Software comprehension is an important part of software maintenance. To understand a piece of large and complex software, the first problem to be solved is where to start the understanding process. Choosing to start the comprehension process from the important software elements has proven to be a practical way. Research on complex networks opens new opportunities for identifying important elements, and many approaches have been proposed. However, the software networks that existing approaches use neglect the multilayer nature of software systems. That is, nodes in the network can have different types of relationships at the same time, and each type of relationship forms a specific layer. Worse still, they mainly focus on identifying important classes, and little work has been done on quantifying package importance. In this paper, we propose an ElementRank approach to provide a ranked list of classes (or packages) for maintainers to start the comprehension process. The top-ranked classes (or packages) can be seen as the starting points for the software comprehension process at the class (or package) level. First, we introduce two kinds of multilayer software networks to describe the topological structure of software at the class level and package level, respectively. Second, we propose a weighted PageRank algorithm to calculate the weighted PageRank value of classes (or packages) in each layer of the corresponding multilayer software network. Then, we use AHP (Analytic Hierarchy Process) to weigh each layer in the corresponding multilayer software network, and further aggregate the weighted PageRank value to obtain the global weighted PageRank value for each class (or package). Finally, all the classes (or packages) are ranked according to their global weighted PageRank values in a descending order, and the top-ranked classes (or packages) can serve as the starting points for the software comprehension process at the class (or package) level. ElementRank is validated theoretically using the widely accepted Weyuker's criteria. Theoretical results show that the global weighted PageRank value for classes (or packages) satisfies most of Weyuker's properties. Furthermore, ElementRank is evaluated empirically using a set of twelve open source software systems. Through a set of experiments, we show the rank correlation between the results of ElementRank and that of the approaches in the related work, and the benefits of ElementRank are also illustrated in comparison with other approaches in the related work. Empirical results also show that ElementRank can be applied to large software systems.

Although extensive research has been conducted on securing the Internet of Things (IoT) communication protocols, various vulnerabilities and exploits are continuously discovered and reported. Since vulnerabilities are introduced from either insecure communication protocols or defectiveness of applications, it is difficult to identify them during the software development or testing phase. In this paper, we present IoTVerif, a system that automatically verifies the Secure Socket Layer/Transport Layer Security (SSL/TLS) certificate for IoT applications that utilize broker-based messaging protocols. IoTVerif constructs the specification of an IoT protocol and verifies its security properties, without relying on prior knowledge about communication protocols. Once the specification is constructed, a general-purpose model checker automatically verifies those properties, as well as generates counter-examples if any property does not hold. We analyze the effectiveness of IoTVerif with real-world IoT-related applications. Our evaluation results show that IoTVerif can successfully identify vulnerabilities from IoT applications, which are exploitable by the man-in-the-middle (MITM) and TLS renegotiation attacks. IoTVerif holds a great promise for reverse-engineering emerging IoT messaging protocols and identifies the vulnerabilities from IoT-related applications.

please see the attached pdf file of Abstract.

In a very recent paper by Qu et al. (IEEE Transactions on Software Engineering, vol. 47 no. 2, pp. 348-366, Feb. 1 2021, doi:10.1109/TSE.2019.2892959), the authors propose an effective equation, top-core, to improve the performance of effort-aware bug prediction models. A distinctive feature of top-core is that it takes into account the coreness of a class in a Class Dependency Network (CDN) when calculating the relative risk of a class to be buggy. In this comment, we show that Qu et al.'s paper contains three shortcomings that may influence the performance of top-core or even have the potential to lead to erroneous results. First, we show that the CDN that they use to calculate the coreness of classes is not very accurate, neglecting many important types of dependency relations between classes such as method call relation, access relation, and instantiates relation. Second, they trained a Logistic Regression model using the scikit-learn framework to predict the probability of a specific class to be buggy. It is actually an L2 regularized Logistic Regression model, which is dependent on the scale of the features. But they neglected to normalize the features, making the obtained results erroneous. Finally, the number of execution times (viz. 10 times in the paper of Qu et al.) they used to reduce the bias caused by the randomness (viz. random split of instances and the process to handle class-imbalance problem) in the experiments is too small to ensure that the obtained results converge to stable values; but they failed to signify the precision level of their results for comparison. In this comment, we provide solutions to the problems by using i) an improved CDN (ICDN) to represent the structure of software systems, ii) the z-score method to normalize the features, and iii) an adaptive mechanism to determine the number of execution times. In the experiments, we find that Qu et al.'s approach based on the Logistic Regression model does not perform significantly better than the state-of-the-art approach Ree, which is inconsistent with the conclusion in Qu et al.'s work. We also observe that replacing CDN with ICDN does improve the performance of Qu et al.'s approach.

Data Distribution Service (DDS) has emerged as a potential solution for data communication challenges in smart grids. DDS is designed to support quality communication for large scale real-time systems through a wide range of QoS policies. However, a smart grid involves various types of communication applications running on different computing environments. Some environments have limited computing resources such as small memory and low performance, which makes it difficult to accommodate DDS. In this paper, we present a feature-based approach for tailoring DDS to configure lightweight DDS by selecting only the necessary features for the application in consideration of the resource constraints of its running environment. This allows DDS to serve as a uniform communication middleware across the smart grid, which is critical for interoperability. We analyze DDS in terms of features and design them using Unified Modeling Language (UML) and Object Constraint Language (OCL) based on inheritance and overriding. We define a formal notion of feature composition to build DDS configurations. We implemented the approach in OpenDDS and demonstrate its application to different application environments. We also experimented the approach for the efficiency of configured DDS in terms of resource utilization. The results show that configured DDS is viable for efficient and quality data communication for applications that run on an environment with limited computing capability.

Software maintenance is indispensable in the software development process. Developers need to spend a lot of time and energy to understand the software when maintaining the software, which increases the difficulty of software maintenance. It is a feasible method to understand the software through the key classes of the software. Identifying the key classes of the software can help developers understand the software more quickly. Existing techniques on key class identification mainly use static analysis techniques to extract software structure information. Such structure information may contain redundant relationships that may not exist when the software runs and ignores the actual interaction times between classes. In this paper, we propose an approach based on dynamic analysis and entropy-based metrics to identify key classes in the Java GUI software system, called KEADA (identifying KEy clAsses based on Dynamic Analysis and entropy-based metrics). First, KEADA extracts software structure information by recording the calling relationship between classes during the software running process; such structure information takes into account the actual interaction of classes. Second, KEADA represents the structure information as a weighted directed network and further calculates the importance of each node using an entropy-based metric OSE (One-order Structural Entropy). Third, KEADA ranks classes in descending order according to their OSE values and selects a small number of classes as the key class candidates. In order to verify the effectiveness of our approach, we conducted experiments on three Java GUI software systems and compared them with seven state-of-the-art approaches. We used the Friedman test to evaluate all approaches, and the results demonstrate that our approach performs best in all software systems.