Modern software systems are increasingly complex, presenting significant challenges in quality assurance. Just-intime vulnerability prediction (JIT-VP) is a proactive approach to identifying vulnerable commits and providing early warnings about potential security risks. However, we observe that current JIT-VP evaluations rely on an idealized setting, where the evaluation datasets are artificially balanced, consisting exclusively of vulnerability-introducing and vulnerability-fixing commits. To address this limitation, this study assesses the effectiveness of JIT-VP techniques under a more realistic setting that includes both vulnerability-related and vulnerability-neutral commits. To enable a reliable evaluation, we introduce a large-scale public dataset comprising over one million commits from FFmpeg and the Linux kernel. Our empirical analysis of eight state-of-theart JIT-VP techniques reveals a significant decline in predictive performance when applied to real-world conditions; for example, the average PR-AUC on Linux drops 98 % from 0.805 to 0.016. This discrepancy is mainly attributed to the severe class imbalance in real-world datasets, where vulnerability-introducing commits constitute only a small fraction of all commits. To mitigate this issue, we explore the effectiveness of widely adopted techniques for handling dataset imbalance, including customized loss functions, oversampling, and undersampling. Surprisingly, our experimental results indicate that these techniques are ineffective in addressing the imbalance problem in JIT-VP. These findings underscore the importance of realistic evaluations of JIT-VP and the need for domain-specific techniques to address data imbalance in such scenarios.

We present VulGuard, an automated tool designed to streamline the extraction, processing, and analysis of commits from GitHub repositories for Just-In-Time vulnerability prediction (JIT-VP) research. VulGuard automatically mines commit histories, extracts fine-grained code changes, commit messages, and software engineering metrics, and formats them for downstream analysis. In addition, it integrates several state-of-the-art vulnerability prediction models, allowing researchers to train, evaluate, and compare models with minimal setup. By supporting both repository-scale mining and model-level experimentation within a unified framework, VulGuard addresses key challenges in reproducibility and scalability in software security research. VulGuard can also be easily integrated into the CI/CD pipeline. We demonstrate the effectiveness of the tool in two influential open-source projects, FFmpeg and the Linux kernel, highlighting its potential to accelerate real-world JIT-VP research and promote standardized benchmarking. A demo video is available at: https://youtu.be/j96096-pxbs.

Open-source development has revolutionized the software industry by promoting collaboration, transparency, and community-driven innovation. Today, a vast amount of various kinds of open-source software, which form networks of repositories, is often hosted on GitHub – a popular software development platform. To enhance the discoverability of the repository networks, i.e., groups of similar repositories, GitHub introduced repository topics in 2017 that enable users to more easily explore relevant projects by type, technology, and more. It is thus crucial to accurately assign topics for each GitHub repository. Current methods for automatic topic recommendation rely heavily on TF-IDF for encoding textual data, presenting challenges in understanding semantic nuances.

Considering the testing process of the software system as a stochastic process is a primary approach to the software reliability modeling technique. Besides some popular distributions, the Poisson distribution has been considered the best based on its advantage when modeling the times at which arrivals enter a system. In the non-homogeneous Poisson process group of models, the S-shaped function is a value curve with many good results. This paper proposes a new imperfect debugging software reliability model based on (1) an Imperfect debugging assumption (the testing process could cause new faults); and (2) the Fault detection rate can be controlled more effectively by the appearance of a growth-rate-controller. The real data from industrial projects verify the application of this model based on good popular criteria values.

Automated program repair (APR) has been gaining ground recently. However, a significant challenge that still remains is test overfitting, in which APR-generated patches plausibly pass the validation test suite but fail to generalize. A common practice to assess the correctness of APR-generated patches is to judge whether they are equivalent to ground truth, i.e., developer-written patches, by either generating additional test cases or employing human manual inspections. The former often requires the generation of at least one test that shows behavioral differences between the APR-patched and developer-patched programs. Searching for this test, however, can be difficult as the search space can be enormous. Meanwhile, the latter is prone to human biases and requires repetitive and expensive manual effort. In this paper, we propose a novel technique,Invalidator, to automatically assess the correctness of APR-generated patches via semantic and syntactic reasoning.Invalidatorleverages program invariants to reason about program semantics while also capturing program syntax through language semantics learned from a large code corpus using a pre-trained language model. Given a buggy program and the developer-patched program,Invalidatorinfers likely invariants on both programs. Then,Invalidatordetermines that an APR-generated patch overfits if: (1) it violates correct specifications or (2) maintains erroneous behaviors from the original buggy program. In case our approach fails to determine an overfitting patch based on invariants,Invalidatorutilizes a trained model from labeled patches to assess patch correctness based on program syntax. The benefit ofInvalidatoris threefold. First,Invalidatorleverages both semantic and syntactic reasoning to enhance its discriminative capability. Second,Invalidatordoes not require new test cases to be generated, but instead only relies on the current test suite and uses invariant inference to generalize program behaviors. Third,Invalidatoris fully automated. We conducted our experiments on a dataset of 885 patches generated on real-world programs in Defects4J. Experiment results show thatInvalidatorcorrectly classified 79% of overfitting patches, accounting for 23% more overfitting patches being detected than the best baseline.Invalidatoralso substantially outperforms the best baselines by 14% and 19% in terms of Accuracy and F-Measure, respectively.

