) for smart home modeling to provide a holistic and overall explanation of smart homes. Machine learning (ML) techniques are applied to overcome the deficiency of a non-intrusive solution as it suffers from challenges in data collection and smart home modeling. Finally, it conducts forensic analysis based on scalable, reusable policies that are designed for graph-based smart home modeling. We implement a prototype of our forensic service and evaluate it in a real-world smart home. The evaluation results show that our forensic service can effectively collect forensic data for smart home modeling and conduct forensic analysis to explain security risks in smart homes.

With the widespread use of mobile devices, security and privacy concerns have been attracting increasing attention. However, it is challenging for Android users to apply the appropriate settings to protect their devices. Therefore, a cloud-based solution is proposed in this paper, which works based on crowdsourcing to generate recommended security and privacy settings for Android users. Following the suggestions of security experts, ordinary users can readily understand how to properly set up their devices for security enforcement. Our solution collects security-related data from experts, and a weight-based algorithm is introduced to determine data priority and credibility. Finally, the recommended security and privacy settings are created based on these data. The evaluation results demonstrate that our solution can effectively improve the robustness and reliability of Android devices.

Recent years have seen the successful application of large pre-trained models to code representation learning, resulting in substantial improvements on many code-related downstream tasks. But there are issues surrounding their application to SE tasks. First, the majority of the pre-trained models focus on pre-training only the encoder of the Transformer. For generation tasks that are addressed using models with the encoder-decoder architecture, however, there is no reason why the decoder should be left out during pre-training. Second, many existing pre-trained models, including state-of-the-art models such as T5-learning, simply reuse the pretraining tasks designed for natural languages. Moreover, to learn the natural language description of source code needed eventually for code-related tasks such as code summarization, existing pretraining tasks require a bilingual corpus composed of source code and the associated natural language description, which severely limits the amount of data for pre-training. To this end, we propose SPT-Code, a sequence-to-sequence pre-trained model for source code. In order to pre-train SPT-Code in a sequence-to-sequence manner and address the aforementioned weaknesses associated with existing pre-training tasks, we introduce three pre-training tasks that are specifically designed to enable SPT-Code to learn knowledge of source code, the corresponding code structure, as well as a natural language description of the code without relying on any bilingual corpus, and eventually exploit these three sources of information when it is applied to downstream tasks. Experimental results demonstrate that SPT-Code achieves state-of-the-art performance on five code-related downstream tasks after fine-tuning.

Code summarization aims to generate brief natural language descriptions for source codes. The state-of-the-art approaches follow a transformer-based encoder-decoder architecture. As the source code is highly structured and follows strict grammars, its Abstract Syntax Tree (AST) is widely used for encoding structural information. However, ASTs are much longer than the corresponding source code. Existing approaches ignore the size constraint and simply feed the whole linearized AST into the encoders. We argue that such a simple process makes it difficult to extract the truly useful dependency relations from the overlong input sequence. It also incurs significant computational overhead since each node needs to apply self-attention to all other nodes in the AST. To encode the AST more effectively and efficiently, we propose AST-Trans in this paper which exploits two types of node relationships in the AST: ancestor-descendant and sibling relationships. It applies the tree-structured attention to dynamically allocate weights for relevant nodes and exclude irrelevant nodes based on these two relationships. We further propose an efficient implementation to support fast parallel computation for tree-structure attention. On the two code summarization datasets, experimental results show that AST-Trans significantly outperforms the state-of-the-arts while being times more efficient than standard transformers1.

Recent years have seen the successful application of deep learning to software engineering (SE). In particular, the development and use of pre-trained models of source code has enabled state-of-the-art results to be achieved on a wide variety of SE tasks. This paper provides an overview of this rapidly advancing field of research and reflects on future research directions.

Open user forums for software products have gradually become an important source of software new features. However, analyzing the rapidly growing user feature requests also brings a huge workload to software managers. Generally, only acceptable requests are of concern to the managers. Therefore, a tool that automatically determines whether the request is acceptable (i.e., to be approved) from the perspective of software managers is needed to enhance the request processing efficiency. In this paper, we lay the groundwork for the computational study of a feature request approval prediction by (1) formally defining the Just-In-Time Feature Request Approval Prediction (i.e., JITFRAP) task by collecting and manually annotating the real-world user feature requests, (2) constructing a standard data set for the JITFRAP task, and exploring characteristics of the task with experiments, and (3) presenting and discussing preliminary results from three basic aspects for the JITFRAP task, which can serve as useful baseline performance for future work. Experimental results prove that FRAP is timing-affected, just-in-time and affected by project status. We propose an approach with reference to these three characteristics and evaluation results indicate the proposed approach is promising. Our dataset is available at https://zenodo.org/record/6544368.

Automated Program Repair (APR) aims to automatically fix bugs in the source code. Recently, with advances in Deep Learning (DL) field, there has been an increase of Neural Program Repair (NPR) studies that use neural networks to model the patch-generation process. NPR approaches have a significant benefit in applicability over prior APR techniques because they do not require any specifications (e.g., a test suite) when generating patches. For this reason, NPR has recently become a popular research topic. In this paper, We undertake a literature review of latest NPR systems to help interested readers understand advancements in this emerging field. We begin by introducing background information of NPR. Next, to make the various NPR systems more understandable, we split them into a four-phase pipeline and discuss various design choices for each phase. To investigate the motivations of different design choices, We further highlight a number of challenges and summarize corresponding solutions adopted by existing NPR systems. Finally, we suggest some intriguing directions for the future research.

