Next activity prediction is one of the main tasks of Predictive Process Monitoring (PPM), enabling organizations to forecast the execution of business processes and respond accordingly. Deep learning models are effective at predictions, but with the price of intensive training and feature engineering, rendering them less generalizable across domains. Large Language Models (LLMs) have been recently suggested as an alternative, but their capabilities in Process Mining tasks are still to be extensively investigated. This work introduces a framework leveraging LLMs and Retrieval-Augmented Generation to enhance their capabilities for predicting next activities. By leveraging sequential information and data attributes from past execution traces, our framework enables LLMs to make more accurate predictions without additional training. We evaluate the approach on a wide range of event logs and compare it with state-of-the-art techniques. Findings show that our framework achieves competitive performance while being more adaptable across domains. Moreover, we assess early prediction capabilities, validate the significance of observed differences through statistical testing, and explore the impact of fine-tuning. Despite these advantages, we also report the framework’s limitations, mainly related to interleaving activity sensitivity and concept drifts. Our findings highlight the potential of retrieval-augmented LLMs in PPM while identifying the need for future research into handling evolving process behaviors and the development of standard benchmarks.

Applying machine learning to fully distributed environments is always becoming more crucial in several real-life contexts. In networked environments, data models can evolve dynamically over time subject to continuous changes known as concept drifts. Detecting when concept drift occurs is essential for various drift-handling techniques and plays a significant role in many scenarios. However, while drift-handling methods exist, an efficient solution for detecting drift in large-scale networks remains unknown. This study proposes a concept drift detection approach allowing to capture temporal variations in the data, enabling a more robust identification of data changes. Specifically, our method detects local models exhibiting a concept drifts by analyzing deviations in learned representations over time. We validate our approach using a real-world urban traffic dataset, demonstrating its effectiveness in identifying concept drift in real scenarios. The results show that the proposed approach successfully identifies sudden and gradual drifts, respectively achieving an F1-score of 0.94 in sudden drift detection and an F1-score of 0.92 in gradual drift detection.

Comprehension of the Unified Modeling Language is essential for learners in the context of software modeling. However, current UML learning tools provide minimal guidance to novice modelers as they are insufficient in analyzing modeling behaviour adopted during the diagram creation process. In order to address this gap, we present an enhanced version of UML Miner, a plugin for Visual Paradigm, that systematically records and analyzes UML modeling activities through the use of Process Mining techniques. UML Miner tracks all modeling events, resulting in event logs that warrant conformance checking against expert modeling practices. This tool establishes flexible, yet structured learning pathways through Declarative Process Mining, supporting trace-based and event-based filtering, customized violation reports, and integration with external process mining tools. This work emphasizes the potential of process mining in computing education, demonstrating how conformance checking can strengthen UML modeling proficiency.

The exponential growth of the Internet of Things (IoT) has generated vast amounts of data at the edge, creating challenges for privacy-preserving and resource-efficient machine learning. Federated Learning (FL) has emerged as a decentralized paradigm that trains models locally on edge devices, reducing privacy risks and communication overhead. However, FL faces significant challenges related to data and resource heterogeneity across devices, including disparities in computational power, memory, and network. To address these issues, this study introduces AH-Fed, an adaptive framework for Heterogeneous Federated Learning (HFL). AH-Fed employs a tri-tiered model architecture to accommodate diverse device capabilities to minimize communication overhead, and stratified resource management to ensure fair and efficient device participation. By adapting training strategies based on device-specific constraints, AH-Fed enhances the inclusivity, scalability, and efficiency of FL systems. Empirical validation demonstrates the framework’s effectiveness in optimizing resource utilization and improving model performance in real-world scenarios.

The adoption of machine learning in distributed environments is expanding rapidly, providing substantial benefits for real-time decision-making. However, this evolution has also increased the prevalence of poisoning attacks that target the model training phase.Defending against such threats is crucial, yet existing defense mechanisms often overlook the dynamic nature of data in evolving contexts. To address this gap, we propose a novel defense strategy that leverages concept drift analysis within a spatiotemporal framework based on a transformer autoencoder. This approach captures both spatial correlations and temporal variations in the data, enabling a more robust identification of adversarial patterns. Specifically, our method detects and excludes compromised local models exhibiting adversarial behavior by analyzing deviations in learned representations over time.We validate our approach using a real-world urban traffic dataset, demonstrating its effectiveness in mitigating the impact of poisoning attacks in dynamic, real-world scenarios. The results confirm that our method successfully identifies poisoned stations, achieving an F1 score of 0.9 in local drift detection. Furthermore, by dynamically filtering out adversarial drifts, our approach enhances the underlying model's robustness against poisoning attacks.

