Vulnerability detection is a crucial aspect of protecting software systems from cyber attacks. However, some types of vulnerabilities are difficult to detect and require analyzing the source code from multi-views. To address this, we propose a general and easily extensible framework, SGVD(Sequential Graph Attention Networks for Vulnerability Detection). SGVD consists of a sequential module that uses the GAT to learn the semantic representations of the code and a novel Fused-Prediction module that extracts useful features from the multi-view source code. We evaluated this framework on a dataset that includes two large-scale open-source C projects. The experiments showed that SGVD had a superior performance compared to the existing advanced graph learning vulnerability detection tools Devign and ReGVd,with an average increase of 12.25% in Accuracy, 13.65% in Precision, 12.04% in F1 score, and 9.14% in Recall.

Information Retrieval-based Bug Localization (IRBL) and Mutation-based Fault Localization (MBFL) are two widely used static and dynamic fault localization techniques, respectively. IRBL takes less time and utilizes more static information of software, while MBFL achieves high accuracy and the results are not easily affected by coincidental correctness test cases. However, the granularity of IRBL is coarse and MBFL consumes a lot of time to generate and execute mutants. In this paper, we propose IRMBFL (Information Retrieval and Mutation Analysis Based Software Fault Localization), a software fault localization technique that combines information retrieval and mutation analysis. First, the suspiciousness of source code files is measured by calculating the text similarity between the bug report and the source code to extract the files which may contain bugs. Then, the extracted files are mutated and tested. Finally, the bug statements are located by analyzing the changes in the execution results of the test cases. The experiments are conducted on the Defects4J dataset and$E_{inspect}{@} n$and EXAM are used as evaluation metrics to evaluate the performance of IRMBFL. The experimental results show that IRMBFL locates 14 and 3 more bug statements than BugLocator and Metallaxis for$E_{inspect}{@}n$when$n=1$. IRMBFL outperforms BugLocator on all projects and outperforms Met-allaxis on 2 out of 6 projects in terms of EXAM. In addition, the average bug localization time overhead of IRMBFL is reduced from 73.87% to 99.78% than Metallaxis.

Recently, deep neural networks (DNN) have been widely applied in various fields, such as image classification, even replace humans to make decisions in some specific tasks. However, like traditional software, DNNs inevitably contain defects. If defective DNN models are applied in safety-critical fields, such as autonomous driving and medical diagnosis, it may cause disastrous consequences. Therefore, effective testing methods are urgently needed to improve the reliability of DNNs. The existing DNN testing methods typically generate test data by either globally modifying the original data or taking adversarial approaches. The generated test data typically struggle to simultaneously achieve good performance in both the degree of difference from the original data and the Error-inducing Success Rate (ESR) with respect to the target DNN model. Moreover, the perturbation-based methods are difficult to be understood by humans. To address the above issue, this paper proposes DeepIA, an interpretability analysis based test data generation method for DNN. DeepIA analyzes the interpretability of decision-making behaviors for DNN. According to the interpretability analysis results, the original training data is split into different regions to evaluate their influences on decision-making results of the DNN. After that, the most significant regions of the original test data are transformed to generate new test data. Experimental results show that the interpretability method effectively enhances the misleading ability of DeepIA for the DNN model under test. Compared with DeepTest and DeepSearch, DeepIA can generate test data with minor permutations and greater ESR.

Natural language processing (NLP) models are vulnerable to adversarial examples. Generating high-quality adversarial examples, which expose the vulnerability of NLP models and can be used to evaluate and improve their robustness, deserves further research. Existing techniques of generating adversarial examples in the NLP field are typically based on greedy synonym replacements, which may result in out-of-context and unnatural perturbations, and are easily identifiable by humans. In this paper, we present MOB-TAG, a Multi-objective Optimization based Textual Adversarial Example Generation method, which includes three types of perturbations, and utilizes pre-trained models such as BERT and RoBERTa to generate high-quality adversarial examples. MOBTAG generates fluent and grammatical output through a mask-then-infill procedure, with introducing multi-objective optimization and genetic algorithm to pursue a high attack success rate while maintaining a high level of similarity and readability. Experimental results show that compared with methods such as TextFooler, BERTAttack, and CLARE, MOBTAG improves the attack success rate and the textual similarity by at least 11.8% and 0.09 on average, respectively.