Ruijie Cai , Zhaowei Zhang , Xiaoya Zhu , Yongguang Zhang , Xiaokang Yin , Shengli Liu
{"title":"Coding style matters: Scalable and efficient identification of memory management functions in monolithic firmware","authors":"Ruijie Cai , Zhaowei Zhang , Xiaoya Zhu , Yongguang Zhang , Xiaokang Yin , Shengli Liu","doi":"10.1016/j.jss.2025.112472","DOIUrl":"10.1016/j.jss.2025.112472","url":null,"abstract":"<div><div>The occurrence of memory corruption vulnerabilities is often closely associated with improper use or implementation of memory management functions. Monolithic firmware typically uses custom memory management functions and lacks information such as function names, which poses significant challenges for vulnerability detection. Therefore, it is crucial for the identification of memory management functions. Existing methods are rendered ineffective due to the absence of metadata, and the diversity in implementation across different firmware images further complicates the identification process. To address the above problem, we introduce MemIdent, a new method leveraging the coding style inherent in identifying memory management functions. MemIdent is engineered to be scalable and efficient, capable of discerning consistent call features across various compiler optimizations and instruction architectures. It leverages three key observations derived from an in-depth analysis of monolithic firmware: the regularity in memory allocation calls, the co-occurrence of allocation and deallocation functions, and the statistical prominence of these features. MemIdent extracts features of call site such as function parameter types and return values using data flow analysis, which are then analyzed through statistical patterns to identify memory allocation and deallocation functions. We evaluate MemIdent’s performance using 44 firmware images covering 6 vendors (i.e., Tenda, Cisco, SonicWall, D-Link, TP-Link, and Comtech) across 3 architectures (MIPS, ARM, and PPC). The experimental results demonstrate that MemIdent has higher accuracy, greater efficiency, and better generality than state-of-the-art (SOTA) approaches, including Heapster, IDA Lumina, and MLM, which offers a significant advancement in memory management function identification methods for monolithic firmware.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"228 ","pages":"Article 112472"},"PeriodicalIF":3.7,"publicationDate":"2025-05-05","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143927457","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Jinzhao Ma , Gen Li , Zhengfu Fang , Jiangbin Zheng , Jun Cao
{"title":"Soft computing approach to viewpoint-controlled virtual texture loading","authors":"Jinzhao Ma , Gen Li , Zhengfu Fang , Jiangbin Zheng , Jun Cao","doi":"10.1016/j.jss.2025.112476","DOIUrl":"10.1016/j.jss.2025.112476","url":null,"abstract":"<div><div>Textures are a crucial element in computer graphics, essential for creating realistic visual effects. Virtual texture technology plays an important role in achieving large-scale texture loading and real-time rendering of natural terrains. However, existing texture loading methods often face performance bottlenecks on low-power platforms, leading to excessive resource consumption. To address this issue, identifying an effective texture loading strategy becomes particularly important.</div><div>This study proposes a viewpoint-controlled soft computing approach, specifically the application of fuzzy logic, to optimize the virtual texture loading process. By analyzing user viewpoint behavior and the importance of different regions within an image, our method can intelligently adjust the resolution of textures, thereby reducing hardware resource consumption during the loading process.</div><div>By introducing soft computing techniques, this paper aims to achieve more efficient large-scale texture rendering, especially in resource-constrained environments. Our research not only provides a new perspective on the development of virtual texture technology but also offers practical solutions for graphics processing on low-power platforms.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"230 ","pages":"Article 112476"},"PeriodicalIF":3.7,"publicationDate":"2025-05-05","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144167293","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"FedMVA: Enhancing software vulnerability assessment via federated multimodal learning","authors":"Qingyun Liu , Xiaolin Ju , Xiang Chen , Lina Gong","doi":"10.1016/j.jss.2025.112469","DOIUrl":"10.1016/j.jss.2025.112469","url":null,"abstract":"<div><div>Software Vulnerability Assessment plays a crucial role in identifying and evaluating security vulnerabilities in software systems and prioritizing their resolution. However, as concerns about data privacy and security continue to grow, traditional vulnerability assessment methods struggle to balance effectiveness with privacy protection, particularly in heterogeneous data environments. To address this challenge, we propose a novel federated multimodal vulnerability assessment framework (FedMVA), designed with privacy preservation at its core. FedMVA leverages federated learning, enabling local model training without sharing data, thereby