Search

AI-based systems, including Large Language Models (LLMs), impact millions by supporting diverse tasks but face issues like misinformation, bias, and misuse. Ethical AI development is crucial as new technologies and concerns emerge, but objective, practical ethical guidance remains debated. This study examines LLMs in developing ethical AI systems, assessing how trustworthiness-enhancing techniques affect ethical AI output generation. Using the Design Science Research (DSR) method, we identify techniques for LLM trustworthiness: multi-agents, distinct roles, structured communication, and multiple rounds of debate. We design the multi-agent prototype LLM-BMAS, where agents engage in structured discussions on real-world ethical AI issues from the AI Incident Database. The prototype's performance is evaluated through thematic analysis, hierarchical clustering, ablation studies, and source code execution. Our system generates around 2,000 lines per run, compared to only 80 lines in the ablation study. Discussions reveal terms like bias detection, transparency, accountability, user consent, GDPR compliance, fairness evaluation, and EU AI Act compliance, showing LLM-BMAS's ability to generate thorough source code and documentation addressing often-overlooked ethical AI issues. However, practical challenges in source code integration and dependency management may limit smooth system adoption by practitioners. This study aims to shed light on enhancing trustworthiness in LLMs to support practitioners in developing ethical AI-based systems.

Research software is an import output of research and must be published according to the FAIR Principles for Research Software. This can be achieved by publishing software with metadata under a persistent identifier. HERMES is a tool that leverages continuous integration to automate the publication of software with rich metadata. In this work, we describe the HERMES workflow itself, and how to extend it to meet the needs of specific research software metadata or infrastructure. We introduce the HERMES plugin architecture and provide the example of creating a new HERMES plugin that harvests metadata from a metadata source in source code repositories. We show how to use HERMES as an end user, both via the command line interface, and as a step in a continuous integration pipeline. Finally, we report three informal case studies whose results provide a preliminary evaluation of the feasibility and applicability of HERMES workflows, and the extensibility of the hermes software package., Comment: 17 pages, 2 figures, 2 tables, submitted to a special issue of Electronic Communications of the EASST collecting submissions of deRSE24, Conference for Research Software Engineers

Turing completeness has made Ethereum smart contracts attractive to blockchain developers and attackers alike. To increase code security, many tools can now spot most known vulnerabilities$-$at the cost of production efficiency. Recent studies show false-positive ratios over 99% in state-of-the-art technologies: this makes them impractical for use in industry and have raised questions on the direction of academic research. In this work we show how integrating and extending current analyses is not only feasible, but also a next logical step in smart-contract security. We propose light-weight static checks on the morphology and dynamics of Solidity code, stemming from a developer-centric notion of vulnerability, that we use to verify the output of other tools, flag potential false alarms, and suggest verifications. Besides technical details we implemented an open-source prototype. For three top-10 vulnerabilities it flags 324 warnings of other tools as false-positives, in 60 verified de-duplicated smart contracts selected from the blockchain by the presence of true (and false) vulnerabilities. This amounts to a 92%- to 100%-reduction in the number of false-positives for these vulnerabilities.

In the evolving landscape of Software Engineering, the paradigm of software ecosystems has emerged, giving rise to proprietary software ecosystems (PSECO), with their central organizations known as keystones. PSECO is characterized by the contribution of various technologies produced as private and protected by intellectual property and confidentiality agreements, centered on common technological platforms. Sustaining these PSECO technological platforms is vital, as any incident can have substantial repercussions. This work introduces a framework for incident management to support the organizations' management teams in the PSECO context, called IM Framework. The IM Framework was developed in close collaboration with practitioners across a large international organization. We grounded the IM Framework based on the results of a rapid review study that retrieved 293 studies, of which 23 were selected after applying review procedures. This framework comprises five core categories: organizational goals, practices, success factors, associated benefits, and prevalent barriers. The IM Framework offers practical guidance for the PSECO management team, focusing on real-world applications to enhance reliability and resilience in a complex and dynamic software environment. Our study also promises to fill the gap in incident management governance by supporting the PSECO organization's management team and maintaining robust technological platforms amidst evolving business demands and market pressures., Comment: 51 pages, 5 figures