Recently, the emerging trend in automatic program repair is to apply deep neural networks to generate fixed code from buggy ones, called NPR (Neural Program Repair). However, the existing NPR systems are trained and evaluated under very different settings (e.g., different training data, inconsistent evaluation data, wide-ranged candidate numbers), which makes it hard to draw fair-enough conclusions when comparing them. Motivated by this, we first build a standard benchmark dataset and an extensive framework tool to mitigate threats for the comparison. The dataset consists of a training set, a validation set and an evaluation set with 144,641, 13,739 and 13,706 bug-fix pairs of Java respectively. The tool supports selecting specific training, validation, and evaluation datasets and automatically conducting the pipeline of training and evaluating NPR models, as well as easily integrating new NPR models by implementing well-defined interfaces. Then, based on the benchmark and tool, we conduct a comprehensive empirical comparison of six SOTA NPR systems w.r.t the repairability, inclination and generalizability. The experimental results reveal deeper characteristics of compared NPR systems and subvert some existing comparative conclusions, which further verify the necessity of unifying the experimental setups in exploring the progresses of NPR systems. Meanwhile, we reveal some common features of NPR systems (e.g., they are good at dealing with code-delete bugs). Finally, we identify some promising research directions derived from our findings.

As User Reviews (URs) of mobile Apps are proven to provide valuable feedback for maintaining and evolving applications, how to make full use of URs more efficiently in the release cycle of mobile Apps has become a widely concerned and researched topic in the Software Engineering (SE) community. In order to speed up the completion of coding work related to URs to shorten the release cycle as much as possible, the task of User Review-based code localization is proposed and studied in depth. However, due to the lack of large-scale ground truth dataset (i.e., truly related pairs), existing methods are all unsupervised learning-based. In order to light up supervised learning approaches, which are driven by large labeled datasets, for Review2Code, and to compare their performances with unsupervised learning-based methods, we first introduce a large-scale human-labeled ground truth dataset, including the annotation process and statistical analysis. Then, a benchmark consisting of two SOTA unsupervised learning-based and four supervised learning-based Review2Code methods is constructed based on this dataset. We believe that this paper can provide a basis for in-depth exploration of the supervised learning-based Review2Code solutions.

In the continental law system, it is appropriate for judges to find relevant laws and consider rules defined in them when dealing with legal cases. Therefore, recommending relevant laws quickly and accurately based on case content is crucial in improving the efficiency of case processing. There have been researched works of recommender systems in various fields, but few of them lucubrates systems that recommend statutes for cases. To the best of our knowledge, there is no research on recommending statutes by modeling the relationship between case content and law content with interpretable hand-crafted features. In this paper, we define five novel types of features for calculating relevance between a case and a statute for resorting all statutes retrieved through collaborative filtering for the input case. Both pair-wise and list-wise ranking models are trained based on all these features for re-ranking the statutes list. Besides, we also test the combinations of different learning algorithms and popular pre-trained language models. Experimental results show that adopting the proposed novel features in pair-wise ranking achieves the best performance. It improves the recommendation recall of the Top 1 statute by almost 5% compared with the collaborative filtering approach.

Recent years have seen a rapidly growing number of online reviews of products. As a result, it is often not possible for customers to go through each review before making purchase decisions. One way to address this problem is to build a system for automatically addressing the helpfulness of reviews and present only those reviews that are determined to be helpful by the system to an end user. The vast majority of existing approaches to the task of review helpfulness prediction are based on hand-crafted features, thus making system performance heavily dependent on the quality of these features. In light of this weakness, we propose a new model of review helpfulness prediction using a combination of Convolutional Neural Network (CNN) and TransE wherein hand-crafted features can also be incorporated to improve the output. Specifically, CNN enables us to learn the semantic information from a review and TransE is used to capture the relationship between different entities mentioned in the review. Experiments on the Amazon product review datasets demonstrate that our approach significantly outperforms the state of the art.

Measuring business process similarity plays an important role in the analysis, management and optimization of business in big companies. In the early days, experts paid major attention to calculating business similarity according to corresponding process models. However, models only express ideal behavior of business processes without any undesired or unexpected business routines. In order to fully model business behavior, some researchers use system logs in similarity measuring. But previous system-logs-based similarity measurements have limitations on: (1) satisfaction of algorithm properties, (2) distribution of similarity values, and (3) complexity of algorithm. In this article, we take the advantages of token logs in process behavioral similarity measuring. Firstly, the Token Log Profile, modeled with a relation matrix, is defined as an abstraction of the initial token logs. Then, similarity between business processes is calculated based on their Token Log Profiles according to the proposed algorithm. Besides, we extend the properties that similarity algorithms should satisfy for evaluating the proposed algorithm. The experimental and analytical results show that our algorithm achieves very promising accuracy and efficiency while satisfying all the proposed properties compared with state-of-the-art algorithms.

