The modern software development landscape heavily relies on transitive dependencies. They enable seamless integration of third-party libraries. However, they also introduce security challenges. Transitive vulnerabilities that arise from indirect dependencies expose projects to risks associated with Common Vulnerabilities and Exposures (CVEs). It happens even when direct dependencies remain secure. This paper examines the lifecycle of transitive vulnerabilities in the Maven ecosystem. We employ survival analysis to measure the time projects remain exposed after a CVE is introduced. Using a large dataset of Maven projects, we identify factors that influence the resolution of these vulnerabilities. Our findings offer practical advice on improving dependency management.

We present HaPy-Bug, a curated dataset of 793 Python source code commits associated with bug fixes, with each line of code annotated by three domain experts. The annotations offer insights into the purpose of modified files, changes at the line level, and reviewers’ confidence levels. We analyze HaPy-Bug to examine the distribution of file purposes, types of modifications, and tangled changes. Additionally, we explore its potential applications in bug tracking, the analysis of bug-fixing practices, and the development of repository analysis tools. HaPy-Bug serves as a valuable resource for advancing research in software maintenance and security.

SQL:1999 recursive queries are almost a quarter century old. In this standard the recursive queries have the form of recursive common table expressions. In recent years vendors of almost all database systems finally implemented this feature. In this article we analyze those implementations and propose a benchmark that can be used to measure them in the future. We also present an experimental evaluation of recursive SQL:1999 queries in free-to-use popular database systems using a network (graph) data set and a hierarchical (tree) data set.

In the dynamic landscape of software engineering, the emergence of ChatGPT-generated code signifies a distinctive and evolving paradigm in development practices. We delve into the impact of interactions with ChatGPT on the software development process, specifically analysing its influence on source code changes. Our emphasis lies in aligning code with ChatGPT conversations, separately analysing the user-provided context of the code and the extent to which the resulting code has been influenced by ChatGPT. Additionally, employing survival analysis techniques, we examine the longevity of ChatGPT-generated code segments in comparison to lines written traditionally. The goal is to provide valuable insights into the transformative role of ChatGPT in software development, illuminating its implications for code evolution and sustainability within the ecosystem.

The Common Vulnerabilities and Exposures (CVEs) system is a reference method for documenting publicly known information security weaknesses and exposures. This paper presents a study of the lifetime of CVEs in software projects and the risk factors affecting their existence. The study uses survival analysis to examine how features of programming languages, projects, and CVEs themselves impact the lifetime of CVEs. We suggest avenues for future research to investigate the effect of various factors on the resolution of vulnerabilities.

Subject matter experts (SMEs) often rely on attribute importance rankings to verify machine learning models, acquire insights into their outcomes, and gain a deeper understanding of the investigated phenomena. To further increase their usefulness, we introduce a new approach to the evaluation of attribute rankings produced by any machine learning method . As a real-world case study , we investigate the attribute importance scores produced using XGBoost and decision bireducts on the data gathered by an HR company, where the goal is to predict the willingness of candidates to change their job. For this task, XGBoost delivers accurate models but fails to identify many attributes that are important to SMEs. In comparison, decision bireducts lead to models that are easier to interpret and explore the data with a higher focus on the diversity of attributes. The ensembles of decision bireducts deliver comparable accuracy and their associated attribute rankings are more insightful than those of XGBoost.

Missing or invalid records in sales data are a common obstacle that can damage the overall effectiveness of market analysis. Completing the data on the basis of the records obtained so far can be formulated in means of a schema matching task. In this paper we present a machine learning based method for performing schema matching for transactional data. The analysis is based on a dataset of over 700.000 transactions from retail stores. We confront the proposed solution with manual and conventional approaches.

Upon receiving a new bug report, developers need to find its cause in the source code. Bug localization can be helped by a tool that ranks all source files according to how likely they include the bug. This problem was thoroughly examined by numerous scientists. We introduce a novel adaptive bug localization algorithm. The concept behind it is based on new feature weighting approaches and an adaptive selection algorithm utilizing pointwise learn–to–rank method. The algorithm is evaluated on publicly available datasets, and is competitive in terms of accuracy and required computational resources compared to state–of–the–art. Additionally, to improve reproducibility we provide extended datasets that include computed features and partial steps, and we also provide the source code.

In this article, we describe the SENSEI system. It helps players to improve their skills in popular eSports games. We discuss the main goals of the system and explain the associated challenges. We also present its conceptual architecture which aims at enabling full automation of the data acquisition and analytic processes. The system is expected to provide in-depth analytics of players' performance and give practical advice regarding possible improvements. Thus its architecture allows players to provide feedback and manually label important concepts. Finally, we discuss our first case study - an advisory system for popular collectible card video games.

