Vulnerability detection plays a crucial role in the software development lifecycle. Commit-level vulnerability detection aims to detect whether the changed code contributed to potential vulnerabilities by the developer when submitting the code, which is also referred to as Just-In-Time (JIT) vulnerability detection. Previous JIT vulnerability detection approaches relied on code metrics and textual features, which were unable to effectively characterize vulnerability-contributing commits (VCCs). Recently, CodeJIT (a code-centric learning-based approach) has been proposed to detect vulnerability at the commit-level. However, CodeJIT still has its limitations: imprecise feature representation, static code embedding, and underutilized heterogeneous information. In this paper, we propose HgtJIT, a JIT vulnerability detection approach based on a Heterogeneous Graph Transformer (HGT) in order to address several limitations of the state-of-the-art CodeJIT approach. We propose diffPDG to represent code changes and use the CCT5 model (the latest feature encoder pre-trained on a large-scale code change corpus) to embed graph nodes to generate the most meaningful vector representations. In addition, we employ HGT to adequately utilize heterogeneous information of the graph to learn vulnerability features. Extensive experiments have shown that HgtJIT is the best-performing model, with F1 and AUC improvement of 14.6%-37.5% and 12.2%-53.7% compared to the baseline model

The reentrancy vulnerability is one of the most notorious vulnerabilities of smart contracts. It enables attackers to hijack the control flow of a smart contract by invoking a function as the entry point and then re-invoking a function as the reentry point before the execution of the entry point ends. Although several approaches have been proposed to detect this vulnerability, they still face two main limitations. Firstly, existing approaches oversimplify the rules for identifying entry and reentry points, and many even neglect reentry point identification during vulnerability detection. Secondly, most existing approaches overlook the flow of state variables that are not promptly updated, a critical aspect of the reentrancy vulnerability. To address the limitations mentioned above, this article proposes a novel static analysis framework for reentry vulnerability detection. We formulate the reentrancy vulnerability detection as entry and reentry point identification with the state variable flow tracking. Based on the insight that most smart contracts are implemented following various technical standards, we utilize static analysis with standard-based rules to identify potential entry and reentry points. This is achieved by detecting the presence of hijackable and exploitable operations inside the smart contract. Meanwhile, we also conduct state variable flow tracking by the static taint analysis. To verify the effectiveness of our proposed approach, we construct three different datasets. Then We compare our approach with eight state-of-the-art smart contract vulnerability detectors, and our tool outperforms these baselines in detecting more vulnerable samples with fewer false positive samples. Meanwhile, our approach achieves a relatively shorter detection time with better detection results, striking a trade-off between effectiveness and efficiency.

A series of discrete time-variant matrix inequalities is generally regarded as one of the challenging problems in science and engineering fields. As a discrete time-variant problem, the existing solving schemes generally need the theoretical support under the continuous-time framework, and there is no independent solving scheme under the discrete-time framework. The theoretical deficiency of solving scheme greatly limits the theoretical research and practical application of discrete time-variant matrix inequalities. In this article, new discrete-time recurrent neural network (RNN) algorithms are proposed, analyzed, and investigated for solving different time-variant matrix inequalities under the discrete-time framework, including discrete time-variant matrix vector inequality (discrete time-variant MVI), discrete time-variant generalized matrix inequality (discrete time-variant GMI), discrete time-variant generalized-Sylvester matrix inequality (discrete time-variant GSMI), and discrete time-variant complicated-Sylvester matrix inequality (discrete time-variant CSMI), and all solving processes are based on the direct discretization thought. Specifically, first of all, four discrete time-variant matrix inequalities are presented as the target problems of these researches. Second, for solving such problems, we propose corresponding discrete-time recurrent neural network (RNN) (DT-RNN) algorithms (termed DT-RNN-MVI algorithm, DT-RNN-GMI algorithm, DT-RNN-GSMI algorithm, and DT-RNN-CSMI algorithm), which are different from the traditional DT-RNN design thought because second-order Taylor expansion is applied to derive the DT-RNN algorithms. This creative process avoids the intervention of continuous-time framework. Then, theoretical analyses are presented, which show the convergence and precision of the DT-RNN algorithms. Abundant numerical experiments are further carried out, which further confirm the excellent properties of the DT-RNN algorithms.

Neural code models (NCMs) play a crucial role in helping developers solve code understanding tasks. Recent studies have exposed that NCMs are vulnerable to several security threats, among which backdoor attack is one of the toughest. It is usually achieved through data poisoning. Specifically, backdoored NCMs work normally on the clean example but produce attacker-expected output on the example injected with backdoor triggers. However, existing backdoor attacks against NCMs face two significant drawbacks: 1) lack of stealthiness, that is trigger tokens are easily detected by defense techniques/humans when they appear in excessive numbers; 2) damage to the model’s normal performance, that is partial trigger tokens may frequently appear as benign features in the clean samples, resulting in clean samples containing them may falsely activate the backdoor. To address these drawbacks, we propose a misactivation-aware stealthy backdoor attack against NCMs through data poisoning called MISNCM. MISNCM features target-biased trigger generation, thus achieving stealthy backdoor attacks. Moreover, we utilize misactivation-aware data poisoning to create calibration samples with partial trigger tokens to reduce false activations and ensure the regular performance of the model. We conduct comprehensive experiments to evaluate the effectiveness of MISNCM in attacking NCMs used for three code understanding tasks: defect detection, clone detection, and authorship attribution. The experimental results demonstrate that the triggers generated by MISNCM achieve an average attack success rate increase of 12.67% over IR and 8.38% over AFRAIDOOR. Furthermore, MISNCM achieves a 3.64% improvement in F1 score on the code clone detection task, and an average of 5.91% improvement in accuracy on the defect detection and authorship attribution tasks, compared with the two baselines.

Recently, Graph Neural Network (GNN)-based vulnerability detection systems have achieved remarkable success. However, the lack of explainability poses a critical challenge to deploy black-box models in security-related domains. For this reason, several approaches have been proposed to explain the decision logic of the detection model by providing a set of crucial statements positively contributing to its predictions. Unfortunately, due to the weakly-robust detection models and suboptimal explanation strategy, they have the danger of revealing spurious correlations and redundancy issue.

