Reviewerly/exHarmony huggingface dataset:
Stateful Depletion and Scheduling of Containers on Cloud Nodes for Efficient Resource Usage

Container scheduling is a fundamental part of today’s service and cloud-based applications. Schedulers operate at different levels depending on how much control the system developers have. On the one hand, container orchestration managers such as Google Kubernetes manage the scheduling of containers to different nodes. On the other hand, serverless managers, such as Google Autopilot, take care of the underlying infrastructure automatically, and developers do not need to manage the nodes. However, when it comes to container depletion, i.e., removing the assigned cloud resources to an idle container, current scheduling technologies have limitations. In this paper, we propose our approach to managing cloud resource usage when containers are idle efficiently. For this purpose, we deplete idle containers statefully, i.e., propose a novel manager that monitors idle containers, saves their state, and efficiently depletes them. This manager reconstructs a depleted container using the saved state when reconstruction is needed. In our approach, we suggest an Infrastructure as Code component to automate the creation of new nodes if a depleted container cannot be scheduled on the same node, e.g., because of being overloaded. We provide an analytical model for the stateful depletion of containers and their rescheduling and empirically evaluate the accuracy of our model. For this purpose, we ran an experiment on a private cloud infrastructure and Google Cloud Platform. Our model has a low error rate of 4.28% averaged over public and private clouds.
Cross Platform API Mappings based on API Documentation Graphs

As different versions of the same application might be implemented based on different platforms/programming languages, it is significantly important to build an automated migration tool for the application programming interface (API) mapping relations between different platforms/programming languages. In this paper, we propose an approach to discover API mappings based on the API documentation. We first divide the information in the API documentation into different types of entities, relations, and attributes to construct their respective API Documentation Graphs (ADGs). Then, we encode nodes, edges and triplets of ADGs and input them to a new graph neural network (GNN) for entity alignment to obtain the API mappings between the two different platforms/programming languages. Taking HarmonyOS and Android as representative cases, we evaluate our approach based on their API documentation. The results show that our approach improves top-1, top-5, and top10 accuracies by 50.57%, 56.25%, and 52.66%, respectively, compared with documentation-based baselines.
Multimodal Graph Reasoning and Fusion for Video Question Answering

Video Question Answering (VideoQA) is a challenging multimodal task that requires the ability to recognize visual elements and reason relations in spatial and temporal dimensions according to the given video and question. Most existing GNN-based methods model the visual elements in a video as graph structures and reason relations between them. Despite the remarkable results of their work, they neglected that the question also has graph structure dependencies, which can be used to reason about relations between the video and the question. In this work, we propose a multimodal graph reasoning and fusion network that builds three graph neural networks for appearance, motion, and text sequences, respectively, and hierarchically reasons and fuses nodes from different modalities. Our proposed method achieves superior performance to several state-of-the-art methods on three benchmark datasets.
“The Need for Speed”: Extracting Session Keys From the Main Memory Using Brute-force and Machine Learning

Digital forensics has become an important topic during this digital devices era. One major problem is extracting critical information from a digital device, and one of such data sources from a digital device is the main memory. The main memory holds many data that can be as simple as a text and a number or as complex as a data structure that holds cryptography keys. In line with the growth of the digital devices era, the need for privacy is also becoming an emerging topic. Encryption is one of the ways to achieve privacy during data transmission. As mentioned, the main memory might hold the session keys to encrypt or decrypt such secure data transmissions. This paper proposes a pure brute-force and a machine learning augmented brute force method to extract session keys from the main memory. In addition, we reduce the training data footprint using a novel entropy-based preprocessing method. We choose the most commonly used secure communication protocols: Secure Shell (SSH) and Transport Layer Security (TLS). With the help of machine learning, our method becomes efficient compared to the brute-force method. Our performance evaluation shows that our methods can extract the keys with high precision and considerably fast run-time.
Pyramid Copy-move Forgery Detection Using Adversarial Optimized Self Deep Matching Network

In this paper, we propose a pyramid copy-move forgery detection framework based on multiscale Conditional Random Field (CRF) using an adversarial optimized self deep matching network. We present a patch-level adversarial optimization scheme to optimize a pre-trained self deep matching network, in order to approximate the distribution of ground truth masks more accurately. The optimized network is adopted as the basic self deep matching network in pyramid copy-move forgery detection. Coarse-to-fine images in pyramid form are put into the adversarial optimized self deep matching network to generate a set of score maps which contain rich multiscale information. Multiscale CRF is designed based on average score unary potentials and pairwise potentials with multiscale information kernels, to adequately explore multiscale information. Extensive experiments on publicly available datasets demonstrate the state-of-the-art performance of the proposed method.
Smarkchain: An Amendable and Correctable Blockchain Based on Smart Markers