Code reviews consist in proof-reading proposed code changes in order to find their shortcomings such as bugs, insufficient test coverage or misused design patterns. Code reviews are conducted before merging submitted changes into the main development branch. The selection of suitable reviewers is crucial to obtain the high quality of reviews. In this article we present a new method of recommending reviewers for code changes. This method is based on profiles of individual programmers. For each developer we maintain his/her profile. It is the multiset of all file path segments from commits reviewed by him/her. It will get updated when he/she presents a new review. We employ a similarity function between such profiles and change proposals to be reviewed. The programmer whose profile matches the change most is recommended to become the reviewer. We performed an experimental comparison of our method against state-of-the-art techniques using four large open-source projects. We obtained improved results in terms of classification metrics (precision, recall and F-measure) and performance (we have lower time and space complexity).

This is the seventeenth special issue of Fundamenta Informaticae based on the CONCURRENCY SPECIFICATION AND PROGRAMMING (CS&P) workshop, in succession to the sixteenth special issue published in 2014.The CS&P workshops, being held every even year in Germany and every odd year in Poland, take place on the basis of an exchange programme between University of Warsaw and Humboldt University in Berlin.Initiated by computer science and mathematical logic interest groups affiliated to Warsaw and Humboldt Universities in the mid-seventies of the XX century, the workshops were suspended for some years in the eighties and resumed in 1992 in the extended form of participation: they evolved from bilateral meetings to the meetings hosting researchers also from a number of countries other than Germany and Poland.The scope of subjects has been broadened too: from linguistic and logical issues initially to diverse research areas such as, for instance, the aforesaid ones.This part contains selected and extended versions of 11 out of 32 articles presented at the meeting that took place in Chemnitz from September 29 to October 1, 2014.As it was the case of all the previous special issues of Fundamenta Informaticae based on CS&P, the articles were selected on the basis of a review process admitted by international scientific periodicals.A complete collection of the contributions has been edited by Louchka Popova-Zeugmann and Holger Schlingloff of Humboldt University and Matthias Werner of Technical University, Chemnitz and published before the workshop as Proceedings.This is, thus, a continuation of the tradition of the former CS&Ps, whose participants had been supplied with proceedings in the form of technical reports during the meetings.The articles contained in this special issue, cover the following topics: Mathematical models of concurrency, Specification languages, Theory of programming, Parallel algorithms, Model checking and testing, Multi-agent systems, Rough sets, Object-oriented approaches, Knowledge management, Knowledge discovery and data mining, Soft computing, Information technology and management, as well as Applications.In order to provide the readers with a better insight into this special issue, we enclose below brief overviews of the accepted papers.The first two articles 'A Classifier Based on a Decision Tree with Verifying Cuts' and 'Classifiers for Behavioral Patterns Identification Induced from Huge Temporal Data', written by members of the Jan G. Bazan's group, are devoted to constructing hierarchical classifiers.The first one considers building decision trees based on additional cuts, while the second one deals with temporal data.

This special issue of Fundamenta Informaticae is dedicated to papers selected from the 24th International Workshop on CONCURRENCY, SPECIFICATION, AND PROGRAMMING (CS&P 2015), which was held in September 28 -30, 2015 in Rzeszów, Poland.After the event, some authors of the papers presented at the workshop were invited to submit a revised and extended version of their papers, which underwent another reviewing process to guarantee that the revised papers meet the standards of FUNDAMENTA INFORMATICAE.Eventually, twelve papers have been selected for publication in this special issue, which gives a representative account of current issues and topics related to Concurrency, Specification, and Programming.A complete collection of the contributions to CS&P 2015 has been edited by scientists of University of Rzeszów and published before the workshop as Proceedings.The article 'Comparison of Heuristics for Optimization of Association Rules' by Fawaz Alsolami, Talha Amin, Igor Chikalov, Mikhail Moshkov, and Beata Zielosko, includes several heuristics for construction of association rules.The presented experimental results show that the difference concerning the length or coverage obtained by the best heuristic and optimal ones (constructed using dynamic programming algorithms) are small.In the paper 'Specialized Predictor for Reaction Systems with Context Properties' Roberto Barbuti, Roberta Gori, Francesca Levi, and Paolo Milazzo consider reaction systems.They revise the notion of formula based predictor by defining a specialized version that assumes the environment to provide molecules according to what expressed by a temporal logic formula.As an application, specialized formula based predictors are used to give theoretical grounds to a model of gene regulation.

Spreadsheets are among the most commonly used applications for data management and analysis. They combine data processing with very diverse supplementary features: statistics, visualization, reporting, linear programming solvers, Web queries periodically downloading data from external sources, etc. However, the spreadsheet paradigm of computation still lacks sufficient analysis. In this article, we demonstrate that a spreadsheet can implement all data transformations definable in SQL, merely by utilizing spreadsheet formulas. We provide a query compiler, which translates any given SQL query into a worksheet of the same semantics, including NULL values. Thereby, database operations become available to the users who do not want to migrate to a database. They can define their queries using a high-level language and then get their execution plans in a plain vanilla spreadsheet. The functions available in spreadsheets impose limitations on the algorithms one can implement. In this paper, we offer O(n log2n) sorting spreadsheet, using a non-constant number of rows, and, surprisingly, Depth-First-Search and Breadth-First-Search on graphs.

