To detect security vulnerabilities in a web application,the security analyst must choose the best performance Security Analysis Static Tool(SAST)in terms of discovering the greatest number of security vulnerabilities ...To detect security vulnerabilities in a web application,the security analyst must choose the best performance Security Analysis Static Tool(SAST)in terms of discovering the greatest number of security vulnerabilities as possible.To compare static analysis tools for web applications,an adapted benchmark to the vulnerability categories included in the known standard Open Web Application Security Project(OWASP)Top Ten project is required.The information of the security effectiveness of a commercial static analysis tool is not usually a publicly accessible research and the state of the art on static security tool analyzers shows that the different design and implementation of those tools has different effectiveness rates in terms of security performance.Given the significant cost of commercial tools,this paper studies the performance of seven static tools using a new methodology proposal and a new benchmark designed for vulnerability categories included in the known standard OWASP Top Ten project.Thus,the practitioners will have more precise information to select the best tool using a benchmark adapted to the last versions of OWASP Top Ten project.The results of this work have been obtaining using widely acceptable metrics to classify them according to three different degree of web application criticality.展开更多
随机测试和划分测试是两种重要的测试方法,关于两者在失效检测能力和效率方面的比较一直是软件测试领域的研究热点之一.适应性随机测试是对随机测试的一种增强,通过实现测试用例在输入域上的均匀分布,提高了随机测试的失效检测能力.该...随机测试和划分测试是两种重要的测试方法,关于两者在失效检测能力和效率方面的比较一直是软件测试领域的研究热点之一.适应性随机测试是对随机测试的一种增强,通过实现测试用例在输入域上的均匀分布,提高了随机测试的失效检测能力.该文从划分测试出发,借鉴了均匀分布的思想,提出了一种基于优先级的迭代划分测试方法(Iterative Partition Testing based on Priority Sampling,IPT-PS).首先迭代划分输入域并选取划分后子域的中心点作为待执行的测试用例,随后采取优先级策略,将待执行的测试用例分为3种不同优先等级并依次执行.迭代划分和中心采样仅需要已知输入域的空间信息,优先级执行则考虑了测试用例的不同空间特性,上述3种操作均仅需要很少的时间开销并力求实现测试用例在输入域上的均匀分布,以提高失效检测能力.该文通过理论分析给出了IPT-PS检测出对应失效所需测试用例数量的上界,并通过一系列实验结果表明:IPT-PS在仅使用接近随机测试时间开销的情况下,可以获得与适应性随机测试相近甚至更好的失效检测能力,是一种高效的测试方法.展开更多
Purpose： In this contribution we continue our investigations related to the activity index （A/） and its formal analogs. We try to replace the AI by an indicator which is better suited for policy applications. Desig...Purpose： In this contribution we continue our investigations related to the activity index （A/） and its formal analogs. We try to replace the AI by an indicator which is better suited for policy applications. Design/methodology/approach： We point out that fluctuations in the value of the AI for a given country and domain are never the result of that country＇s policy with respect to that domain alone because there are exogenous factors at play. For this reason we introduce the F-measure. This F-measure is nothing but the harmonic mean of the country＇s share in the world＇s publication output in the given domain and the given domain＇s share in the country＇s publication output.Findings： The F-measure does not suffer from the problems the AI does Research limitations： The indicator is not yet fully tested in real cases R＆D policy management： In policy considerations, the AI should better be replaced by the F-measure as this measure can better show the results of science policy measures （which the AI cannot as it depends on exogenous factors）. Originality/value： We provide an original solution for a problem that is not fully realized by policy makers.展开更多
Planetary gear train is a prominent component of helicopter transmission system and its health is of great significance for the flight safety of the helicopter.During health condition monitoring,the selection of a fau...Planetary gear train is a prominent component of helicopter transmission system and its health is of great significance for the flight safety of the helicopter.During health condition monitoring,the selection of a fault sensitive feature subset is meaningful for fault diagnosis of helicopter planetary gear train.According to actual situation,this paper proposed a multi-criteria fusion feature selection algorithm (MCFFSA) to identify an optimal feature subset from the highdimensional original feature space.In MCFFSA,a fault feature set of multiple domains,including time domain,frequency domain and wavelet domain,is first extracted from the raw vibration dataset.Four targeted criteria are then fused by multi-objective evolutionary algorithm based on decomposition (MOEA/D) to find Proto-efficient subsets,wherein two criteria for measuring diagnostic performance are assessed by sparse Bayesian extreme learning machine (SBELM).Further,Fmeasure is adopted to identify the optimal feature subset,which was employed for subsequent fault diagnosis.The effectiveness of MCFFSA is validated through six fault recognition datasets from a real helicopter transmission platform.The experimental results illustrate the superiority of combination of MOEA/D and SBELM in MCFFSA,and comparative analysis demonstrates that the optimal feature subset provided by MCFFSA can achieve a better diagnosis performance than other algorithms.展开更多
文摘To detect security vulnerabilities in a web application,the security analyst must choose the best performance Security Analysis Static Tool(SAST)in terms of discovering the greatest number of security vulnerabilities as possible.To compare static analysis tools for web applications,an adapted benchmark to the vulnerability categories included in the known standard Open Web Application Security Project(OWASP)Top Ten project is required.The information of the security effectiveness of a commercial static analysis tool is not usually a publicly accessible research and the state of the art on static security tool analyzers shows that the different design and implementation of those tools has different effectiveness rates in terms of security performance.Given the significant cost of commercial tools,this paper studies the performance of seven static tools using a new methodology proposal and a new benchmark designed for vulnerability categories included in the known standard OWASP Top Ten project.Thus,the practitioners will have more precise information to select the best tool using a benchmark adapted to the last versions of OWASP Top Ten project.The results of this work have been obtaining using widely acceptable metrics to classify them according to three different degree of web application criticality.
