Vulnerability Prediction Research Articles

Regional agricultural drought vulnerability prediction based on interpretable Random Forest.

Drought is one of the leading natural disasters in the world. It severely restricts the normal functioning of societies and economies. The purpose of this paper is to predict the drought vulnerability index in Henan Province so that timely measures can be taken to mitigate the impact of drought and to ensure the continued stability of people's lives and social development. First, the drought vulnerability index of Henan Province for 2010-2022 was calculated based on relevant literature and the regional situation of Henan Province. In addition, the main factors of sensibility and resilience are selected, the prediction indicator system is established, and the grey correlation analysis model is applied to select the top 10 main factors of drought vulnerability. Second, the Random Forest model was trained and simulated, and the drought vulnerability index of Henan Province was predicted for 2023-2025. Finally, the SHapley Additive exPlanations model was used to explain the specific effects of the influences of the Random Forest model. The interpretable Random Forest model not only accurately predicts the drought vulnerability index in Henan Province but also alleviates concerns about the "black box" problem of indirect interpretation of the Random Forest model. The results of the study show that the Average Percentage Error of the drought vulnerability index in Henan Province from 2010 to 2022 simulated by the Random Forest model is as low as 3.0457%, and the simulation accuracy is as high as 96.9643%. Drought vulnerability prediction for Henan Province was also made for the period 2023-2025, showing an increasing trend. Relevant sectors should enhance awareness and early warning of drought, improve resilience, and take effective measures to reduce the socio-economic impact of drought.

Evaluation, Spatial Analysis and Prediction of Ecological Vulnerability in Chongqing Municipality Based on GIS and Principal Component Analysis (PCA)

Evaluation, Spatial Analysis and Prediction of Ecological Vulnerability in Chongqing Municipality Based on GIS and Principal Component Analysis (PCA)

Graph-based explainable vulnerability prediction

Significant increases in cyberattacks worldwide have threatened the security of organizations, businesses, and individuals. Cyberattacks exploit vulnerabilities in software systems. Recent work has leveraged powerful and complex models, such as deep neural networks, to improve the predictive performance of vulnerability detection models. However, these models are often regarded as “black box” models, making it challenging for software practitioners to understand and interpret their predictions. This lack of explainability has resulted in a reluctance to adopt or deploy these vulnerability prediction models in industry applications. This paper proposes a novel approach, Genetic Algorithm-based Vulnerability Prediction Explainer, (herein GAVulExplainer), which generates explanations for vulnerability prediction models based on graph neural networks. GAVulExplainer leverages genetic algorithms to construct a subgraph explanation that represents the crucial factor contributing to the vulnerability. Experimental results show that our proposed approach outperforms baselines in providing concrete reasons for a vulnerability prediction.

Optimized seismic hazard and structural vulnerability model considering macroseismic intensity measures

Macroseismic intensity measures are fundamental quantitative indicators for evaluating the vulnerability and resilience of regional building clusters. The vulnerability model of building portfolios established can provide a noteworthy reference for the development of large-scale regional earthquake risk distributions. However, there are differences in the quantitative scales of the macroseismic intensity standards used in multiple regions. The positive effects of instrument intensity and probabilistic seismic hazard theory on the vulnerability assessment of regional buildings are rarely considered, resulting in significant differences in their assessment results. This paper comprehensively considers the impact of instrument intensity and seismic hazard models on traditional macroseismic intensity. An updated macroseismic intensity measure (UCMS-20) is proposed for evaluating regional buildings, which is combined with the latest version of China's seismic intensity standards. The actual seismic damage sample dataset (31,649 buildings) of four types of building clusters in three typical earthquakes in China (Wenchuan 2008, Yushu 2010, and Jiuzhaigou 2017) has been expanded and updated. Using the UCMS-20, the European Macroseismic Scale (EMS-98), the Modified Mercalli intensity (MMI), and the Medvedev, Sponheuer, and Karnik Scale (MSK-64), vulnerability assessments are conducted on the extended empirical structural seismic damage dataset, and an empirical disaster matrix model considering updating damage states is established. A nonlinear vulnerability prediction model considering updated macrointensity measures is proposed, and the optimized model is validated and compared against the developed multiscale empirical structure dataset. The multiscale vulnerability index calculation model is improved, and novel optimization curves, point clouds, and matrix probability risk models are established, considering the expansion of empirical structural vulnerability databases.

