Vulnerability detectors based on deep learning (DL) models have proven their effectiveness in recent years. However, the shroud of opacity surrounding the decision-making process of these detectors makes it difficult for security analysts to comprehend. To address this, various explanation approaches have been proposed to explain the predictions by highlighting important features, which have been demonstrated effective in domains such as computer vision and natural language processing. Unfortunately, there is still a lack of in-depth evaluation of vulnerability-critical features, such as fine-grained vulnerability-related code lines, learned and understood by these explanation approaches. In this study, we first evaluate the performance of ten explanation approaches for vulnerability detectors based on graph and sequence representations, measured by two quantitative metrics including fidelity and vulnerability line coverage rate. Our results show that fidelity alone is insufficent for evaluating these approaches, as fidelity incurs significant fluctuations across different datasets and detectors. We subsequently check the precision of the vulnerability-related code lines reported by the explanation approaches, and find poor accuracy in this task among all of them. This can be attributed to the inefficiency of explainers in selecting important features and the presence of irrelevant artifacts learned by DL-based detectors.

In the face of increased threats within software registries and management systems, we address the critical need for effective malicious code detection. In this paper, we propose an innovative approach that integrates source code slicing, inter-procedural analysis, and cross-file inter-procedural analysis, thereby enhancing the detection precision and reducing false positives. This approach has been encapsulated within a multi-analysis-based framework for automatic detection of malicious code in real-world software packages. In its application to major third-party software registries like PyPI and NPM, our framework has proven effective, identifying 130 malicious packages from a total of 169,640 monitored over a continuous period of five weeks. This work advances the current state-of-the-art solution to malicious code detection, demonstrating significant practical impact in strengthening the software supply chain defense.

Road network models form the foundation of road network analyses, route planning, navigation and traffic predictions. However, existing models cannot effectively represent the dynamic topological relationships that exist among lanes due to the effects of time-dependent traffic control measures. To address this problem, we propose a time-dependent road network model (TRNM) to represent these topological relationships, and present its construction method based on a traditional carriageway network model. We constructed two TRNMs in Changzhou and Shanghai and then conducted path-planning experiments to verify the effectiveness of the models. Our results showed that TRNMs could be constructed readily from traditional road networks without introducing large volumes of data, while effectively representing the time-dependent topological relationships among lanes. It is particularly beneficial to path planning, as it not only provides valid and shorter paths but also lane-level navigation information. Time-dependent road network models mirror real-world road networks and can represent more time-dependent traffic controls, such as non-periodic changes at different frequencies. The TRNM developed here can provide support for applications based on road network models, as well as a useful reference for the geographic information system (GIS) and complex networks.

Anti-spam technology has been developed to the third generation technology, behavior recognition technology. There are many traditional classification models, among which, decision tree model is the one most widely used, and has a good intelligibility. But the absolutely clear attributes does not always exist in real world. This paper proposed a fuzzy decision tree based method for spam behavior recognition. After preprocessing (data discretization, transformation and compression for continuous-value attributes), the attribute subordinating degree is more natural and reasonable to describe the characteristics of behavior. According to knowledge of the fuzzy decision tree by Fuzzy-ID3, spam can be detected and classified spam sender behavior patterns can by analyzed automatically.