Search

Adaptive Random Testing (ART) aims at improving detection effectiveness by evenly distributing test cases over the whole input domain. Many ART algorithms introducing clustering techniques (such as k-means Clustering) have been proposed to achieve an even spread of test cases. Though previous studies have demonstrated that ART with k-means clustering could achieve a good enhancement in testing effectiveness, k-means clustering is limited by the value of k, which will have a great impact on the test effectiveness. To improve the testing effectiveness of these techniques for object-oriented software, in this paper, we propose an approach named Determination Method of Optimal k-value based on the Experimental Process (DMOV k -EP) to determine the optimal k-value of k-means clustering and make the ART algorithms using k-means clustering technique achieve the best fault detection capability. The proposed method consists of two parts, one is a solution model for k based on the experimental process, and the other is an optimal k-value algorithm based on the presented model. We integrate this method with k-means clustering in ART and apply it to a set of open-source programs, with the experimental results showing that our approach obtains much more appropriate k, and also achieves much better testing effectiveness than other related methods.

Software vulnerability analysis is one of the critical issues in the software industry, and vulnerability classification plays a major role in this analysis. A typical vulnerability classification model usually involves a stage of term selection, in which the relevant terms are identified via feature selection. It also involves a stage of term weighting, in which document weights for the selected terms are computed, and a stage for classifier learning. Generally, the term frequency-inverse document frequency (TF-IDF) is the most widely used term-weighting method. However, empirical evidence shows that the TF-IDF is plagued with issues pertaining to its effectiveness. This paper introduces a new approach for vulnerability classification, which is based on term frequency and inverse gravity moment (TF-IGM). The proposed method is validated by empirical experiments using three machine learning algorithms on ten publicly available vulnerability datasets. The result shows that TF-IGM outperforms the benchmark method across the applications studied.

With the development of information technology, software plays an increasingly important role in the process of social development. However, at the same time, the number of software vulnerabilities is growing, posing a threat to national security and social stability. Therefore, some scholars and research institutions are paying their attention to the study of software vulnerability. In this paper, we propose a new vulnerability model construction method by considering the vulnerability causes and characteristics. Firstly, the causes and characteristics of software vulnerability are analyzed, and a formal vulnerability model is also established. Based on the causes and characteristics of software vulnerability, we establish the vulnerability model using the extended chemical abstract machine and deduce the software vulnerability through a formal method. We verified the effectiveness and efficiency of the proposed model using software vulnerability datasets. In addition, a prototype system is also designed and implemented. Experimental results show that the proposed model is more effective than other methods in the detection of software vulnerabilities.

Software vulnerability remains a serious challenge to the software engineering domain over the past decade as a result of the recent technological advancement in information systems. The rapid development in software applications and failure on the part of system developers to properly analyze program codes before been released to the market increases the chance for data breaches. It is a known fact that most system failures are as a result of bugs and errors detected in software applications. Although code errors significantly affect software quality, there is no effective method that can be used in eliminating software errors to improve its reliability. Data Mining and its related algorithms are an active area which can successfully be applied in analyzing software vulnerability. However the concept of applying data mining techniques has not been empirically proven as an effective method for obtaining the essential characteristics of software vulnerability. To investigate this effect, we propose a vulnerability mining algorithm to analyze and obtain the essential characteristics of Software vulnerability based data mining techniques. We first extracted and preprocessed the software vulnerabilities using data mining techniques and common vulnerability database. We evaluate the proposed technique using the Common Vulnerability and Exposure (CVE) Database, Common Weakness Enumeration (CWE) Database, National Vulnerability Database (NVD) datasets. Empirical results show that the proposed vulnerability mining algorithm has a remarkable improvement in the vulnerability mining process. The most interesting finding is that, we observed that across all the three projects, recall was around 70% and precision was approximately 60%.

Software vulnerability detecting is an important way of discovering the existing loopholes in software in order to ensure the information security. With the rapid development of the information technology in our society, a large variety of application software with various potentially vulnerabilities has emerged. Therefore, a timely discovery and repair of these loopholes before they are exploited by attackers can effectively reduce the threat in the information system. It is of great significance for us to take the initiative to explore and analyze the system security loopholes, so that the danger or threat to the system will be effectively reduced. From the previous research on the software vulnerability detection we have found that each of the existing vulnerability detection methods or tools can only perform well in some particular occasions. In order to overcome such shortcoming and improve these existing detection methods, we present a more accurate and complete analysis of current mainstream detection methods as well as design a set of evaluation criteria for different detection methods in this paper. Meanwhile, we also propose and design an integrated test framework, on which we can test the typical static analysis methods and dynamic mining methods as well as make the comparison, so that we can obtain an intuitive comparative analysis of the results. Finally, we report the experimental analysis to verify the feasibility and effectiveness of the proposed evaluation method and the testing framework, with the results showing that the final test results will serve as a form of guidance to aid the selection of the most appropriate and effective method or tools in vulnerability detection activity.