软件安全缺陷发掘模型研究进展*

软件安全缺陷发掘模型在评估软件安全等级、预测软件剩余安全缺陷数量、确定为保证软件安全所需投入的资源等方面有着重要的意义。本文综述了软件安全缺陷发掘模型研究的进展状况,详细介绍了主要软件安全缺陷发掘模型的内容和原理,并对这些模型的特点和性能进行了比较和分析,最后提出了几个软件安全缺陷发掘模型研究领域需要进一步研究的问题。     

软件缺陷度量与软件过程管理方法研究

软件能力成熟度模型第4级中要求在项目中定量管理,建立组织级过程性能,构成完整的量化管理,采用统计或其它定量方法管理软件过程,并通过对过程中出现的方法,技术等问题进行因果分析和寻找解决方案。在仔细研究了现有的缺陷度量分类方法和分析指标后,提出了一个基于缺陷度量与分析的软件过程改进模型。应用该模型可以设计缺陷数据管理系统。     

基于Bayes网的软件残留错误数度量

软件开发的复杂性决定了理想的软件复杂性度量模型既应具有包容众多复杂因素的能力,又要有构造灵活的功能。迄今为止，人们提出的众多模型，由于设定了很多近乎苛刻的条件，使它们难以具有普适性。Bayes网提供了解决这一问题的有力工具。该文建立起一种基于Baycs网的软件残留错误数度量模型，并对此进行了分析。     

一种面向对象软件缺陷的早期预测方法

软件过程早期的缺陷预测技术可以辅助软件工程决策,从而提高软件开发与测试的质量。针对面向对象软件,提出一种以分析设计模型的度量经验数据建立缺陷回归预测模型的方法,其中模型的建立使用了一种新形式的支持向量回归算法ν-SVR。为了检验缺陷预测模型的实用价值,使用了来自真实世界的Eclipse项目三个版本的度量与缺陷数据集作为模型实验的训练集与测试集。结果表明,基于面向对象分析设计模型度量建立的缺陷回归预测模型可以在生命周期早期给出有效的缺陷数预测值,从而为软件工程实践提供支持。     

基于基准比对思想的软件可靠性预测仿真建模研究

可靠性作为衡量软件质量的重要特性,其定量评估和预测已成为人们关注和研究的焦点。本文针对这个问题展开研究,提出一个可用于软件测试之前的早期可靠性预测仿真模型。此仿真模型通过考查影响软件可靠性的过程因素,采用基准比对思想,利用软件过程度量数据,根据相似度比较,预测软件的残留缺陷数。由于该仿真模型仅需要静态历史数据,故可在软件测试之前,用于估计软件的残留缺陷数,从而预测软件的可靠性,为后期软件过程的改进以及软件测试计划的修正提供依据。     

软件多缺陷定位方法研究综述

软件多缺陷定位(Multiple Fault Localization,简称MFL)尝试在含有多个缺陷的软件程序中自动标识出这些缺陷所在的位置.传统的缺陷定位研究一般假设被测软件内仅含有一个缺陷,而实际情况下软件内往往包含多个缺陷,因此MFL问题更加贴近实际场景.当程序中存在多个缺陷时,由于缺陷数量难以准确估计,同时缺...     

软件关联缺陷的一种检测方法

软件中的关联缺陷是一种比较普遍的现象,某些缺陷的存在与否可能导致其他缺陷检测率的变化.软件关联缺陷是造成软件失效关联的根源.给出了关联缺陷的定义,通过一个软件实例验证了缺陷的关联关系,提出了一种缺陷放回的测试方法用来剔除关联缺陷,并通过实验数据分析了缺陷放回方法的能力和效率.实验数据表明,该方法能有效检测软件关联缺陷.     

面向软件缺陷预测的网络嵌入特征研究

已有研究根据软件的代码依赖、修改历史、协同开发关系等,建立网络模型来预测软件的缺陷;近年来,网络嵌入技术广泛用于软件网络分析,显著提升了缺陷预测效果。本研究发现不同软件关联网络和网络嵌入算法的组合将影响缺陷预测性能。具体地,本文针对3种软件关联网络（类依赖网络、文件耦合网络和开发者贡献网络）,并应用6类网络嵌入方法,分析不同网络嵌入方法所保持的软件结构特征及其对缺陷预测性能的影响。在12个开源Java系统上的实验结果显示：在类依赖网络和文件耦合网络,传统的度量特征上结合网络嵌入特征后,缺陷预测效果得到显著提升;DeepWalk、Grarep和Node2vec网络嵌入算法更擅长学习网络的同质性,缺陷预测效果更好;网络嵌入特征以及缺陷预测性能对嵌入算法的参数配置比较敏感。本研究结论有助于指导缺陷预测中软件关联网络和网络嵌入方法的选择。     