The effectiveness of model-driven software engineering (MDSE) has been demonstrated in the context of complex software; however, it has not been widely adopted due to the requisite efforts associated with model development and maintenance, as well as the specific modelling competencies required for MDSE. Concurrently, artificial intelligence (AI) methods, particularly machine learning (ML) methods, have demonstrated considerable abilities when applied to the huge code bases accessible on open-source coding platforms. The so-called big code provides the basis for significant advances in empirical software engineering, as well as in the automation of coding processes and improvements in software quality with the use of AI. The objective of this paper is to facilitate a synthesis between these two significant domains of software engineering (SE), namely models and AI in SE. The paper provides an overview of the current status of AI-assisted software engineering. In light of the aforementioned considerations, a vision of AI-assisted Big Models in SE is put forth, with the aim of capitalising on the advantages inherent to both approaches in the context of software development. Finally, the new paradigm of pair modelling in MDSE is proposed., Comment: 18 pages, 6 figures, preprint

Context: Previous studies demonstrate that Machine or Deep Learning (ML/DL) models can detect Technical Debt from source code comments called Self-Admitted Technical Debt (SATD). Despite the importance of ML/DL in software development, limited studies focus on automated detection for new SATD types: Algorithm Debt (AD). AD detection is important because it helps to identify TD early, facilitating research, learning, and preventing the accumulation of issues related to model degradation and lack of scalability. Aim: Our goal is to improve AD detection performance of various ML/DL models. Method: We will perform empirical studies using approaches: TF-IDF, Count Vectorizer, Hash Vectorizer, and TD-indicative words to identify features that improve AD detection, using ML/DL classifiers with different data featurisations. We will use an existing dataset curated from seven DL frameworks where comments were manually classified as AD, Compatibility, Defect, Design, Documentation, Requirement, and Test Debt. We will explore various word embedding methods to further enrich features for ML models. These embeddings will be from models founded in DL such as ROBERTA, ALBERTv2, and large language models (LLMs): INSTRUCTOR and VOYAGE AI. We will enrich the dataset by incorporating AD-related terms, then train various ML/DL classifiers, Support Vector Machine, Logistic Regression, Random Forest, ROBERTA, and ALBERTv2., Comment: Accepted as Continuity Acceptance (CA) for a Stage 1 registration of the Registered Report Track at 40th IEEE International Conference on Software Maintenance and Evolution (ICSME 2024), Flagstaff, USA, October 6-11, 2024

Detection of Graphical User Interface (GUI) elements is a crucial task for automatic code generation from images and sketches, GUI testing, and GUI search. Recent studies have leveraged both old-fashioned and modern computer vision (CV) techniques. Oldfashioned methods utilize classic image processing algorithms (e.g. edge detection and contour detection) and modern methods use mature deep learning solutions for general object detection tasks. GUI element detection, however, is a domain-specific case of object detection, in which objects overlap more often, and are located very close to each other, plus the number of object classes is considerably lower, yet there are more objects in the images compared to natural images. Hence, the studies that have been carried out on comparing various object detection models, might not apply to GUI element detection. In this study, we evaluate the performance of the four most recent successful YOLO models for general object detection tasks on GUI element detection and investigate their accuracy performance in detecting various GUI elements.