With a built-in intelligent personal voice assistant providing Q&A services, smart speaker ecosystems combine multiple compatible components, including the internet of things (IoT) technology, mobile devices, and cloud computing. However, as it is closely related to people's daily lives, security and privacy issues have gained worldwide attention. Components in the ecosystem are interconnected and chained together to enable the ecosystem to perform increasingly diverse operations. By collecting meaningful data from smart speaker ecosystems, we can reconstruct user behavior and provide a holistic explanation for finding the root cause of an observable symptom. This highlights the need for digital forensic research to enhance the security and privacy of smart speaker ecosystems. In this paper, we first discuss the digital forensic characteristics of a smart speaker ecosystem. Then, we propose a proof-of-concept digital forensic tool based on data provenance, that supports the identification, acquisition, and analysis of client-side artifacts from local devices.

With the widespread use of Android devices, research on their security has attracted increasing attention. However, at present, digital forensics for investigating attacks, such as social engineering attacks and phishing that target Android users, remains a challenging and time-consuming task. To help discover the existence of an attack and conduct effective investigations, we propose a top-down digital forensic tool for Android applications to reconstruct attack scenarios by considering both high-level user interface (UI) elements and low-level system events. Thus, we can explain the nature of an attack from a visual and global perspective. The tested evaluation results show that our tool can successfully reconstruct scenarios on Android devices for phishing attacks.

To exploit the vast amount of distributed data across edge devices, Federated Learning (FL) has been proposed to learn a shared model by performing distributed training locally on participating devices and aggregating the local models into a global one. The existing FL algorithms suffer from accuracy loss due to that data samples across all devices are usually not independent and identically distributed (non-i.i.d.). Besides, devices might lose connection during the training process in wireless edge computing. Thus, we advocate one-shot Neural Architecture Search technique as a basis to propose a solution which can deal with non-i.i.d. problem and is robust to the intermittent connection issue. We adopt a large network as the global model which includes all the candidate network architectures. The non-i.i.d. problem is alleviated by two steps: (1) identify and train the candidate networks which are potentially high performance and trained with less bias using a heuristic sampling scheme; (2) search for the final model with the highest accuracy rate from the candidate networks. Experimental results show that the model trained by our proposed method is robust to non-i.i.d. problem and can achieve 84% reduced communication overhead compared with the baselines.

With the rapid development of the Internet of Things technology, smart speakers have become increasingly popular. However, smart speaker security is an ensuing threat. At present, smart speakers are activated by voice, and they monitor users’ voices 24 hours per day. Consequently, there may be problems with user privacy leakage. In this paper, we propose a non-intrusive digital forensic method for smart speakers. The main contribution of the paper is an effective method of combining network traffic analysis with the extraction of user intent and alarms about abnormal network traffic to support the investigation of security. We use Xiaomi smart speakers as an example in an experiment to verify our forensic method. The evaluation results show that our method works well for detecting security risks.

Code summarization aims to generate brief natural language descriptions for source code. As source code is highly structured and follows strict programming language grammars, its Abstract Syntax Tree (AST) is often leveraged to inform the encoder about the structural information. However, ASTs are usually much longer than the source code. Current approaches ignore the size limit and simply feed the whole linearized AST into the encoder. To address this problem, we propose AST-Transformer to efficiently encode tree-structured ASTs. Experiments show that AST-Transformer outperforms the state-of-arts by a substantial margin while being able to reduce 90 ~ 95% of the computational complexity in the encoding process.

With the booming deployment of smart homes, concerns about user privacy keep growing. Recent research has shown that encrypted wireless traffic of IoT devices can be exploited by packet-sniffing attacks to reveal users’ privacy-sensitive information (e.g., the time when residents leave their home and go to work), which may be used to launch further attacks (e.g., a break-in). To address the growing concerns, we propose SniffMislead, a non-intrusive (i.e., without modifying IoT devices, hubs, or platforms) privacy-protecting approach, based on packet injection, against wireless packet sniffers. Instead of randomly injecting packets, which is ineffective against a smarter attacker, SniffMislead proposes the notion of phantom users, “people” who do not exist in the physical world. From an attacker’s perspective, however, they are perceived as real users. SniffMislead places multiple phantom users in a smart home, which can effectively prevent an attacker from inferring useful information. We design a top-down approach to synthesize phantom users’ behaviors, construct the sequence of decoy device events and commands, and then inject corresponding packets into the home. We show how SniffMislead ensures logical integrity and contextual consistency of injected packets, as well as how it makes a phantom user indistinguishable from a real user. Our evaluation results from a smart home testbed demonstrate that SniffMislead significantly reduces an attacker’s privacy-inferring capabilities, bringing the accuracy from 94.8% down to 3.5%.

Legal judgment prediction, which aims at predicting judgment results such as penalty, charges, and statutes for cases, has attracted much attention recently. In this article, we focus on building a recommender system to predict the associated statutes for a case given the facts of the case as input. For this purpose, we propose a two-step neural network-based machine learning framework to assist judges as well as ordinary people to reduce their effort in finding applicable statutes. The proposed model takes advantage of recurrent neural networks with a max-pooling layer to obtain contextual representations of documents, i.e., the facts associated with the cases. Moreover, an attention mechanism is used to automatically focus on the important words contributing to the prediction of statutes. In addition, we apply an encoder--decoder ranking approach to extract correlations between statutes to achieve more accurate recommendation results. We evaluate our model on a real-world dataset. Experimental results show that, compared with existing baseline methods, our method can predict statutes that are more likely to appear in real judgments.

