2022, Vol.18, No.2

Journal of Software Assessment and Valuation 2023 KCI Impact Factor : 0.35

pISSN : 2092-8114 / eISSN : 2733-4384
https://journal.kci.go.kr/ksavs

Taint analysis is widely used in detecting security vulnerabilities in source code. However, it is difficult to obtain accurate results in reasonable amount of computing time due to the nature of static analysis. This paper proposes a new way of detecting security vulnerabilities using machine-learning technology utilizing an already established model, graph2vec. The flow graph of a program is transformed into a vector and then given to the model. The data set is prepared by first constructing simplified program and then applying mutation. The evaluation results show that the model detects security vulnerabilities with the accuracy of up to 99%, positively showing the possibility of applying machine-learning technology to the static detection of security vulnerabilities in source code.

Software products and software-intensive computer systems are increasingly used to perform a variety of business and personal functions. In particular, the web service-based ERP system is rapidly changing the way companies conduct business. In this paper, based on international standards such as ISO/IEC 25010, we propose a method to utilize the software quality evaluation concept in the evaluation of completeness. Among the software quality characteristics defined by ISO/IEC 25010, functional suitability is one of the characteristics that draws the greatest attention. It refers to the degree to which a function is provided that satisfies all explicitly stated or implicitly implied needs. In this paper, we intend to discuss the implications of the applicability of the functional suitability in the assessment of the completeness of the ERP system. This discussion will focus on the case of evaluation of the completeness of the web-based ERP system of an electronic component manufacturing company.

It is necessary to distinguish between the evaluation of software maturity, which relates to the quality of the software for which the development process has been completed, and the evaluation of unfinished software that has not reached integration testing or acceptance testing. According to the Supreme Court precedent, it is not enough to complete the work until the scheduled final process, and it is said that it is completed when the main functional parts of the program are developed as agreed and have the performance generally required in terms of social norms. We separate the evaluation of incomplete software from the evaluation of software completeness and call it the evaluation of ready-made software. The software engineering development process requires collaboration and specific roles among project stakeholders. A ready-made evaluation in software should evaluate how well the roles assigned to the project stakeholders have been performed. In addition, it is proposed to calculate the total established ratio by assigning weights according to the stages of the development process for each software type.