Deep Learning (DL) has emerged as a promising means for vulnerability detection due to its ability to automatically derive features from vulnerable code. Unfortunately, current solutions struggle to focus on vulnerability-related parts of vulnerable functions, and tend to exploit spurious correlations for prediction, thus undermining their effectiveness in practice. In this paper, we propose Snopy, a novel DL-based approach, which bridges sample denoising with causal graph learning to capture real vulnerability patterns from vulnerable samples with numerous noise for effective detection. Specifically, Snopy adopts a change-based sample denoising approach to automatically weed out vulnerability-irrelevant code elements in the vulnerable functions without sacrificing the label accuracy. Then, Snopy constructs a novel Causality-Aware Graph Attention Network (CA-GAT) with Feature Caching Scheme (FCS) to learn causal vulnerability features while maintaining efficiency. Experiments on the three public benchmark datasets show that Snopy outperforms the state-of-the-art baselines by an average of 27.22%, 85.89%, and 75.50% in terms of F1-score, respectively.

Abstract Application programming interface (API) recommendation plays a crucial role in facilitating smart contract development by providing developers with a ranked list of candidate APIs for specific recommendation points. Deep learning‐based approaches have shown promising results in this field. However, existing approaches mainly rely on token sequences or abstract syntax trees (ASTs) for learning recommendation point‐related features, which may overlook the essential knowledge implied in the relations between or within statements and may include task‐irrelevant components during feature learning. To address these limitations, we propose a novel code graph called pruned and augmented AST (pa‐AST). Our approach enhances the AST by incorporating additional knowledge derived from the control and data flow relations between and within statements in the smart contract code. Through this augmentation, the pa‐AST can better represent the semantic features of the code. Furthermore, we conduct AST pruning to eliminate task‐irrelevant components based on the identified flow relations. This step helps mitigate the interference caused by these irrelevant parts during the model feature learning process. Additionally, we extract the API sequence surrounding the recommendation point to provide supplementary knowledge for the model learning. The experimental results demonstrate our proposed approach achieving an average mean reciprocal rank (MRR) of 68.02%, outperforming the baselines' performance. Furthermore, through ablation experiments, we explore the effectiveness of our proposed code representation approach. The results indicate that combining pa‐AST with the API sequence yields improved performance compared with using them individually. Moreover, our AST augmentation and pruning techniques significantly contribute to the overall results.

Abstract Vulnerability classification is a significant activity in software development and software maintenance. Natural Language Processing (NLP) techniques, which utilize the descriptions in public repositories, are widely used in automatic software vulnerability classification. However, vulnerability descriptions are ordinarily short and contain many technical terms, making them difficult for machines to automatically comprehend. In this paper, we present an approach based on vulnerability triggers to automatically classify vulnerabilities. First, we extract vulnerability triggers with Bert Question and Answer (Bert Q&A). Then, we use Recurrent Convolutional Neural Networks for Text classification (TextRCNN) to classify vulnerabilities based on Common Weakness Enumeration (CWE). We statistically perform an analysis of vulnerability triggers and comprehensively evaluate the classification performance of our approach on a set of 4769 prelabeled vulnerability entries, as well as compare it with state‐of‐the‐art vulnerability classification approaches. Experiment results show that our approach can achieve a F1‐measure of 95% on extraction and 80.8% on classification.

As with anything connected to the internet, industrial Internet of Things (IIoT) devices are also subject to severe cybersecurity threats because an adversary could exploit vulnerabilities in their internal software to perform malicious attacks. Despite the promising results of deep learning-based approaches, most solutions can only detect the presence of a vulnerability but fail to pinpoint its corresponding type. Recently, TreeVul formalizes the task as a hierarchical multilabel classification problem to predict complete coarse-to-fine vulnerability type hierarchy. Yet, the TreeVul approach is still inaccurate and neglects samples labeled at coarse categories. In this article, we proposeHierVul, a novel hierarchy-aware representation learning approach for IIoT vulnerability classification. Specifically, to make full use of vulnerable samples labeled at any granularity,HierVulconstructs hierarchy-specific extractors as well as classifiers to disentangle level-wise vulnerability features from the code representation learning network backbone, and maximizes their marginal probability in the probability space constrained by the Common Weakness Enumeration tree hierarchy. Furthermore, considering that the distinction between two vulnerability types at the same level of abstraction becomes smaller and smaller as the refinement of classification granularity,HierVulleverages residual connections to add parent-level coarser-grained features to child-level finer-grained features to transfer hierarchical knowledge across levels. The experimental results show thatHierVulachieves 15.25%, 45.16%, and 14.52% relative improvement over TreeVul on Weight F1, Macro F1, and PF, respectively, indicating the effectiveness ofHierVulin the practical scenario.

Time-variant problems are widespread in science and engineering, and discrete-time recurrent neurodynamics (DTRN) method has been proved to be an effective way to deal with a variety of discrete time-variant problems. However, this DTRN method is usually based on the study of continuous time-variant problems and lacks a direct study of discrete time-variant problems. To solve the abovementioned problem, based on a pioneering direct discretization technique, we study and develop a new DTRN method to solve equality-constrained discrete time-variant nonlinear optimization (EC-DTVNO) problem. Specifically, first, to solve the EC-DTVNO problem, the recent method widely used by researchers is Lagrange multiplier method. By introducing Lagrange multiplier to construct Lagrange function, the objective function and equality constraint are integrated into a discrete time-variant nonlinear system. Then, the corresponding error function is defined, and the corresponding DTRN method for solving the EC-DTVNO problem can be obtained by direct discretization technique. Thereafter, this DTRN method is analyzed theoretically and its convergence is proved. In addition, numerical experiments and application experiments further confirm the effectiveness and superiority of DTRN method.

Memory-related vulnerabilities can result in performance degradation or even program crashes, constituting severe threats to the security of modern software. Despite the promising results of deep learning (DL)-based vulnerability detectors, there exist three main limitations: (1) rich contextual program semantics related to vulnerabilities have not yet been fully modeled; (2) multi-granularity vulnerability features in hierarchical code structure are still hard to be captured; and (3) heterogeneous flow information is not well utilized. To address these limitations, in this article, we propose a novel DL-based approach, called MVD+ , to detect memory-related vulnerabilities at the statement-level. Specifically, it conducts both intraprocedural and interprocedural analysis to model vulnerability features, and adopts a hierarchical representation learning strategy, which performs syntax-aware neural embedding within statements and captures structured context information across statements based on a novel Flow-Sensitive Graph Neural Networks, to learn both syntactic and semantic features of vulnerable code. To demonstrate the performance, we conducted extensive experiments against eight state-of-the-art DL-based approaches as well as five well-known static analyzers on our constructed dataset with 6,879 vulnerabilities in 12 popular C/C++ applications. The experimental results confirmed that MVD+ can significantly outperform current state-of-the-art baselines and make a great trade-off between effectiveness and efficiency.

