Software vulnerabilities are a well-known problem in current software projects. The situation becomes even more complicated, due to the ever-increasing complexity of the interconnections between both commercial and free open-source software (FOSS) projects. In this dissertation, we are aiming to facilitate the security assessment process in an industrial context. We start from the level of the own code of an individual software project, for which we propose a differential benchmarking approach for automatic assessment of static analysis security testing tools. We have demonstrated this approach, using 70 revisions of four major versions of Apache Tomcat with 62 distinct vulnerability fixes as a ground-truth set to test 7 tools. Since modern software projects often import functionality via software dependencies, that can also introduce vulnerabilities into the dependent project, we propose a methodology for counting actually vulnerable dependencies. We have evaluated the methodology on the set of 200 most used industry-relevant FOSS libraries, that resulted in 10905 distinct library instances when considering all the library versions. Finally, we have investigated the situation on the level of the FOSS ecosystem. Here we have studied decision-making strategies of developers for selecting and updating dependencies, as well as the influence of security concerns on the developers' decisions from quantitative and qualitative perspectives. For the qualitative study we have run 15 semi-structured interviews with software developers from 15 companies located in 7 countries.

The world is extremely diverse and its diversity is obvious in the cultural differences and the large number of spoken languages being used all over the world. In this sense, we need to collect and organize a huge amount of knowledge obtained from multiple resources differing from one another in many aspects. A possible approach for doing that is to think of designing effective tools for construction and maintenance of linguistic resources and localized domain ontologies based on well-defined knowledge representation methodologies capable of dealing with diversity and the continuous evolvement of human knowledge. In this thesis, we present a collaborative platform which allows for knowledge organization in a language-independent manner and provides the appropriate mapping from a language independent concept to one specific lexicalization per language. This representation ensures a smooth multilingual enrichment process for linguistic resources and a robust construction of ontologies using language-independent concepts. The collaborative platform is designed following a workflow-based development methodology that models linguistic resources as a set of collaborative objects and assigns a customizable workflow to build and maintain each collaborative object in a community driven manner, with extensive support of modern web 2.0 social and collaborative features.

River reaches worldwide historically experience morphological regulations, as channelization, as well as flow regime alterations, which often lead to degradation of freshwater ecosystems. In last seven decades a large number of dams have been designed and built worldwide contributing to such river hydromorphological alterations. In alpine and piedmont regions river reaches often experience anthropogenic flow regime alteration due to hydropower production. The fluctuating flow regime typical of river reaches downstream hydropower plant releases (hydropeaking) is known to produce several adverse ecological effects, strongly linked to morphological characteristics of the downstream channel. Hydropeaking can also alter the thermal regime of the receiving water body (thermopeaking) if released hypolimnetic water has different temperature from surface water; also thermopeaking can have adverse consequences on river environment. In a changing world with respect to renewable energy production but also to global warming, the understanding of hydropeaking and thermopeaking ecological impacts represent a lively research challenge. The first part of the present thesis is dedicated to the characterization and quantification of hydropeaking and thermopeaking alterations. Adopting a statistical approach on an extended dataset of Alpine and Norwegian rivers, a suite of indicators have been designed and exploited to identify the degree of alteration of both hydrological and thermal regime. The study provides two screening tools that can be exploited by environmental managers in the identification of critically altered river reaches. The second part is dedicated to the development of a two-dimensional numerical shallow-water model able to simulate surface water passive tracer transport over complex morphologies, exploitable in the numerical investigation of river thermal transport dynamics. In the third part the interaction between hydropeaking waves and receiving reach morphology has been investigated via numerical modeling. The work consists on a first quantitative attempt to investigate the eco-hydraulic response of river reaches with different channel morphologies to hydropeaking waves of different intensities. Such general approach can be applied to a specific case to support the choice of the most effective river restoration strategy leading to the optimal specific eco-hydraulic conditions. Finally, the last part reports an application of the designed approaches and tools to Lundesokna River, a Norwegian river affected by hydropeaking.