Multi-class vulnerability prediction using value flow and graph neural networks

In recent years, machine learning models have been increasingly used to detect security vulnerabilities in software, due to their ability to achieve high performance and lower false positive rates compared to traditional program analysis tools. However, these models often lack the capability to provide a clear explanation for why a program has been flagged as vulnerable, leaving developers with little reasoning to work with. We present a new method which not only identifies the presence of vulnerabilities in a program, but also the specific type of error, considering the whole program rather than just individual functions. Our approach utilizes graph neural networks that employ inter-procedural value flow graphs, and instruction embedding from the LLVM Intermediate Representation, to predict a class. By mapping these classes to the Common Weakness Enumeration list, we provide a clear indication of the security issue found, saving developers valuable time which would otherwise be spent analyzing a binary vulnerable/non-vulnerable label. To evaluate our method’s effectiveness, we used two datasets: one containing memory-related errors (out of bound array accesses), and the other a range of vulnerabilities from the Juliet Test Suite, including buffer and integer overflows, format strings, and invalid frees. Our model, implemented using PyTorch and the Gated Graph Sequence Neural Network from Torch-Geometric, achieved a precision of 96.35 and 91.59% on the two datasets, respectively. Compared to common static analysis tools, our method produced roughly half the number of false positives, while identifying approximately three times the number of vulnerable samples. Compared to recent machine learning systems, we achieve similar performance while offering the added benefit of differentiating between classes. Overall, our approach represents a meaningful improvement in software vulnerability detection, providing developers with valuable insights to better secure their code.

Enhancing Financial Vulnerability Models for Non-Profit Organizations: Integrating Financial Ratios and Macroeconomic Indicators for Comprehensive Risk Assessment

Purpose: This research advances the financial vulnerability prediction model for Non-Profit Organizations (NPOs) by incorporating a comprehensive set of financial and macroeconomic indicators, aiming to refine risk management and strategic planning within the sector. Theoretical Framework: Building upon Tuckman and Chang (1991) foundational work, this study addresses the evolving financial landscape's complexities. It expands on traditional financial ratio analyses to include broader economic conditions affecting NPOs, recognizing the limitations of previous literature. Design/Methodology/Approach: The study analyzes financial data from two NPOs (2017-2021), using three models to assess the influence of internal financial ratios (e.g., Debt Ratio, Cash Ratio, Net Operating Margin) and external macroeconomic factors (e.g., inflation, GDP growth) on NPO financial vulnerability and performance. Findings: Results highlight a significant positive relationship between the Cash Ratio and Return on Assets, underscoring liquidity management’s importance for NPO sustainability. Other factors showed minimal impact, suggesting a nuanced approach to financial vulnerability. Research Implications: The findings emphasize the necessity of integrating financial ratios with macroeconomic indicators in NPO management strategies, offering a refined model for understanding and mitigating financial risk. Originality/Value: This study enhances the financial management literature for NPOs by incorporating macroeconomic indicators into vulnerability assessment models. It provides a comprehensive framework for robust financial planning, filling a crucial gap in non-profit financial analysis and contributing to the sector’s resilience.

Individualised prediction of resilience and vulnerability to sleep loss using EEG features.

It is well established that individuals differ in their response to sleep loss. However, existing methods to predict an individual's sleep-loss phenotype are not scalable or involve effort-dependent neurobehavioural tests. To overcome these limitations, we sought to predict an individual's level of resilience or vulnerability to sleep loss using electroencephalographic (EEG) features obtained from routine night sleep. To this end, we retrospectively analysed five studies in which 96 healthy young adults (41 women) completed a laboratory baseline-sleep phase followed by a sleep-loss challenge. After classifying subjects into sleep-loss phenotypic groups, we extracted two EEG features from the first sleep cycle (median duration: 1.6 h), slow-wave activity (SWA) power and SWA rise rate, from four channels during the baseline nights. Using these data, we developed two sets of logistic regression classifiers (resilient versus not-resilient and vulnerable versus not-vulnerable) to predict the probability of sleep-loss resilience or vulnerability, respectively, and evaluated model performance using test datasets not used in model development. Consistently, the most predictive features came from the left cerebral hemisphere. For the resilient versus not-resilient classifiers, we obtained an average testing performance of 0.68 for the area under the receiver operating characteristic curve, 0.72 for accuracy, 0.50 for sensitivity, 0.84 for specificity, 0.61 for positive predictive value, and 3.59 for likelihood ratio. We obtained similar performance for the vulnerable versus not-vulnerable classifiers. These results indicate that logistic regression classifiers based on SWA power and SWA rise rate from routine night sleep can largely predict an individual's sleep-loss phenotype.