The Ponzi scheme implemented through smart contracts is one of the most common scams on the blockchain platform. Although various learning-based Ponzi smart contract detection approaches have been proposed, they still suffer from several limitations, i.e., 1) extracting insufficient semantics and gathering Ponzi irrelevant components from the smart contract during feature engineering, and 2) underutilizing structured semantic features during model training. As the Ponzi scheme is an economic crime with the typical Rob-Peter-to-Pay-Paul transaction pattern, we propose a transaction semantic learning based approach to mitigate the above limitations. The fundamental idea of our approach is to represent the transaction-related semantics of a smart contract as a graph and utilize a graph convolutional network (GCN) to learn the potential Ponzi-like transaction pattern from it. We define a novel code representation named slice transaction property graph (sTPG) to represent the transaction-related semantics, which can encode multiple transaction-related semantics inside a smart contract function into a graph and eliminate other irrelevant fragments. Then, we propose a relation-sensitive GCN as the learning model to identify potential Ponzi-scheme-like transaction patterns from sTPG by considering both nodes and edges features in sTPG. We evaluate our approach on two datasets: 1) smart contracts collected from Forum and Public datasets, and 2) really deployed smart contracts on the Ethereum blockchain. The experiment results show that our approach outperforms the state-of-the-art learning-based approaches.

rgb0.00,0.00,0.00 In recent years, the discrete-time recurrent neural network (DTRNN) model has received growing attention. This fully benefits from the recurrent neural networks (RNNs) that not only have plenty of advantages for solving computing problems in the real-time tracking control but also have the remarkable potential of parallel processing and nonlinear processing. However, there is a general lack of research on the applicability of DTRNN model to handle parallel robot. In addition, the precision is always an important point in real-time tracking control, and most of existing studies generally lack the elaborate researches on the precision analyses. In this article, the corresponding DTRNN model (i.e., general five-instant discretization (FID) formula DTRNN model) with parameter selection method is established. As one of the important theoretical contributions, the dominant term of truncation error of discretization formula and the conditions of maintaining precision of corresponding DTRNN model are proved from the mathematical view strictly. Besides, the influence of the selected parameter for the precision of such a DTRNN model is also analyzed. Finally, the above theoretical analyses are verified in the tracking control experiments of the Stewart platform, which is a widely used and representative parallel robot.

Java (de)serialization is prone to causing security-critical vulnerabilities that attackers can invoke existing methods (gadgets) on the application's classpath to construct a gadget chain to perform malicious behaviors. Several techniques have been proposed to statically identify suspicious gadget chains and dynamically generate injection objects for fuzzing. However, due to their incomplete support for dynamic program features (e.g., Java runtime polymorphism) and ineffective injection object generation for fuzzing, the existing techniques are still far from satisfactory. In this paper, we first performed an empirical study to investigate the characteristics of Java deserialization vulnerabilities based on our manually collected 86 publicly known gadget chains. The empirical results show that 1) Java deserialization gadgets are usually exploited by abusing runtime polymorphism, which enables attackers to reuse serializable overridden methods; and 2) attackers usually invoke exploitable overridden methods (gadgets) via dynamic binding to generate injection objects for gadget chain construction. Based on our empirical findings, we propose a novel gadget chain mining approach, GCMiner, which captures both explicit and implicit method calls to identify more gadget chains, and adopts an overriding-guided object generation approach to generate valid injection objects for fuzzing. The evaluation results show that GCMiner significantly outperforms the state-of-the-art techniques, and discovers 56 unique gadget chains that cannot be identified by the baseline approaches.

Java deserialization vulnerability is a severe threat in practice. Researchers have proposed static analysis solutions to locate candidate vulnerabilities and fuzzing solutions to generate proof-of-concept (PoC) serialized objects to trigger them. However, existing solutions have limited effectiveness and efficiency.In this paper, we propose a novel hybrid solution ODDFuzz to efficiently discover Java deserialization vulnerabilities. First, ODDFuzz performs lightweight static taint analysis to identify candidate gadget chains that may cause deserialization vulnerabilities. In this step, ODDFuzz tries to locate all candidates and avoid false negatives. Then, ODDFuzz performs directed greybox fuzzing (DGF) to explore those candidates and generate PoC testcases to mitigate false positives. Specifically, ODDFuzz applies a structure-aware seed generation method to guarantee the validity of the testcases, and adopts a novel hybrid feedback and a step-forward strategy to guide the directed fuzzing.We implemented a prototype of ODDFuzz and evaluated it on the popular Java deserialization repository ysoserial. Results show that, ODDFuzz could discover 16 out of 34 known gadget chains, while two state-of-the-art baselines only identify three of them. In addition, we evaluated ODDFuzz on real-world applications including Oracle WebLogic Server, Apache Dubbo, Sonatype Nexus, and protostuff, and found six previously unreported exploitable gadget chains with five CVEs assigned.

ReentrantLock, an alternative to Synchronized, is provided in Java5 to handle the conflicts of memory accesses in concurrent programs. However, falsely using ReentrantLock may introduce deadlocks. To fix deadlocks caused by ReentrantLock, in this paper, we propose TemLock, an approach that can detect and fix deadlocks in Java programs based on the fix templates. We detect and fix deadlocks based on the predefined templates by searching and modifying the node information in AST of the program. Experimental results show that TemLock can fix 156 out of 177 deadlocks caused by ReentrantLock in Java projects, indicating its effectiveness. The URL of this tool is https://github.com/yyc36/TemLock_ReentrantLock/tree/master. The video of our demo is available at https://www.youtube.com/watch?v=LIRcRF99ApY.

Existing smart contract vulnerability detection efforts heavily rely on fixed rules defined by experts, which are inefficient and inflexible. To overcome the limitations of existing vulnerability detection approaches, we propose a GNN based approach. First, we construct a graph representation for a smart contract function with syntactic and semantic features by combining abstract syntax tree (AST), control flow graph (CFG), and program dependency graph (PDG). To further strengthen the presentation ability of our approach, we perform program slicing to normalize the graph and eliminate the redundant information unrelated to vulnerabilities. Then, we use a Bidirectional Gated Graph Neural-Network model with hybrid attention pooling to identify potential vulnerabilities in smart contract functions. Experiment results show that our approach can achieve 89.2% precision and 92.9% recall in smart contract vulnerability detection on our dataset and reveal the effectiveness and efficiency of our approach.