Teaching the Unified Modelling Language (UML) is a critical task in the frame of Software Engineering courses. Teachers need to understand the students’ behavior along with their modeling activities to provide suggestions and feedback to avoid more frequent mistakes and improve their capabilities. This paper presents a novel approach for teaching the UML in Software Engineering courses, focusing on understanding and improving student behavior and capabilities during modeling activities. It introduces a cloud-based tool that captures and analyzes UML diagrams created by students during their interactions with a UML modeling tool. The key aspect of the proposal is the integration of a Retrieval Augmented Generation Large Language Model (RAG-based LLM), which generates insightful feedback for students by leveraging knowledge acquired during the modeling process.The effectiveness of this method is demonstrated through an experiment involving a substantial dataset comprising 5,120 labeled UML models. The validation process confirms the performance of the UML RAG-based LLM in providing relevant feedback related to entities and relationships in the students’ models. Additionally, a qualitative analysis highlights the user satisfaction, underscoring its potential as a valuable tool in enhancing the learning experience in software modeling education.

Creating radiology reports is a vital but time-intensive task that involves analyzing images, consulting documents, and evaluating data. This process, heavily reliant on human effort, is prone to errors that can vary with the radiologists experience. Consequently, automating the generation of radiology reports is a key research goal due to its potential impact on medical procedures and patient care.This work proposes a multimodal approach specifically designed for generating radiological reports from chest X-rays (CXRs). Our method integrates a LLaMa large language model with Retrieval Augmented Generation (RAG), enhanced by a modified ALBEF embedding model that exploits efficient organ semantic segmentation and triple contrastive loss (called EALBEF). The combination of these two components allows radiological report generation that surpasses current state-of-the-art methods in terms of quality and accuracy. Our approach demonstrates a significant enhancement in the radiologist-specific metrics (e.g., RadCliQ), as well as across various generic lexical-based metrics (e.g., GLEU). Quantitative analyses of the models outputs reveal a notable increase in fluency and accuracy, with a marked reduction in issues such as hallucinations and source-reference divergences in the generated reports.

This study introduces an innovative approach to safety report generation using a Retrieval-Augmented Generation (RAG) framework, tailored to synthesize comprehensive reports from descriptions and logs of work sessions. The core contribution of our study is the comparison and optimization of various Large Language Model variants (based on LLaMA) and embedding models, aiming to identify the most effective combination for accurately capturing and reflecting the intricacies of safety-related data in a given domain. Our RAG-based system leverages the strengths of different LLaMA models and embedding techniques to process and contextualize the input data, which include detailed session descriptions and operational logs. By integrating these models, we aim to automate the generation of safety reports that are not only coherent and contextually relevant, but also adhere to the stringent requirements of safety documentation in professional environments. The validation of our approach is performed using an aviation safety dataset and classic metrics in the field, such as Recall@5, GLEU, METEOR, and BERTscore. Our findings demonstrate the potential of RAG-based systems in streamlining the process of safety report generation, offering significant improvements in efficiency and accuracy over traditional methods and non domain-specific tailored models.

Abstract Traditionally, process-aware Decision Support Systems (DSSs) have been enhanced with AI functionalities to facilitate quick and informed decision-making. In this context, AI-Augmented Business Process Management Systems have emerged as innovative human-centric information systems, blending flexibility, autonomy, and conversational capability. Large Language Models (LLMs) have significantly boosted such systems, showcasing remarkable natural language processing capabilities across various tasks. Despite the potential of LLMs to support human decisions in business contexts, empirical validations of their effectiveness for process-aware decision support are scarce in the literature. In this paper, we propose the Business Process Large Language Model (BPLLM) framework, a novel approach for enacting actionable conversations with human workers. BPLLM couples Retrieval-Augmented Generation with fine-tuning, to enrich process-specific knowledge. Additionally, a process-aware chunking approach is incorporated to enhance the BPLLM pipeline. We evaluated the approach in various experimental scenarios to assess its ability to generate accurate and contextually relevant answers to users’ questions. The empirical study shows the promising performance of the framework in identifying the presence of particular activities and sequence flows within the considered process model, offering insights into its potential for enhancing process-aware DSSs.

Although Internet traffic detection and categorization have been extensively researched over the last decades, it remains a hot issue in the Internet of Things (IoT) context, mainly when traffic is generated in medical structures. Theoretically, it is possible to apply classical methods for IoT traffic categorization and to detect traffic addressed to intelligent devices present in hospital rooms. The problem is always to get a proper medical IoT traffic dataset. In this work, we have created a synthetic dataset of IoT traffic generated by different smart devices put in different hospital rooms. For creating the medical IoT traffic, we have exploited IoT-Flock, an open-source tool for IoT traffic generation supporting CoAP and MQTT, the most used IoT protocols. We have performed, for the first time, a multinomial classification of IoT-Flock-generated traffic considering both normal-traffic and packets of different attacks. The classification has been performed by comparing both traditional machine learning techniques and deep learning network models composed of several hidden layers. The obtained results are very encouraging and can confirm the usability of IoT-Flock data to be used to test and train machine and deep learning models to detect abnormal IoT traffic in a medical scenario.

