In modern software systems, early and accurate vulnerability detection is crucial. Traditional Static Analysis Tools (SATs) highlight potential security issues, providing fine-grained information including lines of code and vulnerability categories; however, they are hindered by a large number of false alarms. On the other hand, Artificial Intelligence (AI)-based Vulnerability Prediction (VP) has emerged as a promising alternative for vulnerability identification in software products. Nevertheless, current VP methods face important limitations, such as the granularity level of the predictions, since VP is commonly conducted at the file or function level. In this study, we examine whether the utilization of AI-based vulnerability prediction as a filtering mechanism for static analysis alerts could reduce the number of false alarms, leading to more practical Static Application Security Testing (SAST). The results of the analysis show that this approach improves the practicality of static analysis, reducing false positives, with the impact on the detection accuracy being small.

As society is continuously adapting to technological change and progress, fast-moving digital transformations are the driving force for setting the necessary skillsets for the workforce. Furthermore, the advent of Industry 5.0 as a defining concept for the future, which advocates a human-centric coalescence of humans and technology or software, renders the skilled workforce the most important asset in any organization or business. The endgame of the digital transformation is to evoke the reshaping, evolution, or replacement of traditional and possibly obsolete processes at intra- or inter-organizational levels in multiple aspects, introducing innovative ways of re-defining the workforce. In this context SKILLAB will act as a smart tool for handling, honing, and widening the competencies of the personnel of companies, forecasting future skill gaps and providing European citizens with a tool for upskilling and reskilling.

The rise of Large Language Models (LLMs) has provided new directions for addressing downstream text classification tasks, such as vulnerability prediction, where segments of the source code are classified as vulnerable or not. Several recent studies have employed transfer learning in order to enhance vulnerability prediction taking advantage of the prior knowledge of the pre-trained LLMs. In the current study, different Transformer-based pre-trained LLMs are examined and evaluated with respect to their capacity to predict vulnerable software components. In particular, we fine-tune BERT, GPT-2, and T5 models, as well as their code-oriented variants namely CodeBERT, CodeGPT, and CodeT5 respectively. Subsequently, we assess their performance and we conduct an empirical comparison between them to identify the models that are the most accurate ones in vulnerability prediction.

Vulnerability prediction is an important mechanism for secure software development, as it enables the early identification and mitigation of software vulnerabilities. Vulnerability Prediction Models (VPMs) are Machine Learning (ML) models able to detect potentially vulnerable software components based on information retrieved from their source code. Despite the notable advancements in the field of vulnerability prediction, especially with the utilization of Deep Learning (DL) and text mining techniques, current literature still lacks a highly accurate, reliable, and practical VPM. Recently, the Large Language Models (LLMs), which have demonstrated remarkable capabilities in text understanding and processing, have started being utilized for vulnerability prediction, demonstrating highly promising results. The purpose of the present paper is to explore the utilization of LLMs in the field of vulnerability detection, identify challenges and open issues that still need to be addressed, and potentially propose directions for future research. Our analysis suggests that while LLM-based VPMs have outperformed traditional DL approaches in vulnerability prediction, significant challenges still need to be addressed to be considered sufficiently accurate, reliable, and practical.

Abstract Monitoring technical debt (TD) is considered highly important for software companies, as it provides valuable information on the effort required to repay TD and in turn maintain the system. When it comes to TD repayment, however, developers are often overwhelmed with a large volume of TD liabilities that they need to fix, rendering the procedure effort demanding. Hence, prioritizing TD liabilities is of utmost importance for effective TD repayment. Existing approaches rely on the current TD state of the system; however, prioritization would be more efficient by also considering its future evolution. To this end, the present work proposes a practical approach for prioritization of TD liabilities by incorporating information retrieved from TD forecasting techniques, emphasizing on the class‐level granularity to provide highly actionable results. Specifically, the proposed approach considers the change proneness and forecasted TD evolution of software artifacts and combines it with proper visualization techniques, to enable the early identification of classes that are more likely to become unmaintainable. To demonstrate and evaluate the approach, an empirical study is conducted on six real‐world applications. The proposed approach is expected to facilitate developers better plan refactoring activities, in order to manage TD promptly and avoid unforeseen situations long term.