Crowds often appear in surveillance videos in public places, from which anomaly detection is of great importance to public safety. Since the abnormal cases are rare, variable and unpredictable, autoencoders with encoder and decoder structures using only normal samples have become a hot topic among various approaches for anomaly detection. However, since autoencoders have excessive generalization ability, they can sometimes still reconstruct abnormal cases very well. Recently, some researchers construct memory modules under normal conditions and use these normal memory items to reconstruct test samples during inference to increase the reconstruction errors for anomalies. However, in practice, the errors of reconstructing normal samples with the memory items often increase as well, which makes it still difficult to distinguish between normal and abnormal cases. In addition, the memory-based autoencoder is usually available only in the specific scene where the memory module is constructed and almost loses the prospect of cross-scene applications. We mitigate the overgeneralization of autoencoders from a different perspective, namely, by reducing the prediction errors for normal cases rather than increasing the prediction errors for abnormal cases. To this end, we propose an autoencoder based on hybrid attention and motion constraint for anomaly detection. The hybrid attention includes the channel attention used in the encoding process and spatial attention added to the skip connection between the encoder and decoder. The hybrid attention is introduced to reduce the weight of the feature channels and regions representing the background in the feature matrix, which makes the autoencoder features more focused on optimizing the representation of the normal targets during training. Furthermore, we introduce motion constraint to improve the autoencoder’s ability to predict normal activities in crowded scenes. We conduct experiments on real-world surveillance videos, UCSD, CUHK Avenue, and ShanghaiTech datasets. The experimental results indicate that the prediction errors of the proposed method for frequent normal crowd activities are smaller than those of other approaches, which increases the gap between the prediction errors for normal frames and the prediction errors for abnormal frames. In addition, the proposed method does not depend on a specific scene. Therefore, it balances good anomaly detection performance and strong cross-scene capability.

In recent years, the cable-driven planar robot has made fruitful achievements in many fields, but the related researches are scarce yet in the industrial engineering field. In this article, as a powerful tool for solving discrete time-varying problems, the discrete-time recurrent neural network (DTRNN) is extended to drive the cable-driven planar robot for discrete real-time tracking control, which is derived by a new immediate discretization method, and thus, is termed as ID-DTRNN model. Specifically, first, we present the physical structure and mathematical model of the cable-driven planar robot. Then, the new ID-DTRNN model is proposed and applied for driving such cable-driven planar robot, which bases on the a different way of construction of the traditional DTRNN model. Through numerical experiments, the feasibility, validity, and physical reliability of the ID-DTRNN model for discrete real-time tracking control of the cable-driven planar robot are fully verified. In addition, in the real world, physical experiments of the cable-driven planar robot are presented, which successfully promote the development of physical application of the ID-DTRNN model, and fill the gap of such model in the industrial engineering field.

Controlling and processing of time-variant problem is universal in the fields of engineering and science, and the discrete-time recurrent neural network (RNN) model has been proven as an effective method for handling a variety of discrete time-variant problems. However, such model usually originates from the discretization research of continuous time-variant problem, and there is little research on the direct discretization method. To address the aforementioned problem, this article introduces a novel discrete-time RNN model for solving the discrete time-variant problem in a pioneering manner. Specifically, a discrete time-variant nonlinear system, which originates from the mathematical modeling of serial robot manipulator, is presented as a target problem. For solving the problem, first, the technique of second-order Taylor expansion is used to deal with the discrete time-variant nonlinear system, and the novel discrete-time RNN model is proposed subsequently. Second, the theoretical analyses are investigated and developed, which shows the convergence and precision of the proposed discrete-time RNN model. Furthermore, three distinct numerical experiments verify the excellent performance of the proposed discrete-time RNN model. In addition, a robot manipulator example further verifies the effectiveness and practicability of the proposed novel discrete-time RNN model.

Memory-related vulnerabilities constitute severe threats to the security of modern software. Despite the success of deep learning-based approaches to generic vulnerability detection, they are still limited by the underutilization of flow information when applied for detecting memory-related vulnerabilities, leading to high false positives.

Abstract Bug localization is an important field in software engineering research. The traditional bug localization approaches based on information retrieval separate words through lexical analysis. In this way, the comments of the source code are ignored or treated as plain text, which will lose some semantic information. In this paper, MBL_SHL, an automatic Method‐level Bug Localization approach, which utilises code Summarization, Historical fixed bugs and code Length, is presented. Based on the code summarization technology, this approach first supplements the comment for uncommented code, and then calculates the Word2vec vector and Term Frequency–Inverse Document Frequency vector for the bug report, methods and comments, respectively. After that the authors calculate separately the similarity between the bug report and each method, the bug report and each comment. The code length information and historical fix information are also considered as a weight and a part of the score, respectively, to calculate the final score of each method. Finally, the scores are sorted to determine the list of methods that may need to be modified when fixing the software bugs. We built a method‐granular bug localization dataset, which contains five open‐source projects. The experimental results show that the proposed approach significantly outperforms the existing approaches on the method level.

Many deep learning models, for example, neural machine translation (NMT) models, have been developed for Automated Program Repair (APR). Due to the advantages of NMT model's strong generalization ability and less manual in-tervention, NMT-based methods perform well in APR. However, previous NMT-based APR approaches regard a code snippet as a sequence of tokens, which ignores the inherent structure of code. In this paper, we propose a novel end-to-end approach with Graph-to-Sequence learning, GrasP, to generate patches for buggy methods. To better represent the buggy method, we use a graph based on abstract syntax tree (AST) to represent the source code. In order to learn complex graph representation, we introduce the attention-based encoder-decoder model for graph-to-sequence learning. The empirical evaluation on the popular benchmark Defects4J shows that GrasP can generate compilable patches for 75 bugs, of which 34 patches are correct.

SUMMARY At present, disputes caused by medical expenses are widespread. How to use information means to provide accurate prediction of medical expenses for serious illnesses has become a research hotspot. Gastric cancer is a common cancer. The key of its medical expenses prediction lies in the mining of repeated structures and the statistics of repeated execution times. In the existing process mining methods, repeated nodes are regarded as the same nodes, and only counted once. This paper changes the original dynamic‐service‐flow‐net into a dynamic‐medical‐path‐net by taking the repetition times of nodes into account. Then αtj algorithm and TNC algorithm are proposed to build the dynamic‐medical‐path‐net system to predict the medical expenses. A medical evaluation model is proposed to evaluate each alternative schemes comprehensively in order to get the best medical scheme, and then the predictive medical expense would be obtained. The proposed method has about 25% improved to the conventional methods.