Securing Smart Contracts: Harnessing the Power of Efficient NetB2 Detection

Objective: Using a variety of datasets from the Ethereum documentation and Smart Contract Dataset repository, this study tackles the crucial problem of classifying smart contract vulnerabilities. Methods: Our study uses a three-module method and focuses on the Resource 3 Dataset, which contains over 2,000 Ethereum smart contracts, including inherited contracts. The groundwork for deep learning model training is laid in Module 1 by extracting bytecode from Solidity files and creating images thereafter. In Colab, Module 2 entails importing data, pre-processing, SMOTE balancing, and building three deep learning models: CNN, XCEPTION, and EfficientNet-B2. Module 3 is a Flask-based web application created in Visual Studio Code that enables vulnerability predictions, bytecode extraction, and user interaction. Findings: With an overall accuracy of 71 percent, the Convolutional Neural Network (CNN) displays its effectiveness in classifying vulnerabilities. Although the accuracy of XCEPTION and EfficientNet-B2 is 69% and 75%, respectively, the latter is the top performer. Novelty & Applications: The online application adds to the comprehensive examination of smart contract security by giving users an easy-to-use interface. The EfficientNet-B2 model stands out as a dependable tool for precise vulnerability classification, and this study advances our understanding of and efforts to mitigate vulnerabilities in Ethereum smart contracts. Keywords: Smart Contracts, Vulnerability Classification, Ethereum, Deep Learning, Convolutional Neural Network (CNN)

Spatio-temporal prediction of groundwater vulnerability based on CNN-LSTM model with self-attention mechanism: A case study in Hetao Plain, northern China

Located in northern China, the Hetao Plain is an important agro-economic zone and population centre. The deterioration of local groundwater quality has had a serious impact on human health and economic development. Nowadays, the groundwater vulnerability assessment (GVA) has become an essential task to identify the current status and development trend of groundwater quality. In this study, the Convolutional Neural Network (CNN) and Long Short-Term Memory (LSTM) models are integrated to realize the spatio-temporal prediction of regional groundwater vulnerability by introducing the Self-attention mechanism. The study firstly builds the CNN-LSTM model with self-attention (SA) mechanism and evaluates the prediction accuracy of the model for groundwater vulnerability compared to other common machine learning models such as Support Vector Machine (SVM), Random Forest (RF), and Extreme Gradient Boosting (XGBoost). The results indicate that the CNN-LSTM model outperforms these models, demonstrating its significance in groundwater vulnerability assessment. It can be posited that the predictions indicate an increased risk of groundwater vulnerability in the study area over the coming years. This increase can be attributed to the synergistic impact of global climate anomalies and intensified local human activities. Moreover, the overall groundwater vulnerability risk in the entire region has increased, evident from both the notably high value and standard deviation. This suggests that the spatial variability of groundwater vulnerability in the area is expected to expand in the future due to the sustained progression of climate change and human activities. The model can be optimized for diverse applications across regional environmental assessment, pollution prediction, and risk statistics. This study holds particular significance for ecological protection and groundwater resource management.

Adaptive Hybrid Learning for Websites Vulnerability prediction

This study presents a comprehensive exploration of machine learning (ML) techniques for predicting vulnerabilities in websites, which is a critical aspect of modern cybersecurity. With the advancement of digital threats and the complexity of cyber-attacks, conventional security strategies have become increasingly inadequate. By employing machine learning algorithms such as Random Forest and Gradient Boosting, this study formulates models adept at identifying potential vulnerabilities within the website code. This approach responds to the escalating demand for enhanced security measures, in the face of increasingly sophisticated digital threats. By integrating anomaly detection findings through the Isolation Forest algorithm, this study enriches the training dataset, enabling models to adapt to both known and emerging vulnerability patterns
 The Gradient Boosting model slightly outperformed the Random Forest model in terms of overall accuracy, achieving a precision of 97% for the non-vulnerability class, and the vulnerability class had a precision of 90%, leading to an overall accuracy of 96.25%., which is attributed to its ability to iteratively learn from previous errors, thereby enhancing its adaptability to new vulnerabilities. This study underscores the significant potential of ML to enhance cybersecurity measures against website vulnerabilities.