Immutability is an important property of blockchain which ensures integrity and prevents forgery modification of previous transactions. However, immutability also prohibits the possibility of amending outdated codes and correcting typography or fraudulent data, both of which are common needs in many use cases. Therefore, a tradeoff that keeps the integrity guarantee but lifts the strict limitation of immutability is necessary to allow the practical applications of blockchain in areas other than cryptocurrencies. In this paper, we propose a novel scheme called Smarkchain, which will enhance blockchain technology with the features of amendment and correction by incorporating smart markers, an approach which enables multiway branching and merging in blockchain. Smarkchain has the unique advantages of allowing multiple consecutive blocks to be amended or corrected at one time, allowing multiple amendments or corrections over the same blocks, and not needing to modify existing blocks. Evaluation results of a prototype implementation show that our approach is practical.
Hash Proof System with Auxiliary Inputs and Its Application

In this work, we develop a hash proof system with auxiliary inputs (HPSAI), whose performance is as efficient as the underlying hash proof system (HPS). Moreover, we show that our HPSAI is a practical tool for the creation of leakage-resilient public key encryption (LR-PKE). In particular, we obtain a CCA-secure LR-PKE scheme that is able to leak most of the secret key information-theoretically with any hard-to-invert leakage function. Furthermore, our construction enjoys pairing-free and constant ciphertext size.
Semantic Feature Learning based on Double Sequences Structure for Software Defect Number Prediction

Software defect prediction(SDP), which predicts defective code areas, including files, code blocks, code lines, etc. It can help developers or testers in allocating test resources before the testing phase. Software defect number prediction(SDNP) is an important research direction of SDP. Previous studies mostly used regression-based methods or different neural networks to mine the semantic features contained in AST, but the way to represent code was relatively simple. In this article, we propose a framework for representing the semantic features in terms of sequences of nodes with a double sequence structure, by analyzing the ASTs and the changes in the code blocks between adjacent version. In addition, to combine statistical metric information, we also propose a model that dynamically determines the ratio of semantic features to traditional metric features during model training by using the gated fusion mechanism to perform SDNP. In the experimental part, we select 10 open source Java projects as training and test sets, and conduct a lot of comparative experiments. The experimental results demonstrate the superiority of our proposed method compared to the baseline approach.
A Detection Method for Scarcity Defect of Blockchain Digital Asset based on Invariant Analysis

Blockchain Digital Assets (BDAs) are intangible assets issued based on blockchain, providing a new paradigm for managing digital assets. Smart contracts are programs running on the blockchain and enhance the flexibility of BDA in a programmable way. However, scarcity defects in smart contracts can lead to abnormal changes in the number of BDA and affect their worth. Software invariants are logical assertions that a program fragment needs to remain faithful during execution and work well in defect detection. This paper studies the scarcity defect detection method of smart contract digital assets based on invariant analysis for the first time. First, we point out eight scarcity defects in three categories and describe their examples. Next, we propose two invariants—transfer invariant and swap invariant—that should be maintained in digital assets’ management and transaction process. Then, we use the two invariants as test oracles and propose an oracle-based method to detect scarcity defects in smart contract. Finally, we evaluate the proposed method on a real-world smart contract dataset. The experimental results show that our method can effectively detect scarcity defects in smart contracts and improve the scarcity defect detection capability of existing smart contract testing tools.
PDG2Vec: Identify the Binary Function Similarity with Program Dependence Graph

Binary code similarity identification is an important technique applied to many security applications (e.g., plagiarism detection, bug search). The primary challenge of this research topic is how to extract sufficient information from the binary code for similarity comparison. Although numerous approaches have been proposed to address the challenge, most of them leverage features determined by human experience or extracted using machine learning methods and ignore some critical technique semantic information. Additionally, they assess their approach exclusively in laboratory environments and lack real-world datasets. Both problems lead to the limited effectiveness of these methods in real application scenarios (e.g., vulnerable function search).In this paper, we propose a novel approach PDG2Vec, which extracts the data dependence graph and control dependence graph (i.e., program dependence graph (PDG)) as the features of functions and uses them for identifying function similarity. Meanwhile, we design several strategies to optimize the PDG’s construction and use them in similarity comparison to balance time-consuming and accuracy. We implement the prototype of PDG2Vec, which can perform binary code similarity comparison across architectures of x86, x86_64, MIPS32, ARM32, and ARM64. We evaluate PDG2Vec with two datasets. The experimental results show that PDG2Vec is resilient to cross-architecture and extracts more precise semantics than other approaches. Moreover, PDG2Vec outperforms the state-of-the-art tools in the vulnerable function search scenario and has excellent performance.
Robust Perception for Autonomous Vehicles using Dimensionality Reduction