In recent years, we have witnessed an important increase in research focusing on how machine learning (ML) techniques can be used for software quality assessment and improvement. However, the derived methodologies and tools lack transparency, due to the black-box nature of the employed machine learning models, leading to decreased trust in their results. To address this shortcoming, in this paper we extend the state-of-the-art and -practice by building explainable AI models on top of machine learning ones, to interpret the factors (i.e. software metrics) that constitute a module as in risk of having high technical debt (HIGH TD), to obtain thresholds for metric scores that are alerting for poor maintainability, and finally, we dig further to achieve local interpretation that explains the specific problems of each module, pinpointing to specific opportunities for improvement during TD management. To achieve this goal, we have developed project-specific classifiers (characterizing modules as HIGH and NOT-HIGH TD) for 21 open-source projects, and we explain their rationale using the SHapley Additive exPlanation (SHAP) analysis. Based on our analysis, complexity, comments ratio, cohesion, nesting of control flow statements, coupling, refactoring activity, and code churn are the most important reasons for characterizing classes as in HIGH TD risk. The analysis is complemented with global and local means of interpretation, such as metric thresholds and case-by-case reasoning for characterizing a class as in-risk of having HIGH TD. The results of the study are compared against the state-of-the-art and are interpreted from the point of view of both researchers and practitioners.

Developing modern secure and low-energy applications in a short time imposes new challenges and creates the need of designing new software tools to assist developers in all phases of application development. The design of such tools cannot be considered a trivial task, as they should be able to provide optimization of multiple quality requirements. In this paper, we introduce the SDK4ED platform, which incorporates advanced methods and tools for measuring and optimizing maintainability, dependability and energy. The presented solution offers a com-plete tool-flow for providing indicators and optimization meth-ods with emphasis on embedded software. Effective forecasting models and decision-making solutions are also implemented to improve the quality of the software, respecting the constraints imposed on maintenance standards, energy consumption limits and security vulnerabilities. The use of the SDK4ED platform is demonstrated in a healthcare embedded application.

To date, the identification and quantification of Technical Debt (TD) rely heavily on a few sophisticated tools that check for violations of certain predefined rules, usually through static analysis. Different tools result in divergent TD estimates calling into question the reliability of findings derived by a single tool. To alleviate this issue, we present a tool that employs machine learning on a dataset built upon the convergence of three widely-adopted TD Assessment tools to automatically assess the class-level TD for any arbitrary Java project. The proposed tool is able to classify software classes as high-TD or not, by synthesizing source code and repository activity information retrieved by employing four popular open source analyzers. The classification results are combined with proper visualization techniques, to enable the identification of classes that are more likely to be problematic. To demonstrate the proposed tool and evaluate its usefulness, a case study is conducted based on a real-world open-source software project. The proposed tool is expected to facilitate TD management activities and enable further experimentation through its use in an academic or industrial setting.

Programming upcoming exascale computing systems is expected to be a major challenge. New programming models are required to improve programmability, by hiding the complexity of these systems from application developers. The EXA2PRO programming framework aims at improving developers’ productivity for applications that target heterogeneous computing systems. It is based on advanced programming models and abstractions that encapsulate low-level platform-specific optimizations and it is supported by a runtime that handles application deployment on heterogeneous nodes. It supports a wide variety of platforms and accelerators (CPU, GPU, FPGA-based Data-Flow Engines), allowing developers to efficiently exploit heterogeneous computing systems, thus enabling more HPC applications to reach exascale computing. The EXA2PRO framework was evaluated using four HPC applications from different domains. By applying the EXA2PRO framework, the applications were automatically deployed and evaluated on a variety of computing architectures, enabling developers to obtain performance results on accelerators, test scalability on MPI clusters and productively investigate the degree by which each application can efficiently use different types of hardware resources.

Technical Debt (TD) is a successful metaphor in conveying the consequences of software inefficiencies and their elimination to both technical and non-technical stakeholders, primarily due to its monetary nature. The identification and quantification of TD rely heavily on the use of a small handful of sophisticated tools that check for violations of certain predefined rules, usually through static analysis. Different tools result in divergent TD estimates calling into question the reliability of findings derived by a single tool. To alleviate this issue we use 18 metrics pertaining to source code, repository activity, issue tracking, refactorings, duplication and commenting rates of each class as features for statistical and Machine Learning models, so as to classify them as High-TD or not. As a benchmark we exploit 18.857 classes obtained from 25 Java projects, whose high levels of TD has been confirmed by three leading tools. The findings indicate that it is feasible to identify TD issues with sufficient accuracy and reasonable effort: a subset of superior classifiers achieved an F2-measure score of approximately 0.79 with an associated Module Inspection ratio of approximately 0.10. Based on the results a tool prototype for automatically assessing the TD of Java projects has been implemented.