Summary In this paper, we propose a composite nonlinear multiset canonical correlation projections (CNMCPs) framework where orthogonal constraints are imposed in each set. This makes CNMCP capable of learning uncorrelated low‐dimensional features with minimum redundancy in Hilbert space. With the CNMCP framework, we further present a particular algorithm called multikernel multiset canonical correlations or mKMCC, which introduces different weights into multiple nonlinear functions in all views. An alternating iterative optimization is designed for computational solution. Numerous experimental results on practical datasets have demonstrated the effectiveness and robustness of mKMCC, in contrast with existing kernel correlation learning approaches.

Summary With the proliferation of knowledge source on the internet as well as the widely professional agents, the knowledge interchange is drawing much attention. Ontology is recognized as the crucial technology due to their nature of sharing, formalization, and conceptualization to integrate and share the knowledge. In this paper, by interpreting and negotiating the communication content, a unified understanding of knowledge is formed; then, we can realize the interoperability between ontologies. We have developed the ontology automatic negotiation by agent elect protocol (AEP) to elect optimal participants and encourage agents to obey the protocol, concept mapping protocol (CMP) to find the corresponding concept mappings with the highest relevancy, and in addition, agent negotiation protocol (ANP). In ANP, we define the simultaneous negotiation protocol and agents' strategies to combine distributed ontologies interchange with agent negotiation. Finally, the implementation and preliminary results are given to verify the validity of the proposed ontology negotiation.

Abstract Security bugs can catastrophically impact our increasingly digital lives. Designing effective tools for detecting and fixing software security bugs requires a deep understanding of security bug characteristics. In this paper, we conducted a comprehensive study on security bugs and proposed the classification criteria for security bug category, that is, root cause, consequence, and location. In addition, we selected 1076 bug reports from five projects (i.e., Apache Tomcat, Apache HTTP Server, Mozilla Firefox, Linux Kernel, and Eclipse) in the NVD for investigation. Finally, we investigated the correlation between the classification results and obtained some findings: (1) memory operation is the most common security bug; (2) the primary root causes of security bugs are CON (Configuration Error), INP (Input Validation Error), and MEM (Memory Error); (3) the severity of more than 40% of security bugs is high; (4) security bugs caused by INP mainly occur on web; and (5) security bugs caused by LOG (Logic Resource Error) usually lead to DoS (Denial of Service). We discussed these findings through data analysis, which can also help developers better understand the characteristics of security bugs.

Abstract Web development usually follows with analyzing the functionality, designing the user interface (UI) prototype, implementing the UI by front‐end (FE) developers and implementing the REpresentational State Transfer (RESTful) application programming interface (API) by back‐end (BE) programmers. Unfortunately, web development is a tedious, cumbersome, and time‐consuming task, which makes it a challenge for the FE programmers to work in an efficient way. In this paper, we propose an approach, image2emmet, to assist FE programmers in implementing the UI. First, we collect HyperText Markup Language, Cascading Style Sheets (HTML‐CSS) dataset in an automatic and efficient way. The HTML‐CSS dataset used for model training consists of HTML‐CSS code and its display images. Second, the faster region‐based convolutional neural network (CNN) (R‐CNN) is utilized to detect the UI component. Finally, we build a model combining CNN and long short‐term memory (LSTM) to transform the UI component into the HTML‐CSS code. The empirical study demonstrates that image2emmet can achieve a precision of 80% on the UI component detection and 60% on the transformation of UI component into HTML‐CSS code.

During the bug fixing process, developers usually need to analyze the source code to induce the bug cause, which is useful for bug understanding and localization. The bug fixes of historical bugs usually reflects the bug causes when fixing them. This paper aims at exploiting the corresponding relationship between bug causes and bug fixes to automatically classify bugs into their cause categories. First, we define the code-related bug classification criterion from the perspective of the cause of bugs. Then, we propose a new model to exploit the knowledge in the bug fix by constructing fix trees from the diff source code at Abstract Syntax Tree (AST) level, and representing each fix tree based on the encoding method of Tree-based Convolutional Neural Network (TBCNN). Finally, the corresponding relationship between bug causes and bug fixes is analyzed by automatically classifying bugs into their cause categories. We collected 2000 real-world bugs from two open source projects Mozilla and Radare2 to evaluate our approach. The experimental results show the existence of observational correlation between the bug fix and the cause of the historical bugs, and the proposed fix tree can effectively express the characteristics of the historical bugs for bug cause classification.

Face super-resolution (FSR) is an effective way to solve low-resolution (LR) problems in face analysis. But, most FSR methods only consider that LR face images have a single resolution, which is usually not consistent with practical situations due to the existence of multiple resolutions. To date, simultaneously learning the mappings from multiple LRs to high resolution (HR) has not been given proper attention. To solve this issue, we first propose a multi-set partial least squares (MPLS) approach to jointly deal with multi-set random variables via a recursive optimization. With MPLS, we then present a novel FSR method called MPLS-FH to simultaneously learn multiple resolution-specific mappings for various LR views from the same source. Concretely, MPLS-FH first divides multi-resolution face images into many patches. Then, it jointly learns the latent coherent features of principal-component embeddings of multi-resolution patches. Last, it super-resolves the input LR face by cross-resolution neighborhood search. Experimental results demonstrate the effectiveness of the proposed method in terms of quantitative and qualitative evaluations.

Coalition formation is an important research issue in the field of multi-agent, which can be widely applied in task allocation. This paper is different from traditional social task allocation problem. We propose that a mobile agent is assigned to each subtask that is decomposed by a complex task. Mobility refers to the ability of each agent to move to individuals with relevant professional capability. In this work, we model cooperation among mobile agents through coalition formation game in which mobile agents are graph-constrained and workers are in the social network. We propose a simple and distributed algorithm for the mobile agents who self-organize into independent disjoint coalitions. Compared with a non-cooperative approach where each mobile agent is self-interested to minimize its own operation cost, mobile agents decide to form disjoint coalitions to reduce the total operation cost. In addition, we prove the convergence of the algorithm. Simulation results show that, in different cases, coalition formation presents a performance improvement.

Low resolution is one of the main obstacles in the application of face recognition. Although many methods have been proposed to improve the problem, they assume that low-resolution (LR) face images have a uniform scale. In real scenarios, this prerequisite is very harsh. In this paper, we propose a scale-adaptive LR face recognition approach based on two-dimensional multi-set canonical correlation analysis (2DM-CCA), where face image matrix does not need to be previously transformed into a vector. In the proposed method, training sets with different resolutions are treated as different views, and then projected in parallel into a latent coherent space where the consistency of multi-view face data is maximally enhanced. When a new LR face image with an arbitrary scale is input, we first transform it by using the left and right projection matrices of an appropriate training view, and then reconstruct its high resolution facial feature by neighborhood reconstruction. Experimental results show that our proposed method is more effective and efficient than several existing methods.

