Breast density classification is a critical factor in assessing breast cancer risk, and most existing methods rely on mammography. This study proposes a method for automatic breast density classification using T2-weighted MRI images, following the ACR BI-RADS criteria. The proposed method involves creating total and border masks based on MRI scans, excluding the chest area, computing the percentage of periglandular fat, and classifying density into “Dense” and “Not Dense”. Experimental validation was conducted using 136 MRI exams, including cases with prosthetic implants, mastectomy, nodulectomy, and tumorectomy. The method achieved an Accuracy of 0.86, a Precision of 0.96, a Specificity of 0.97, and a Sensitivity of 0.76. These results highlight the robustness of the method and demonstrate the potential of MRI-based density classification as a complementary tool to mammography. The findings provide new insights for breast imaging practices and assist radiologists in clinical practice. Future developments will focus on extending the classification to the original four BI-RADS classes. • Breast density is a key risk factor for breast cancer, typically assessed with mammography. • This paper proposes an MRI-based approach for breast density classification into “Dense” and “Not Dense” categories. • The proposed method, based on the computation of periglandular fat percentage, achieved Accuracy 0.87, Precision 0.96, Specificity 0.97, and Sensitivity 0.76

Generative deep learning (DL) models have been successfully adopted for vulnerability patching. However, such models require the availability of a large dataset of patches to learn from. To overcome this issue, researchers have proposed to start from models pre-trained with general knowledge, either on the programming language or on similar tasks such as bug fixing. Despite the efforts in the area of automated vulnerability patching, there is a lack of systematic studies on how these different training procedures impact the performance of DL models for such a task. This paper provides a manyfold contribution to bridge this gap, by (i) comparing existing solutions of self-supervised and supervised pre-training for vulnerability patching; and (ii) for the first time, experimenting with different kinds of prompt-tuning for this task. The study required to train/test 23 DL models. We found that a supervised pre-training focused on bug-fixing, while expensive in terms of data collection, substantially improves DL-based vulnerability patching. When applying prompt-tuning on top of this supervised pre-trained model, there is no significant gain in performance. Instead, prompt-tuning is an effective and cheap solution to substantially boost the performance of self-supervised pre-trained models, i.e., those not relying on the bug-fixing pre-training.

Pre-trained Machine Learning (ML) models help to create ML-intensive systems without having to spend conspicuous resources on training a new model from the ground up. However, the lack of transparency for such models could lead to undesired consequences in terms of bias, fairness, trustworthiness of the underlying data, and, potentially even legal implications. Taking as a case study the transformer models hosted by Hugging Face, a popular hub for pre-trained ML models, this paper empirically investigates the transparency of pre-trained transformer models. We look at the extent to which model descriptions (i) specify the datasets being used for their pre-training, (ii) discuss their possible training bias, (iii) declare their license, and whether projects using such models take these licenses into account. Results indicate that pre-trained models still have a limited exposure of their training datasets, possible biases, and adopted licenses. Also, we found several cases of possible licensing violations by client projects. Our findings motivate further research to improve the transparency of ML models, which may result in the definition, generation, and adoption of Artificial Intelligence Bills of Materials.

Ocular diseases present a significant public health challenge, necessitating accurate and timely diagnosis for effective management and preservation of vision. Fundus imaging, providing a single snapshot of the eye’s posterior segment, plays a pivotal role in diagnosing ocular diseases. However, the interpretation of fundus images is inherently limited by the lack of volumetric data, posing challenges for comprehensive disease evaluation. This paper explores a preliminary approach integrating radiomics and pattern matching into the analysis of eye fundus images to enhance diagnostic capabilities. Our method takes as input the radiomic feature values extracted from the medical images and after the selection and discretization process identifies if there exists a recurrent pattern to distinguish diseased eyes from normal ones. We prove our approach on a dataset of 300 eye fundus images. Results achieved are comparable with ones obtained using artificially intelligence-based approaches.