A new constitutive model is proposed to describe the stress-strain-time behaviour of clays and organic soils. This approach is based on the framework of overstress viscoplastic theory and can be applied to any elastoplastic (inviscid) model.The most innovative idea of the proposed model is the identification of two components of strain for each deformation mechanism. In particular, in both the elastic and the plastic regimes a fast and a slow strain mechanism are assumed to be present. To this aim the constitutive model is based on two yield surfaces based on overstress viscoplasticity theory: one is quasi-instantaneous (for the fast part of plastic deformations) and the other is viscous (for the slow part of plastic deformations). This assumption permits the reliable simulation of the mechanical behaviour of a wide range of clayey soils: from inorganic clay (a.e. kaolinite and bentonite), to organic clays and peats. A further interesting aspect of the proposed model is the capability of simulate both the normally consolidated and the overconsolidated regime within a unique constitutive approach. An extensive experimental program on three different peaty soils has been performed to validate the constitutive model. The experimental tests include a wide range of oedometric tests (with very different loading conditions), and a series of triaxial tests conducted on NC and OC peats. The model has been validated also by simulating the settlements of a real embankment founded on a thick layer of organic clay.

Textual Entailment (TE) aims at capturing major semantic inference needs across applications in Natural Language Processing. Since 2005, in the TE recognition (RTE) task, systems are asked to automatically judge whether the meaning of a portion of text, the Text, entails the meaning of another text, the Hypothesis. Although several approaches have been experimented, and improvements in TE technologies have been shown in RTE evaluation campaigns, a renewed interest is rising in the research community towards a deeper and better understanding of the core phenomena involved in textual inference. In line with this direction, we are convinced that crucial progress may derive from a focus on decomposing the complexity of the TE task into basic phenomena and on their combination. Analysing TE in the light of the notions provided in logic to deï¬ ne an argument, and to evaluate its validity, the aim of our work is to understand how the common intuition of decomposing TE would allow a better comprehension of the problem from both a linguistic and a computational viewpoint. We propose a framework for component-based TE, where each component is in itself a complete TE system, able to address a TE task on a speciï¬ c phenomenon in isolation. Five dimensions of the problem are investigated: i) the deï¬ nition of a component-based TE architecture; ii) the implementation of TE-components able to address speciï¬ c inference types; iii) the linguistic analysis of the phenomena relevant to component-based TE; iv) the automatic acquisition of knowledge to support component-based entailment judgements; v) the development of evaluation methodologies to assess component-based TE systems capabilities to address single phenomena in a pair.