Adversarial attacks on machine learning models have proven to be a major contributor for the lack of actual deployment and adoption of ML in many practical use-cases. They have been found to be equally lethal in video streams as they are in images and texts. This finds particular relevance in the domain of autonomous driving tasks, which make use of object recognition neural architectures. In this paper, we take a step back from the cat and mouse chase of novel attacks and ad-hoc defenses and try to explain adversarial attacks from the perspective of the geometry of the high-dimensional spaces that the models operate in. Additionally, we make use of our idea of relating adversarial attacks to dimensionality to propose a counter-measure that uses dimension reduction. We have tested our proposition on state-of-the-art object detection and classification models on video streams including Faster-RCNN and YOLO and corresponding adversarial attacks on these models. Having optimally tuned the hyper-parameter associated with variability preservation upon dimension reduction using simple Singular Value Decomposition, we have shown that the performance of the robust version of the object detector models is within 2−3% of that on the clean samples, despite the presence of adversarial perturbation.
Emotional Dashboard: a Non-Intrusive Approach to Monitor Software Developers' Emotions and Personality Traits

Developers' emotions are crucial elements that influence the overall job satisfaction of software engineers, including motivation, productivity, and quality of the work, affecting the software development lifecycle. Existing approaches to assess and monitor developers' emotions, such as facial expressions, self-assessed surveys, and biometric sensors, imply considerable intrusiveness on developers' routines and tend to be used only during limited periods. This paper proposes a new non-intrusive and automatable tool (Emotional Dashboard) to assess, monitor, and visualize software developers' emotions during long periods, providing team leaders and project managers with an overview of teams' and software developers' emotional statuses. The idea is to use posts shared by developers on social media to assess their emotions' polarity and visualize the emotional situation on a dashboard, allowing the identification of potentially abnormal emotional periods that may affect the software development. A first evaluation of the tool’s accuracy, done by comparing the emotion polarity (negative, positive, or neutral) of posts done by our tool with the manual classification of a set of posts done by three psychologists, has shown an accuracy of 77%. The tool is available for analysis at this link: https://emotional-dashboard.herokuapp.com.
Improved Methods of Pointer Mixture Network for Code Completion

Code completion is an efficient software development technique in modern integrated development environments (IDEs), which can predict the most likely code token(s) based on the context of the code to be completed, so as to improve the work efficiency of developers. The Pointer Mixture Network proposed in recent years has achieved good results in code completion, the contribution of this paper is to improve the Pointer Mixture Network’s method. We used one-hot encoding in the data preprocessing phase, which makes the distance between the tokens of calculation more reasonable, and also has an effect on the expansion characteristics of the code. Besides, we add label smoothing to avoid the overfitting of neural language networks and improve the generalization ability of the model. In neural language networks, we apply the three-layer LSTM, so that the hidden layers of LSTM can fully learn the context information. In terms of the optimizer, we choose NAdam whose performance is better than Adam used in the Pointer Mixture Network, which greatly accelerates the training speed of the model. Experiments show that our work exceeds the results obtained in the Pointer Mixture Network, which is in code completion tasks in Python and JavaScript programming languages.
A Taxonomy of Software Flaws Leading to Buffer Overflows

The buffer overflow attack has been dubbed ‘the vulnerability of the century’, because of the frequency and impact of this class of vulnerability. The wide variety of situations where this vulnerability can arise makes it particularly difficult to assess their occurrence or prevent them. In this paper, we present a novel taxonomy of programming errors which can lead to buffer overflows. This taxonomy easily translates into preconditions that ensure the code’s safe execution. We also illustrate each taxonomic class with a real-life example. Finally, from these examples, we draw a series of principles that developers can immediately incorporate in their programming habits in order to improve the security of their code.
Graph Encryption for Shortest Path Queries with k Unsorted Nodes