The video game industry is particularly rewarding as it represents a large portion of the software development market. However, working in this domain may be challenging for developers, not only because of the need for heterogeneous skills (from software design to computer graphics), but also for the limited body of knowledge in terms of good and bad design and development principles, and the lack of tool support to assist them. This tool demo proposes UnityLint, a tool able to detect 18 types of bad smells in Unity video games. UnityLint builds upon a previously-defined and validated catalog of bad smells for video games. The tool, developed in C# and available both as open-source and binary releases, is composed of (i) analyzers that extract facts from video game source code and metadata, and (ii) smell detectors that leverage detection rules to identify smells on top of the extracted facts.Tool: https://github.com/mdipenta/UnityCodeSmellAnalyzerTeaser Video: https://youtu.be/HooegxZ8H6g

Video games represent a substantial and increasing share of the software market. However, their development is particularly challenging as it requires multi-faceted knowledge, which is not consolidated in computer science education yet. This article aims at defining a catalog of bad smells related to video game development. To achieve this goal, we mined discussions on general-purpose and video game-specific forums. After querying such a forum, we adopted an open coding strategy on a statistically significant sample of 572 discussions, stratified over different forums. As a result, we obtained a catalog of 28 bad smells, organized into five categories, covering problems related to game design and logic, physics, animation, rendering, or multiplayer. Then, we assessed the perceived relevance of such bad smells by surveying 76 game development professionals. The survey respondents agreed with the identified bad smells but also provided us with further insights about the discussed smells. Upon reporting results, we discuss bad smell examples, their consequences, as well as possible mitigation/fixing strategies and trade-offs to be pursued by developers. The catalog can be used not only as a guideline for developers and educators but also can pave the way toward better automated tool support for video game developers.

Continuous integration and delivery (CI/CD) have been shown to be very useful to improve the quality of software products (e.g., increasing their reliability or maintainability), and their development processes, e.g., by shortening release cycles. Applying CI/CD in the context of Cyber-Physical Systems (CPSs) can be particularly important, given that many of those systems can have safety-critical properties, and given their interaction with hardware or simulators during the development phase. This paper empirically analyzes how CI/CD is enacted in CPSs when considering the context of open-source projects, that often (also) rely on hosted CI/CD solutions, and benefit of an open-source development community. We qualitatively analyze a statistically significant sample of 670 pull requests from 20 open-source CPSs hosted on GitHub, to identify and categorize---also keeping into account catalogs from previous literature---bad practices, challenges, mitigation, and restructuring actions. The study reports and discusses the relationships we found between bad practices/challenges and CI/CD restructuring/mitigation strategies, reporting concrete examples, especially those emerging from the intrinsic complexity of CPSs.

Recently, several research efforts have been focused on automotive safety, due to the increasing technology embedded in our vehicles. Research community have produced different methods aimed, for instance, to profile driver behaviour, starting from a feature set gathered by the vehicle. The provided methods are mainly machine learning-based: these solutions, as largely demonstrate in literature, suffer from several issues, due to the context variability but also because they are not able to provide a rational reason for the specific prediction. To overcome these limitations, in this paper we propose a novel model checking based approach to driver identification. Furthermore, a novel automatic procedure able to infer a logical representation of the driver behaviour is discussed. Two real-world datasets for the evaluation of the proposed method are considered, obtaining interesting results in driver identification.

The growth of the video game market, the large proportion of games targeting mobile devices or streaming services, and the increasing complexity of video games trigger the availability of video game-specific tools to assess performance and maintainability problems. This paper proposes UnityLinter, a static analysis tool that supports Unity video game developers to detect seven types of bad smells we have identified as relevant in video game development. Such smell types pertain to performance, maintainability and incorrect behavior problems. After having defined the smells by analyzing the existing literature and discussion forums, we have assessed their relevance with a survey involving 68 participants. Then, we have analyzed the occurrence of the studied smells in 100 open-source Unity projects, and also assessed UnityLinter's accuracy. Results of our empirical investigation indicate that developers well-received performance- and behavior-related issues, while some maintainability issues are more controversial. UnityLinter is, in general, accurate enough in detecting smells (86%-100% precision and 50%-100% recall), and our study shows that the studied smell types occur in 39%-97% of the analyzed projects.

Sport result prediction proposes an interesting challenge considering as popular and widespread are sport games, for instance tennis and soccer. The outcome prediction is a difficult task because there are a lot of factors that can afflict the final results and most of them are related to the player human behaviour. In this paper we propose a new feature set (related to the match and to players) aimed to model a soccer match. The set is related to characteristics obtainable not only at the end of the match, but also when the match is in progress. We consider machine learning techniques to predict the results of the match and the number of goals, evaluating a dataset of real-world data obtained from the Italian Serie A league in the 2017-2018 season. Using the RandomForest algorithm we obtain a precision of 0.857 and a recall of 0.750 in won match prediction, while for the goal prediction we obtain a precision of 0.879 in the number of goal prediction less than two, and a precision of 0.8 in the number of goal prediction equal or greater to two.