The architectural space impacts the emotional state of its inhabitants. Nevertheless, no studies have investigated, to date, how it influences the perception of others' affective states, possibly impacting our social behavior. This paper analyzes the eye-gaze data collected during a social scenario recreated after a promenade within virtual architectures. Immersive and dynamic virtual architectures were characterized by decreasing or increasing sidewall distance, ceiling height, windows height, and different colors. At the end of such an experience, participants judged the arousal level expressed by a virtual avatar. For the first time, we apply machine and deep learning techniques to the behavioral, environmental, and eye-gaze features extracted during the dynamic experience of virtual architectures. In order to verify the feasibility of automated classification of the final arousal judgment on the avatar emotional expression, we have considered both interpretable, i.e., decision trees, and black-box models, i.e., dense neural networks. The decision tree reached an accuracy rate of 66%, showing the importance of eye-gaze parameters to classify the participants' arousal judgment. The black-box dense neural network increased the accuracy up to 80%. Overall, our findings demonstrate the capability of artificial intelligence methodologies to classify and possibly predict the arousal judgment of body expressions at the end of a virtual promenade. Such knowledge will serve the design and evaluation of future spaces by combining virtual reality and artificial intelligence within the experience of architecture. In such a way, it will be possible to predict the influence of the surrounding architecture on human social behavior.

Parkinson's is a neurodegenerative disease, with a slow but progressive evolution, which involves some main functions such as the control of movements and balance. Symptoms vary by patient and include motor factors such as tremors and stiffness as well as non-motor symptoms such as cognitive impairment. Its diagnosis is not easy, so it is becoming increasingly necessary to assist doctors in identifying and predicting the disease. Artificial intelligence takes up this challenge and this work proposes a new approach to predict the onset of the disease and monitor patients. The experimentation involved the use of different classification algorithms. The proposed methodology was validated on a large ad hoc data set by compiling data collected by the Parkinson's Progression Markers Initiative (PPMI). Specifically, the study compares the results of the classification taking into consideration only the characteristics belonging to the motor sphere, or those of the non-motor sphere, with the aim of understanding which characteristics are more significant for the identification of the disease. In this regard, a multi-stage feature selection was conducted and SHAP was used to make the model explainable.

Heart disease is becoming the biggest cause of mortality worldwide. Its early detection can considerably lower the risk of mortality and help to promote its successful treatment. However, this early detection necessitates regular monitoring of a wide range of clinical and lifestyle factors. This is why a growing number of studies are being conducted to automate the forecasting of cardiac diseases, beginning with an examination of ECG images, which is the first diagnostic test performed on patients and also the most simple and economical to conduct. This study investigates the use of three groups of ECG images acquired from three separate sets of cardiac patients, with different heart-related illnesses, and a set of healthy controls to predict heart disease using deep learning classifiers. The evaluation is carried out on a real-life dataset, and the results highlight really interesting findings.

Parkinson's disease is one of the most prevalent neurodegenerative diseases in the world, usually occurring after the age of 50, but in some cases, also affects younger people. It is a disease that affects movement, coordination, and muscle control, all of which cause a range of symptoms that affect patients' writing and drawing skills. Diagnosis is clinical, so it occurs mainly through the evaluation of the patient's movements, coordination, and muscle control. Therefore, the analysis of micrographic models can introduce a new methodology of investigation in the diagnosis and monitoring of Parkinson's disease. This study proposes an approach based on artificial intelligence in combination with the spiral test, which consists in asking the patient to draw a spiral, thanks to which it is possible to make the early diagnosis of Parkinson's disease. The classification is performed with a combination of an Echo State Network and an MLP layer. To validate the approach, several classification algorithms belonging to two macro groups (boosting decision trees based) were used as baseline. The results obtained are very satisfactory with the ESN-based classifier exhibiting an F-Score of 97.8%. The very encouraging results indicate that the proposed approach may be an effective contribution to improving Parkinson's diagnostics.

Lung cancer is one of the diseases with the highest mortality rate and early detection is key to making the disease as treatable as possible. The most common and useful method for recognizing pulmonary nodules is computed tomography, which allows them to be located and monitored. The disadvantage of this technique is that the scans have to be interpreted by doctors, who could make mistakes. The use of pulmonary CAD is therefore becoming increasingly widespread, a system capable of automatically analyzing CT images and providing information on possible suspicious regions found in the images. These systems, by offering radiologists a list of already marked regions of interest to view with particular attention, increase the efficiency of detection of small nodules and reduce reporting times by physicians. This study aims to accurately detect the location of pulmonary nodules through a Deep Learning approach with the use of computed tomography scans. In particular, it proposes the use of a new variant of the UNet architecture, called GUNet3++, which has been compared with the other types of this network. To validate the approach, the public LIDC-IDRI dataset was used, which collects pulmonary CT images of about a thousand patients with different types of cancer. The results obtained are very promising, showing a performance improvement compared to other UNet networks.

The increasing number of always more sophisticated car sensors, which allow to extract information about the driver, encourages auto vehicle developers and researchers to focus on the topic of driver identification. The advantages can be various, such as to customise and improve driver experience, to increase safety and to reduce global environmental problems. This work explores a set of features extracted from a car monitoring system, installed on real cars, to identify the driver on the basis of his/her driving behaviour. The proposed features are leveraged by a Multiobjective Evolutionary Learning Scheme for generating Fuzzy Rule-Based Classifiers characterized by different trade-offs between the classification accuracy and the explainability of the classification models. To evaluate the effectiveness and efficiency of the proposed approach, we carry out an experimental analysis on a real-world dataset, composed by actual measures extracted from 4 cars driven by 4 different drivers. The results show that the fuzzy classification models experimented in this work are more accurate and explaninable than the classification models generated adopting tree-based classifiers, such as decision trees and random forests.

