Background: Multi-source cross-project defect prediction (MSCPDP) attempts to transfer defect knowledge learned from multiple source projects to the target project. MSCPDP has drawn increasing attention from academic and industry communities owing to its advantages compared with single-source cross-project defect prediction (SSCPDP). However, two main problems, which are how to effectively extract the transferable knowledge from each source dataset and how to measure the amount of knowledge transferred from each source dataset to the target dataset, seriously restrict the performance of existing MSCPDP models. Objective: In this paper, we propose a novel multi-source transfer weighted ensemble learning (MASTER) method for MSCPDP. Method: MASTER measures the weight of each source dataset based on feature importance and distribution difference and then extracts the transferable knowledge based on the proposed feature-weighted transfer learning algorithm. Experiments are performed on 30 software projects. We compare MASTER with the latest state-of-the-art MSCPDP methods with statistical test in terms of famous effort-unaware measures (i.e., PD, PF, AUC, and MCC) and two widely used effort-aware measures (P_opt 20% and IFA). Result: The experiment results show that: 1) MASTER can substantially improve the prediction performance compared with the baselines, e.g., an improvement of at least 49.1% in MCC, 48.1% in IFA; 2) MASTER significantly outperforms each baseline on most datasets in terms of AUC, MCC, P_opt 20% and IFA; 3) MSCPDP model significantly performs better than the mean case of SSCPDP model on most datasets and even outperforms the best case of SSCPDP on some datasets. Conclusion: It can be concluded that 1) it is very necessary to conduct MSCPDP, and 2) the proposed MASTER is a more promising alternative for MSCPDP.

The detection of program vulnerabilities remains a challenging task in software security. The existing vulnerability detection methods rarely consider the multidimensional feature space complementarity of program graph structures, which easily overlooks contextual environment features and syntax structure features. This disadvantage leads to insufficient performance in capturing complex structural features, which hinders the improvement in detection accuracy. To address this issue, this paper introduces a novel vulnerability detection method, EnGS2F, which adopts the representation learning of an enhanced graph structure to improve the efficiency of capturing vulnerability information. On the dimension of the graph structure, a context relationship graph (CRG) is integrated on the basis of a program dependency graph (PDG) to enrich the global structural context representation. On the dimension of graph nodes, abstract syntax tree (AST) embedding and paragraph embedding are integrated to solve the problem of insufficient feature space complementarity. Moreover, the combination of a gated graph neural network (GGNN) with a graph attention mechanism further improves the learning performance of the enhanced graph structure. EnGS2F has been rigorously evaluated on program slices from open-source vulnerability datasets, demonstrating significant improvements over current competitive methods in detecting program vulnerabilities. Specifically, EnGS2F achieved a significant increase in the F1 score, outperforming existing technologies by 6%.

Software defect prediction (SDP) is an effective technique to lower software module testing costs. However, the imbalanced distribution almost exists in all SDP datasets and restricts the accuracy of defect prediction. In order to balance the data distribution reasonably, we propose a novel resampling method LIMCR on the basis of Naïve Bayes to optimize and improve the SDP performance. The main idea of LIMCR is to remove less-informative majorities for rebalancing the data distribution after evaluating the degree of being informative for every sample from the majority class. We employ 29 SDP datasets from the PROMISE and NASA dataset and divide them into two parts, the small sample size (the amount of data is smaller than 1100) and the large sample size (larger than 1100). Then we conduct experiments by comparing the matching of classifiers and imbalance learning methods on small datasets and large datasets, respectively. The results show the effectiveness of LIMCR, and LIMCR+GNB performs better than other methods on small datasets while not brilliant on large datasets.

Modern software systems need to autonomously adapt their behavior at runtime in order to maintain their utility in response to continuous environmental changes. Most studies on models at runtime focus on providing suitable techniques to manage the complexity of software at runtime but neglect reliability caused by adaptation activities. Therefore, adaptive behaviors may lead to a decrease in reliability, which may result in severe financial loss or life damage. Runtime software architecture (RSA) is an abstract of a running system, which describes the elements of the current system, the states of these elements and the relation between the elements and their states at runtime. The main difference between RSA and software architecture at design time (DSA) is that RSA has a causal connection with the running system, whereas DSA does not. However, RSA and DSA have both symmetry and asymmetry in software architecture. To ensure that architecture-centric software can provide reliable services after adaptation adjustment, a method is proposed to analyze the impact of changes caused by adaptation strategy on the overall software reliability, which will be predicted at the runtime architecture model layer. Based on a Java platform, through non-intrusive monitoring, an RSA behavioral model is obtained followed by runtime reliability analysis model. Following this, reliability prediction results are obtained through a discrete-time Markov chain (DTMC). Finally, an experiment is conducted to verify the feasibility of the proposed method.

Heterogeneous defect prediction (HDP) is a significant research topic in cross-project defect prediction (CPDP), due to the inconsistency of metrics used between source and target projects. While most HDP methods aim to improve the performance of models trained on data from one source project, few studies have investigated how the number of source projects affects predictive performance. In this paper, we propose a new multi-source heterogeneous kernel mapping (MSHKM) algorithm to analyze the effects of different numbers of source projects on prediction results. First, we introduce two strategies based on MSHKM for multi-source HDP. To determine the impact of the number of source projects on the predictive performance of the model, we regularly vary the number of source projects in each strategy. Then, we compare the proposed MSHKM with state-of-the-art HDP methods and within-project defect prediction (WPDP) methods, in terms of three common performance measures, using 28 data sets from five widely used projects. Our results demonstrate that, (1) in the multi-source HDP scenario, strategy 2 outperforms strategy 1; (2) for MSHKM, a lower number of source projects leads to better results and performance under strategy 1, while n = 4 is the optimal number under strategy 2; (3) MSHKM performs better than related state-of-the-art HDP methods; and (4) MSHKM outperforms WPDP. In summary, our proposed MSHKM algorithm provides a promising solution for heterogeneous cross-project defect prediction, and our findings suggest that the number of source projects should be carefully selected to achieve optimal predictive performance.

The original software reliability demonstration test (SRDT) does not take adequate account of prior knowledge or the prior distribution, which can lead to an expensive use of many resources. In the current paper, we propose a new improved Bayesian based SRDT method. We begin by constructing a framework for the SRDT scheme, then we use decreasing functions to construct the prior distribution density functions for both discrete and continuous safety-critical software, and then present schemes for both discrete and continuous Bayesian software demonstration functions (which we call DBSDF and CBSDF, respectively). We have carried out a set of experiments comparing our new schemes with the classic demonstration testing scheme on several published data sets. The results reveal that the DBSDF and CBSDF schemes are both more efficient and more applicable, and this is especially the case for safety-critical software with high reliability requirements.