Distributed Interactive Applications (DIAs) such as virtual reality and multiplayer online game usually require fast processing of tremendous data and timely exchange of delay-sensitive action data and metadata. This makes traditional mobile-based or cloud-based solutions no longer effective. Thanks to edge computing, DIA Service Providers (DSPs) can rent resources from Edge Infrastructure Providers (EIPs) to place service entities that store user states and run computation-intensive tasks. One fundamental problem for a DSP is to decide where to place service entities to achieve low-delay pairwise interactions between DIA users, under the constraint that the total placement cost is no more than a specified budget threshold. In this article, we formally model the service entity placement problem and prove that it is NP-complete by a polynomial reduction from the set cover problem. We present GPA, an efficient algorithm for service entity placement, and theoretically analyze its performance. We evaluated GPA with both real-world data trace-driven simulations, and observed that GPA performs close to the optimal algorithm and generally outperforms the baseline algorithm. We also output a curve showing the trade-off between the weighted average interaction delay and the budget threshold, so that a DSP can choose the right balance.

While exaggeration is one of the most prevalent rhetorical devices, it is arguably one of the least studied in the figurative language processing community.We contribute to the computational study of exaggeration by (1) creating the first Chinese corpus focusing on sentence-level hyperbole detection, with the goal of facilitating a cross-lingual study on this phenomenon, (2) performing a statistical and manual analysis of our corpus, with the goal of gaining insights into the strategies humans employ when creating hyperboles, and (3) addressing the automatic hyperbole detection task with deep learning techniques.

With the development of cloud computing and wireless networks, cloud storage services are widely used in daily life. People can get access to cloud storage anytime and anywhere. Cloud storage forensics is a computer forensic scenario that currently appears frequently. In this paper, we first briefly introduce the general methods of traditional cloud storage forensics and then introduce forensic investigations that are conducted on three cloud storage services: BaiduNetDisk, 115yun, and WeiYun. The findings of the forensic analysis are presented in detail to help the development of forensics for cloud storage services.

Edge service entity placement is a fundamental issue in mobile edge computing, which tries to place service entities on edge servers to achieve better economic benefits and quality of service for users. Most existing studies towards this issue usually deploy application services separately; however, we observe that many application services can be broken down into smaller service components/entities, which may enable us to share these smaller entities between application services. Therefore, in this paper, we propose the concept of service entity chain, which is a chain of ordered service entities that represent an application service. We study the problem of placing service entities in the form of chains on edge servers within a given cost budget, so as to minimize the total latency experienced by users. We provide a formal problem formulation and design an efficient algorithm for it. Extensive simulations are conducted to demonstrate the advantages of the proposed algorithm compared with two state-of-the-art algorithms.

Abstract As the promotion of technologies and applications of Big Data, the research of business process management (BPM) has gradually deepened to consider the impacts and challenges of big business data on existing BPM technologies. Recently, parallel business process mining (e.g. discovering business models from business visual data, integrating runtime business data with interactive business process monitoring visualisation systems and summarising and visualising historical business data for further analysis, etc.) and multi‐perspective business data analytics (e.g. pattern detecting, decision‐making and process behaviour predicting, etc.) have been intensively studied considering the steep increase in business data size and type. However, comprehensive and in‐depth testing is needed to ensure their quality. Testing based solely on existing business processes and their system logs is far from sufficient. Large‐scale randomly generated models and corresponding complete logs should be used in testing. To test parallel algorithms for discovering process models, different log completeness and generation algorithms were proposed. However, they suffer from either state space explosion or non‐full‐covering task dependencies problem. Besides, most existing generation algorithms rely on random executing strategy, which leads to low and unstable efficiency. In this paper, we propose a novel log completeness type, that is, #TAR completeness, as well as its generation algorithm. The experimental results based on a series of randomly generated process models show that the #TAR complete logs outperform the state‐of‐the‐art ones with lower capacity, fuller dependencies covering and higher generating efficiency.

The task of statute prediction focuses on determining applicable statutes for legal cases with the inputs of fact descriptions, which is crucial for both legal experts and ordinary people without professional knowledge. Existing works just consider the correspondence from facts to individual statutes and ignore the correlations between statutes. Moreover, charges of cases have associations with statutes. To address these issues, we formulate statute prediction task as a sequence generation problem and propose a novel joint generative model to mine correlations between statutes. By integrating statute prediction task and charge prediction task, we also make model learn associations between statutes and charges. Experiments show our model outperforms several baselines significantly and correlative statutes are predicted accurately.

Traditional cloud database directly stores user plaintext information, information security is directly related to the security of Cloud server, which will create a great security risk. The user's information security is not guaranteed. In this paper, a database encryption technology is designed, which can balance the problem of information security and use efficiency well. In this paper, a simplified onion encryption model is designed and implemented, which can realize the full homomorphic encryption on the cloud database to a certain extent, and improve the efficiency of ciphertext operation to a certain extent.

Security is critical to cloud services, this paper introduces a design of firewall, which based on IDS's feedback t change rules in order to detect attack flexible. It combines firewall and Intrusion Detection Systems(IDS) by using Intrusion Detection Systems, which detects ICMP, TCP, UDP attacks. Usually, a cloud service is a service built on a virtual machine. The virtual device is virtualized to achieve the purpose of multiplexing. Therefore, if you want to implement cloud security detection, you can listen to the physical device's network card. There are two types of Intrusion Detection System, one is host- based intrusion detection system(HIDS) and another is network intrusion detection system(NIDS). What's more, in order to highlight the importance of the firewall, the IDS monitoring data is analyzed and added to the firewall's defense strategy automatically. Finally, we measure the effectiveness of the system by False Negative(FN) and False Positive(FP), and verify that feedback plays a crucial role in improving the effectiveness of the system, improving the efficiency of the entire system filtering attacks.