Software bug issues are unavoidable in software development and maintenance. In order to manage bugs effectively, bug tracking systems are developed to help to record, manage and track the bugs of each project. The rich information in the bug repository provides the possibility of establishment of entity-centric knowledge bases to help understand and fix the bugs. However, existing named entity recognition (NER) systems deal with text that is structured, formal, well written, with a good grammatical structure and few spelling errors, which cannot be directly used for bug-specific named entity recognition. For bug data, they are free-form texts, which include a mixed language studded with code, abbreviations and software-specific vocabularies. In this paper, we summarize the characteristics of bug entities, propose a classification method for bug entities, and build a baseline corpus on two open source projects (Mozilla and Eclipse). On this basis, we propose an approach for bug-specific entity recognition called BNER with the Conditional Random Fields (CRF) model and word embedding technique. An empirical study is conducted to evaluate the accuracy of our BNER technique, and the results show that the two designed baseline corpus are suitable for bug-specific named entity recognition, and our BNER approach is effective on cross-projects NER.

As an emerging human-solving paradigm, crowdsourcing has attracted much attention where requesters want to employ reliable workers to complete the specific task. Task assignment is a vital branch in crowdsourcing. Most existing works in crowdsourcing haven't taken self-interested individuals' strategy into account. To guarantee truthfulness, auction has been regarded as a promising form to charge requesters and reward workers. In this paper, we consider an online task assignment scenario, where each worker has a set of experienced skills, whereas specific task is budget-constrained and requires certain skill. Under this scenario, we model the crowdsourcing task assignment as a reverse auction in which requesters are buyers and workers are sellers. Specially, our paper studies simple task case where the requester ask for single skill. We propose TMC-VCG and TMC-ST and prove the related properties for the mechanisms theoretically. Meanwhile, through extensive simulations, we verify the truthfulness and also evaluate other performance.

Due to the availability of various open source Machine Learning (ML) tools and libraries, developers nowadays can easily implement their purposes by just invoking machine learning APIs without knowing the details of the algorithm. However, the owners of ML tools and libraries usually pay more attention to the correctness and functionality of their algorithm, while spending much less effort on maintaining their code and keeping their code at a high quality level. Considering the popularity of machine learning in today's world, low quality ML tools and libraries can have a huge impact on the software products that use ML algorithms. So in this paper, we conduct an empirical study on real machine learning bugs to examine their patterns and how they evolve over time. We collect three popular machine learning projects on Github, and manually analyzed 329 closed bugs from the perspectives of their bug category, fix pattern, fix scale, fix duration, and type of software maintenance. The results show that (1) there are seven categories of bugs in machine learning programs; (2) twelve different fix patterns are commonly used to fix the bugs; (3) 63.83% of the patches belong to micro-scale-fix and small-scale-fix, and 68.39% of the bugs are fixed within one month; (4) 47.77% of the bug fixes belong to corrective activity from the view of software maintenance.

Multiple view data with different feature representations have widely arisen in various practical applications. Due to the information diversity, fusing multiview features is very valuable for classification purpose. In this paper, we propose a new multifeature fusion method called fractional-order discriminative multiview correlation projection (FDMCP), which is based on fractional-order scatter matrices with class label information of the samples. FDMCP first defines supervised covariance matrices in each view. It then constructs fractional supervised scatter matrices. Experimental results on three benchmark face image datasets show that our proposed FDMCP approach outperforms generalized multiview linear discriminant analysis.

In the open source community such as GitHub, developers usually need to find projects similar to their work, with the aim to reuse their functions and explore ideas of features that could be possibly added into their project at hand. Traditional text search engine can help detect similar resources. However, it is difficult for developers to use in open source community because a few query words cannot describe the whole features of a project. In this paper, we present a practical software recommendation system, REPERSP, which is used to recommend personalized software projects in GitHub. According to the features of projects created by developers and their behavior to other known projects, REPERSP recommends the top N relevant and personalized software projects. Moreover, REPERSP is implemented with the MapReduce parallel processing frame - Apache Spark for large-scale data, which can be scaled to a large number of users and projects for practical usage. Empirical results show that REPERSP can recommend more accurate results compared with other two recommendation algorithms, i.e., UserCF (user collaborative filtering) and ItemCF (item collaborative filtering). Video of our demo is available at https://youtu.be/WKigSUV4UA0.

Summary Wound area changes over multiple weeks are highly predictive of the wound healing process. A big data eHealth system would be very helpful in evaluating these changes. We usually analyze images of the wound bed for diagnosing injury. Unfortunately, accurate measurements of wound region changes from images are difficult. Many factors affect the quality of images, such as intensity inhomogeneity and color distortion. To this end, we propose a fast level set model‐based method for intensity inhomogeneity correction and a spectral properties‐based color correction method to overcome these obstacles. State‐of‐the‐art level set methods can segment objects well. However, such methods are time‐consuming and inefficient. In contrast to conventional approaches, the proposed model integrates a new signed energy force function that can detect contours at weak or blurred edges efficiently. It ensures the smoothness of the level set function and reduces the computational complexity of re‐initialization. To increase the speed of the algorithm further, we also include an additive operator‐splitting algorithm in our fast level set model. In addition, we consider using a camera, lighting, and spectral properties to recover the actual color. Numerical synthetic and real‐world images demonstrate the advantages of the proposed method over state‐of‐the‐art methods. Experimental results also show that the proposed model is at least twice as fast as methods used widely. Copyright © 2016 John Wiley & Sons, Ltd.

Auction is a highly effective trading form for distributing resource among buyers in a market at competitive prices, and has been applied to many domains, e.g. spectrum allocation in wireless networks and the virtual machine allocation in cloud computing. Most of existing auction mechanisms based on McAfee double auction calculate the uniform clearing prices for winning buyers no matter what channel they acquired, which does not reflect the differences of buyers' personalised preferences for heterogeneous spectrums. Hence, in this paper, we propose a truthful double auction scheme, named TRUDA, which incorporates the marginal effect of buyer–seller pair into auction mechanism design and considers the case in which buyers are mutually exclusive. We show analytically that this auction mechanism guarantees the economic‐robustness of the auction and has polynomial time complexity.

