N AT I O N A L C Y B E R S E C U R I T Y ST R AT E GY I V TRUSTWORTHY SOFTWARE ENGINEERING (TRUX) Prof. Dr. Jacques Klein 3. Explainable software: by ensuring that software engineering solutions to business problems are not black-box solutions but, instead, provide explanations and contextual information to help end users. This research direction is in line with an emerging requirement in the field of artificial intelligence where models and techniques must be devised in such a way that the results of an AI solution can be understood by human experts. Given the use of AI algorithms in several of our research areas, we also investigate directions on making the analyses tractable. TruX is a software engineering and software security research group that develops innovative approaches and tools to help the research and practice communities build trustworthy software. Trustworthy software has reduced vulnerabilities; when it fails, it can be repaired automatically; when it operates, it can justify its execution drives. TruX explores the huge data on software development artefacts (including source code and textual information in repositories, such as bug reports, reviews, etc.) to derive knowledge on how to automate the analysis, construction, and repair of software programs. In particular, TruX conducts research in three main areas: Tools for practitioners: TruX aims at developing both practical and fundamental research solutions. Practical, because TruX directly targets practitioners with the ambition to release tools that are relevant for developers. Fundamental, because TruX investigates key open and hard software engineering problems such as the definition of code similarity (e.g. representation learning techniques for semantic code clone identification), the derivation of abstract repair operators that are less prone to test overfitting, etc. 1. Software security: by developing new tools and approaches to assess and ensure security and privacy properties of software applications. Examples of research activities are the detection of privacy leaks in Android apps or the detection of vulnerabilities in open-source software at “commit time”. 2. Software repair: by devising and implementing novel algorithms, methodologies, and tool support for automatically repairing programs. This is performed by identified bug or vulnerability locations and applying code change operations that will enable the programs to satisfy correctness criterion. TruX is particularly focused on inventing software repair solutions that are in line with practitioners’ constraints. Project acronym Project name Principal investigator Funding body CHARACTERIZE Characterization of Malicious Code in Mobile Apps: Towards Accurate and Explainable Malware Detection J. Klein FNR CatchMe Android Malicious code Localisation: Catch Me if You can! J. Klein FNR HitDroid Hinting at Malicious Code in Android Apps Identifying Malicious Payloads in Malware at Market Scale with Graph and Data Clustering Techniques J. Klein UL LuxWAys Luxembourg/West Africa Lab for Higher Education Capacity Building in Cybersecurity and Emerging Topics in ICT4Dev T.F.D.A. Bissyande 38