Finding security vulnerabilities in the source code as early as possible is becoming more and more essential. In this respect, vulnerability prediction models have the potential to help the security assurance activities by identifying code locations that deserve the most attention. In this paper, we investigate whether prediction models behave like milk (i.e., they turn with time) or wine (i.e., the improve with time) when used to predict future vulnerabilities. Our findings indicate that the recall values are largely in favor of predictors based on older versions. However, the better recall comes at the price of much higher file inspection ratio values.

This paper discusses the merits and challenges of adopting software product line engineering (SPLE) as the main development process for an automotive Hall Effect sensor. This versatile component is integrated into a number of automotive applications with varying safety requirements (e.g., windshield wipers and brake pedals).

This paper presents an approach based on machine learning to predict which components of a software application contain security vulnerabilities. The approach is based on text mining the source code of the components. Namely, each component is characterized as a series of terms contained in its source code, with the associated frequencies. These features are used to forecast whether each component is likely to contain vulnerabilities. In an exploratory validation with 20 Android applications, we discovered that a dependable prediction model can be built. Such model could be useful to prioritize the validation activities, e.g., to identify the components needing special scrutiny.

This paper presents an empirical study comparing two alternatives for generating code from aspect-oriented models. In an aspect "disrupting" process, an object oriented implementation in Java is automatically generated from domain specific models, comprising a mix of UML (for core functionality) and DSLs (for qualities like security and perfor mance). In an aspect "preserving" process, an aspect oriented implementation in AspectJ is automatically generated from the same models. In both alternatives, a number of subjects are asked to perform several maintenance tasks requiring the addition and improvement of functionality. The results show that, in most of the cases, the AO alternative provides for shorter maintenance cycles.