Abstract Static analysis tools are widely used for vulnerability detection as they can analyze programs with complex behavior and millions of lines of code. Despite their popularity, static analysis tools are known to generate an excess of false positives. The recent ability of Machine Learning models to learn from programming language data opens new possibilities of reducing false positives when applied to static analysis. However, existing datasets to train models for vulnerability identification suffer from multiple limitations such as limited bug context, limited size, and synthetic and unrealistic source code. We propose Differential Dataset Analysis or D2A, a differential analysis based approach to label issues reported by static analysis tools. The dataset built with this approach is called the D2A dataset. The D2A dataset is built by analyzing version pairs from multiple open source projects. From each project, we select bug fixing commits and we run static analysis on the versions before and after such commits. If some issues detected in a before-commit version disappear in the corresponding after-commit version, they are very likely to be real bugs that got fixed by the commit. We use D2A to generate a large labeled dataset. We then train both classic machine learning models and deep learning models for vulnerability identification using the D2A dataset. We show that the dataset can be used to build a classifier to identify possible false alarms among the issues reported by static analysis, hence helping developers prioritize and investigate potential true positives first. To facilitate future research and contribute to the community, we make the dataset generation pipeline and the dataset publicly available. We have also created a leaderboard based on the D2A dataset, which has already attracted attention and participation from the community.

Discovering application configurations and dependencies in the existing runtime environment is a critical prerequisite to the success of cloud migration, which attracts many attentions from both researchers and commercial vendors. However, the high complexity and diversity of enterprise applications as well as their runtime environment challenge the existing approaches which generally depend on the pre-built domain specific knowledge. In this paper, we propose a generic framework for application configuration discovery which can be applied even when the domain knowledge is missing or incomplete. We design a generic approach to significantly narrow down the configuration discovery scale based on the iterative comparison and enable users to manually identify configurations from reasonable scaled file sets with semantic tags. To maximize automation, we further design an easy extensible and pluggable knowledge base to assist configuration discovery. Through extensive case study, the capability and efficiency of our framework have been demonstrated.

Service management is becoming more and more important within the area of IT management. How to efficiently manage and organize service in complicated IT service environments with frequent changes is a challenging issue. IT service and the related information from different sources are characterized as diverse, incomplete, heterogeneous, and geographically distributed. It is hard to consume these complicated services without knowledge assistant. To address this problem, a systematic way (with proposed toolsets and process) is proposed to tackle the challenges of acquisition, structuring, and refinement of structured knowledge. An integrated knowledge process is developed to guarantee the whole engineering procedure which utilizes Bayesian networks (BNs) as the knowledge model. This framework can be successfully applied on key tasks in service management, such as problem determination and change impact analysis, and a real example of Cisco VoIP system is introduced to show the usefulness of this method.

To strengthen patch management, organizations are required not only to focus on sole patch management on single server, machine or application servers, but also to consider other IT system management processes as well because patch management relies on them to be efficient. Processes such as inventory, system configurations, risk management, change management, system audit, and business cost on policy and SLA should be evaluated and enhanced together with patch management; appropriate applicability assessment of patch should be built in and coordinated with all these processes to make patch management a safe, reliable and efficient process to carry out its high profile tasks. This paper presents a patch management framework based on SLA-driven patch applicability analysis. It provides automatic patch applicability analysis and risk assessment for supporting business-impact analysis and logical control during patch process. Experimental results collected from the simulation on realistic business services case study show that SLA-driven patch applicability analysis based patch management outperforms traditional patch management.

Along with the improvement of cloud technologies, we envision that thousands of web applications whether owned by individuals or enterprises will be migrated into cloud. These web applications share the cloud resources while require different quality of service guarantees and management policies. It is challenging while with abundant innovation opportunities given the easy and dynamic provisioning of cloud resources. In order to facilitate practitioners to evaluate, experiment, or enhance existing functionalities of distributed web application management in cloud environment, a componentized distributed service foundation named TANSO is proposed. TANSO targets serving as platform to manage thousands of web application server instances and provide plenty of interfaces for user to extend and experiment new ideas. TANSO has implemented framework components to enable fundamental management. It also provides interfaces to admit and foster user's innovative algorithms and designs for managing large-scale web applications.

IT infrastructure is highly complex and changeable for reacting to business update with market change. Unfortunately, change is not always successful. Managing change effectively and reducing the negative effects of day-to-day operations has become one of the most important tasks in IT service management. Beyond recording all configuration items used in the provision of operational services, analysis and audit for the operations on configuration items are more important. One needs to scale or respond to special domain knowledge, collaboration and the right data for helping IT professionals to improve their configuration management. In this paper, a sync audit with Request for Change (RFC) ticket and knowledge-enhanced audit analysis services is proposed to improve change & configuration management quality. The essential contribution of this work is to organize the highly complex IT configuration information with RFC ticket and to build a knowledge repository for accumulating and reusing experts' knowledge for audit. In addition, a prototype is implemented to explore this knowledge-enhanced audit analysis services framework. Finally, a real use case of change management is used for evaluating the effectiveness and efficiency of the knowledge-enhanced audit analysis services framework.