Graphics Processing Units (GPU) have significantly more applications than just rendering images. They are also used in general-purpose computing to solve problems that can benefit from massive parallel processing. However, there are tasks that either hardly suit GPU or fit GPU only partially. The latter class is the focus of this paper. We elaborate on hybrid CPU/GPU computation and build optimization methods that seek the equilibrium between these two computation platforms. The method is based on heuristic search for bi-objective Pareto optimal execution plans in presence of multiple concurrent queries. The underlying model mimics the commodity market where devices are producers and queries are consumers. The value of resources of computing devices is controlled by supply-and-demand laws. Our model of the optimization criteria allows finding solutions of problems not yet addressed in heterogeneous query processing. Furthermore, it also offers lower time complexity and higher accuracy than other methods.

Unified State Model (USM) is a single data model that allows conveying objects of major programming languages and databases. USM exploits and emphasizes common properties of their data models. USM is equipped with mappings from these data models onto it. With USM at hand, we have faced the next natural research question whether numerous query languages for the data subsumed by USM can be clearly mapped onto a common language. We have designed and proposed such a language called the Unified Query Language (UQL). UQL is intended to be a minimalistic and elegant query language that allows expressing queries of languages of data models covered by USM. In this paper we define UQL and its concise set of operators. Next we conduct a mild introduction into UQL features by showing examples of SQL and ODMG OQL queries and their mapping onto UQL. We conclude by presenting the mapping of the theoretical foundations of these two major query languages onto UQL. They are the multiset relational algebra and the object query algebra. This is an important step towards the establishment of a fully-fledged common query language for USM and its subsumed data models.

Analytic database queries are exceptionally time consuming. Decision support systems employ various execution techniques in order to accelerate such queries and reduce their resource consumption. Probably the most important of them consists in materialization of partial results. However, any introduction of derived objects into the database schema increases the cost of software development, since programmers must take care of their usage and synchronization. In this article we consider using partial aggregations materialized in additional tables. The idea is based on the concept of metagranules that represent the information on grouping and used aggregations. Metagranules have a natural partial order that guides the optimisation process. We present solutions to two problems. Firstly, we assume that a set of stored metagranules is given and we optimize a query. We present a novel query rewriting method to make analytic queries use the information stored in metagranules. We also describe our proof-of-concept implementation of this method and perform an extensive experimental evaluation using databases of the size up to 0:5 TiB and 6 billions rows. Secondly, we assume that a database workload is given and we want to select the optimal set of metagranules to materialize. Although each metagranule accelerates some queries, it also imposes a significant overhead on updates. Therefore, we propose a cost model that includes both benefits for queries and penalties for updates. We experiment with the complete search in the space of sets of metagranules to find the optimum. Finally, we empirically verify identified optimal sets against database instances up to 0:5 TiB with billions of rows and hundreds millions of aggregated rows.

The software architecture is typically defined as the fundamental organization of the system embodied in its components, their relationships to one another and to the system's environment. It also encompases principles governing the system's design a

In recent years, the scalability of web applications has become critical. Web sites get more dynamic and customized. This increases servers' workload. Furthermore, the future increase of load is difficult to predict. Thus, the industry seeks for solu

In this paper we discuss the misunderstanding that have arisen over the years around the broadly defined term of the object-relational impedance mismatch. It occurs in various aspects of database application programming. There are three concerns judg

Detection of design patterns is an important part of reverse engineering. Availability of patterns provides for a better understanding of code and also makes analysis more efficient in terms of time and cost. In recent years, we have observed a continual improvement in the field of automatic detection of design patterns in source code. Existing approaches can detect a fairly broad range of design patterns, targeting both structural and behavioral aspects of patterns. However, it is not straightforward to assess and compare these approaches. There is no common ground on which to evaluate the accuracy of the detection approaches, given the existence of variants and specific code constructs used to implement a design pattern. We propose a systematic approach to constructing a comprehensive test suite for detectors of design patterns. This approach is applied to construct a test suite covering the Singleton pattern. The test suite contains many implementation variants of these patterns, along with such code constructs as method forwarding, access modifiers, and long inheritance paths. Furthermore, we use this test suite to compare three detection tools and to identify their strengths and weaknesses.

We propose a method for automatic detection of occurrences of design patterns. We also describe its proof-of-concept implementation and the results of comparative experiments with other tools. The method presented here is able to detect many nonstandard implementation variants of design patterns, while its efficiency is comparable to other state-of-the-art detection tools. Moreover, the method is highly customizable because an analyst can introduce a new pattern retrieval query or modify an existing one and then repeat the detection using the results of earlier source code analysis stored in a relational database.