CONTEXT: Information retrieval-based bug localization (IRBL) is a promising approach for efficiently identifying buggy software modules in response to user bug reports. Supervised learning techniques were adopted to improve the bug localization performance, but they brought the cold-start problem due to insufficient training data. Recent studies focused on transfer learning techniques to utilize cross-project data. These techniques improved performance but left a question regarding better cross-project data selection. OBJECTIVE: To evaluate the effectiveness of bellwether projects, which are exemplary cross-project data better than the others for training a cross-project bug localization model. METHOD: With a bug localization method, the performance of cross-project bug localization was observed to find bellwether projects and to evaluate its effective usage for bug localization. RESULTS: One cross-project was dominantly better than the others. Also, it was often helpful to mix a bellwether project with the small available within-project data to improve the localization performance. CONCLUSION: A practical implication is to select cross-project data supported by cross-project bug localization on other projects. Mixing it with target project data is often beneficial at an early phase.

CONTEXT: Web applications are exposed to malicious accesses through the Internet. SQL injection (SQLi) attacks are still a typical threat to web application providers. Although recent studies proposed deep learning-based SQLi attack detection models with high performance, those studies were not evaluated under the same conditions. Crucial aspects other than the predictive performance were also overlooked. OBJECTIVE: To evaluate SQLi attack detection models from multi-aspects related to its operation. METHOD: Three aspects, namely, predictive performance, detection speed, and operation costs, were applied to deep learning-based SQLi attack detection models. RESULTS: No DL-based model beaten a conventional machine learning-based model, Random Forests. CONCLUSION: Researchers must evaluate DL-based SQLi attack detection models with conventional ones with hyper-parameter tuning.

Infrastructure as Code (IaC) has become the de-facto standard method for managing cloud resources. Just like general source code (e.g., Java, etc.), infrastructure code also has numerous bugs so it needs to be tested. While several testing frameworks for IaC for cloud systems have been developed in practice, researchers have paid little attention to their testing. This study presents an empirical investigation of the use of tests for IaC for cloud systems. Our empirical results show that (i) 55.2% of the repositories using Terratest have at least one server infrastructure test; (ii) developers often maintain server infrastructure tests (1.7%-11.3% commits out of all the commits); (iii) many repositories have tests for system functionality (28%), deployment (20%), and configuration (17%).

Federated learning trains a model on a centralized server using datasets distributed over a massive amount of edge devices. Since federated learning does not send local data from edge devices to the server, it preserves data privacy. It transfers the local models from edge devices instead of the local data. However, communication costs are frequently a problem in federated learning. This paper proposes a novel method to reduce the required communication cost for federated learning by transferring only top updated parameters in neural network models. The proposed method allows adjusting the criteria of updated parameters to trade-off the reduction of communication costs and the loss of model accuracy. We evaluated the proposed method using diverse models and datasets and found that it can achieve comparable performance to transfer original models for federated learning. As a result, the proposed method has achieved a reduction of the required communication costs around 90% when compared to the conventional method for VGG16. Furthermore, we found out that the proposed method is able to reduce the communication cost of a large model more than of a small model due to the different threshold of updated parameters in each model architecture.

In the field of data science, and for academics in general, the Python programming language is a popular choice, mainly because of its libraries for storing, manipulating, and gaining insight from data. Evidence includes the versatile set of machine learning, data visualization, and manipulation packages used for the ever-growing size of available data. The Zen of Python is a set of guiding design principles that developers use to write acceptable and elegant Python code. Most principles revolve around simplicity. However, as the need to compute large amounts of data, performance has become a necessity for the Python programmer. The new idea in this paper is to confirm whether writing the Pythonic way peaks performance at scale. As a starting point, we conduct a set of preliminary experiments to evaluate nine Pythonic code examples by comparing the performance of both Pythonic and Non-Pythonic code snippets. Our results reveal that writing in Pythonic idioms may save memory and time. We show that incorporating list comprehension, generator expression, zip, and itertools.zip_longest idioms can save up to 7,000 MB and up to 32.25 seconds. The results open more questions on how they could be utilized in a real-world setting. The replication package includes all scripts, and the results are available at https://doi.org/10.5281/zenodo.5712349