IT services need an automatic and flexible ability to react to dynamic changes in their environment. Managing change effectively and reducing the negative effects of day-today operations has become one of the most important tasks in IT service management, which require hiring highly skilled IT professionals with correspondingly high labor costs. There is a challenge to select, implement and integrate the right resources quickly and effectively. Although there is a growing body of research into IT management, many techniques are either too narrow (focusing on a single component rather than the entire system), or they address only configuration data collection and integration. Instead, one needs to scale or respond to special domain knowledge, collaboration and the right data for helping IT professionals to improve their work. In this paper, we propose a knowledge-sharing based collaborating management system for IT service management. It aims to bridge the gap between domain experts' knowledge and manageable systems. We developed a proof-of-concept of an impact analysis service based on knowledge-sharing; it establishes an IT service management collaboration paradigm and ecosystem, leveraging the expert's rich knowledge and experience to improve the management quality and reduce the cost. A case study driven by customers demonstrates that collaboration with knowledge sharing is effective both at constructing useful system analysis services and in using those services to improve system management.

SIP flow management should respect the specific characteristics of SIP protocol applied in multimedia or telecom services for meeting stringent quality of service (QoS) requirement. The specific characteristics include explicit session structure for correlating a series of SIP messages, stringent response time required by real-time applications, extra overhead imposed by SIP message retransmission, service differentiation for meeting different business demands. We designed a front-end flow management (FEFM) system for SIP application servers to address these issues. We present the overall architecture of FEFM, the functionalities of primary modules in FEFM and the evaluation results in this paper. The evaluation results show that FEFM has the ability to achieve the tradeoffs among overload protection, QoS assurance and service differentiation.

Service management is becoming more and more important within the area of IT service management. How to efficiently manage and organize service in complicated IT environments with frequent changes is a challenging issue. Service and the related information from different sources are characterized as diverse, incomplete, heterogeneous, and geographically distributed. It is hard to consume these complicated data without knowledge assistant. To address this problem, a knowledge engineering framework is proposed to tackle the challenges of acquisition, structuring and refinement of structured knowledge regarding existing different unstructured information resource, and the Bayesian network is utilized as the knowledge model. This framework can be successfully applied on key tasks in service management, such as problem determination and change impact analysis. And a real example of Cisco VoIP system is introduced to show the usefulness of this method.

We study how to build a front-end flow management system for SIP application servers. This is challenging because of some special characteristics of SIP and SIP applications. (1) SIP flows are well organized into sessions. The session structure should be respected when managing SIP flows. (2) SIP has been adopted by telecom industry, whose applications have more critical QoS requirements than WEB ones. (3) SIP message retransmissions exacerbate the overload situation in case of load bursts; moreover, they may trigger persistent retransmission phenomenon, which retains large response times even after the original burst disappears. To address the combination of these challenges, we propose a novel front-end SIP flow management system FEFM. FEFM integrates concurrency limiting, message scheduling and admission control to achieve overload protection and performance management. It also devises some techniques such as response time prediction, twin-queue scheduling, and retransmission removal to accomplish SLA-oriented improvement, reduce the call rejection rate and banish the persistent retransmission phenomenon. Intensive experiments show that FEFM achieves overload protection in burst period, improves performance significantly, and has the ability to compromise different tradeoffs between throughput and SLA satisfaction.

Learning with very large-scale datasets is always necessary when handling real problems using artificial neural networks. However, it is still an open question how to balance computing efficiency and learning stability, when traditional neural networks spend a large amount of running time and memory to solve a problem with large-scale learning dataset. In this paper, we report the first evaluation of neural network distributed-learning strategies in large-scale classification over protein secondary structure. Our accomplishments include: (1) an architecture analysis on distributed-learning, (2) the development of scalable distributed system for large-scale dataset classification, (3) the description of a novel distributed-learning strategy based on chips, (4) a theoretical analysis of distributed-learning strategies for structure-distributed and data-distributed, (5) an investigation and experimental evaluation of distributed-learning strategy based-on chips with respect to time complexity and their effect on the classification accuracy of artificial neural networks. It is demonstrated that the novel distributed-learning strategy is better-balanced in parallel computing efficiency and stability as compared with the previous algorithms. The application of the protein secondary structure prediction demonstrates that this method is feasible and effective in practical applications.