文摘随机测试和划分测试是两种重要的测试方法,关于两者在失效检测能力和效率方面的比较一直是软件测试领域的研究热点之一.适应性随机测试是对随机测试的一种增强,通过实现测试用例在输入域上的均匀分布,提高了随机测试的失效检测能力.该文从划分测试出发,借鉴了均匀分布的思想,提出了一种基于优先级的迭代划分测试方法(Iterative Partition Testing based on Priority Sampling,IPT-PS).首先迭代划分输入域并选取划分后子域的中心点作为待执行的测试用例,随后采取优先级策略,将待执行的测试用例分为3种不同优先等级并依次执行.迭代划分和中心采样仅需要已知输入域的空间信息,优先级执行则考虑了测试用例的不同空间特性,上述3种操作均仅需要很少的时间开销并力求实现测试用例在输入域上的均匀分布,以提高失效检测能力.该文通过理论分析给出了IPT-PS检测出对应失效所需测试用例数量的上界,并通过一系列实验结果表明:IPT-PS在仅使用接近随机测试时间开销的情况下,可以获得与适应性随机测试相近甚至更好的失效检测能力,是一种高效的测试方法.
文摘Purpose： In this contribution we continue our investigations related to the activity index （A/） and its formal analogs. We try to replace the AI by an indicator which is better suited for policy applications. Design/methodology/approach： We point out that fluctuations in the value of the AI for a given country and domain are never the result of that country＇s policy with respect to that domain alone because there are exogenous factors at play. For this reason we introduce the F-measure. This F-measure is nothing but the harmonic mean of the country＇s share in the world＇s publication output in the given domain and the given domain＇s share in the country＇s publication output.Findings： The F-measure does not suffer from the problems the AI does Research limitations： The indicator is not yet fully tested in real cases R＆D policy management： In policy considerations, the AI should better be replaced by the F-measure as this measure can better show the results of science policy measures （which the AI cannot as it depends on exogenous factors）. Originality/value： We provide an original solution for a problem that is not fully realized by policy makers.
基金co-supported by the Equipment Pre-research Foundation Project of China (No. JZX7Y20190243016301)Helicopter Transmission Technology Key Laboratory Foundation of China (No. KY-52-2018-0024)the Fundamental Research Funds for the Central Universities & Funding of Jiangsu Innovation Program for Graduate Education under Grant (No. KYLX16_0336)
文摘Planetary gear train is a prominent component of helicopter transmission system and its health is of great significance for the flight safety of the helicopter.During health condition monitoring,the selection of a fault sensitive feature subset is meaningful for fault diagnosis of helicopter planetary gear train.According to actual situation,this paper proposed a multi-criteria fusion feature selection algorithm (MCFFSA) to identify an optimal feature subset from the highdimensional original feature space.In MCFFSA,a fault feature set of multiple domains,including time domain,frequency domain and wavelet domain,is first extracted from the raw vibration dataset.Four targeted criteria are then fused by multi-objective evolutionary algorithm based on decomposition (MOEA/D) to find Proto-efficient subsets,wherein two criteria for measuring diagnostic performance are assessed by sparse Bayesian extreme learning machine (SBELM).Further,Fmeasure is adopted to identify the optimal feature subset,which was employed for subsequent fault diagnosis.The effectiveness of MCFFSA is validated through six fault recognition datasets from a real helicopter transmission platform.The experimental results illustrate the superiority of combination of MOEA/D and SBELM in MCFFSA,and comparative analysis demonstrates that the optimal feature subset provided by MCFFSA can achieve a better diagnosis performance than other algorithms.