The detection and classification of Internet traffic was studied in depth in the last twenty years, but this is still an open research issue as pertains the Internet of Things (IoT), mainly because real IoT traffic dataset are not very widespread. With this paper, we make public an integrated dataset, made of actual IoT network flows, built using six different network sources, which could represent a research reference for further investigations. Furthermore, we exploited it to optimize the hyper-parameters of a deep neural network and evaluate its performance for both distinguishing normal and abnormal traffic and discriminating different types of attacks, achieving very good results.

Defect prediction and estimation techniques play a significant role in software maintenance and evolution. Recently, several research studies proposed just-in-time techniques to predict defective changes. Such prediction models make the developers check and fix the defects just at the time they are introduced (commit level). Nevertheless, early prediction of defects is still a challenging task that needs to be addressed and can be improved by getting higher performances. To address this issue this paper proposes an approach exploiting a large set of features corresponding to source code metrics detected from commits history of software projects. In particular, the approach uses deep temporal convolutional networks to make the fault prediction. The evaluation is performed on a large data-set, concerning four well-known open-source projects and shows that, under certain considerations, the proposed approach has effective defect proneness prediction ability.

Identifying and diagnosing as early as possible malignant lung nodules is essential to reduce the mortality of lung cancer patients. Radiologists employ computer tomography scan to detect cancer in the body and track its growth. Interpretation of tomography scan, today still not automated, can lead to cancer detection at early stages, thus leading to the treatment of cancer which can decrease the death rates. Image processing, a branch of computer-assisted diagnostic, can support radiologists for the early detection of cancer. Against that background, we propose a novel ensemble-based approach for more accurate lung cancer classification using Computer tomography scan images. This work exploits transfer learning using pre-trained deep networks (e.g., VGG, Xception, and ResNet), combined into an ensemble architecture to classify clustered images of lung lobes. The approach is validated on a real dataset and shows that the ensemble classifier ensures effective performance, exhibiting better generalization capabilities.

Technical debt is a metaphor that refers to all the consequences of poorly written code and trade-offs in development. Early technical debt diagnosis is important for software developers because it allows planning for software maintenance and improvement activities, such as refactoring, to prevent system degradation. Several studies have been conducted in the literature on the identification of the technical debt and its consequences, thanks to useful tools for identifying the problem within the source code. On the other hand, this work aims to explore a deep learning approach to predict the rise of technical debt in software code by leveraging the knowledge of changing quality metrics. For validation of the approach, a large dataset was built, related to four known Java software projects, with the collection of numerous class-level code quality metrics. The results obtained show the effectiveness of the proposed approach in predicting the development of Technical Debt within the source code. We obtained an F1 score of 0.99 for two of the chosen software systems and greater than 0.91 for the remaining two.

The thyroid is an endocrine gland located in the anterior region of the neck: its main task is to produce thyroid hormones, which are functional to our entire body. Its possible dysfunction can lead to the production of an insufficient or excessive amount of thyroid hormone. Therefore, the thyroid can become inflamed or swollen due to one or more swellings forming inside it. Some of these nodules can be the site of malignant tumors. One of the most used treatments is sodium levothyroxine, also known as LT4, a synthetic thyroid hormone used in the treatment of thyroid disorders and diseases. Predictions about the treatment can be important for supporting endocrinologists’ activities and improve the quality of the patients’ life. To date, there are numerous studies in the literature that focus on the prediction of thyroid diseases on the trend of the hormonal parameters of people. This work, differently, aims to predict the LT4 treatment trend for patients suffering from hypothyroidism. To this end, a dedicated dataset was built that includes medical information related to patients being treated in the ”AOU Federico II” hospital of Naples. For each patient, the clinical history is available over time, and therefore on the basis of the trend of the hormonal parameters and other attributes considered it was possible to predict the course of each patient’s treatment in order to understand if this should be increased or decreased. To conduct this study, we used different machine learning algorithms. In particular, we compared the results of 10 different classifiers. The performances of the different algorithms show good results, especially in the case of the Extra-Tree Classifier, where the accuracy reaches 84%.

In this paper, we present a Deep Learning architecture, exploiting a fuzzy layer, applied to the data coming from various sensors located under the feet of a patient affected by the Parkinson's disease. The solution we propose permits one to cluster data coming from different sensors into different fuzzy partitions, according to the different parts of the feet, and to discriminate the illness of a person as well as the severity degree of the disease itself. We employed a known dataset to evaluate our solution and compared its performance with some similar approaches found in the relevant literature. Moreover, we performed an intensive parameter optimization step to find the best setting for the proposed fuzzy neural network. The evaluation shows that our solution obtains good classification results both in the binary and in the multiclassification approach.