Accurate and complete commit messages summarizing software changes are important to support various software maintenance activities. In practice, these commit messages are often manually submitted by individual software developer to provide information about the changes involved in the incremental changes. Hence, the content and quality of these commit messages may be different. For example, some commit messages are too short and lack of essential information while others with too much detailed information can be time-consuming to read. What's more, most of the commit messages focus on what has been changed by developers in a commit, but why they changed and the motivation behind the code changes (which can assist developers in understanding code changes), are usually ignored. In this paper, we present an approach that can automatically generate the commit messages related to the code changes, including not only what have been changed but also why they were changed. Our approach uses method stereotypes and the type of changes to generate commit messages. We evaluate our approach by comparing the quality of generated messages with the original commit messages written by the original developers and those generated by a state-of-art technique, i.e., ChangeScribe. The results demonstrate that the messages generated by our approach are preferred in about 69% of the cases.

Given a new issue request, suitable developers should be arranged to implement it. Technologies such as developer recommendation have been proposed to tackle this issue. These techniques tend to recommend experienced developers, i.e., the more experienced the developer is, the more possible he/she is recommended. However, if the experienced developers are hectic, the junior developers may be employed to finish the incoming issue. But they may have difficulty in finishing these tasks for lack of developing experience. In this paper, we propose a novel approach, DR_PSF (Developer Recommendation with Personalized Source-code Files), to enhance developer recommendation by leveraging personalized source-code files. DR_PSF uses the collaborative topic modeling (CTM) technique to analyze developer expertise and triage some personalized files for the recommended developers. An empirical study is conducted, and the results show that DR_PSF can effectively recommend useful personalized source-code files for them to refer when they implement the incoming issue.

As technology evolves and electricity demand rises, more and more research focus on the efficient electricity allocation mechanisms so as to make consumer demand adaptive to the supply of electricity at all times. In this paper, we formulate the problem of electricity allocation as a novel combinatorial auction model, and then put forward a directly applicable mechanisms. It is proven that the proposed mechanism is equipped with some useful economic properties and computational traceability. Our works offer potential avenues for the stduy about efficient electricity allocation methods in smart grid.

Software becomes increasingly complex with its continuous maintenance activities. Given a system under maintenance, developers used to employing code search techniques to locate the code of their interests. However, they may have difficulties in understanding the source code elements and the relationship among them in the searching results. If there is a word base for a specific system, the developers can refer it to help locate and recover the source code elements and their relationships, which can improve the maintenance efficiency. In this paper, we present a tool, WB4SP(Word Base for Specific Programs), which focuses on building the word base for a specific system. WB4SP can retrieve the words, recover the relationship between them, and display the evolution of these words during the software evolution.

Topic models are shown to be effective to mine unstructured software engineering (SE) data. In this paper, we give a simple survey of exploring topic models to support various SE tasks between 2003 and 2015. The survey results show that there is an increasing concern in this area. Among the SE tasks, source code comprehension and software history comprehension are the mostly studied, followed by software defects prediction. However, there is still only a few studies on other SE tasks, such as feature location and regression testing.

Program comprehension is one of the first and most frequently performed activities during software maintenance and evolution. In a program, there are not only source code, but also comments. Comments in a program is one of the main sources of information for program comprehension. If a program has good comments, it will be easier for developers to understand it. Unfortunately, for many software systems, due to developers’ poor coding style or hectic work schedule, it is often the case that a number of methods and classes are not written with good comments. This can make it difficult for developers to understand the methods and classes, when they are performing future software maintenance tasks. To deal with this problem, in this paper we propose an approach which assesses the quality of a code comment and generates suggestions to improve comment quality. A user study is conducted to assess the effectiveness of our approach and the results show that our comment quality assessments are similar to the assessments made by our user study participants, the suggestions provided by our approach are useful to improve comment quality, and our approach can improve the accuracy of the previous comment quality analysis approaches.

Regression testing is essential to ensure software quality during software evolution. Two widely-used regression testing techniques, test case selection and prioritization, are used to maximize the value of the continuously enlarging test suite. However, few works consider both these two techniques together, which decreases the usefulness of the independently studied techniques in practice. In the presence of changes during program evolution, regression testing is usually conducted by selecting the test cases that cover the impact results of the changes. It seldom considers the false-positives in the information covered. Hence, the effectiveness of such regression testing techniques is decreased. In this paper, we propose an approach, ComboRT, which combines test case selection and prioritization together to directly generate a ranked list of test cases. It is based on the impact results predicted by the change impact analysis (CIA) technique, FCA–CIA, which generates a ranked list of impacted methods. Test cases which cover these impacted methods are included in the new test suite. As each method predicted by FCA–CIA is assigned with an impact factor value corresponding to the probability of this method to be impacted, test cases are then ordered according to the impact factor values of the impacted methods. Empirical studies on four Java based software systems demonstrate that ComboRT can be effectively used for regression testing in object-oriented Java-based software systems during their evolution.

This paper investigates a massive MIMO multi-pair two-way relay system, where K-pair users exchange information within communication pair, with the help of a shared amplify- and-forward (AF) relay station (RS). Large scale antenna array is equipped at the RS and each user has a signal antenna. The RS adopts the zero-forcing reception/zero-forcing transmission (ZFR/ZFT) beamforming. The imperfect channel state information (CSI) is considered, and the impact of channel estimation errors on system performances is investigated. Based on two power scaling schemes, we obtain the asymptotic spectral efficiency and asymptotic energy efficiency of the considered system. Our results reveal that when the number of RS antennas grows without bound, the small-fading can be averaged out; the additional noise and residual self-interference generated by channel estimation errors will completely disappear; and inter-pair interference will also vanish. Consequently, the simulation results will be confirmed by Monte-Carlo simulation method.

Software repositories such as revision control systems and bug tracking systems are usually used to manage the changes of software projects. During software maintenance and evolution, software developers and stakeholders need to investigate these repositories to identify what tasks were worked on in a particular time interval and how much effort was devoted to them. A typical way of mining software repositories is to use topic analysis models, e.g., Latent Dirichlet Allocation (LDA), to identify and organize the underlying structure in software documents to understand the evolution of development topics. These previously LDA-based topic analysis models can capture either changes on the strength (popularity) of various development topics over time (i.e., strength evolution) or changes in the content (the words that form the topic) of existing topics over time (i.e., content evolution). Unfortunately, few techniques can capture both strength and content evolution simultaneously. However, both pieces of information are necessary for developers to fully understand how software evolves. In this paper, we propose a novel approach to analyze commit messages within a project's lifetime to capture both strength and content evolution simultaneously via Online Latent Dirichlet Allocation (On-Line LDA). Moreover, the proposed approach also provides an efficient way to detect emerging topics in real development iteration when a new feature request arrives at a particular time, thus helping project stakeholds progress their projects smoothly.