Making vulnerability prediction more practical: Prediction, categorization, and localization

Context:Due to the prevalence of software vulnerabilities, vulnerability detection becomes a fundamental problem in system security. Objective:To solve this problem, academics and industries have made great efforts to propose deep-learning-based (DL-based) approaches but these attempts have three main limitations: (1) perform poorly on real-world projects (e.g., Accuracy below 74.33% and F1 below 73.55%); (2) perform poorly in catching vulnerable patterns due to incomplete code representations; (3) mostly perform coarse-grained function-level prediction and lack interpretability analysis. Methods:In this paper, we propose VulPCL, a BLSTM and CodeBERT based approach, which makes the first attempt to perform vulnerability prediction, categorization, and localization automatically within a framework. To alleviate the above-mentioned limitations, our VulPCL considers multi-dimension (i.e., text-based, sequence-based, and graph-based) representations to catch latent vulnerable patterns and multi-model training to learn high-level semantics. Results:Through experiments on four real-world datasets containing 114+ CWE (Common Weakness Enumeration) types spanning from 2005 to 2022, we find that our VulPCL outperforms the baselines by (1) 13.51%∼60.64% and 14.34%∼180.23% on Accuracy, and F1 respectively on vulnerability prediction; (2) 10.32%∼46.79%, and 10.71%∼127.80% on Accuracy, and macro-F1 respectively on vulnerability categorization; (3) 9.23%∼36.54% on Top-10 Accuracy on vulnerability localization. Conclusion:These results indicate that our VulPCL is considerably more accurate, effective, fine-grained, and practical than previous studies. Besides, our further analyses show that VulPCL is indeed capable of capturing all vulnerability lines, and the result of line-level vulnerability localization is consistent with the function-level vulnerability prediction as the increase of predicted lines. Thus making VulPCL more interpretable than previous studies. Our additional investigation also shows that VulPCL effectively detects the Most Dangerous 25 CWEs in 2022, which is instructive for security researchers.

Secure Digital Asset Transactions: Integrating Distributed Ledger Technology with Safe AI Mechanisms

This paper explores the integration of distributed ledger technology (DLT) and artificial intelligence (AI) in digital asset transactions, focusing on the challenges of security, privacy protection, and smart contract reliability. Through a comprehensive analysis, it was found that DLT ensures transaction security and transparency through decentralized recording and consensus mechanisms, while AI enhances security through anomaly detection and threat analysis. In addition, the convergence of DLT and AI has significantly enhanced privacy protection by encrypting data transfers and using data desensitization techniques. In addition, AI-driven automated testing and vulnerability prediction improve the reliability and execution efficiency of smart contracts, ensuring the integrity of transactions. Overall, the integration of DLT and AI provides a solid framework for safe, efficient and reliable digital asset trading, paving the way for the further development and maturity of the digital asset market.

The impact of hard and easy negative training data on vulnerability prediction performance

Vulnerability prediction models have been shown to perform poorly in the real world. We examine how the composition of negative training data influences vulnerability prediction model performance. Inspired by other disciplines (e.g. image processing), we focus on whether distinguishing between negative training data that is ‘easy’ to recognise from positive data (very different from positive data) and negative training data that is ‘hard’ to recognise from positive data (very similar to positive data) impacts on vulnerability prediction performance. We use a range of popular machine learning algorithms, including deep learning, to build models based on vulnerability patch data curated by Reis and Abreu, as well as the MSR dataset. Our results suggest that models trained on higher ratios of easy negatives perform better, plateauing at 15 easy negatives per positive instance. We also report that different ML algorithms work better based on the negative sample used. Overall, we found that the negative sampling approach used significantly impacts model performance, potentially leading to overly optimistic results. The ratio of ‘easy’ versus ‘hard’ negative training data should be explicitly considered when building vulnerability prediction models for the real world.