In software development, the raw requirements proposed by users are frequently incomplete, which impedes the complete implementation of application functionalities. With the emergence of large language models, recent methods with the top-down waterfall model employ a questioning approach for requirement completion, attempting to explore further user requirements. However, users, constrained by their domain knowledge, lack effective acceptance criteria, which fail to capture the implicit needs of the user. Moreover, the cumulative errors of the waterfall model can lead to discrepancies between the generated code and user requirements. The Agile methodologies reduce cumulative errors through lightweight iteration and collaboration with users, but the challenge lies in ensuring semantic consistency between user requirements and the code generated. We propose AgileGen, an agile-based generative software development through human-AI teamwork. AgileGen attempts for the first time to use testable requirements by Gherkin for semantic consistency between requirements and code. Additionally, we innovate in human-AI teamwork, allowing users to participate in decision-making processes they do well and enhancing the completeness of application functionality. Finally, to improve the reliability of user scenarios, a memory pool mechanism is used to collect user decision-making scenarios and recommend them to new users. AgileGen, as a user-friendly interactive system, significantly outperformed existing best methods by 16.4% and garnered higher user satisfaction., Comment: This paper is accepted by ACM TOSEM

During software development, poor design and implementation choices can detrimentally impact software maintainability. Design smells, recurring patterns of poorly designed fragments, signify these issues. Role-stereotypes denote the generic responsibilities that classes assume in system design. Although the concepts of role-stereotypes and design smells differ, both significantly contribute to the design and maintenance of software systems. Understanding the relationship between these aspects is crucial for enhancing software maintainability, code quality, efficient code review, guided refactoring, and the design of role-specific metrics. This paper employs an exploratory approach, combining statistical analysis and unsupervised learning methods, to understand how design smells relate to role-stereotypes across desktop and mobile applications. Analyzing 11,350 classes from 30 GitHub repositories, we identified several design smells that frequently co-occur within certain role-stereotypes. Specifically, three (3) out of six (6) role-stereotypes we studied are more prone to design smells. We also examined the variation of design smells across the two ecosystems, driven by notable differences in their underlying architecture. Findings revealed that design smells are more prevalent in desktop than in mobile applications, especially within the Service Provider and Information Holder role-stereotypes. Additionally, the unsupervised learning method showed that certain pairs or groups of role-stereotypes are prone to similar types of design smells. We believe these relationships are associated with the characteristic and collaborative properties between role-stereotypes. The insights from this research provide valuable guidance for software teams on implementing design smell prevention and correction mechanisms, ensuring conceptual integrity during design and maintenance phases., Comment: 32 pages, 8 figures

Program refinement involves correctness-preserving transformations from formal high-level specification statements into executable programs. Traditional verification tool support for program refinement is highly interactive and lacks automation. On the other hand, the emergence of large language models (LLMs) enables automatic code generations from informal natural language specifications. However, code generated by LLMs is often unreliable. Moreover, the opaque procedure from specification to code provided by LLM is an uncontrolled black box. We propose LLM4PR, a tool that combines formal program refinement techniques with informal LLM-based methods to (1) transform the specification to preconditions and postconditions, (2) automatically build prompts based on refinement calculus, (3) interact with LLM to generate code, and finally, (4) verify that the generated code satisfies the conditions of refinement calculus, thus guaranteeing the correctness of the code. We have implemented our tool using GPT4, Coq, and Coqhammer, and evaluated it on the HumanEval and EvalPlus datasets.

This article introduces a novel middleware that utilizes cost-effective, low-power computing devices like Raspberry Pi to analyze data from wireless sensor networks (WSNs). It is designed for indoor settings like historical buildings and museums, tracking visitors and identifying points of interest. It serves as an evacuation aid by monitoring occupancy and gauging the popularity of specific areas, subjects, or art exhibitions. The middleware employs a basic form of the MapReduce algorithm to gather WSN data and distribute it across available computer nodes. Data collected by RFID sensors on visitor badges is stored on mini-computers placed in exhibition rooms and then transmitted to a remote database after a preset time frame. Utilizing MapReduce for data analysis and a leader election algorithm for fault tolerance, this middleware showcases its viability through metrics, demonstrating applications like swift prototyping and accurate validation of findings. Despite using simpler hardware, its performance matches resource-intensive methods involving audiovisual and AI techniques. This design's innovation lies in its fault-tolerant, distributed setup using budget-friendly, low-power devices rather than resource-heavy hardware or methods. Successfully tested at a historical building in Greece (M. Hatzidakis' residence), it is tailored for indoor spaces. This paper compares its algorithmic application layer with other implementations, highlighting its technical strengths and advantages. Particularly relevant in the wake of the COVID-19 pandemic and general monitoring middleware for indoor locations, this middleware holds promise in tracking visitor counts and overall building occupancy., Comment: 23 pages, 7 figures, 4 tables