Fault localization has been used to provide feedback for incorrect student programs since locations of faults can be a valuable hint for students about what caused their programs to crash. Unfortunately, existing fault localization techniques for student programs are limited because they usually consider either the program's syntax or semantics alone. This motivates the new design of fault localization techniques that use both semantic and syntactical information of the program.In this paper, we introduce FFL (Fine grained Fault Localization), a novel technique using syntactic and semantic reasoning for localizing bugs in student programs. The novelty in FFL that allows it to capture both syntactic and semantic of a program is three-fold: (1) A fine-grained graph-based representation of a program that is adaptive for statement-level fault localization; (2) an effective and efficient model to leverage the designed representation for fault-localization task and (3) a node-level training objective that allows deep learning model to learn from fine-grained syntactic patterns. We compare FFL's effectiveness with state-of-the-art fault localization techniques for student programs (NBL, Tarantula, Ochiai and DStar) on two real-world datasets: Prutor and Codeflaws. Experimental results show that FFL successfully localizes bug for 84.6% out of 2136 programs on Prutor and 83.1% out of 780 programs on Codeflaws concerning the top-10 suspicious statements. FFL also remarkably outperforms the best baselines by 197%, 104%, 70%, 22% on Codeflaws dataset and 10%, 17%, 15% and 8% on Prutor dataset, in term of top-1, top-3, top-5, top-10, respectively.

Constructing a static call graph requires trade-offs between soundness and precision. Program analysis techniques for constructing call graphs are unfortunately usually imprecise. To address this problem, researchers have recently proposed call graph pruning empowered by machine learning to post-process call graphs constructed by static analysis. A machine learning model is built to capture information from the call graph by extracting structural features for use in a random forest classifier. It then removes edges that are predicted to be false positives. Despite the improvements shown by machine learning models, they are still limited as they do not consider the source code semantics and thus often are not able to effectively distinguish true and false positives.

Abstract Software reliability modelling is the mathematical technique used to evaluate the reliability of a software system. The non‐homogeneous Poisson process is a prominent approach in this field. More than half of the models in this group are based on S‐shaped functions, primarily the 2‐parameter S‐shaped function. This paper proposes a new model based on the 3‐parameter S‐shaped function, which is an expanded form of the 2‐parameter S‐shaped function obtained by adding a growth rate controller. Real data from industrial software development projects are used to verify the usability of the proposed model. The proposed model is shown to perform better than the existing models, especially with respect to the predictive performance. Furthermore, the rate of convergence of the proposed model is acceptable, with a rate of 76.47%.

With the recent explosive growth of mobile devices such as smartphones or tablets, guaranteeing consistent web appearance across all environments has become a significant problem. This happens simply because it is hard to keep track of the web appearance on different sizes and types of devices that render the web pages. Therefore, fixing the inconsistent appearance of web pages can be difficult, and the cost incurred can be huge, e.g., poor user experience and financial loss due to it. Recently, automated web repair techniques have been proposed to automatically resolve inconsistent web page appearance, focusing on improving usability. However, generated patches tend to disrupt the webpage's layout, rendering the repaired webpage aesthetically unpleasing, e.g., distorted images or misalignment of components. In this paper, we propose an automated repair approach for web pages based on meta-heuristic algorithms that can assure both usability and aesthetics. The key novelty that empowers our approach is a novel fitness function that allows us to optimistically evolve buggy web pages to find the best solution that optimizes both usability and aesthetics at the same time. Empirical evaluations show that our approach is able to successfully resolve mobile-friendly problems in 94% of the evaluation subjects, significantly outperforming state-of-the-art baseline techniques in terms of both usability and aesthetics.