The Role of Fluid Mechanics in Coronary Atherosclerotic Plaques: An Up-to-Date Review.

Most acute coronary syndromes are due to a sudden luminal embolism caused by the rupturing or erosion of atherosclerotic plaques. Prevention and treatment of plaque development have become an effective strategy to reduce mortality and morbidity from coronary heart disease. It is now generally accepted that plaques with thin-cap fibroatheroma (TCFA) are precursors to rupturing and that larger plaques and high-risk plaque features (including low-attenuation plaque, positive remodeling, napkin-ring sign, and spotty calcification) constitute unstable plaque morphologies. However, plaque vulnerability or rupturing is a complex evolutionary process caused by a combination of multiple factors. Using a combination of medicine, engineering mechanics, and computer software, researchers have turned their attention to computational fluid mechanics. The importance of fluid mechanics in pathological states for promoting plaque progression, inducing plaque tendency to vulnerability, or even rupture, as well as the high value of functional evaluation of myocardial ischemia has become a new area of research. This article reviews recent research advances in coronary plaque fluid mechanics, aiming to describe the concept, research implications, current status of clinical studies, and limitations of fluid mechanic's characteristic parameters: wall shear stress (WSS), axial plaque shear (APS), and fractional flow reserve (FFR). Previously, most computational fluid dynamics were obtained using invasive methods, such as intravascular ultrasound (IVUS) or optical coherence tomography (OCT). In recent years, the image quality and spatial resolution of coronary computed tomography angiography (CCTA) have greatly improved, making it possible to compute fluid dynamics by noninvasive methods. In the future, the combination of CCTA-based anatomical stenosis, plaque high-risk features, and fluid mechanics can further improve the prediction of plaque development, vulnerability, and risk of rupturing, as well as enabling noninvasive means to assess the degree of myocardial ischemia, thereby providing an important aid to guide clinical decision-making and optimize treatment.

A Comparative Study of Commit Representations for JIT Vulnerability Prediction

With the evolution of software systems, their size and complexity are rising rapidly. Identifying vulnerabilities as early as possible is crucial for ensuring high software quality and security. Just-in-time (JIT) vulnerability prediction, which aims to find vulnerabilities at the time of commit, has increasingly become a focus of attention. In our work, we present a comparative study to provide insights into the current state of JIT vulnerability prediction by examining three candidate models: CC2Vec, DeepJIT, and Code Change Tree. These unique approaches aptly represent the various techniques used in the field, allowing us to offer a thorough description of the current limitations and strengths of JIT vulnerability prediction. Our focus was on the predictive power of the models, their usability in terms of false positive (FP) rates, and the granularity of the source code analysis they are capable of handling. For training and evaluation, we used two recently published datasets containing vulnerability-inducing commits: ProjectKB and Defectors. Our results highlight the trade-offs between predictive accuracy and operational flexibility and also provide guidance on the use of ML-based automation for developers, especially considering false positive rates in commit-based vulnerability prediction. These findings can serve as crucial insights for future research and practical applications in software security.

Applying the ELSA Framework to Assess Ecosystem Vulnerability in Wetlands of the Aral Sea Region

Wetlands are vital ecosystems that provide numerous ecological services, including water purification, flood control, and wildlife habitat. However, wetlands are under threat due to human activities and climate change. Accurate mapping and monitoring of wetlands are crucial for effective conservation and management. Remote sensing techniques have revolutionized wetland mapping by providing detailed and up-to-date information on wetland extent, vegetation composition, and hydrological patterns. Wetlands play a crucial role in global ecosystems, providing numerous ecological services such as flood control, water purification, and habitat for diverse flora and fauna. Monitoring of the wetland dynamics are essential for effective conservation and sustainable management. This research paper provides a detailed examination of recent advances in remote sensing research of wetlands, focusing on the utilization of inventory geoecological mapping. Wetland ecosystems are dynamic and sensitive to environmental changes, making their monitoring a challenging but imperative task. Remote sensing technologies offer a unique opportunity to observe and analyze wetland characteristics at various scales. We explore the use of remote sensing in wetlands mapping, highlighting its benefits, challenges, and future prospects with a special emphasis on vulnerability assessment and vulnerability prediction using ELSA (Essential Life Support Area) approach.