基于深度学习的软件自动修复方法的修复偏好研究

基于机器学习的软件修复方法可以降低软件缺陷修复成本，无须人工干涉而自动修复软件缺陷，但不同的缺陷修复软件对不同类型缺陷的修复偏好不明确，且缺乏针对性而无法充分发挥深度学习模型的作用；为此在研究缺陷分类的基础上，研究几种具有代表性基于深度学习的软件自动修复方法对不同类型的缺陷总的修复概率，并比较分析不同学习模型对于修复不同类型缺陷的修复偏好，后续可以更好地进行模型选择以及软件自动修复工作。实验结果表明，基于深度学习的软件自动修复方法倾向于修复IF语句类型、方法语句类型、return语句类型的缺陷。基于自编码器的软件自动修复方法倾向于修复IF语句类型的缺陷，基于LSTM的编码器-解码器的修复方法倾向于修复与方法语句类型相关的缺陷，而基于CNNs的编码器-解码器的修复方法则对IF语句类型、方法语句类型以及return语句类型这三种类型缺陷的修复偏好相差不大。     

软件缺陷度量与分析技术研究

软件能力成熟度模型第4级中要求在项目中定量管理,建立组织级过程,构成完整的量化管理,采用统计或其它定量方法管理软件过程,并通过对过程中出现的方法、技术等问题进行因果分析和寻找解决方案[1]。在仔细研究了现有的缺陷度量分类方法和分析指标后,通过运用缺陷数据分析方法,在开发过程中运用缺陷分析的结果,可以采取合适的对策尽早发现和消除存在的缺陷,以提高软件产品的开发质量和成功率。     

Software Residual defects Prediction Model based on BBNs

IntroductionTesting and modification of software are repetitiveprocesses.When to release and implement the qualifiedsoftware product is an important question.The purposeof residual defects'prediction is to keep the code de-fects number under the acceptable level in testing times.It is very important for a decision maker to estimate thephase of software testing and the achievable object.It issignificant for maintenance of delivered software.1Software residual defects predic-tion modelSoftware…     

基于贝叶斯公式的软件缺陷影响因素分析

随着时软件缺陷重视程度的提高，人们提出了很多软件缺陷预测模型，但所有的模型都只停留在缺陷数预测的基础上，不能系统分析出导致预测结果的真正原因。而本文结合一个具体的软件缺陷预测模型。利用贝叶斯公式对导致结果发生的影响因素进行了分析。此方法不但能对现有开发项目的一些重要影响因素起到控制作用，还为今后的开发项目提供了一定的经验数据，预防同类错误的再次发生。     

A defect prediction method for software versioning

New methodologies and tools have gradually made the life cycle for software development more human-independent. Much of the research in this field focuses on defect reduction, defect identification and defect prediction. Defect prediction is a relatively new research area that involves using various methods from artificial intelligence to data mining. Identifying and locating defects in software projects is a difficult task. Measuring software in a continuous and disciplined manner provides many advantages such as the accurate estimation of project costs and schedules as well as improving product and process qualities. This study aims to propose a model to predict the number of defects in the new version of a software product with respect to the previous stable version. The new version may contain changes related to a new feature or a modification in the algorithm or bug fixes. Our proposed model aims to predict the new defects introduced into the new version by analyzing the types of changes in an objective and formal manner as well as considering the lines of code (LOC) change. Defect predictors are helpful tools for both project managers and developers. Accurate predictors may help reducing test times and guide developers towards implementing higher quality codes. Our proposed model can aid software engineers in determining the stability of software before it goes on production. Furthermore, such a model may provide useful insight for understanding the effects of a feature, bug fix or change in the process of defect detection.

Negative samples reduction in cross-company software defects prediction

ContextSoftware defect prediction has been widely studied based on various machine-learning algorithms. Previous studies usually focus on within-company defects prediction (WCDP), but lack of training data in the early stages of software testing limits the efficiency of WCDP in practice. Thus, recent research has largely examined the cross-company defects prediction (CCDP) as an alternative solution.ObjectiveHowever, the gap of different distributions between cross-company (CC) data and within-company (WC) data usually makes it difficult to build a high-quality CCDP model. In this paper, a novel algorithm named Double Transfer Boosting (DTB) is introduced to narrow this gap and improve the performance of CCDP by reducing negative samples in CC data.MethodThe proposed DTB model integrates two levels of data transfer: first, the data gravitation method reshapes the whole distribution of CC data to fit WC data. Second, the transfer boosting method employs a small ratio of labeled WC data to eliminate negative instances in CC data.ResultsThe empirical evaluation was conducted based on 15 publicly available datasets. CCDP experiment results indicated that the proposed model achieved better overall performance than compared CCDP models. DTB was also compared to WCDP in two different situations. Statistical analysis suggested that DTB performed significantly better than WCDP models trained by limited samples and produced comparable results to WCDP with sufficient training data.ConclusionsDTB reforms the distribution of CC data from different levels to improve the performance of CCDP, and experimental results and analysis demonstrate that it could be an effective model for early software defects detection.     