Over the last decade, Online Social Networks (OSNs) have attracted hundreds of millions of users worldwide, establishing themselves as one of most successful communication tools to date. Yet, the business model adopted by current centralized approaches makes them inherently prone to privacy issues and hostile to openness, as service providers rely on the commercial exploitation of their userbases' private data as their means of survival. We believe, as others do, that decentralization could represent a solution to this fundamental problem. In this work, we propose a novel P2P approach to decentralized OSNs in which peers are organized as a social overlay (SO): an overlay network that effectively mirrors an underlying social network by constraining communication to pairs of peers whose owners are friends. SOs are special in two ways. First, by embodying friendship in their links, SOs can help us either solve or mitigate fundamental trust-related issues that arise in P2P systems. Second, SOs exhibit an inherent compatibility towards OSNs, a result of the former being shaped after human communication, and the latter being human communication tools. These give raise to an inherent potential for synergy, which we propose to reap by means of a simple approach that provides a key functionality of modern OSNs: profile-based communication. In our approach, nodes cache the profile pages of their friends locally, and updates get proactively disseminated only by trusted nodes, over a user's ego network: the subgraphs of social networks composed by a user, her friends, and the connections among them. The contributions of this thesis then emerge as we tackle this seemingly simple problem of update dissemination over ego networks and, along the way, uncover issues that lead us to progressively deeper problems and understanding, and, ultimately, to effective solutions. In the first part of this thesis, we explore the use of push gossip protocols as the means to achieve efficient dissemination of updates over ego networks. We show that mainstream gossip protocols cannot be applied in this context, due to the largely non-uniform structure of ego networks. By taking these structural properties into account, we develop a novel gossip protocol that is able to adapt to, and leverage this non-uniformity, providing efficient and timely dissemination of updates. The study of these dissemination protocols under peer churn leads us to uncover the second problem we tackle in this thesis -- namely, the network-induced communication delays that emerge from the interaction of the social graph with the underlying peer dynamics. By means of a small-scale simulation study, we find that not only these delays can be rather extreme, but that they matter more than the underlying dissemination protocol on the long run. While this realization is in itself a contribution, we also find that evaluating the problem in more depth, as well as identifying opportunities for improvement, cannot be done by simulations alone. This is due to three factors: i) the size of the target networks under study, ii) the large parameter space inherent to availability modelling, and iii) the large number of repetitions required for obtaining good quality estimators. Put together, these translate into prohibitive costs. We therefore propose a novel hybrid analytical/simulation framework that enables the estimation of dissemination delays at a practical cost. In the third part of this thesis, we show how to further develop this framework by deriving analytical, closed-form expressions that describe delays as a function of a graph and availability parameters, when the underlying availability model is based on a certain class of simpler distributions. Finally, by putting together the lessons we learnt along the way -- our dissemination protocol and the knowledge we acquired about the workings of communication delays -- we devise the final contribution of this thesis: a hybrid, cloud-assisted P2P architecture that enables efficient dissemination in social overlays under churn. This solution, as we show, provides performance that rivals that of centralized solutions, while incurring modest economical costs.

The increasing number of repeated malware penetrations into official mobile app markets poses a high security threat to the confidentiality and privacy of end users' personal and sensitive information. Protecting end user devices from falling victims to adversarial apps presents a technical and research challenge for security researchers/engineers in academia and industry. Despite the security practices and analysis checks deployed at app markets, malware sneak through the defenses and infect user devices. The evolution of malware has seen it become sophisticated and dynamically changing software usually disguised as legitimate apps. Use of highly advanced evasive techniques, such as encrypted code, obfuscation and dynamic code updates, etc., are common practices found in novel malware. With evasive usage of dynamic code updates, a malware pretending as benign app bypasses analysis checks and reveals its malicious functionality only when installed on a user's device. This dissertation provides a thorough study on the use and the usage manner of dynamic code updates in Android apps. Moreover, we propose a hybrid analysis approach, StaDART, that interleaves static and dynamic analysis to cover the inherent shortcomings of static analysis techniques to analyze apps in the presence of dynamic code updates. Our evaluation results on real world apps demonstrate the effectiveness of StaDART. However, typically dynamic analysis, and hybrid analysis too for that matter, brings the problem of stimulating the app's behavior which is a non-trivial challenge for automated analysis tools. To this end, we propose a backward slicing based targeted inter component code paths execution technique, TeICC. TeICC leverages a backward slicing mechanism to extract code paths starting from a target point in the app. It makes use of a system dependency graph to extract code paths that involve inter component communication. The extracted code paths are then instrumented and executed inside the app context to capture sensitive dynamic behavior, resolve dynamic code updates and obfuscation. Our evaluation of TeICC shows that it can be effectively used for targeted execution of inter component code paths in obfuscated Android apps. Also, still not ruling out the possibility of adversaries reaching the user devices, we propose an on-phone API hooking based app introspection mechanism, AppIntrospector, that can be used to analyze, detect and prevent runtime exploitation of app vulnerabilities that involve dynamic code updates.