Mobile devices have become, in the last years, an essential tool used to perform daily activities. However, they also have become the target of continuous malware attacks usually coming out from new malware obtained as a variant of existing ones. For this reason, we suppose that by comparing the behavior of a new application with those of known malware applications it is possible to define it as malicious or trusted. According to this, the current study proposes an approach based on a data-aware declarative process mining technique to identify similarities and recurring patterns in the system call traces generated by a set of malicious mobile applications. The obtained characterization, represented by a set of declarative constraints within their data attributes, can be considered as a run-time fingerprint of a malware useful to evaluate the membership of a new application to a given malware family. The empirical validation of the proposed approach is performed on a dataset of more than 1200 trusted and malicious applications coming out from eight malware families and the obtained results show a very good discrimination ability.

Parkinson's disease is a degenerative movement disorder causing considerable disability. However, the early detection of this syndrome and of its progression rates may be decisive for the identification of appropriate therapies. For this reason, the adoption of Neural Networks to detect this disease on the base of walking information is gaining more and more interest. In this paper, we defined a Deep Neural Network based approach allowing one to exploit the information coming from various sensors located under the feet of a person. The proposed approach allows one to discriminate people affected by the Parkinson syndrome and detect the progression rates of the disease itself. To evaluate the proposed architecture we used a known dataset with the aim to compare its performance with other similar approaches. Moreover, we performed an in-depth hyper-parameter optimization to find out the best neural network configuration for the specific task. The comparison shows that the proposed classifier, trained with the best parameters, outperforms the results proviously obtained in other studies on the same dataset.

A significant amount of source code in software systems is made up of comments, parts of the code that are ignored by the compiler. Comments in the code are a primary source for system documentation. These are crucial for the work of software maintainers, as a basis for code traceability, for maintenance activities, but also for the use of the code itself as a library or framework in other projects. Although many software developers consider comments important, existing approaches to software quality analysis mainly disregard code comments and focus only on source code. This paper presents an approach, based on topic modeling, for analyzing the comments consistency to the source code. A model was provided to analyze the quality of comments in terms of consistency since comments should be consistent with the source code they refer to. The results show a similarity in the trend of topic distribution and it emerges that almost all classes are associated with no more than 3 topics.

Novice programmers often encounter difficulties performing debugging tasks effectively. Even if modern development environments (IDEs) provide high-level support for navigating through code elements and for identifying the right conditions leading to the bug, debugging still requires considerable human effort. Programmers usually have to make hypotheses that are based on both program state evolution and their past debugging experiences. To mitigate this effort and allow novice programmers to gain debugging experience quickly, we propose an approach based on the reuse of existing bugs of open source systems to provide informed guidance from the failure site to the fault position. The goal is to help novices in reasoning on the most promising paths to follow and conditions to define. We implemented this approach as a tool that exploits the knowledge about fault and bug position in the system, as long as any bug of the system is known. The effectiveness of the proposed approach is validated through a quasi-experiment that qualitatively and quantitatively evaluates how the debugging performances of the students change when they are trained using the tool.

Comprehension of how students and developers head the development of software and what specific hurdles they face, have a strong potential to better support the coding workflow. In this paper, we present the CodingMiner environment to generate event logs from IDE usage enabling the adoption of fuzzy-based process mining techniques to model and to study the developers' coding process. The logs from the development sessions have been analyzed using the fuzzy miner to highlight emergent and interesting developers' and students' behaviors during coding. The mined processes show different IDE usage patterns for students with different skills and performances. To validate our approach, we describe the results of a study in which the CodingMiner environment is used to investigate the coding activities of twenty students of a CS2 course performing a given programming task during four assignments. Results also demonstrate that fuzzy-based process mining techniques can be effectively exploited to understand students and developers behavior during programming tasks providing useful insights to improve the way they code.

The current authentication systems based on password and pin code are not enough to guarantee attacks from malicious users. For this reason, in the last years, several studies are proposed with the aim to identify the users basing on their typing dynamics. In this paper, we propose a deep neural network architecture aimed to discriminate between different users using a set of keystroke features. The idea behind the proposed method is to identify the users silently and continuously during their typing on a monitored system. To perform such user identification effectively, we propose a feature model able to capture the typing style that is specific to each given user. The proposed approach is evaluated on a large dataset derived by integrating two real-world datasets from existing studies. The merged dataset contains a total of 1530 different users each writing a set of different typing samples. Several deep neural networks, with an increasing number of hidden layers and two different sets of features, are tested with the aim to find the best configuration. The final best classifier scores a precision equal to 0.997, a recall equal to 0.99 and an accuracy equal to 99% using an MLP deep neural network with 9 hidden layers. Finally, the performances obtained by using the deep learning approach are also compared with the performance of traditional decision-trees machine learning algorithm, attesting the effectiveness of the deep learning-based classifiers in the domain of keystroke analysis.

Process mining is a family of techniques that aim at analyzing business process execution data recorded in event logs. Conformance checking is a branch of this discipline embracing approaches for verifying whether the behavior of a process, as recorded in a log, is in line with some expected behavior provided in the form of a process model. In the literature, process mining techniques have already been used to study software development processes starting from logs derived from version management systems or from document management systems. In this paper, we use conformance checking to test coding behaviors starting from event logs generated from IDE usage. Understanding how developers carry out coding activities and what hurdles they usually face should provide useful tips for improving and supporting software development processes. In particular, through conformance checking, we can compare different process executions, and identify behavioral similarities and differences. In our experimentation, we evaluated the activities performed by 40 novice developers performing coding activities in 5 development sessions. We assessed the developers to distinguish the ones obtaining the best performance. We then compared the behavior extracted from this group of developers with the others. The results show different IDE usage patterns for developers with different skills and performance.