Proven positive effects of Cooperative Intelligent Transport Systems (C-ITS) are in many cases prohibited by the non-negligible cost required for the initial installation but also maintenance of the infrastructure and the on-board vehicle intelligent systems that need to be deployed for their operation. In parallel, a series of State of the Art cooperative safety and automated solutions do not exploit data directly originating from the infrastructure and the environment, failing, in this way, to have the most reliable possible safety critical information that is vital to the optimum fulfillment of their objectives; that being primarily the increase of traffic safety. SAFE STRIP (SAFE and green Sensor Technologies for self-explaining and forgiving Road Interactive aPplications) EU funded project envisions to simultaneously address those challenges by introducing a revolutionary C-ITS approach through the placement of low-cost innovative sensorial frameworks on the road pavement surface itself in order to acquire reliable and lane specific traffic and environmental information that is directed through I2X (Infrastructure to Everything) communication to all types of vehicles. The current manuscript presents the vision and objectives, the core use cases serving as the proof of concept of the technological solution built, the implementation approach towards delivering the solution and, finally, the multilayered validation approach anticipated by the Consortium towards delivering a prototype of an as much as possible high technological readiness as well as C-ITS functions evidencing its value.

Refactoring is a prevalent technique that can be applied for improving software structural quality. Refactorings can be applied at different levels of granularity to resolve 'bad smells' that can be identified in various artifacts (e.g., methods, classes, packages). A fundamental software engineering principle that can be applied at various levels of granularity is the Single Responsibility Principle (SRP), whose violation leads to the creation of lengthy, complex and non-cohesive artifacts; incurring smells like Long Method, God Class, and Large Package. Such artifacts, apart from being large in size tend to implement more than one functionalities, leading to decreased cohesion, and increased coupling. In this paper, we study the effect of applying refactorings that lead to conformance to the SRP, at all three levels of granularity to identify possible differences between them. To study these differences, we performed an industrial case study on two large-scale software systems (more than 1,500 classes). Since SRP is by definition related to modularity, as a success measure for the refactoring we use coupling and cohesion metrics. The results of the study can prove beneficial for both researchers and practitioners, since various implications can be drawn.

Carpooling is a mobility concept that appears to be the answer when it comes to challenges in urban mobility derived by population growth. In carpooling, the same amount of people move with fewer vehicles leading to reduced traffic congestion and consequently to less CO2 emissions, fuel consumption and drivers frustration. However, there has always been scepticism around carpooling due to the inherent mistrust between drivers and passengers. In recent years, some reputation systems have been proposed to reduce the impact of mistrust on carpooling applications. Among them, the work of Salamanis et al. (Salamanis, 2018), in which a reputation assessment mechanism based on clustering users travel preferences, was introduced. In this paper, we provide an extended version of the previous mechanism and we thoroughly evaluate its robustness in relation with different types of malicious attacks and clustering algorithms. In addition, we compare our mechanism with a benchmarking reputation system that utilizes the simple arithmetic mean to calculate reputation values based on users ratings. The evaluation results indicate that the extended reputation assessment mechanism exhibits more robust behavior compared to the benchmarking system in all types of attacks when using the hierarchical clustering algorithm.

Providing efficient, sustainable and personalized mobility services in urban environments that combine a spectrum of transport modes (e.g., public transport, electric vehicles, vehicle sharing, low energy and/or emission routes) constitutes a great challenge. In this work, we present MOVESMART, a holistic approach (and integrated platform) for the provision of renewable personal mobility services, leveraging crowd-sourcing data, tools for collecting real-time information by multimodal travelers, and traffic prediction mechanisms. MOVESMART guarantees real-time responses to renewable (on-demand) mobility queries for efficient multi-modal route planning that are time-dependent as well as sensitive to aperiodic incidents and traffic prediction forecasts. This paper focuses on the cloudbased (backend) services of the MOVESMART platform.