protecting sensitive information while ensuring efficient vulnerability evaluation. Our framework also incorporates multimodal data, including code structure, lexical features, and developer comments, fully utilizing the complementary nature of these modalities. We introduce a weighted variance minimization loss function to improve the alignment between local and global models and adopt a momentum-based weight allocation strategy with a dynamic learning rate mechanism to enhance the model’s robustness and adaptability across diverse data environments. Extensive ablation studies demonstrate that FedMVA outperforms existing methods in multiple performance metrics, significantly improving the precision of vulnerability assessment. This work highlights the advantages of integrating multimodal data within a federated learning framework, providing an innovative and promising solution for effective and privacy-preserving vulnerability assessment in complex software systems.</div><div><em>Editor’s note: Open Science material was validated by the Journal of Systems and Software Open Science Board</em>.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"228 ","pages":"Article 112469"},"PeriodicalIF":3.7,"publicationDate":"2025-05-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143903444","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"So much more than test cases – An industrial study on testing of software units and components","authors":"Torvald Mårtensson","doi":"10.1016/j.jss.2025.112479","DOIUrl":"10.1016/j.jss.2025.112479","url":null,"abstract":"<div><div>While software-developing organizations increasingly write test cases and continuously run them to find defects and ensure quality, the associated maintenance and execution costs increase over time. According to practitioners in the software industry, more test cases is not the solution, which calls for other methods and tools that can complement traditional test cases. Based on a cross-company workshop with 30 participants, three focus groups with 19 participants, and a validation workshop with 30 participants, this paper presents insights from practitioners at six large-scale companies, describing experiences from real industrial settings with regards to testing of software units and components. As every tool is also a cost for the organization, this paper presents a structured and holistic approach based on grounded theory, where methods and tools are evaluated and selected from four categories, representing test activities with different purposes: Optimize feedback loops, Improve test efficiency, Improve test suite effectiveness, and Technical debt management. The participants in the study also described how methods and tools used within their companies were often not well described in the company’s ways-of-working, which caused frustration and confusion. Feedback from the continuous integration and delivery pipeline must be understandable (describing what the problem is), actionable (describing what the developer needs to do), and explained (describing and motivating why this is important). The findings from this study provide actionable strategies for how testing of units and components can be conducted in a more structured way, which could help companies cut costs, save time and identify problems earlier.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"228 ","pages":"Article 112479"},"PeriodicalIF":3.7,"publicationDate":"2025-04-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143892309","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Hong Quy Nguyen , Thong Hoang , Hoa Khanh Dam , Guoxin Su , Zhenchang Xing , Qinghua Lu , Jiamou Sun
{"title":"Human-understandable explanation for software vulnerability prediction","authors":"Hong Quy Nguyen , Thong Hoang , Hoa Khanh Dam , Guoxin Su , Zhenchang Xing , Qinghua Lu , Jiamou Sun","doi":"10.1016/j.jss.2025.112455","DOIUrl":"10.1016/j.jss.2025.112455","url":null,"abstract":"<div><div>Recent advances in deep learning have significantly improved the performance of software vulnerability prediction (SVP). To enhance trustworthiness, the SVP highlights predicted lines of code (LoC) that may be vulnerable. However, providing LoC alone is often insufficient for software practitioners, as it lacks detailed information about the nature of the vulnerability. This paper introduces a novel framework that is built on SVP by offering additional explanatory information based on the suggested LoC. Similar to security reports, our framework comprehensively explains the vulnerability aspects, such as Root Cause, Impact, Attack Vector, and Vulnerability Type. The proposed framework is powered by transformer architectures. Specifically, we leverage pre-trained language models for code to fine-tune on two practical datasets: BigVul and Vulnerability Key Aspect, ensuring our framework’s applicability to real-world scenarios. Experiments using the ROUGE and BLEU scores as evaluation metrics show that our framework achieves better performance with CodeT5+, statistically outperforming a baseline study in generating key vulnerability aspects. Additionally, we conducted a small-scale user study with experienced software practitioners to assess the effectiveness of the framework. The results show that 72% of the participants found our framework helpful in accepting the SVP results, and 68% rated the additional explanations as moderately to extremely useful.