CLUSTER ANALYSIS FOR RESEARCHING DIGITAL FOOTPRINTS OF STUDENTS IN EDUCATIONAL INSTITUTIONS

It is shown that Cluster Analysis (CA) can be used in the process of researching the Digital Traces (DT) of students of an educational institution, as well as other educational institutions that introduce a Digital Educational Environment (DEE) into the educational process. Cluster analysis can reveal behavioral patterns of education seekers. Also, the use of CA methods will improve the personalization of training and increase the effectiveness of educational programs. It is shown that in the context of ensuring Information Security (IS) of the DEE of educational institutions, technologies and methods of DT analysis can also be useful, for example, for: monitoring students’ network activity; analysis of student authorization and authentication logs; detection of malicious programs and attacks on the DEE; analysis of IS threats to the DEE as a whole; vulnerability prediction. It is shown that the application of CA methods can be useful in studying the degree of information security of the DEE of universities and other educational institutions. It has been established that CA methods can help identify groups of students with similar patterns of activity from the point of view of IS, both the DEE of the educational institution as a whole, and its computer networks and systems. It has been established that with the help of CA DT, it is possible to detect anomalous behavior of students, to detect unusual patterns of activity, facts of unauthorized use of resources or other deviations from the typical behavior of students in the network of the educational institution. The article also provides the results of experimental studies of the level of competences of students of various specialties at the university in IS and protection of information assets of the DEE. In this, CA methods were used in the process of studying students’ DT. Six types of users were distinguished on the basis of CA DT of different groups of students registered in the university DEE. As a result of the application of CA methods, students registered in the university’s DEE were divided into appropriate clusters according to criteria affecting IS risks.

The Holy Grail of Vulnerability Predictions

The Holy Grail of Vulnerability Predictions

Prediction of Vulnerability to addiction based on Religious Beliefs with the Mediating Role of Psychological Well-being in Women

Background: Effective religious beliefs, along with psychological well-being, are effective factors in the tendency or non-tendency to addiction. The more developed a person's religious beliefs are, the more effective they will be in preventing addiction. The purpose of this study was to predict the prevalence of addiction based on religious beliefs and the role of mediation of psychological well-being in women. Methods: In a correlational study, 185 women in East Azarbaijan were selected by multi-stage cluster random sampling, and they completed the addiction preparedness, psychological well-being and religious beliefs assessment questionnaire. Results: The results showed that there was a significant negative relationship between psychological well-being and readiness for addiction, and there was a significant positive relationship between religious beliefs and psychological well-being. The proposed model had a good fit with the data. Conclusions: Religious beliefs with mediating psychological well-being can predict the prevalence of addiction in women. Considering this, there can be suggestions for prevention and intervention in the women's addiction field.

Development of a seismic vulnerability and risk model for typical bridges considering innovative intensity measures

Seismic intensity measures are one of the core parameters for estimating regional bridges’ seismic risk and vulnerability. Using macroscopic seismic intensity indicators to predict and assess the seismic vulnerability of bridges can contribute positively to establishing urban and rural earthquake risk models. However, the developed vulnerability model rarely considers the contribution of instrument intensity to its quantification results and ignores the influence of nondamage bridge samples on the development of bridge risk models and the membership relationship between seismic vulnerability levels, which makes the developed model somewhat localized and uncertain. This study proposes a quantitative method and innovative model considering composite seismic intensity (instrumental and macroseismic intensity) indicators. The model was updated and validated using 300,000 acceleration records monitored by ten seismic stations during the Luding earthquake on September 5, 2022, in China, and the features of seismic motion parameters were analysed. The established empirical vulnerability dataset of bridges during the 2008 Wenchuan earthquake in China was updated and optimized using the developed models and methods. The traditional vulnerability level of bridges has been expanded by adding and refining actual samples (2317 bridges) from different seismic intensity zones. A vulnerability prediction model based on an updated extended bridge database was developed using nonlinear regression methods. A fragility membership index calculation model for estimating the correlation features of bridge vulnerability levels is proposed by combining the probability risk and fuzzy membership correlation algorithm. The traditional method for calculating the seismic vulnerability index has been improved, and a multiparameter bridge vulnerability model validation and rationality analysis have been conducted using the newly developed bridge sample dataset.