A fuzzy logic based approach for phase-wise software defects prediction using software metrics

ContextThe software defect prediction during software development has recently attracted the attention of many researchers. The software defect density indicator prediction in each phase of software development life cycle (SDLC) is desirable for developing a reliable software product. Software defect prediction at the end of testing phase may not be more beneficial because the changes need to be performed in the previous phases of SDLC may require huge amount of money and effort to be spent in order to achieve target software quality. Therefore, phase-wise software defect density indicator prediction model is of great importance.ObjectiveIn this paper, a fuzzy logic based phase-wise software defect prediction model is proposed using the top most reliability relevant metrics of the each phase of the SDLC.MethodIn the proposed model, defect density indicator in requirement analysis, design, coding and testing phase is predicted using nine software metrics of these four phases. The defect density indicator metric predicted at the end of the each phase is also taken as an input to the next phase. Software metrics are assessed in linguistic terms and fuzzy inference system has been employed to develop the model.ResultsThe predictive accuracy of the proposed model is validated using twenty real software project data. Validation results are satisfactory. Measures based on the mean magnitude of relative error and balanced mean magnitude of relative error decrease significantly as the software project size increases.ConclusionIn this paper, a fuzzy logic based model is proposed for predicting software defect density indicator at each phase of the SDLC. The predicted defects of twenty different software projects are found very near to the actual defects detected during testing. The predicted defect density indicators are very helpful to analyze the defect severity in different artifacts of SDLC of a software project.     

基于缺陷分层与PSO算法的软件缺陷预测模型

根据软件开发分层的思想,提出了基于软件缺陷分层的测试构架。在缺陷分层的测试架构下可以知道测试类之间的的关系和属性,容易发现关联缺陷。本文是在软件缺陷分层测试架构下结合粒子群优化(PSO)算法建立软件缺陷预测模型,并通过模拟实验验证预测模型的性能。结果显示该模型能有效提高预测缺陷效率和缺陷发生位置。     

基于受控马尔科夫链的软件缺陷优化测试策略

目前许多文献都讨论的受控马尔科夫链软件测试模型,是通过对部分假设条件进行特殊化处理后得到的,这将导致模型的适用范围较小且偏离实际应用。依据软件控制论思想,通过一系列新的制约条件的转换,提出一种改善的、测试资源约束下的受控马尔科夫链模型来消除已有模型的缺陷。同时,该模型能够在高效性、复杂性和适用性3方面达到一个平衡点。为了证明其有效,根据该模型设计了一种新的软件缺陷优化测试策略,并对该策略进行了仿真实验,将其与传统的随机测试策略进行了比较。实验结果表明,该模型具有较高的实用性和有效性。     

Estimating software readiness using predictive models

In this study, defect tracking is used as a proxy method to predict software readiness. The number of remaining defects in an application under development is one of the most important factors that allow one to decide if a piece of software is ready to be released. By comparing predicted number of faults and number of faults discovered in testing, software manager can decide whether the software is likely ready to be released or not.The predictive model developed in this research can predict: (i) the number of faults (defects) likely to exist, (ii) the estimated number of code changes required to correct a fault and (iii) the estimated amount of time (in minutes) needed to make the changes in respective classes of the application. The model uses product metrics as independent variables to do predictions. These metrics are selected depending on the nature of source code with regards to architecture layers, types of faults and contribution factors of these metrics. The use of neural network model with genetic training strategy is introduced to improve prediction results for estimating software readiness in this study. This genetic-net combines a genetic algorithm with a statistical estimator to produce a model which also shows the usefulness of inputs.The model is divided into three parts: (1) prediction model for presentation logic tier (2) prediction model for business tier and (3) prediction model for data access tier. Existing object-oriented metrics and complexity software metrics are used in the business tier prediction model. New sets of metrics have been proposed for the presentation logic tier and data access tier. These metrics are validated using data extracted from real world applications. The trained models can be used as tools to assist software mangers in making software release decisions.     

组合核相关向量机的软件可靠性预测模型

可靠性作为衡量软件质量的一种重要特性,对软件管理具有重要的意义。针对单一核函数的缺陷,提出一种组合核函数相关向量机的软件可靠性预测模型。首先对当前软件可靠性研究现状进行分析,然后采用组合核函数相关向量机对训练集进行学习和建模,最后通过具体实例对模型的预测性能进行分析。结果表明,本模型获得了理想的软件可靠性预测结果,且其预测性能要优于单一核函数模型,在软件可靠性预测中有重要的应用价值。     

基于拟似然估计方法的软件失效预测模型

软件缺陷预测是软件可靠性研究的一个重要方向。由于影响软件失效的因素有很多,相互之间关联关系复杂,在分析建模中常用联合分布函数来描述,而实际应用中难以确定,直接影响软件失效预测。基于拟似然估计提出一种软件失效预测方法,通过主成分分析筛选影响软件失效的主要影响因素,建立多因素软件失效预测模型,利用这些影响因素的数字特征(均值函数和方差函数)以及采用拟似然估计方法估计出模型参数,进而对软件失效进行预测分析。基于两个真实数据集Eclipse JDT和Eclipse PDE,与经典Logistic回归和Probit回归预测模型进行实验对比分析,结果表明采用拟似然估计对软件缺陷预测具有可行性,且预测精度均优于这两种经典回归预测模型。