The presence of software vulnerabilities is a serious threat to any software project. Exploiting them can compromise system availability, data integrity, and confidentiality. Unfortunately, many open source projects go for years with undetected ready-to-exploit critical vulnerabilities. In this study, we investigate the presence of software vulnerabilities in open source projects and the factors that influence this presence. We analyzed the top 100 open source PHP applications in GitHub using a static analysis vulnerability scanner to examine how common software vulnerabilities are. We also discussed which vulnerabilities are most present and what factors contribute to their presence. We found that 27% of these projects are insecure, with a median number of 3 vulnerabilities per vulnerable project. We found that the most common type is injection vulnerabilities, which made 58% of all detected vulnerabilities. Out of these, cross-site scripting (XSS) was the most common and made 43.5% of all vulnerabilities found. Statistical analysis revealed that project activities like branching, pulling, and committing have a moderate positive correlation with the number of vulnerabilities in the project. Other factors like project popularity, number of releases, and number of issues had almost no influence on the number of vulnerabilities. We recommend that open source project owners should set secure code development guidelines for their project members and establish secure code reviews as part of the project's development process.

Many software projects are shipped to customers containing defects. Defective software cost money, time, and lives. To reduce this harm, software companies allocate testing and quality assurance budgets. The enormous sizes of modern software pose challenges to traditional testing approaches due to the need for scalability. Defect prediction models have been used to direct testing efforts to probable causes of defects in the software. Early approaches for software defect prediction relied on statistical approaches to classify software modules and decide whether each module is a defect-prone module or not. Lately, many researchers used machine learning techniques to train a model that can classify software modules to defect-prone modules and not defect-prone modules. Starting from the new millennium, neural networks and deep learning won many competitions in machine learning applications. However, the use of deep learning to build a software defect prediction model was not investigated thoroughly. In this paper, we used a deep neural network to build a software defect prediction model and compared our proposed model with other machine learning algorithms like random forests, decision trees, and naive Bayesian networks. The result shows small improvement over the other learning models in most of the comparisons. These results prove the value of using deep learning for defect prediction and open the door for more experiments.

Source-to-source transformation is an important tool for migrating key legacy programs to modern languages and platforms and giving them new life. Many organizations cannot do without their legacy systems on the one hand, but are stuck in an old technology on the other hand. Converting to a newer programming language can ease integration with modern technologies, give access to a wider developers population and/or lower maintenance costs. Serious language conversion efforts use automated tools, since manual conversion is out of question for non- trivial programs. We present our experiment in building a Java to C# transformer, Java2C#, that partially converts legacy Java code (version 1.1 or earlier) to C#. Java2C# is written in TXL, a language specially designed for program transformation, using tree re-writing. We explore and discuss the challenges and issues to consider when automatically transforming Java to C# and when building automated language transformers in general.

Software engineering curricula emphasize developing new software systems. Little attention is given to how to change and modernize existing systems, i.e., the theory and practice of software maintenance and reengineering. This paper presents the author's experience in teaching software reengineering in a masters-level course at University of Leicester, UK. It presents the course objectives, outline and the lessons learned. The main lessons are: first, there is a big shortage of educational materials for teaching software reengineering. Second, selecting the suitable materials (that balance theory and practice) and the right tool(s) for the level of students and depth of coverage required is a difficult task. Third, teaching reengineering using toy exercises and assignments does not convey the practical aspects of the subject. While, teaching with real, even small size, exercises and assignments, is almost infeasible. Getting the balance right requires careful consideration and experimentation. Finally, students understand and appreciate this topic much more if they have previous industrial experience and when they are presented with real industrial case studies.

Abstract The number of Web users and the diversity of their interests increase continuously; Web‐content providers seek to infer these interests and to adapt their Web sites to improve accessibility of the offered content. Usage‐pattern mining is a promising approach in support of this goal. Assuming that past navigation behavior is an indicator of the users' interests, then, Web‐server logs can be mined to infer what the users are interested in. On that basis, the Web site may be reorganized to make the interesting content more easily accessible or recommendations can be dynamically generated to help new visitors find information of interest faster. In this paper, we discuss a case study examining the effectiveness of sequential‐pattern mining for understanding the users' navigation behavior in focused Web sites. This study examines the Web site of an undergraduate course, as an example of a focused Web site that offers information intrinsically related to a process and closely reflects the workflow of this underlying process. We found that in such focused sites, indeed, visitor behavior reflects the process supported by the Web site and that sequential‐pattern mining can effectively predict Web‐usage behavior in these sites. Copyright © 2004 John Wiley & Sons, Ltd.

In the context of the CelLEST project, we have been investigating the problem of reengineering and reusing the services provided by legacy applications, running on mainframe hosts. This work has resulted in a suite of methods, based on understanding and modeling the users' interaction with the legacy-application interface. These methods aim at (a) modeling the behavior of the legacy user interface as a state-transition diagram, (b) recovering specifications for the application's functions by discovering the users' tasks as frequently occurring interaction patterns, and (c) constructing new user-interface front-ends to make the recovered legacy functions accessible through the Web. We describe the overall process for legacy migration to the World Wide Web, using the CelLEST methods, and we illustrate it with an example case study.

A key challenge facing IT organizations today is their evolution towards adopting e-business practices that gives rise to the need for reengineering their underlying systems. Any reengineering effort has to be aware of the functional requirements of the subject system, in order not to violate the integrity of its intended uses. However, as systems get regularly maintained throughout their lifecycle, the documentation of their requirements often become obsolete or get lost. To address this problem of software requirements loss, we have developed an interaction-pattern mining method for the recovery of functional requirements as usage scenarios. Our method analyzes traces of the run-time system-user interaction to discover frequently recurring patterns; these patterns correspond to the functionality currently exercised by the system users, represented as usage scenarios. The discovered scenarios provide the basis for reengineering the system into web-accessible components, each one supporting one of the discovered scenarios. In this paper, we describe IPM2, our interaction-pattern discovery algorithm, we illustrate it with a case study from a real application and we give an overview of the reengineering process in the context of which it is employed.

As software systems age, the requirements that motivated their original development get lost. Requirements documentation is unavailable or obsolete. Recapturing these requirements is critical for software reengineering activities. In our CelLEST process we adopt a data-mining approach to this problem and attempt to discover patterns of frequent similar episodes in the sequential run-time traces of the legacy user-interface behavior. These patterns constitute operational models of the application's functional requirements, from the end-user perspective. We have developed an algorithm, IPM, for interaction-pattern discovery. This algorithm discovers patterns that meet a user-specified criterion and is robust to insertion errors, caused by user mistakes or by the availability of alternative scenarios for the same user task. In this paper, we discuss IPM and we evaluate it with a case study.

No abstract available.