Due to the big volume of data and complex execution, event logs of business processes inevitably contain various errors. In the field of process mining, if we derive process models from the event data without repairing, it is very likely that the resulting process is extremely different from what we expect. Current methods of repairing logs generally compare the log with an existing reference model to seek an optimal alignment, which requires that there should be a reliable reference model. Therefore, this paper presents an approach which only refers to the log itself to repair mistaken traces. We identify loop structures and frequent event sequences (sound conditions) between certain events. For each trace, basic trace and loop events are separated in advance. The basic trace is split into several parts to get repaired one by one according to sound conditions. Then loop events are added back and checked according to corresponding loop structure we discover. The repaired log should be as clean as possible and as similar to the original log as possible so that correctness and integrity of the original log are guaranteed. Experimental results based on different logs prove that our approach is effective and efficient.

Edge computing is one of the emerging technologies aiming to enable timely computation at the network edge. With virtualization technologies, the role of the traditional edge providers is separated into two: edge infrastructure providers (EIPs), who manage the physical edge infrastructure, and edge service providers (ESPs), who purchase slices of physical resources (e.g., CPU, bandwidth, memory space, disk storage) from EIPs and then cache service entities to offer their own value-added services to end users. When an ESP caches a service entity in an edge server, the ESP has to pay some fees (i.e, the cache cost) to the EIP that owns the edge server. One of the fundamental problems in edge virtualization is the so-called service entity caching problem, i.e., where to place service entities for an ESP to minimize the cache cost. In this paper, we study the service entity caching problem from the utility perspective. We use `utility' to denote the positive impact on a client from caching a service entity in an edge server, and the exact meaning of utility can vary depending on specific scenarios. We formulate the Utility-based Service Entity Caching (UtilitySEC) problem, which can be generalized to many existing problems by modifying the `utility'. We prove that the UtilitySEC problem is NP-complete and design an approximation algorithm for it. Extensive simulations are conducted to evaluate the performance of the proposed framework.

The rapid development of web service provides many opportunities for companies to migrate their business processes to the Internet for wider accessibility and higher collaboration efficiency. However, the open, dynamic and ever-changing Internet also brings challenges in protecting these business processes. There are certain process monitoring methods and the recently proposed ones are based on state changes of process artifacts or places, however, they do not mention defending process interactions from outer tampering, where events could not be detected by process systems, or saving fault-handling time. In this paper, we propose a novel Token-based Interaction Monitoring framework based on token carried data to safeguard process collaboration and reduce problem solving time. Token is a more common data entity in processes than process artifacts and they cover all tasks' executions. Comparing to detecting places' state change, we set security checking points at both when tokens are just produced and to be consumed. This will ensure that even if data is tampered after being created it would be detected before being used. For applying monitoring framework, we develop a collaboration constructing method with token-based process mining techniques to derive global interaction processes as well as organize historical process data in forms of token.

The cognitive network system learns from the past (situations, plans, decisions, actions) and uses this knowledge to improve the decisions in the future. Scenarios in which data resources for configuring radio-system parameters are stored in the cloud for easily sharing and exchanging between nodes are foreseeable. Due to the physical inaccessibility and limited control, it is always a tough topic to formulate appropriate access control strategies for the cloud data and data access requests submitted by applications are not always correct and credible. Cloud servers cannot clearly confirm that these requests are consistent with a user's original intent. In this paper, we propose a new access control method and forensic framework for user-intent monitoring of cloud-based networked applications in cognitive networks. Our framework has two main functions. Firstly, it makes sure that every data access request submitted by applications is correct. This means that it accurately shows what it wants. Monitoring user-intent can also help the cognitive engine to make decisions in turn. Secondly, it can offer adequate details to help forensic analysts reconstruct a precise view of user interaction with applications and understand system conditions. Our framework can function correctly in untrusted environments and is transparent to applications, systems and communication environments. It incurs no discernible performance overhead.

Coordination is important in software development. Socio-Technical Congruence (STC) is proposed to measure the match between coordination requirements and actual coordination activities, and has been proved to have impact on software failures in commercial projects. Continuous defect prediction is aimed to predict defects just in time, which is more meaningful than traditional defect prediction in practice. In this paper, we compute the build-level STC and investigate its usefulness in continuous defect prediction based on 10 GitHub projects. We find that adding STC metrics into logistic regression models can significantly improve both the explanatory power and the predictive power when predicting build failures. Furthermore, we compare the performance of STC and MDL from the aspects of regression and prediction. MDL is short for Missing Developer Links, a deviation of the STC metric. We find that MDL usually performs better than STC. Our work is promising to help detect coordination issues during real time process of software development.