</div><div><em>Editor’s note: Open Science material was validated by the Journal of Systems and Software Open Science Board</em>.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"228 ","pages":"Article 112455"},"PeriodicalIF":3.7,"publicationDate":"2025-04-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143917697","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"VULOC: Vulnerability location framework based on assembly code slicing","authors":"Xinghang Lv , Jianming Fu , Tao Peng","doi":"10.1016/j.jss.2025.112459","DOIUrl":"10.1016/j.jss.2025.112459","url":null,"abstract":"<div><div>Automated detection of software vulnerabilities is an important topic in software security. Although the currently proposed deep learning-based approaches are effective in detecting vulnerabilities, their lack of accuracy in pinpointing the location of vulnerabilities leads to significant limitations in real-world usage. To address the above problem, we propose a vulnerability location framework based on assembly code slicing, VULOC, which achieves high detection capability and localization accuracy. VULOC first compiles C/C++ programs to obtain assembly code containing addresses. Then we use Addr2line to generate the mapping between assembly code and source code line numbers, and slice the assembly code into code blocks, which are encoded into the neural network model. Finally, we propose the BLSTM-LOC model for learning vulnerability features and predicting vulnerability locations. To the best of our knowledge, it is the first time that the mapping relationship between assembly code and source code line numbers is exploited for vulnerability detection. Experimental results show that VULOC exhibits higher performance than the current state-of-the-art vulnerability detection methods, both on existing datasets and real-world software products in vulnerability detection.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"227 ","pages":"Article 112459"},"PeriodicalIF":3.7,"publicationDate":"2025-04-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143876860","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Optimization selection method for software reliability growth model based on cosine similarity","authors":"Jinyong Wang , Ce Zhang","doi":"10.1016/j.jss.2025.112474","DOIUrl":"10.1016/j.jss.2025.112474","url":null,"abstract":"<div><div>So far, there have been many different software reliability growth models (SRGMs) established. It is difficult to choose which SRGM to apply in the reliability evaluation of actual software projects due to the varying assumptions of the established SRGM. In general, there will be considerable discrepancies between SRGMs used for fault prediction and software reliability evaluation of the same software development project. Considering the complexity of the actual software testing process, selecting a single optimal SRGM to evaluate software reliability may not be in line with the actual situation of fault detection (FD) or fault introduction (FI) during software testing. In order to select a class of appropriate SRGMs for the current software development and testing environment in the actual software project reliability evaluation, this paper proposes using the cosine similarity classification method. The purpose of this study is to explore effective methods for dividing into a class of optimal models, rather than selecting an optimal model. In comparison to the classical distance based approach (DBA) for selecting a single optimal SRGM, the proposed method can effectively partition a class of optimal models, including a single optimal model selected by DBA. Experimental results demonstrate the effectiveness of the proposed method.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"228 ","pages":"Article 112474"},"PeriodicalIF":3.7,"publicationDate":"2025-04-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143882804","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Quentin Stiévenart , David Binkley , Coen De Roover
{"title":"An empirical evaluation of static, dynamic, and hybrid slicing of WebAssembly binaries","authors":"Quentin Stiévenart , David Binkley , Coen De Roover","doi":"10.1016/j.jss.2025.112453","DOIUrl":"10.1016/j.jss.2025.112453","url":null,"abstract":"<div><div>The WebAssembly standard aims to form a portable compilation target, enabling the cross-platform distribution of programs written in a variety of languages. This paper introduces and evaluates novel slicing approaches for WebAssembly, including dynamic and hybrid approaches. Given a program and a location in that program, a program slice is a reduced program that preserves the behavior at the given location. A <em>static</em> slice does so for all possible inputs, while a <em>dynamic</em> slice does so for a fixed set of inputs. <em>Hybrid</em> slicing is a combination of static and dynamic slicing.