Currently, the gender is mainly inferred through bone and dental analyses. However, such sort of analysis is useless when bones are not available. Hair is a stable substance that, depending on its length, is capable of retaining years of information. In this paper we propose a machine learning based approach aimed to identify gender through hair elements. Preliminary results have even indicated that the method is promising also for forensics analysis since it is able to identify the gender with a high accuracy.

Android malware is increasing from the point of view of the complexity and the harmful actions. As a matter fact, malware writers are developing sophisticated techniques to infect mobile devices very closed to their counterpart for personal computers. One of these threats is represented by the possibility to control the infected devices from the attacker i.e., the so-called botnet. In this paper a method able to identify botnet in Android environment through model checking is proposed. Starting from the malicious payload definition, the proposed method is able to detect and to localize the code related to the malicious botnet. We experiment real-world botnet based Android malware, obtaining encouraging results.

The European Railway Traffic Management System has the purpose to provide a common signaling system for all the European nations. It consists of two subsystems: the trackside subsystem (TSS) and the on-board subsystem (OBS) that communicate to exchange information about the state of the trackside and/or the train. Radio communication can take place according to the requirements specification reported in ERTMS/ETCS SUBSET-026-3. As the communication between TSS and OBS is a critical issue, we exploit model checking to verify the correctness of the communication process as specified in the SUBSET-026-3. The results achieved during the experimentation seem to be very promising.

With the increasing diffusion of mobile technologies, nowadays mobile devices represent an irreplaceable tool to perform several operations, from posting a status on a social network to transfer money between bank accounts. As a consequence, mobile devices store a huge amount of private and sensitive information and this is the reason why attackers are developing very sophisticated techniques to extort data and money from our devices. This paper presents the design and the implementation of LEILA (formaL tool for idEntifying mobIle maLicious behAviour), a tool targeted at Android malware families detection. LEILA is based on a novel approach that exploits model checking to analyse and verify the Java Bytecode that is produced when the source code is compiled. After a thorough description of the method used for Android malware families detection, we report the experiments we have conducted using LEILA. The experiments demonstrated that the tool is effective in detecting malicious behaviour and, especially, in localizing the payload within the code: we evaluated real-world malware belonging to several widespread families obtaining an accuracy ranging between 0.97 and 1.

Despite the development of new technologies, in order to prevent the stealing of cars, the number of car thefts is sharply increasing.With the advent of electronics, new ways to steal cars were found.To avoid auto-theft attacks, in this paper we propose a machine leaning based method to silently e continuously profile the driver by analyzing built-in vehicle sensors.We evaluate the efficiency of the proposed method in driver identification using 10 different drivers.Results are promising, as a matter of fact we obtain a high precision and a recall evaluating a dataset containing data extracted from real vehicle.

In the last years, several safety automotive concepts have been proposed, for instance the cruise control and the automatic brakes systems.The proposed systems are able to take the control of the vehicle when a dangerous situation is detected.Less effort was produced in driver aggressiveness in order to mitigate the dangerous situation.In this paper we propose an approach in order to identify the driver aggressiveness exploring the usage of unsupervised machine learning techniques.A real world case study is performed to evaluate the effectiveness of the proposed method.

Data breaches usually involve financial information such as credit card or bank details. Automated formal verification of safety critical systems has been mostly focused on analysing high-level abstract models which, however, are significantly different from real implementations written in programming languages. In this paper we propose a technique that links model checking verification closer to real implementations, with particular regard to financial environment, in order to identify possible causes of data breaches. A formal model starting from execution traces is retrieved. Thus, the discovered model can be analysed to verify it respects the defined properties. A real safety critical system has been used as a case study to evaluate the proposed methodology.