Cloud computing is a suitable platform to execute the deadline-constrained scientific workflows which are typical big data applications and often require many hours to finish. Moreover, the problem of energy consumption has become one of the major concerns in clouds. In this paper, we present a cost and energy aware scheduling (CEAS) algorithm for cloud scheduler to minimize the execution cost of workflow and reduce the energy consumption while meeting the deadline constraint. The CEAS algorithm consists of five sub-algorithms. First, we use the VM selection algorithm which applies the concept of cost utility to map tasks to their optimal virtual machine (VM) types by the sub-makespan constraint. Then, two tasks merging methods are employed to reduce execution cost and energy consumption of workflow. Further, In order to reuse the idle VM instances which have been leased, the VM reuse policy is also proposed. Finally, the scheme of slack time reclamation is utilized to save energy of leased VM instances. According to the time complexity analysis, we conclude that the time complexity of each sub-algorithm is polynomial. The CEAS algorithm is evaluated using Cloudsim and four real-world scientific workflow applications, which demonstrates that it outperforms the related well-known approaches.

In the case of a traditional court judge, the facts are based on the law as the cornerstone, the fact that can be proved by the legal evidences. As we all know, assisting judges to manage evidence chain information can significantly improve the efficiency and quality of judges. Therefore, based on this idea, this paper will introduce the design and implementation of Visual Modeling Tool for evidence chain. The tool can help the judge to build various types of evidence chain, and can help to improve the work efficiency of judges. This visual modeling tool is divided into two main forms of visualization, includes the Graphical Mode and Table Mode. It means the same data with different display forms. So that the judge can deal with a large number of complex and varied evidence of chain information quickly and easily. Also, the efficiency of the judge to handle the case can be significantly improved.

This paper presents a method of the association statistics between the cause of action and the statute. According to the close relationship between the cause of action and the statute in the written judgment, this paper puts forward the statistical analysis of the cause of action and the statute. The method mainly includes the pretreatment of semi-structured written judgments, reading information of the cause of action and the statute from structured documents, standardizing statutes, depositing in the database, generating EXCEL form of the association statistics from the cause of action to the statue and generating TXT form of the association statistics from the statue to the cause of action. In the process of reasoning and assessment, we can achieve the prediction of statutes and narrow the size of the cause of action.

With the process of the information openness and the development of Internet technology, judicial data begin to enter the public view, and the carrier of that is the referee document, as referee document almost reflect all information of cases. Everyone is a social media content producer and consumer, which on behalf of public's opinion about the law, and it has made the legal significance not only limited to the professional field, but also includes social cognitive meanings. So, Digging into the relationship between professional legal meaning and social cognition has become an important issue. We use the knowledge graph to construct the relationship network between social media and law entities of professional legal data, and introduce the related methods of knowledge graph.

Document clustering (or text clustering) is the application of cluster analysis to textual documents. It has applications in automatic document organization, topic extraction and fast information retrieval or filtering. At the same time, there are still many challenges, for example the accuracy of clustering needs to be improved. In this regard, the process of cluster correction becomes the object of analysis. In this paper, we focus on the polysemy and synonymy issue in clustering process. Polysemy represents the ambiguity of an individual word or phrase that can be used (in different contexts) to express two or more different meanings. However, synonymy is the semantic relation that holds between two or more words that can (in a given context) express the same meaning. These two conditions will affect our results of clustering. In order that, we use bag of words model to distinguish contexts of the same words and word2vec to re-cluster word with the similar meaning. Cosine similarity is also use to measure of similarity between two nonzero vectors in these two model.

With the continuous advancement of the informatization of the Chinese People's Court, the court's view on the extraction and application of information has not only been on the structured data, but also for the semi-structured and unstructured data. In the process of in-depth study of the judgment document, many cases require the collection of the document result as an important data dimension, and the key is that the statute is the core of the whole result, so the integrity and correctness of the statute obtained has played a key role for the process of the judgment document processing. However, in the process of writing a specific judgment document, the same statute has different string forms due to the diversity of writing, which leads directly to the error data source. Comparing the editing distance between the strings can judge the similarity of them to a certain extent. Therefore, an automatic method based on the editing distance algorithm is devised, which constructs the disparity model between different statutes strings, to obtain the standardized writing of the same type data. Using this method can remove the non-standard writing of statutes, and ultimately access to the standard statutes collection. This method has a higher efficiency than the method of enumerating all the writing circumstances, which needs the manual participation, additional data storage and update.

The traditional approach to measure text similarity is based on the TF-IDF algorithm to get the document vector, and then use the cosine similarity algorithm to calculate the text similarity. However, this method of statistical way ignores the potential semantics of the articles or words. By some means, this method only aims at the word itself. But with the Latent Semantic Analysis, the semantic space is added on the basis of calculate TF-IDF. Each word and document can have a position in semantic space by Singular Value Decomposition. That allows the semantic analysis, document clustering, and the relationship between semantic class and document class can be finished at the same time. Here, we summarize the text similarity measures, and gradually extend to the Latent Semantic Analysis. The experiment shows that the statutes predicted by LSA are more accurate than that only by TF-IDF.

Judgment documents contain a wealth of valuable information. The original judgment documents are written in pure text format, so we cannot obtain information directly, which hinders the study of the judgment documents. We propose an approach to parse Chinese judgment documents into structured documents to solve this problem. Divide a judgment document into logical segments, and then extract and label information items from these logical segments. Use information items to build analytic document information model and the model is output into a structured XML document.