The birth of cloud-based development environments makes available an increasing number of data coming out from the interaction of different developers with a diverse level of expertise. This data, if opportunely captured and analyzed, can be useful to understand how developers head the coding activities and can suggest members of developers community how to improve their performances. This paper presents a framework allowing to generate event logs from cloud-based IDE. These event logs are then examined using a process mining technique to extract the developers' coding processes and compare them in the shared coding environment. The approach can be used to discover emergent and interesting developers' behavior. Thus, we compare the coding process extracted by developers with different skills. To validate our approach, we describe the results of a study in which we investigate the coding activities of forty students of an advanced Java programming course performing a given programming task-during four assignments. Results also prove that users with different performances possess distinct attitudes highlighting that the adopted process mining technique can be useful to comprehend how developers can improve their coding skills.

Mobile devices are always more diffused in the last years, allowing the users to perform several tasks: communication, web surfing, requiring web services. Given the high amount of sensitive data and operations related to these tasks, securing the mobile devices is becoming a very critical issue. As matter of the fact, malware attacks are on the rise and new mobile malware are continually generated with the aim of stealing private data and performing illegal activities. Since this new malware is mainly obtained by reusing existing malicious code, malware detection is supported by the study and the tracking of the mobile malware phylogeny. This paper proposes a malware phylogeny model obtained by a declarative Process Mining (PM) approach from the analysis of some running malware applications. The main idea is that the set of relations and recurring execution patterns among the syscalls of a running malware application can be modeled to obtain a malware fingerprint. The malware fingerprints are compared and classified by using a fuzzy clustering algorithm to recover the malware phylogeny map of all the considered malware families. The evaluation of the proposed approach is performed on a dataset of more than 4,000 infected applications across 39 malware families obtaining very encouraging results.

On line games market is vastly growth in the last years thanks to the diffusion of innovative and performant platforms. Game players can be involved in always more convincing environment where they compete, collaborate and change information with other players. This allows game developers to invest a huge amount of resources to ensure game player safeness and satisfaction. According to this, an increasing interest is pointed towards the study of a new approach for the game bots detection since game bots are used by cheater players to obtain personal advantages with a consequent disappointment and reduction of the game appealing. This paper describes an ensemble Fuzzy Logic approach aiming to discriminate between human players and game bots using a set of features describing their behavior in the game environment. The evaluation is performed on a real on-line role player game and gives effective results.

Software code life cycle is characterized by continuous changes requiring a great effort to perform the testing of all the components involved in the changes. Given the limited number of resources, the identification of the defect proneness of the software components becomes a critical issue allowing to improve the resources allocation and distributions. In the last years, several approaches to evaluating the defect proneness of software components are proposed: these approaches exploit products metrics (like the Chidamber and Kemerer metrics suite) or process metrics (measuring specific aspect of the development process). In this paper, a multi-source machine learning approach based on a selection of both products and process metrics to predict defect proneness is proposed. With respect to the existing approaches, the proposed classifier allows predicting the defect proneness basing on the evolution of these features across the project development. The approach is tested on a real dataset composed of two well-known open-source software systems on a total of 183 releases. The obtained results show that the proposed features have effective defect proneness prediction ability.

In the last years, researchers and auto vehicle developers are focusing their attention on the topic of driver identification encouraged by an increasing number of always more sophisticated vehicle sensors able to extract information about the driver. Indeed, driver identification can be very useful to customize and improve driver experience, increase the safety on the road and reduce the global environmental problems. In this work, we propose and explore a set of features (extracted from a car monitoring system) identifying the driver basing on his/her driving behavior. The proposed behavioral features are exploited using a time series classification approach and a multi-layer perceptron (MLP) network is used to evaluate the ability of the proposed features to identify the vehicle driver. The proposed features are tested on a real data set composed of totally 66 observations (each observation consists of a given person driving a given car on a predefined path). The obtained results show that the proposed features have effective driver identification ability.

In the last years, the growing adoption of cloud-based multi-tiers systems has strongly increased the levels of resource sharing among companies, improving the enterprise efficiency, thanks to a refined business dynamism and a rapid decrease in costs. However, in spite of their advantages, this new business model highlights the emergence of new computational approaches aimed at the distribution and the optimization of resources sharing along so-called multi-tenants system, i.e., cloud-based architecture where a single instance of software runs on a single server and serves multiple companies (tenants). This paper faces this challenging gap by proposing an auto-scaling cloud computing multi-tenancy architecture where process mining and fuzzy-based load-balancing systems synergistically interact to provide an improved and optimized resource management distribution. A case study is carried out to show the proposed architecture in operation.