The reduction of road congestion requires intuitive urban congestion-control platforms that can facilitate transport stakeholders in decision making. Interactive ITS visual analytics tools can be of significant assistance, through their real-time interactive visualizations, supported by advanced data analysis algorithms. In this paper, an interactive visual analytics platform is introduced that allows the exploration of historical data and the prediction of future traffic through a unified interactive interface. The platform is backed by several data analysis techniques, such as road behavioral visualization and clustering, anomaly detection, and traffic prediction, allowing the exploration of behavioral similarities between roads, the visual detection of unusual events, the testing of hypotheses, and the prediction of traffic flow after hypothetical incidents imposed by the human operator. The accuracy of the prediction algorithms is verified through benchmark comparisons, while the applicability of the proposed toolkit in facilitating decision making is demonstrated in a variety of use case scenarios, using real traffic and incident data sets.

Mobility of people and goods in urban environments raises several quality and sustainability concerns. While ICTs have established the ground for developing intelligent transport services, their effective use for supporting cleaner urban mobility still represents a major research challenge. The eCOMPASS research project addressed this challenge through introducing new mobility concepts and establishing a methodological framework for route planning optimization, delivering a comprehensive set of innovative tools and services for end-users to enable eco-awareness in urban transport. eCOMPASS innovative tools are based on new algorithmic technology concerning tools and methods for vehicle routing (cars and vehicle fleets) and multimodal human mobility for city dwellers and tourists. eCOMPASS involved a generic architecture that considered all types and scenarios of human and goods mobility in urban environments minimizing their environmental impact. In this work, we report on the main scientific innovations and end-products of eCOMPASS for vehicle routing, including car route planning and vehicle fleets.

The exploration of the potential correlations of traffic conditions between roads in large urban networks, which is of profound importance for achieving accurate traffic prediction, often implies high computational complexity due to the implicated network topology. Hence, focal methods are required for dealing with the urban network complexity, reducing the performance requirements that are associated to the classical network search techniques (e.g., Breadth First Search). This paper introduces a graph-theory-based technique for managing spatial dependence between roads of the same network. In particular, after representing the traffic network as a graph, the local neighbors of each road are extracted using Breadth First Search graph traversal algorithm and a lower complexity variant of it. A Pearson product-moment correlation-coefficient-based metric is applied on the selected graph nodes for a prescribed number of level sets of neighbors. In order to evaluate the impact of the new method to the traffic prediction accuracy achieved, the most correlated roads are used to build a STARIMA model, taking also into account the possible time delays of traffic conditions between the interrelated roads. The proposed technique is benchmarked using traffic data from two different cities: Berlin, Germany, and Thessaloniki, Greece. Benchmark results not only indicate significant improvement on the computational time required for calculating traffic correlation metric values but also reveal that a different variant works better in different network topologies, after comparison to third-party approaches.

SUMMARY The addition of semantic information into Web services (WS) results in more accurate search and retrieval in service registries. The key issue to facilitate organization of services, taking into account their semantics, is the development of automatic mechanisms that generate appropriate mappings between Web service elements and their semantics‐enabled counterparts. In this paper, we introduce an ontology‐based mechanism for automatic semantic categorization of WS and their structural components. The presented approach, as opposed to similar ones, takes into account the lexicographic, structural, and data type characteristics of WS. Moreover, a software tool that implements the proposed service categorization mechanism is presented, and a benchmark process is executed that reveals outstanding performance of the developed mechanism in comparison with a relevant state‐of‐the‐art approach. Copyright © 2011 John Wiley & Sons, Ltd.

This paper presents a semantic rule-based system for the composition of successful algorithmic pathways capable of solving medical computational problems (MCPs). A subset of medical algorithms referring to MCP solving concerns well-known medical problems and their computational algorithmic solutions. These solutions result from computations within mathematical models aiming to enhance healthcare quality via support for diagnosis and treatment automation, especially useful for educational purposes. Currently, there is a plethora of computational algorithms on the web, which pertain to MCPs and provide all computational facilities required to solve a medical problem. An inherent requirement for the successful construction of algorithmic pathways for managing real medical cases is the composition of a sequence of computational algorithms. The aim of this paper is to approach the composition of such pathways via the design of appropriate finite-state machines (FSMs), the use of ontologies, and SWRL semantic rules. The goal of semantic rules is to automatically associate different algorithms that are represented as different states of the FSM in order to result in a successful pathway. The rule-based approach is herein implemented on top of Knowledge-Based System for Intelligent Computational Search in Medicine (KnowBaSICS-M), an ontology-based system for MCP semantic management. Preliminary results have shown that the proposed system adequately produces algorithmic pathways in agreement with current international medical guidelines.