The growing usage of research software in the research community has highlighted the need to recognize and acknowledge the contributions made not only by researchers but also by Research Software Engineers. However, the existing methods for crediting research software and Research Software Engineers have proven to be insufficient. In response, we have developed FAIRSECO, an extensible open source framework with the objective of assessing the impact of research software in research through the evaluation of various factors. The FAIRSECO framework addresses two critical information needs: firstly, it provides potential users of research software with metrics related to software quality and FAIRness. Secondly, the framework provides information for those who wish to measure the success of a project by offering impact data. By exploring the quality and impact of research software, our aim is to ensure that Research Software Engineers receive the recognition they deserve for their valuable contributions., Comment: 10 pages, 4 figures 2 tables. Preprint of the IEEE eScience 2023 Conference publication

The organizations and researchers producing research software face a common problem of making their software sustainable beyond funding provided by a single research project. This is addressed by research software engineers through building communities around their software, providing appropriate licensing, creating reliable and reproducible research software, making it sustainable and impactful, promoting, and ensuring that the research software is easy to adopt in research workflows, etc. As a result, numerous practices and guidelines exist to enhance research software quality, reusability, and sustainability. However, there is a lack of a unified framework to systematically integrate these practices and help organizations and research software developers refine their development and management processes. Our paper aims at bridging this gap by introducing a novel framework: RSMM. It is designed through systematic literature review and insights from interviews with research software project experts. In short, RSMM offers a structured pathway for evaluating and refining research software project management by categorizing 79 best practices into 17 capabilities across 4 focus areas. From assessing code quality and security to measuring impact, sustainability, and reproducibility, the model provides a complete evaluation of a research software project maturity. With RSMM, individuals as well as organizations involved in research software development gain a systematic approach to tackling various research software engineering challenges. By utilizing RSMM as a comprehensive checklist, organizations can systematically evaluate and refine their project management practices and organizational structure., Comment: 10 pages, 6 figures, 1 table. Submitted to IEEE eScience 2024 Conference

Complementing natural language (NL) requirements with graphical models can improve stakeholders' communication and provide directions for system design. However, creating models from requirements involves manual effort. The advent of generative large language models (LLMs), ChatGPT being a notable example, offers promising avenues for automated assistance in model generation. This paper investigates the capability of ChatGPT to generate a specific type of model, i.e., UML sequence diagrams, from NL requirements. We conduct a qualitative study in which we examine the sequence diagrams generated by ChatGPT for 28 requirements documents of various types and from different domains. Observations from the analysis of the generated diagrams have systematically been captured through evaluation logs, and categorized through thematic analysis. Our results indicate that, although the models generally conform to the standard and exhibit a reasonable level of understandability, their completeness and correctness with respect to the specified requirements often present challenges. This issue is particularly pronounced in the presence of requirements smells, such as ambiguity and inconsistency. The insights derived from this study can influence the practical utilization of LLMs in the RE process, and open the door to novel RE-specific prompting strategies targeting effective model generation.

