Search

Software vulnerabilities play a major role, as there are multiple risks associated, including loss and manipulation of private data. The software engineering research community has been contributing to the body of knowledge by proposing several empirical studies on vulnerabilities and automated techniques to detect and remove them from source code. The reliability and generalizability of the findings heavily depend on the quality of the information mineable from publicly available datasets of vulnerabilities as well as on the availability and suitability of those databases. In this paper, we seek to understand the anatomy of the currently available vulnerability databases through a systematic mapping study where we analyze (1) what are the popular vulnerability databases adopted; (2) what are the goals for adoption; (3) what are the other sources of information adopted; (4) what are the methods and techniques; (5) which tools are proposed. An improved understanding of these aspects might not only allow researchers to take informed decisions on the databases to consider when doing research but also practitioners to establish reliable sources of information to inform their security policies and standards.

In this paper, we investigate experimentally the use of auctioning as a method for optimizing task orchestration in distributed computing systems by making selfish agents compete to execute computational tasks. Our goal is to find an approach that can improve the performance of these systems, using a deadline, fines, and reward limits in a reverse second-price sealed bid auction, to incentive and control the system, specifically in terms of improving task throughput and power consumption. With improvements to both energy consumption and task throughput, we have developed a promising approach, that is able to scale with the number of machines in the system. Results suggest that this type of auction may be useful for improving the implementation of these systems in a wide range of scenarios.

Software development based on MLOps practices is entering its early adoption stage. As for it, practitioners and researchers are starting to develop pipelines composed of tools capable of automating the whole software lifecycle. The development of the pipeline however is not as straightforward as it looks and some key points need to be addressed. In this work, we propose our vision for the development of the MLOps pipeline by showing what to keep into account when choosing the tools for each step of a pipeline. The proposition has been backed up by describing a developed use case scenario: the OSSARA use case. We believe that the presented use case, as well as the remarks presented for the process of tool selection for each MLOps phase, will help practitioners and researchers in the process of developing their own pipelines.

The cloud continuum concept has drawn increasing attention from practitioners, academics, and funding agencies and been adopted progressively. However, the concept remains mired in various definitions with different studies providing contrasting descriptions. Therefore, to understand the concept of cloud continuum and to provide its definition, in this work we conduct a systematic mapping study of the literature investigating the different definitions, how they evolved, and where does the cloud continue. The main outcome of this work is a complete definition that merges all the common aspects of cloud continuum, which enables practitioners and researchers to better understand what cloud continuum is.

Background: Developers spend more time fixing bugs refactoring the code to increase the maintainability than developing new features. Researchers investigated the code quality impact on fault-proneness, focusing on code smells and code metrics. Objective: We aim at advancing fault-inducing commit prediction using different variables, such as SonarQube rules, product, process metrics, and adopting different techniques. Methods: We designed and conducted an empirical study among 29 Java projects analyzed with SonarQube and SZZ algorithm to identify fault-inducing and fault-fixing commits, computing different product and process metrics. Moreover, we investigated fault-proneness using different Machine and Deep Learning models. Results: We analyzed 58,125 commits containing 33,865 faults and infected by more than 174 SonarQube rules violated 1.8M times, on which 48 software product and process metrics were calculated. Results clearly identified a set of features that provided a highly accurate fault prediction (more than 95% AUC). Regarding the performance of the classifiers, Deep Learning provided a higher accuracy compared with Machine Learning models. Conclusions: Future works might investigate whether other static analysis tools, such as FindBugs or Checkstyle, can provide similar or different results. Moreover, researchers might consider the adoption of time series analysis and anomaly detection techniques.

Background: Several recent software engineering studies use data mined from the version control systems adopted by the different software projects. However, inspecting the data and statistical methods used in those studies reveals several problems with the current approach, mainly related to the dependent nature of the data. Objective: We analyzed time-dependent data in software engineering at commit level, and propose an alternative approach based on time series analysis. Method: We identified statistical tests designed for time series analysis and propose a technique to model time dependent data, similarly to what is done in finance and weather forecasting. We applied our approach to a small set of projects of different sizes, investigating the behaviour of the SQALE Index, in order to highlight the time and interdependency of the different commits. Results: Using these techniques, we analysed and model the data, showing that it is possible to investigate this type of commit data using methods from time series analysis. Conclusion: Based on the promising results, we plan to validate the robustness of the approach by replicating previous works.