</div><div>We build on Observational-Based Slicing (ORBS), where we explore the design space for instantiating ORBS for WebAssembly. For example, ORBS can be applied to the whole program or to only the function containing the slicing criterion, and it can be applied before compilation to WebAssembly or afterwards. We evaluate the slices produced using various options quantitatively and qualitatively. Our evaluation reveals that dynamic slicing at the level of a function from a WebAssembly binary finds a sweet spot in terms of slice time and slice size, and that a combination of static and dynamic slicers achieves the best trade-off in terms of slicing time and slice size.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"228 ","pages":"Article 112453"},"PeriodicalIF":3.7,"publicationDate":"2025-04-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143907608","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Jiandong Shang , Jiaru Li , Yizhe Sui , Hengliang Guo , Xu Gao , Dujuan Zhang , Yang Guo , Gang Wu
{"title":"CEGT: Smart contract vulnerability detection via Connectivity-Enhanced GCN-Transformer","authors":"Jiandong Shang , Jiaru Li , Yizhe Sui , Hengliang Guo , Xu Gao , Dujuan Zhang , Yang Guo , Gang Wu","doi":"10.1016/j.jss.2025.112454","DOIUrl":"10.1016/j.jss.2025.112454","url":null,"abstract":"<div><div>The deployment of smart contracts on blockchains is rising rapidly. Accurate detection of security vulnerabilities in smart contracts can significantly minimize property losses. However, most existing machine learning (ML)-based models for smart contract vulnerability detection models overlook the contract graph structures and sequence information, reducing detection effectiveness. This study presents a Connectivity-Enhanced GCN-Transformer (CEGT), a method for detecting smart contract vulnerability detection that integrates graph and sequence models to enhance vulnerability detection accuracy. We improve node connectivity by identifying additional paths between nodes in the graph and augment the representation capability of node features through an additional orthogonal transformation layer, which performs an orthogonal transformation on the weight matrix. Moreover, we designed a novel attention mechanism, termed the dynamic attention mechanism, based on the sequence model and inspired by the concept of dynamic routing in capsule networks. Such a dynamic attention mechanism within the sequence model is introduced to integrate structural and sequential information of smart contracts, thereby enhancing vulnerability in detection accuracy. Our experiments demonstrate that CEGT surpasses state-of-the-art methods in detecting Reentrancy, Timestamp dependence, and Integer overflow vulnerabilities, achieving F1 scores of 93.47%, 89.33%, and 91.27%, respectively. This enables us to achieve greater accuracy in detecting smart contract vulnerabilities, helping to identify potential risks, reduce security threats, and ensure the reliability and safety of blockchain applications.</div><div><em>Editor’s note: Open Science material was validated by the Journal of Systems and Software Open Science Board</em>.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"227 ","pages":"Article 112454"},"PeriodicalIF":3.7,"publicationDate":"2025-04-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143873447","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Mykhailo Klymenko , Thong Hoang , Xiwei Xu , Zhenchang Xing , Muhammad Usman , Qinghua Lu , Liming Zhu
{"title":"Architectural patterns for designing quantum artificial intelligence systems","authors":"Mykhailo Klymenko , Thong Hoang , Xiwei Xu , Zhenchang Xing , Muhammad Usman , Qinghua Lu , Liming Zhu","doi":"10.1016/j.jss.2025.112456","DOIUrl":"10.1016/j.jss.2025.112456","url":null,"abstract":"<div><div>Utilising quantum computing technology to enhance artificial intelligence systems is expected to improve training and inference times, increase robustness against noise and adversarial attacks, and reduce the number of parameters without compromising accuracy. However, moving beyond proof-of-concept or simulations to develop practical applications of these systems while ensuring high software quality faces significant challenges due to the limitations of quantum hardware and the underdeveloped knowledge base in software engineering for such systems. In this work, we have conducted a systematic mapping study to identify the challenges and solutions associated with the software architecture of quantum-enhanced artificial intelligence systems. The results of the systematic mapping study reveal several architectural patterns that describe how quantum components can be integrated into inference engines, as well as middleware patterns that facilitate communication between classical and quantum components. Each pattern realises a trade-off between various software quality attributes, such as efficiency, scalability, trainability, simplicity, portability, and deployability. The outcomes of this work have been compiled into a catalogue of architectural patterns.</div><div><em>Editor’s note: Open Science material was validated by the Journal of Systems and Software Open Science Board</em>.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"227 ","pages":"Article 112456"},"PeriodicalIF":3.7,"publicationDate":"2025-04-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"143873446","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}