In the emerging space economy, autonomous robotic missions with specialized goals such as mapping and mining are gaining traction, with agencies and enterprises increasingly investing resources. Multirobot systems (MRS) research has provided many approaches to establish control and communication layers to facilitate collaboration from a technical perspective, such as granting more autonomy to heterogeneous robotic groups through auction-based interactions in mesh networks. However, stakeholders' competing economic interests often prevent them from cooperating within a proprietary ecosystem. Related work suggests that distributed ledger technology (DLT) might serve as a mechanism for enterprises to coordinate workflows and trade services to explore space resources through a transparent, reliable, non-proprietary digital platform. We challenge this perspective by pointing to the core technical weaknesses of blockchains, in particular, increased energy consumption, low throughput, and full transparency through redundancy. Our objective is to advance the discussion in a direction where the benefits of DLT from an economic perspective are weighted against the drawbacks from a technical perspective. We finally present a possible DLT-driven heterogeneous MRS for map exploration to study the opportunities for economic collaboration and competitiveness., Comment: 5 pages, 1 figure, 1 table, accepted for conference (ICSE24-NIER)

In the new space economy, space agencies, large enterprises, and start-ups aim to launch space multi-robot systems (MRS) for various in-situ resource utilization (ISRU) purposes, such as mapping, soil evaluation, and utility provisioning. However, these stakeholders' competing economic interests may hinder effective collaboration on a centralized digital platform. To address this issue, neutral and transparent infrastructures could facilitate coordination and value exchange among heterogeneous space MRS. While related work has expressed legitimate concerns about the technical challenges associated with blockchain use in space, we argue that weighing its potential economic benefits against its drawbacks is necessary. This paper presents a novel architectural framework and a comprehensive set of requirements for integrating blockchain technology in MRS, aiming to enhance coordination and data integrity in space exploration missions. We explored distributed ledger technology (DLT) to design a non-proprietary architecture for heterogeneous MRS and validated the prototype in a simulated lunar environment. The analyses of our implementation suggest global ISRU efficiency improvements for map exploration, compared to a corresponding group of individually acting robots, and that fostering a coopetitive environment may provide additional revenue opportunities for stakeholders., Comment: 10 pages, 4 figures, accepted for conference (SAC24)

A number of methods for large-scale agile development have recently been suggested. Much of the advice in agile methods focuses on teamwork. Prior research has established that teamwork quality influences project success both for traditional software development teams and agile teams. Further, prior studies have also suggested that teamwork quality may play out differently in large projects compared to small. We investigated the relationship between teamwork quality and project success with a survey of 196 project participants across 34 teams in four projects, replicating a previous study on single teams. The new data do not fit the previously established theoretical model, which raises several concerns. The observed effect of teamwork quality on project success operates differently across projects. We discuss possible reasons, which include disagreements on what characterises success in large-scale agile development, "concept drift" of teamwork quality factors, the possibility that interteam factors might have more influence on project success than intrateam factors, and finally, that our study design does not capture all relevant levels and functions. We conclude with a call for more studies on the quality and frequency of interaction between teams in addition to internal team factors to further advance theory and practice within large-scale agile software development.

With the rapid growth of cloud computing, a variety of software services have been deployed in the cloud. To ensure the reliability of cloud services, prior studies focus on failure instance (disk, node, and switch, etc.) prediction. Once the output of prediction is positive, mitigation actions are taken to rapidly resolve the underlying failure. According to our real-world practice in Microsoft Azure, we find that the prediction accuracy may decrease by about 9% after retraining the models. Considering that the mitigation actions may result in uncertain positive instances since they cannot be verified after mitigation, which may introduce more noise while updating the prediction model. To the best of our knowledge, we are the first to identify this Uncertain Positive Learning (UPLearning) issue in the real-world cloud failure prediction scenario. To tackle this problem, we design an Uncertain Positive Learning Risk Estimator (Uptake) approach. Using two real-world datasets of disk failure prediction and conducting node prediction experiments in Microsoft Azure, which is a top-tier cloud provider that serves millions of users, we demonstrate Uptake can significantly improve the failure prediction accuracy by 5% on average.