Recently, an increasing number of inter-app attacks such as confused deputy attacks, data leakage attacks and collusion attacks spring up. However, there is no perfect defense method against them. As we all know, developers play an important role in android security, but their weak consciousness about the security may lead to inter-app attacks. Therefore, considered for developers, it is important to investigate and try to defend against such attacks in android. This paper presents typical inter-app attacks in android and proposes AutoPatchDroid, an automatic framework to find the vulnerable code in apps and patch them automatically. We firstly find the vulnerable paths from sources to sinks, sources to execution exit points, execution entry points to sinks and execution entry points to execution exit points in the application using static analysis. Then we locate the vulnerable code pieces and insert the patch code to guard against such attacks. AutoPatchDroid prevent inter-app attacks in the application level rather than modifying the kernel or framework. We use DroidBench and IccRE to evaluate our framework, and find that AutoPatchDroid could effectively secure the apps. The runtime overhead introduced by AutoPatchDroid is 1.105% on average.

The wide spread of mobile devices has also caused the explosive growth of malwares. Application behavior analysis is a popular technique to fight against malwares. However current app behavior analysis methods still have some limitations. For example, many popular dynamic analysis methods are built on Dalvik virtual machines. They cannot disclose the behavior of native code. VMI based methods can overcome this limitation but they're executed in simulated environments. Now malwares can detect where they are running so as to hide the illegal behaviors by anti-forensic techniques. Considering these, we present the DroidRevealer. It is based on kernel-level system calls monitoring and it's running on real android devices. By intercepting and interpreting certain file/network related and android-specific system calls, it can reconstruct app behaviors in real-time. It's difficult to evade as it runs in the kernel. And its results do not simply focus on a single kind of behavior or a single app. Instead it is data oriented, i.e. it monitors how the target data source is used. The result is presented as an intelligible graph which can provide both a good basis for detection and crucial evidence for forensics. Experiments have proved that the performance of our method is acceptable.

Stroke grouping in sketch recognition is both difficult and time-consuming. Our preliminary experiment indicates that, when people drawing flowcharts, their gaze focused on non-arrow areas, which providing a spatial cue for stroke grouping. Therefore, we present a novel stroke grouping method aided by gaze information. Based on gaze data that is collected simultaneously during natural drawing process, we generate hotspot areas serving as the position reference of semantic symbols. Strokes are first roughly grouped by the hotspot areas, so as to efficiently decrease the searching space. Experiment on a dataset of 54 flowcharts shows that time efficiency of stroke grouping can be greatly improved in our method and there is much potential for introducing eye-gaze data in sketch recognition.

To improve software quality, developers often open a bug repository and allow users to find bugs, describe bugs in the form of bug reports and submit bug reports to the repository.Based on the description, testers assign a priority to each bug report.In the beginning the process of priority assignment is performed manually.With the increasing amount of bug reports, researchers introduced classification methods to assign priorities automatically with all the features considered.In this paper feature selection methods are introduced to improve the effect of bug report prioritization using classification models.The experimental results show that feature selection based on Information Gain and Pearson Correlation can improve the precision and recall for bug report prioritization on two models, i.e., SVM and Naive Bayes.

Semantic tags of points of interest (POIs) are a crucial prerequisite for location search, recommendation services, and data cleaning. However, most POIs in location-based social networks (LBSNs) are either tag-missing or tag-incomplete. This article aims to develop semantic annotation techniques to automatically infer tags for POIs. We first analyze two LBSN datasets and observe that there are two types of tags, category-related ones and sentimental ones, which have unique characteristics. Category-related tags are hierarchical, whereas sentimental ones are category-aware. All existing related work has adopted classification methods to predict high-level category-related tags in the hierarchy, but they cannot apply to infer either low-level category tags or sentimental ones. In light of this, we propose a latent-class probabilistic generative model, namely the spatial-temporal topic model (STM), to infer personal interests, the temporal and spatial patterns of topics/semantics embedded in users’ check-in activities, the interdependence between category-topic and sentiment-topic, and the correlation between sentimental tags and rating scores from users’ check-in and rating behaviors. Then, this learned knowledge is utilized to automatically annotate all POIs with both category-related and sentimental tags in a unified way. We conduct extensive experiments to evaluate the performance of the proposed STM on a real large-scale dataset. The experimental results show the superiority of our proposed STM, and we also observe that the real challenge of inferring category-related tags for POIs lies in the low-level ones of the hierarchy and that the challenge of predicting sentimental tags are those with neutral ratings.

Nowadays Hadoop is popular among businesses and individuals for its low costs, convenience, and fast speed. However, this also makes it the goal of data leakage attacks as sensitive data stored with an HDFS infrastructure grows rapidly. Therefore, it is important to investigate such attacks in Hadoop. Several works have been done on improving the security of Hadoop, but hardly any have been done on data leakage investigation. This paper presents a typical data leakage attack scene in Hadoop and proposes Haddle (Hadoop Data Leakage Explorer), a forensic framework composed of automatic analytical methods and on-demand data collection based on two stages. With the assistance of Haddle, investigators can find the stolen data, find the perpetrator who stole the data, and reconstruct the crime scene. Also, Haddle can help improve the audit mechanism of Hadoop.