The crucial aim of software security is malware detection. A malware is a program with malicious intents. The predominate anti-malware solutions are signature-based. These detectors compute the signature starting from the syntactic characteristics of the malicious code. Unfortunately, the signature-based techniques are ineffective against the code obfuscations, i.e., trivial transformations that alter the syntax of the code preserving the normal behaviour of the program. To address this limitation, formal methods are used in software security. Formal methods are rigorous techniques used to verify the behaviour of a system. This paper aims to make an overview on behavioural based techniques developed to detect malware programs. The illustrated approaches are based on different formal techniques.

Android operating system is constantly overwhelmed by new sophisticated threats and new zero-day attacks. While aggressive malware, for instance malicious behaviors able to cipher data files or lock the GUI, are not worried to circumvention users by infection (that can try to disinfect the device), there exist malware with the aim to perform malicious actions stealthy, i.e., trying to not manifest their presence to the users. This kind of malware is less recognizable, because users are not aware of their presence. In this paper we propose FormalDroid, a tool able to detect silent malicious beaviours and to localize the malicious payload in Android application. Evaluating real-world malware samples we obtain an accuracy equal to 0.94.

Modern vehicles have lots of connectivity, this is the reason why protect in-vehicle network from cyber-attacks becomes an important issue. The Controller Area Network is a de facto standard for the in-vehicle network. However, lack of security features of CAN protocol makes vehicles vulnerable to attacks. The message injection attack is a representative attack type which injects fabricated messages to deceive original Electronic Control Units or to cause malfunctions. In this paper we propose a method able to detect four different type of attacks targeting the CAN protocol adopting fuzzy algorithms. We obtain encouraging results with a precision ranging from 0.85 to 1 using the fuzzy NN algorithm in the identification of attacks targeting CAN protocol.

Medical studies demonstrated that diabetes pathology is increasing in last decades and the trend do not tends to stop. In order to help and to accelerate the diagnosis of diabetes in this paper we propose a method able to classify patients affected by diabetes using a set of characteristic selected in according to World Health Organization criteria. Evaluating real-world data using state of the art machine learning algorithms, we obtain a precision value equal to 0.770 and a recall equal to 0.775 using the HoeffdingTree algorithm.

Android represents the most widespread mobile environment. This increasing diffusion is the reason why attackers are attracted to develop malware targeting this platform. Malware writers usually use code obfuscation techniques in order to evade the current antimalware detection and to generate new malware variants. These techniques make code programs harder to understand and they change the signature of the application making ineffective the signature extraction work. We propose a method based on formal methods able to identify whether a mobile application is obfuscated. In this preliminary work we identify one of the most widespread obfuscation technique: the code reordering. We test our method on a real-world dataset composed by Android trusted and ransomware samples, obtaining encouraging results.

Android is currently the most widely used mobile environment. This trend encourages malware writers to develop specific attacks targeting this platform with threats designed to covertly collect data or financially extort victims, the so-called ransomware. In this paper we use formal methods, in particular model checking, to automatically dissect ransomware samples. Starting from manual inspection of few samples, we define a set of rule in order to check whether the behaviours we find are representative of ransomware functionalities.

Android smartphones are the most widespread in the world. This is the reason why attackers write code more and more aggressive in order to steal data and other important information stored in the phone. One of the most representative malware that implements the typical trojan behaviour in Android environment is the so-called Fake Installer. In this paper we use formal methods, in particular model checking, in order to identify Fake Installer malware. We specify a set of formulae and then we check these on a designed application model, built in CCS, to recognize whether an application is a malware belonging to Fake Installer family or a legitimate sample. We experiment our methodology on 1125 real world samples obtaining very promising results.

In this paper, we use model checking to perform the analysis and the assessment of the Purchasing Process performance in the field of Action Controls. The aim of these controls, in a Management Control Systems, is to ensure that the employee behaviours are consistent with the objectives and strategies of the organization. However, model checking suffers from the so-called state explosion problem, which says that the state space grows exponentially in the number of concurrent processes. In this paper we consider a property-based methodology developed to combat the state explosion problem. Our focus is two fold: (i) we show how model checking can be applied in the context of business process modelling and analysis, (ii) we evaluate and test the reduction methodology using an academic case study. Our investigations suggest that the business community can benefit from this efficient methodology developed in formal methods since it can detect errors that were missed by traditional verification techniques. Thus, formal methods can be adopted to enhance the effectiveness of the organizational control together with an increase of process efficiency levels. We show and discuss the obtained experimental results.