Computational biology continues to spread into new fields, becoming more accessible to researchers trained in the wet lab who are eager to take advantage of growing datasets, falling costs, and novel assays that present new opportunities for discovery even outside of the much-discussed developments in artificial intelligence. However, guidance for implementing these techniques is much easier to find than guidance for reporting their use, leaving biologists to guess which details and files are relevant. Here, we provide a set of recommendations for sharing code, with an eye toward guiding those who are comparatively new to applying open science principles to their computational work. Additionally, we review existing literature on the topic, summarize the most common tips, and evaluate the code-sharing policies of the most influential journals in biology, which occasionally encourage code-sharing but seldom require it. Taken together, we provide a user manual for biologists who seek to follow code-sharing best practices but are unsure where to start., Comment: 19 pages, 1 figure; for supporting data see https://doi.org/10.5281/zenodo.10459940

Python has become one of the most popular programming languages for software development due to its simplicity, readability, and versatility. As the Python ecosystem grows, developers face increasing challenges in avoiding module conflicts, which occur when different packages have the same namespace modules. Unfortunately, existing work has neither investigated the module conflict comprehensively nor provided tools to detect the conflict. Therefore, this paper systematically investigates the module conflict problem and its impact on the Python ecosystem. We propose a novel technique called InstSimulator, which leverages semantics and installation simulation to achieve accurate and efficient module extraction. Based on this, we implement a tool called ModuleGuard to detect module conflicts for the Python ecosystem. For the study, we first collect 97 MC issues, classify the characteristics and causes of these MC issues, summarize three different conflict patterns, and analyze their potential threats. Then, we conducted a large-scale analysis of the whole PyPI ecosystem (4.2 million packages) and GitHub popular projects (3,711 projects) to detect each MC pattern and analyze their potential impact. We discovered that module conflicts still impact numerous TPLs and GitHub projects. This is primarily due to developers' lack of understanding of the modules within their direct dependencies, not to mention the modules of the transitive dependencies. Our work reveals Python's shortcomings in handling naming conflicts and provides a tool and guidelines for developers to detect conflicts., Comment: The paper was accepted by ICSE24

Serious games are defined as applied games that focus on the gamification of an experience (e.g., learning and training activities) and are not strictly for entertainment purposes. In recent years, serious games have become increasingly popular due to their ability to simultaneously educate and entertain users. In this review, we provide a comprehensive overview of the different types of digital games and expand on the serious games genre while focusing on its various applications. Furthermore, we present the most widely used game engines used in the game development industry and extend the Unity game machine advantages. Lastly, we conclude our research with a detailed comparison of the two most popular choices (Unreal and Unity engines) and their respective advantages and disadvantages while providing future suggestions for serious digital game development., Comment: 13 pages, 98 references, This is an Accepted Manuscript of an article published by Wseas Transactions on Computer Research on 2023, available online: http://dx.doi.org/10.37394/232018.2023.11.2

Reducing the cost and delay and improving quality are major issues for product and software development, especially in the automotive domain. Product line engineering is a wellknown approach to engineer systems with the aim to reduce costs and development time as well as to improve the product quality. Feature models enable to make logical selection of features and obtain a filtered set of assets that compose the product. We propose to use a color code in feature models to make possible decisions visual in the feature tree. The color code is explained and its use is illustrated. The completeness of the approach is discussed., Comment: In Proceedings TiCSA 2023, arXiv:2310.18720

This study explores the capabilities of Large Language Models, particularly OpenAI's ChatGPT, in addressing the challenges associated with software modeling, explicitly focusing on the bidirectional traceability problem between design models and code. The objective of this study is to demonstrate the proficiency of ChatGPT in understanding and integrating specific requirements into design models and code. We also explore its potential to offer solutions to the bidirectional traceability problem through a case study. The findings indicate that ChatGPT is capable of generating design models and code from natural language requirements, thereby bridging the gap between these requirements and software modeling. Despite its limitations in suggesting a specific method to resolve the problem using ChatGPT itself, it exhibited the capacity to provide corrections to be consistent between design models and code. As a result, the study concludes that achieving bidirectional traceability between design models and code is feasible using ChatGPT., Comment: 10 pages including references and appendix