Software testing is a continuous process during the software development stages to ensure quality software products. Researchers, experts and software engineers keep going on studying new techniques, methods and approaches of testing to accommodate changes in software development because of the flexible requirement along with the changing of technology. So, developers and testers need to have effective methods, tools and approaches to create a high-quality product at an efficient cost. This paper provides an effective approach for context-driven testing (CDT) in an agile software development process. CDT is a testing approach that supports the tester to choose their testing techniques and test objectives based on specific contexts. The aim of this paper is to propose an effective approach for implementing the CDT in practice, called CDTiP. Through an analysis of two case studies using an agile development process with different contexts, we validate the effectiveness of the approach in terms of test coverage, detect errors, test effort. The empirical results show that CDTiP is suitable for the agile development process that can help the tester to detect defects faster at minimum cost. The results of this method have been applied at Enclave, an ODC Software Engineering company, on real projects.

There has been observed explosive growth in the development of mobile applications (apps) for Android and iOS operating systems, which has led to the direct impact towards mobile app development. In order to design and propose quality-oriented apps, it is the primary responsibility of developers to devote time and sufficient efforts towards testing to make the apps bug-free and operational in the hands of end-users without any hiccup. Manual testing procedures take a prolonged amount of time in writing test cases, and in some cases, the full testing requirements are not met. Besides, the insufficient knowledge of tester also impacts the overall quality and bug-free apps. To overcome the obstacles of testing, we propose a new testing methodology cum tool called “AgileUATM” which works primarily towards white-box and black-box testing. To evaluate the validity of the proposed tool, we put the tool in a real-time operational environment concerning mobile test apps. By using this tool, all the acceptance criteria are determined via user stories. The testers/developers specify requirements with formal specifications based on programs properties, predicates, invariants, and constraints. The results show that the proposed tool generated effective and accurate test cases, test input. Meanwhile, expected output was also generated in a unified fashion from the user stories to meet acceptance criteria. The proposed solution also reduced the development time to identify test data as compared to manual Behavior-Driven Development (BDD) methodologies. This tool can support the developers to get a better idea about the required tests and able to translate the customer’s natural languages to computer languages as well. This paper fulfills an approach to suitably test mobile application development.

This paper considers the problem of dynamic evacuation routing in large smart buildings. We investigate a scalable routing approach which not only generates effective routes for evacuees but also quickly updates routes as the disaster status and building conditions could change during the evacuation time. We first design a flexible and scalable evacuation system for large smart buildings with multiple levels of computational support. Given such a system, we develop a novel distributed algorithm for finding effective evacuation routes dynamically by using an LCDT (Length-Capacity-Density-Trustiness) weighted graph model, which is built upon the current disaster information and building conditions. Finally, we propose a caching strategy which expedites dynamic route generation with the current effective route part(s) in order to improve the performance of dynamic evacuation in large buildings. To validate our approach, we test the proposed algorithm with our implementation of an evacuation simulator and compare the results with other approaches. Experimental results show that our approach outperforms other ones in the aspect of the evacuation time reduction and the maximum number of people being evacuated in each time span.

It is undeniable that visual aid is the most useful option to capture the objects than any methods by using text, log. With current trends of software development methods, instead of documenting requirements in hundreds of pages or planning projects, developers are using Scrum-board and Mind-map as tools to visualize their plans, project progress, and project requirements. To the given challenges of Exploratory Testing, one of the solutions is to track in detail all of what has been done by testers and visualize them in any form which easies to capture information. By using a case study, this study investigates the role of One2Explore as a visual tool for testing in MeU Company. The findings of this study indicate that using graphs as a method to display test execution and relevant information is an approach that can be beneficial in achieving effective testing.

Recently, research papers which are related to artificial intelligence topic, especially decision support methodologies have received continuous concentration and achieved remarkable developments. Many articles have shown the important application of those methods in several aspects along with their effectiveness in most fields of research. In this paper we focus on approach using genetic algorithm and Nash equilibrium to solve the problem choosing appropriate bidders in multi-round procurement, which is currently considered an unsolved problem to many procuring entities. Instead of using manual and subjective consideration from procuring entities, a scientific methodology on decision-making support has been studied and identified equilibrium points in multiple-round procurements, which is the most beneficial to both investors and selected tenderers. These results can be a scientific promising solution for choosing bidders in multi-round procurement and ensure win-win relationship for all parties in procurement process.