Current memory forensic methods mainly focus on evidence collection and data recovery. A little work is about how to automatically identify malwares from many unknown processes and analyze their behaviors in high semantic level so as to collect related evidences. In fact, in real cases, investigators are often faced with large number of processes that they have no knowledge of. Although current malware detection tools could provide some help, they usually can't illustrate the purposes, abilities and behavior details of malwares and are thus often not fit for the forensic requirements. In this paper, we present a framework named Detective to cope with these issues. Given a set of unknown processes, Detective can classify benign and malware processes automatically. This is implemented by HNB classifying algorithm and a Dynamic-Link Libraries-based model. Detective could then explain malware behaviors in high semantic level through clustering and frequent item sets mining techniques. Besides, Detective sheds light on evidence collection by the information obtained from previous steps. Detective is applicable for both online and offline forensic scenarios. Experiments on real-world malware set have proved that the accuracy of Detective is above 90% and the time cost is only several seconds.

The exponential growth of the size of the search space has always been an obstacle to POMDP planning. Heuristics are often used to reduce the search space size and improve computational efficiency. As the advantage of the feature of POMDP problems should be taken into deeper consideration, we analyze the clustering feature of reachable space of POMDP problems and apply policy iteration based on this clustering feature. With insights from theoretical analysis, we have developed a practical POMDP algorithm Point Clustering Feature Based Policy Iteration (PCFBPI). Empirically, PCFBPI is competitive with PBPI in terms of solution quality and convergence efficiency on some large-scale problems.

Abstract Memory forensics is an important technique for protecting network security and fighting against computer crimes. It has developed greatly in the past decade, because memory can provide more reliable information that other evidence sources do not contain. However, nowadays, when investigating network criminal cases, the Gigabyte (GB) and even Terabyte (TB) level memory and many such dumps have made memory analysis a difficult task. And investigators usually have to deal with complex operating system (OS) data structures, which they have little knowledge of. So how to analyze memory evidence automatically so as to find the hidden criminal behavior and reconstruct the scenario in an understandable way has become an important problem. This paper presents an automatic memory analysis methodology based on data correlation. Through analyzing key OS data structures and utilizing a clustering algorithm, this methodology can discover the relationships among processes, files, users, Dynamic‐link library (DLLs), and network connections. By describing these relationships as correlation graphs, our methods can reorganize these independent memory evidences and disclose their meanings in a high semantic level. Experiments have proved that these correlation graphs can help investigators find hidden criminal behavior and reconstruct the criminal scenarios. And as we know, now, little work is in this field. Copyright © 2015 John Wiley & Sons, Ltd.

Due to the more and more intense competition in software market, usability is gaining more and more attention. For software engineering students, learning and mastering human-computer interaction knowledge can help them design software products with higher usability. In this paper, we describe a preliminary experience of teaching HCI to undergraduate software engineering students in Nanjing University (NJU), including curriculum design, course implementation and improvements based on some feedback from students. We believe that this information is useful at how to teach HCI in a practical way, and we hope it can serve as guidance for other teachers struggling with similar course design issues.

Software testing is the primary approach to support software quality assurance. Many novel software testing methods have been proposed to achieve various tasks in recent years. It is a challenge to teach these new testing methods and classical testing methods within limited time. This paper reports our work in progress on the new teaching approach to software testing methods based on diversity principles.

Training a large number of qualified software engineers is a great challenge for universities, and curriculum design is an important issue. Based on IEEE-CS/ACM SE2004, Nanjing University in China designs the software engineering undergraduate curriculum NJU-SEC2006. There are three main concerns about the curriculum design. Firstly, the knowledge delivering sequence is designed to match the different scales (small/medium/large) software development. Secondly, the knowledge of professional practices is integrated into courses throughout the whole undergraduate program. Thirdly, traditional computer science courses are reformed according to the situation of China. NJU-SEC2006 has been executed for years, and received positive feedback from students, instructors and employers.

One important issue in undergraduate software engineering curriculum is how to help students establish the concept of software engineering at the beginning of software engineering undergraduate program and to provide a reasonable basis of knowledge and skills for subsequent courses. The "Computing and Software Engineering (CSE)", a three-semester course, is designed as the introductory course for undergraduate software engineering program at NJU in China; it tries to help students learn the comprehensive knowledge and skills in constructing small-to-medium size software. The course includes not only technical topics, such as programming and software development technology, but also professionalism and teamwork through constructing different scales of software. The knowledge is organized with the complete software example development demonstration, which makes it easier for students to synthesize all knowledge related in software development. CSE has been executed from 2009, and it has been refined according to feedback from students, lecturers and TAs. This paper describes the design and teaching practice of CSE.

The aim of process mining is to rediscover the process model from the event log which is recorded by the information system. Although the omnipresence of the event logs in information system, rarely part of them are considered to analyze the processes. In this paper, we present a new mining algorithm based on the event type we defined. This algorithm not only can detect all of the SWF-nets and short-loops, but also can directly detect the implicit dependency. Because we can obtain more task information from the event log, we can deal with a wider subclass of WF-nets with the algorithm we have presented.

The enormous growth of the World Wide Web has made it important to perform resource discovery efficiently. Consequently, several new ideas have been proposed; among them a key technique is focused crawling which is able to crawl particular topical portions of the World Wide Web quickly without having to explore all Web pages. In this paper, we present an intelligent focused crawler algorithm in which we embed ontology to evaluate the page's relevance to the topic. Compared with other algorithms using domain knowledge, our algorithm can evolve the ontology automatically during crawl process. Considering the instinct characteristics of the ontology, propagation has also been imported to accelerate the evolution of the ontology. We applied our approaches in several tasks and provided an empirical evaluation which has shown promising results.