Open Source Software (OSS) communities often resist regulation typical of traditional organizations. Yet formal governance systems are being increasingly adopted among communities, particularly through non-profit mentor foundations. Our study looks at the Apache Software Foundation Incubator program and 208 projects it supports. We assemble a scalable, semantic pipeline to discover and analyze the governance behavior of projects from their mailing lists. We then investigate the reception of formal policies among communities, through their own governance priorities and internalization of the policies. Our findings indicate that while communities observe formal requirements and policies as extensively as they are defined, their day-to-day governance focus does not dwell on topics that see most formal policy-making. Moreover formalization, be it dedicating governance focus or adopting policy, has limited association with project sustenance.

In a microservices-based system, reliability and availability are key components to guarantee the best-in-class experience for the consumers. One of the key advantages of microservices architecture is the ability to independently deploy services, providing maximum change flexibility. However, this introduces an extra complexity in managing the risk associated with every change: any mutation of a service might cause the whole system to fail. In this research, we would propose an algorithm to enable development teams to determine the risk associated with each change to any of the microservices in the system., Comment: 18 pages, 5 figures

Third-party libraries (TPLs) have become an essential component of software, accelerating development and reducing maintenance costs. However, breaking changes often occur during the upgrades of TPLs and prevent client programs from moving forward. Semantic versioning (SemVer) has been applied to standardize the versions of releases according to compatibility, but not all releases follow SemVer compliance. Lots of work focuses on SemVer compliance in ecosystems such as Java and JavaScript beyond Golang (Go for short). Due to the lack of tools to detect breaking changes and dataset for Go, developers of TPLs do not know if breaking changes occur and affect client programs, and developers of client programs may hesitate to upgrade dependencies in terms of breaking changes. To bridge this gap, we conduct the first large-scale empirical study in the Go ecosystem to study SemVer compliance in terms of breaking changes and their impact. In detail, we purpose GoSVI (Go Semantic Versioning Insight) to detect breaking changes and analyze their impact by resolving identifiers in client programs and comparing their types with breaking changes. Moreover, we collect the first large-scale Go dataset with a dependency graph from GitHub, including 124K TPLs and 532K client programs. Based on the dataset, our results show that 86.3% of library upgrades follow SemVer compliance and 28.6% of no-major upgrades introduce breaking changes. Furthermore, the tendency to comply with SemVer has improved over time from 63.7% in 2018/09 to 92.2% in 2023/03. Finally, we find 33.3% of downstream client programs may be affected by breaking changes. These findings provide developers and users of TPLs with valuable insights to help make decisions related to SemVer., Comment: 11 pages, 4 figures. This paper has been accepted by ASE'23

The software bill of materials (SBOM) concept aims to include more information about a software build such as copyrights, dependencies and security references. But SBOM lacks visibility into the process for building a package. Efforts such as Supply-chain Levels for Software Artifacts (SLSA) try to remedy this by focusing on the quality of the build process. But they lack quantitative assessment of that quality. They are purely qualitative. A new form of assurance case and new technique for structuring it, called process reduction, are presented. An assurance case for a toolchain is quantitative and when structured as a process reduction can measure the strength of the toolchain via the strength of the reduction. An example is given for a simple toolchain., Comment: 7 pages, 3 figures

AUTOSAR (AUTomotive Open System ARchitecture) is an open industry standard for the automotive sector. It defines the three-layered automotive software architecture. One of these layers is the application layer, where functional behaviors are encapsulated in Software Components (SW-Cs). Inside SW-Cs, a set of runnable entities represents the internal behavior and is realized as a set of tasks. To address AUTOSAR's lack of support for modeling behaviors of runnables, languages such as Simulink are employed. Simulink simulations assume Simulink block behaviors are completed in zero execution time, while real execution requires a finite execution time. This timing mismatch can result in failures to detect unexpected runtime behaviors during the simulation phase. This paper extends the Simulink environment to model the timing properties of tasks. We present a Simulink block that can schedule tasks with non-zero simulation times. It enables a more realistic analysis during model development., Comment: 21 pages