Telecommunication systems are becoming more and more complex and dynamic. As an example, on e-commerce platforms, on content provision platforms or cloud computing platforms, a variety of dierent agents interact and inuence each other. In data-centers, large numbers of dierent ows need to be served meeting a given quality of service, and the routing decisions taken for one ow can easily inuence the performance of some other ows. These examples are characterized by complexity and dynamism. These features emerge form the interactions among agents and the environment where they operate, and from the fact that agents can choose their actions within a spectrum of possible strategies. As a result, given the structural constraints of a system, it is usually challenging to understand what the emerging properties and the operating points of such system are. In the present work we analyze the dynamics of such systems, with the aim of devising strategies to optimize their operating points. Given their variety, we resort to dierent techniques to analyze each of them. In the second and third chapters we will resort to a game theoretical framework, as we will need to model an edge caching system as a multi-agent system where the decisions made by one of the agents determine the behavior of all the others. In the fourth chapter we will tackle a ow segmentation problem. In this context we will need to model the behavior of an agent seeking to maximize a private utility from the interactions with a stochastic environment, therefore we will use the theory of stochastic optimization. In the fth chapter we tackle the problem of determining an optimal trunk-reservation policy for a queue control problem, in absence of knowledge of the statistical properties of the queue. In this case, we will use reinforcement learning tools to devise an algorithm based on policy learning that converges to an optimal policy.

Quasiconformal Transformation Optics (QCTO) has been investigated and applied for the design of innovative electromagnetic field manipulating devises. The design is focused on enhancing radiation performance of antenna arrays. Towards this end, the QCTO approach has been utilized for the application of compressing dimension of linear array at the same time keeping its radiation performance equivalent to the original array. The basic QCTO is then generalized to allow an arbitrary physical arrangement coated with a suitable lens to exhibit the same radiating features of an arbitrary reference virtual array in free space. This removed the limitation on the state-of-the-art QCTO method to handle transformation between arbitrarily shaped geometries. A representative numerical example, concerned with a two-dimensional layout, is presented to assess the effectiveness of the proposed method as well as the enhanced features of the resulting metamaterial-coated arrays with respect to standard conformal arrangements. In addition, the capability to achieve significantly simplified structures by means of tile discretization approximation of the synthesized lens is investigated. Selected numerical examples are reported to illustrate the effectiveness of tile-discretized lenses versus ideal QCTO arrangements. The metamaterial lens that resulted from the extended QCTO was found to be significantly anisotropic posing implementation challenge. To address this issue, an innovative approach, based on the System-by-Design (SbD) paradigm, is proposed for the synthesis of isotropic non-magnetic metamaterial lenses. Selected numerical results, concerned with an application of the SbD-QCTO approach, are reported to give some insights on its advantages and current limitations in terms of computational efficiency, effectiveness, and flexibility.

Sustainability while being definitely a new form of humanity, as it has been proposed and dealt with in many urban and landscape projects lacks often of an essential characteristic of the anthropic space: seduction. We believe that Sustainability has to find its own power of seduction if it is to compete successfully with the ambiguous but established charms of the unsustainable city. From all the above it is clear the importance of the ‘Aesthetic of Sustainability’ as fundamental for the success of a new model of green planning not just from an environmental and economic point of view, but, perhaps and most importantly, from a social and mental one. This research investigates the possibility to look at Sustainability and Aesthetics through the lens of evolutive processes and the complexity theory to inform a new Bottom Up/Self Organized approach as a possible morphogenetic process for sustainable city design. Often criticized as the theory of ‘out of control’ the complexity theory applied to the urban could instead be the enabler of a new paradigm where the notion of single authorship with intellectual ownership and his aesthetic language is substituted by the concept of a collective and a new aesthetics of choice where the Aesthetics of Sustainability is that action on the psyche, negotiating between personal subjectivity and collective subjectivity, as a form of knowledge, a process, and a tool for aesthetic creation that cannot be separated from the socius and the environment.