Mobile systems have become essential for communication and productivity but are also becoming target of continuous malware attacks. New malware are often obtained as variants of existing malicious code. This work describes an approach for dynamic malware detection based on the combination of Process Mining (PM) and Fuzzy Logic (FL) techniques. The firsts are used to characterize the behavior of an application identifying some recurring execution expressed as a set of declarative constraints between the system calls. Fuzzy logic is used to classify the analyzed malware applications and verify their relations with the existing malware variants. The combination of the two techniques allows to obtain a fingerprint of an application that is used to verify its maliciousness/trustfulness, establish if it belongs from a known malware family and identify the differences between the detected malware behavior and the other variants of the some malware family. The approach is applied on a dataset of 3000 trusted and malicious applications across twelve malware families and has shown a very good discrimination ability that can be exploited for malware detection and family identification.

The growth in use of mobile phones to communicate and access sensitive resources drives the research of new approaches for protecting smartphones from all the possible attacks deriving from malicious software. Moreover, the continuous emerging of new and sophisticated malware makes current solutions to protect mobile phones inadequate shortly after being implemented. In this paper a new approach for run-time malware detection is proposed. It consists in analyzing system call traces gathered from malware and trusted applications to identify a set of relationships and recurring execution patterns that characterize their respective behavior. The characterization of the malware behaviour is expressed in terms of declarative constraints between system calls and can be used to identify similarities across malware families, detect malware variants within the same family, and to build trees of malware families based on their similarities. The effectiveness and efficiency of the approach have been assessed using a dataset of more than 1500 between trusted and malicious applications across six malware families. The results show that the proposed approach exhibits a very good discriminating ability exploitable for both malware detection and the study of malware evolution.

Abstract The implementation of crosscutting concerns in object‐oriented (OO) systems entails scattering and tangling of code across several components increasing code duplication and making the system harder to comprehend, maintain, evolve and reuse. Therefore, identification of crosscutting concerns drives the re‐engineering or refactoring tasks in order to improve modularization of an existing system and increasing its overall internal quality. This paper proposes an approach to identify and analyse the components implementing the static and dynamic crosscutting in OO systems. The approach defines a meta‐model representing the structure of an OO system in terms of its components. A static analysis of an OO software system is performed to create an instance of this meta‐model. Such meta‐model is finally analysed to find static and dynamic crosscutting among concerns. The effectiveness and efficiency of the proposed approach have been validated in an empirical assessment where it was applied to some OO java systems. The obtained results show a good level of effectiveness for the crosscutting analysis. Copyright © 2016 John Wiley & Sons, Ltd.

Cloud computing is rapidly emerging as a new information technology that aims at providing improved efficiency in the private and public sectors, as well as promoting growth, competition, and business dynamism. Cloud computing represents, today, an opportunity also from the perspective of business process analytics since data recorded by process-centered cloud systems can be used to extract information about the underlying processes. Cloud computing architectures can be used in cross-organizational environments in which different organizations execute the same process in different variants and share information about how each variant is executed. If the process is characterized by low predictability and high variability, business rules become the best way to represent the process variants. The contribution of this paper consists in providing: (i) a cloud computing multi-tenancy architecture to support cross-organizational process executions; (ii) an approach for the systematic extraction/composition of distributed data into coherent event logs carrying process-related information of each variant; (iii) the integration of online process mining techniques for the runtime extraction of business rules from event logs representing the process variants running on the infrastructure. The proposed architecture has been implemented and applied for the execution of a real-life process for acknowledging an unborn child performed in four different Dutch municipalities.

Knowledge about design pattern (DP) instances improves program comprehension and reengineering of object-oriented systems. Effectively, it helps to discover developer design decisions and trade-offs that often are not documented. This work describes an approach to automatically detect DPs in existing object-oriented systems by tracing systems' source code components with the roles they play in the patterns. In the proposed approach, DPs are modeled based on their high-level structural properties (e.g., inheritance, dependency, invocation, delegation, type nesting, and membership relationships) that are checked, by source code parsing, against the system structure and components. Moreover, the approach can also detect pattern variants, defined by overriding the pattern properties. This paper presents a description of the approach, provides a brief description of the supporting tool, and discusses the results from the experiments carried out to validate it. The approach was validated on seven systems of an open benchmark that contains systems of increasing sizes. For five additional systems, the results have been compared with the ones from a similar approach existing in the literature. The obtained results, the identified DP variants, and the effectiveness of the approach are thoroughly presented and discussed. Copyright © 2014 John Wiley & Sons, Ltd.

The implementation of a Design Pattern (DP) may be affected by some problems due to typical deficiencies of Object Oriented languages that may worsen the modularity of a software system, and thus its comprehensibility, maintainability, and testability. Aspect Oriented Programming allows to implement DPs by its powerful quantification constructs that can handle better modularity and composition, helping to overcome some of the OO design trade-offs in current DP implementations. In Model Driven Development system models, defined by a Design Specification Language (DSL), are transformed between different levels of abstraction to get system implementation. In this paper we propose an Aspect Oriented DSL-based framework to specify and to apply, declaratively, Design Patterns to the system classes. The main aim driving the definition of the proposed framework is to improve the modularity, the internal code quality, and the flexibility, by allowing software designers to specify DP models with an extensive modifiability thus reducing the impact of changes related to DP adoption.