As the development of a software project progresses, its complexity grows accordingly, making it difficult to understand and maintain. During software maintenance and evolution, software developers and stakeholders constantly shift their focus between different tasks and topics. They need to investigate into software repositories (e.g., revision control systems) to know what tasks have recently been worked on and how much effort has been devoted to them. For example, if an important new feature request is received, an amount of work that developers perform on ought to be relevant to the addition of the incoming feature. If this does not happen, project managers might wonder what kind of work developers are currently working on. Several topic analysis tools based on Latent Dirichlet Allocation (LDA) have been proposed to analyze information stored in software repositories to model software evolution, thus helping software stakeholders to be aware of the focus of development efforts at various time during software evolution. Previous LDA-based topic analysis tools can capture either changes on the strengths of various development topics over time (i.e., strength evolution) or changes in the content of existing topics over time (i.e., content evolution). Unfortunately, none of the existing techniques can capture both strength and content evolution. In this paper, we use Dynamic Topic Models (DTM) to analyze commit messages within a project's lifetime to capture both strength and content evolution simultaneously. We evaluate our approach by conducting a case study on commit messages of two well-known open source software systems, jEdit and PostgreSQL. The results show that our approach could capture not only how the strengths of various development topics change over time, but also how the content of each topic (i.e., words that form the topic) changes over time. Compared with existing topic analysis approaches, our approach can provide a more complete and valuable view of software evolution to help developers better understand the evolution of their projects.

Summary In recent years, many energy‐efficient algorithms and data dissemination protocols have been proposed for wireless sensor networks (WSNs). Because sensor nodes close to sink node have more traffic loads, they will quickly deplete their limited energy in practical implementation, and it will finally lead to energy hole and network partition problem. Adding sink mobility into sensor networks can bring in new opportunities to improve energy efficiency for WSNs. In this paper, we proposed our multiple mobile sink‐based routing algorithm for data dissemination to improve WSNs performance. Multiple mobile sinks will be utilized to collect the interested raw data. They will move back and forth along predetermined paths; one of which is the diameter of the circle, and the other two are fixed on arc lines. Mobile sinks will sojourn at some fixed points to collect raw data from relevant areas. Extensive simulation results show that our proposed algorithm can efficiently mitigate the hot spots problem and prolong the network lifetime of WSNs. Copyright © 2014 John Wiley & Sons, Ltd.

Summary We study the cloud resource auction problem where users can bid for resource bundle containing heterogeneous types of virtual machines, and providers allocate virtual machines to their users through group price model. Compared with fixed price model, which is not always the best approach for trading resources as its economically inefficient and inflexible nature, the group price model possess the better flexibility and monetary benefits for auction participants (e.g., cloud providers and users). The proposed auction mechanism strategy‐proof group buying‐based auction mechanism, which formulates the problem of virtual machine allocation in clouds as a combinatorial auction problem, and holds some important property such as individual rationality, ex‐post budget balance, and truthfulness, meanwhile guaranteeing efficiency in both the provider's revenue and system efficiency. Extensive simulation results show that the proposed mechanism yields the allocation efficiency and computational tractability compared with the mechanism with fixed price model. Copyright © 2015 John Wiley & Sons, Ltd.

Program comprehension is one of the most frequently performed activities during software maintenance and evolution. In order to facilitate program comprehension, a variety of graphical models have been proposed in software engineering community to construct relationships between program elements. These graphical models are mostly used for understanding the system based on structural syntax dependencies between program elements. However, these graphical models fail to extract the functional or semantic features of the system. Thus, developers still cannot effectively identify the functional part in source code fit for their needs. This paper tries to fill this gap, and proposes a novel representation, program feature network (PFN), to identify the semantic features of the program at class level. PFN is generated based on the relational topic model, a hierarchical probabilistic model of networks. Based on PFN, the semantic features and the links between pairs of two classes in the program can be clearly shown. In addition, PFN can predict the possible links between the newly change request in existing program feature network rather than reconstructing the representation from the start.

Software Change Impact Analysis (CIA) is an essential technique to identify the unpredicted and potential effects caused by software changes. A rich body of different CIA techniques, especially static CIA techniques, have continuously emerged in recent years. However, it is difficult for researchers or practitioners to decide which technique is most appropriate for their needs, or which CIA technique is more effective. Unfortunately, there was only a few work on the comparison of the CIA techniques. This paper presents a comparison study of different types of popular static CIA approaches, i.e., structural static analysis, textual analysis, and historical analysis. For each kind of static CIA approach, we introduce a representative technique, that is FCA -- CIA, ROSE, and IRC2M, respectively. Finally, some empirical studies are conducted on three real-world programs to compare the accuracy of these CIA techniques based on the precision and recall metrics. The results show that the accuracy of these three CIA techniques is different, and FCA - CIA has the best precision while the IRC2M has the best recall.

The researches of Web service fasten on composition process, and are lack of the formalized description on dynamic attributes of service component itself. Aiming to these, a new dynamic and concurrent model of Web service component is presented. Firstly, this paper analyzes the process of state transition of service component under certain actions, and then depicts the dynamic transition process of service component with the state transition graph. At last, the physical representation method in memory and the algorithms to judge equivalence of state transition graph are given. Comparing with existing researches, the dynamic evolvement of service component under the actions is considered, and the algorithm to judge equivalence of service components provides an effective tool for model verification.

This paper proposes the SSOA (Semantic Service-oriented Architecture) based on formal and distributed ontologies, and the knowledge baseframed by ontology and the fuzzy reasoning system oriented to agent cognition are considered to prescribe and treat the uncertainty of agent cognizing. The SSOA includes two essential components. Knowledge Base Supported by Formal Ontology and Agent-oriented Fuzzy Reasoning System. First, Knowledge Base Framed by Formal Ontology builds a concept hierarchy organized by inclusion relation, and uses those concepts to describe specific objects to form assertions of an application domain. Agent-oriented Fuzzy Reasoning System then incorporates plausibility degree into assertions of certain agent, and the alphabet of symbols, well-formed formulas, axioms and inferences rules are constructed respectively. The SSOA architecture constructs a fundament for services interaction and composition automatically under open environment.

A difficulty of sharing messages transferred among Web services is absence of common vocabulary, and the semantic organization and description of Web services is an important requirement for enabling the automatic discovery, selection, composition, execution and monitoring of Web services. This paper proposes a model for semantic-based interaction between Web services. The method defined some ontology-based vocabularies to describe different Web services and some mapping rules among those vocabularies. Compared with existing methods, the method considers the Web services together with the semantic interpretation, satisfiability and reasoning of distributed ontologies. So the method can ensure the share and reusage of term be used for describing parameters of Web services