Shortest distance queries over large-scale graphs bring great benefits to various applications, i.e., save planning time and travelling expenses. To protect the sensitive nodes and edges in the graph, a user outsources an encrypted graph to an untrusted server without losing the query ability. However, no prior work has considered the user requirement of the shortest path with k unsorted nodes. In particular, we are concerned with how to securely find the shortest path by passing k nodes that do not have a fixed traverse order. To solve the problems, we propose Gespun (stands for Graph encryption for shortest path queries with k unordered nodes). It includes an oracle encryption scheme that is provably secure against the semi-honest server. Specifically, we compute the shortest paths and distances for all nodes locally to obtain path-distance oracles. We transform the shortest paths to a sequence of secure codes by using a pseudo-random permutation to protect the structure privacy. We encrypt the shortest distance by using additively homomorphic encryption. Second, we pack the oracles in link-list nodes and store them in an array-based dictionary after another permutation. Next, we construct a search graph to compute the shortest path while guaranteeing that the path passes the required k nodes. We formally prove that Gespun is adaptively semantically-secure in the random oracle. We implement a prototype of Gespun and evaluate its performance. Experiments results demonstrate that Gespun is efficient, e.g., a query over 6301 nodes, 20777 edges, and 5 unsorted nodes only needs 483 ms to get queried results. We believe that our research problem span new research that soon promotes a new line of graph encryption schemes.
A Green Neural Network with Privacy Preservation and Interpretability

Successive subspace learning, a novel green, unsupervised and interpretable machine learning paradigm is widely used in image and point cloud data classification, medical diagnosis, and forgery detection. The multi-stage Saab transform and Channel-wise Saab transform extract low-level to high-level data features for successive subspace learning, but the feature extraction process has some privacy security issues that hinder its further development. Li et al. [1] have proposed corresponding privacy-preserving schemes for the multi-stage Saab transform. However, the above methods would be in the multi-stage Channel-wise Saab transformation has the possibility of failure. Therefore, this paper proposes a noise truncation method based on the differential privacy approach to privacy-protect the Channel-wise Saab transform and designs a green neural network with privacy protection and interpretability using the protected multi-stage Channel-wise Saab transform, Layer-wise relevance propagation method and back propagation algorithm, named SFLW-CNN. Finally, extensive experiments show that the SFLW-CNN method proposed in this paper achieves trade-offs in utility, privacy, and interpretability.
Towards Improving Multiple Authorship Attribution of Source Code

Source code authorship attribution addresses the problems of copyright infringement disputes and plagiarism detection. However, most software projects are collaborative development projects. It is necessary to study multiple authorship attribution. Existing methods are not reliable in the domain of multiple authorship attribution. The reasons are as follows: i) It is a challenge to divide the code boundaries of different authors in a sample; ii) code segments belonging to different authors in a sample are usually small or incomplete. This paper proposes a method to address these challenges. We first divide the code sample into multiple lines, then integrate the code lines with similar author styles into code segments using Siamese networks. Finally, we use a path-based code representation and machine learning to identify authors. Experimental results show the method achieves an accuracy of 87.35% on C/C++ dataset and 91.35% on Java dataset, which performs better than existing methods.
An Empirical Study of the Bug Link Rate

Defect data is critical for software defect prediction. To collect defect data, it is essential to establish links between bugs and their fixes. Missing links (i.e. low link rate) can cause false negatives in the defect dataset, and bias the experimental results. Despite the importance of bug links, little prior work has used bug link rate as a criterion for selecting subjects, and there is no empirical evidence to know whether there are simpler alternative criteria for evaluating a project’s link rate to aid selection. To this end, we conduct a comprehensive study on the bug link rate. Based on 34 open-source projects, we make a detailed statistical analysis of the actual link rates of the projects, and examine the factors affecting link rates from both quantitative and qualitative perspectives. The findings could improve the understanding of bug link rates, and guide the selection of better subjects for defect prediction.
A Comprehensive Analysis of NVD Concurrency Vulnerabilities

Concurrency vulnerabilities caused by synchronization problems will occur in the execution of multi-threaded programs, and the emergence of concurrency vulnerabilities often cause great threats to the system. Once the concurrency vulnerabilities are exploited, the system will suffer various attacks, seriously affecting its availability, confidentiality and security. In this paper, we extract 839 concurrency vulnerabilities from Common Vulnerabilities and Exposures (CVE), and conduct a comprehensive analysis of the trend, classifications, causes, severity, and impact. Finally, we obtained some findings: 1) From 1999 to 2021, the number of concurrency vulnerabilities disclosures show an overall upward trend. 2) In the distribution of concurrency vulnerability, race condition accounts for the largest proportion. 3) The overall severity of concurrency vulnerabilities is medium risk. 4) The number of concurrency vulnerabilities that can be exploited for local access and network access is almost equal, and nearly half of the concurrency vulnerabilities (377/839) can be accessed remotely. 5) The access complexity of 571 concurrency vulnerabilities is medium, and the number of concurrency vulnerabilities with high or low access complexity is almost equal. The results obtained through the empirical study can provide more support and guidance for research in the field of concurrency vulnerabilities.