In some business environments, processes of different organizations are very similar to each other. This produces families of processes with common characteristics but also portions that vary according to the specific organization. Two emerging approaches can be adopted and combined to easily model, implement and update families of business processes: Software Product Line (SPL) and Service-Oriented Architecture (SOA). Our work suggests a framework to transfer the main peculiarities of the SPL to the SOA system development, in order to realize a SOA system line. Starting from the SPL concept, we introduce process lines, i.e., families of process models suitable for different customers or market segments. Moreover, we present an approach for the automatic generation of a SOA system starting from a process model. The combination of these approaches, can be used to easily develop a family of SOA systems each one appropriate for different context characteristics. In this work, an application of the proposed approach in a real project is also proposed.

SUMMARY This paper presents a semi‐automatic approach for the recovery and evolution of the design of existing Web applications. The proposed approach is structured in two main phases and is based on the Ubiquitous Web Applications (UWA) design framework, a methodology and a set of models and tools for the user‐centered design of multichannel context‐aware Web applications. In the first phase a representative set of the application's front‐end Web pages are analyzed to abstract the ‘as‐is’ design model of the application according to the UWA methodology. In the second phase, the recovered design model is evolved to define the ‘to be’ version of it. This evolution activity considers the up‐to‐date requirements available for the application and UWA design guidelines to identify shortcomings and opportunities of improvement in the ‘as‐is’ design. The reverse modeling phase exploits clustering and clone detection techniques and is supported by the RE‐UWA tool, an Eclipse IDE customized to implement the reverse engineering process defined to extract formal UWA models expressed as instances of a MOF metamodel. The forward design phase is supported by a set of UWA modeling tools that are built on top of the Eclipse Modeling Framework (EMF) and the Eclipse Graphical Modeling Framework (GMF). The proposed design recovery and evolution approach is applied to four real‐world Web applications and the obtained results are also presented in the paper. Copyright © 2012 John Wiley & Sons, Ltd.

Despite Model Driven Engineering (MDE) approaches are largely used to develop, update and evolve Web Applications (WAs), the use of these approaches for the development of process-centric WAs is still very limited. This is an important issue in the context of MDE considering that WAs are often used to support users in the execution of business processes. In this paper, we propose the integration of three MDE metamodels used to represent the structure of information, service and presentation layers of a WA with the metamodel of Declare, a declarative language for business process rapresentation. The declarative nature of Declare allows us to combine an efficient roundtrip engineering support with the advantages of an MDE approach. We present and discuss a case study where the proposed approach is used to develop a typical online shopping application with the aim to validate and verify the feasibility and the effectiveness of the approach.

Firefox and Chrome are two very popular open source Web browsers, implemented in C/C++. This paper analyzes what topics were discussed in Firefox and Chrome bug reports over time. To this aim, we indexed the text contained in bug reports submitted each semester of the project history, and identified topics using Latent Dirichlet Allocation (LDA). Then, we investigated to what extent Firefox and Chrome developers/contributors discussed similar topics, either in different periods, or over the same period. Results indicate a non-negligible overlap of topics, mainly on issues related to page layouting, user interaction, and multimedia contents.

Tracing source code elements of an existing Object Oriented software system to the components of a Design Pattern is a key step in program comprehension or re-engineering. It helps, mainly for legacy systems, to discover the main design decisions and trade-offs that are often not documented. In this paper an approach is presented to automatically detect Design Patterns in existing Object Oriented systems by tracing system's source code components to the roles they play in the Patterns. Design Patterns are modelled by high level structural Properties (e.g. inheritance, dependency, invocation, delegation, type nesting and membership relationships) that are checked, by source code parsing, against the system structure and components. The approach allows to detect also Pattern variants, defined by overriding the Pattern structural properties. The approach was applied to some open-source systems to validate it. Results on the detected patterns, discovered variants and on the overall quality of the approach are provided and discussed.

This paper presents the main features of ConAn, a tool supporting an approach to find scattered and tangled class members in OO systems and to group them in concerns. The recovered information is useful for refactoring/migration tasks, such as towards Aspect Oriented Programming (AOP).

Aspects have a large impact on the static structure and dynamic behaviour of the system they belong. This is due to the intrinsic intrusive nature of aspects and the woven process allowing the alteration of the structure, the control and data flow of the components of the base system in aspect oriented (AO) systems. Several and different types of interactions among aspects and the other components can be introduced according to the different mechanisms provided by AO Programming. These interactions can make higher the complexity of the overall system affecting its comprehension. In this paper we propose a taxonomy to categorize these types of interactions among aspects and the components of the base system. The taxonomy can be used to understand how each type of interaction affects the complexity, and thus the comprehensibility, of the system.

Aspect oriented programming (AOP) supports the cross-cutting of concerns by means of aspects. The maintenance of AO systems may be more difficult than 'traditional' ones, due to the large impact that aspects have on the static structure and dynamic behavior of the overall system. In this paper an inter-procedural aspect control flow graph is proposed to represent the interactions among the aspects and the object oriented (OO) components of an AO system. The graph allows an easier identification of the impact between aspects and the OO components. It helps the maintainer to identify sources of undesired side and ripple effects in the code and avoid the introduction of new ones when modifying an AOP system.