This study explores estimation of grasping region of objects from gaze data. Our study distinguishes from previous works by accounting for "grasping uniformity" of the objects. In particular, we consider three types of graspable objects: (i) with a well-defined graspable part (e.g. handle), (ii) without a grip but with an intuitive grasping region, (iii) without any grip or intuitive grasping region. We assume that these types define how "uniform" grasping region is across different graspers. In experiments, we use "Learning to grasp" data set and apply the method of [Pramot et al. 2018] for estimating grasping region from gaze data. We compute similarity of estimations and ground truth annotations for the three types of objects regarding subjects (a) who perform free viewing and (b) who view the images with the intention of grasping. In line with many previous studies, similarity is found to be higher for non-graspers. An interesting finding is that the difference in similarity (between free viewing and motivated to grasp) is higher for type-iii objects; and comparable for type-i and ii objects. Based on this, we believe that estimation of grasping region from gaze data offers a larger potential to "learn" particularly grasping of type-iii objects.

CONTEXT: Architecture and design of systems are sensitive to non-functional requirements (NFRs). Identifying NFRs and their categories at early phase is an essential task for project success. Automatic classification methods for that purpose have been studied for supporting requirement analysis. The past studies used simple vectorization methods and might miss semantics and interactions among words in requirements. OBJECTIVE: To examine whether different vectorization methods lead to differences in the classification performance of NFRs and their categories. METHOD: Comparative experiments were conducted with open data. Five vectorization methods including document embedding methods and four supervised classification methods were supplied. RESULTS: Some advanced methods could achieve better performance than traditional ones. The preference was dependent on classification methods. CONCLUSIONS: It is beneficial to consider using advanced methods for classifying non-functional requirements categories.

Software ecosystems have had a tremendous impact on computing and society, capturing the attention of businesses, researchers, and policy makers alike. Massive ecosystems like the JavaScript node package manager (npm) is evidence of how packages are readily available for use by software projects. Due to its high-dimension and complex properties, software ecosystem analysis has been limited. In this paper, we leverage topological methods in visualize the high-dimensional datasets from a software ecosystem. Topological Data Analysis (TDA) is an emerging technique to analyze high-dimensional datasets, which enables us to study the shape of data. We generate the npm software ecosystem topology to uncover insights and extract patterns of existing libraries by studying its localities. Our real world example reveals many interesting insights and patterns that describes the shape of a software ecosystem.

Time zone, different work schedule, limited real-time information sharing, steep learning curve and different personal specialties, these are common limitations in the collaborative studies, especially when a researcher has just been introduced to the research field or working in a different environment (i.e. Internship programs). This paper introduces you with the experiences, challenges, difficulties, lessons learned, common fallacies and pitfalls in the collaborative software engineering research through the experience of 2-months collaborative research program between Kasetsart University in Thailand and Nara Institute of Science and Technology in Japan. Good mentoring and flat-style communication between professors and students are good indicators of the high quality result in the internship program. These information can be useful to professors, young researchers and internship students who will be conducting researches in such manner.

This paper presents a framework to specify and verify integrated services of a home network system (HNS). We first develop a modeling language to describe the HNS and the integrated services. Complementing our previous work, the language captures each appliance as an object consisting of properties and methods, encapsulating the underlying protocols and platforms. We then present a method that verifies the integrated services with symbolic model checking, by translating the proposed language into the SMV (symbolic model verifier) language. Thus, it is possible to validate if the integrated service is specified as intended, automatically and exhaustively. Using the proposed framework, service developers can effectively detect design flaws in a single integrated service, as well as feature interactions among multiple services, in early stages of service development.

The programmable service for Internet telephony (VoIP) allows end-users or third parties to define their own customized services. However, it imposes a serious drawback that service description created by end-users is likely to contain problems that are semantically ambiguous or inconsistent. To cope with this problem, we have so far proposed semantic warnings, which are the guidelines to guarantee the semantic correctness for the CPL (call processing language) programmable service environment. We evaluate the proposed semantic warnings with practical VoIP system, VOCAL (Vovida open communication application library). In the experiment, the proposed warnings revealed a semantic redundancy in a ready-made feature of VOCAL. It is also shown that customized features containing the semantic warnings often led VOCAL to problematic situations. Thus, the proposed warnings can help feature provisioning system to detect semantic flaws in programmable service environment.