During software development, balancing security and non security issues is challenging. We focus on security awareness and approaches taken by non-security experts using software development issue trackers when considering security. We first analyse interfaces from prominent issue trackers to see how they support security communication and how they integrate security scoring. Then, we investigate through a small scale user study what criteria developers take when prioritising issues, in particular observing their attitudes to security. We find projects make reference to CVSS summaries (Common Vulnerability Scoring System), often alongside CVE reports (Common Vulnerabilities and Exposures), but issue trackers do not often have interfaces designed for this. Users in our study were not comfortable with CVSS analysis, though were able to reason in a manner compatible with CVSS. Detailed explanations and advice were seen as helpful in making security decisions. This suggests that adding improvements to communication through CVSS-like questioning in issue tracking software can elicit better security interactions., Comment: 9th Workshop on Security Information Workers WSIW 2023 - Co-located Workshop at SOUPS 2023, Anaheim, United States

Machine learning (ML) models trained on subjective self-report scores struggle to objectively classify pain accurately due to the significant variance between real-time pain experiences and recorded scores afterwards. This study developed two devices for acquisition of real-time, continuous in-session pain scores and gathering of ANS-modulated endodermal activity (EDA).The experiment recruited N = 24 subjects who underwent a post-exercise circulatory occlusion (PECO) with stretch, inducing discomfort. Subject data were stored in a custom pain platform, facilitating extraction of time-domain EDA features and in-session ground truth scores. Moreover, post-experiment visual analog scale (VAS) scores were collected from each subject. Machine learning models, namely Multi-layer Perceptron (MLP) and Random Forest (RF), were trained using corresponding objective EDA features combined with in-session scores and post-session scores, respectively. Over a 10-fold cross-validation, the macro-averaged geometric mean score revealed MLP and RF models trained with objective EDA features and in-session scores achieved superior performance (75.9% and 78.3%) compared to models trained with post-session scores (70.3% and 74.6%) respectively. This pioneering study demonstrates that using continuous in-session ground truth scores significantly enhances ML performance in pain intensity characterization, overcoming ground truth sparsity-related issues, data imbalance, and high variance. This study informs future objective-based ML pain system training., Comment: 18 pages, 2-page Appendix, 7 figures

Image captioning (IC) systems aim to generate a text description of the salient objects in an image. In recent years, IC systems have been increasingly integrated into our daily lives, such as assistance for visually-impaired people and description generation in Microsoft Powerpoint. However, even the cutting-edge IC systems (e.g., Microsoft Azure Cognitive Services) and algorithms (e.g., OFA) could produce erroneous captions, leading to incorrect captioning of important objects, misunderstanding, and threats to personal safety. The existing testing approaches either fail to handle the complex form of IC system output (i.e., sentences in natural language) or generate unnatural images as test cases. To address these problems, we introduce Recursive Object MElting (Rome), a novel metamorphic testing approach for validating IC systems. Different from existing approaches that generate test cases by inserting objects, which easily make the generated images unnatural, Rome melts (i.e., remove and inpaint) objects. Rome assumes that the object set in the caption of an image includes the object set in the caption of a generated image after object melting. Given an image, Rome can recursively remove its objects to generate different pairs of images. We use Rome to test one widely-adopted image captioning API and four state-of-the-art (SOTA) algorithms. The results show that the test cases generated by Rome look much more natural than the SOTA IC testing approach and they achieve comparable naturalness to the original images. Meanwhile, by generating test pairs using 226 seed images, Rome reports a total of 9,121 erroneous issues with high precision (86.47%-92.17%). In addition, we further utilize the test cases generated by Rome to retrain the Oscar, which improves its performance across multiple evaluation metrics., Comment: Accepted by ISSTA 2023

Third-party libraries (TPLs) are extensively utilized by developers to expedite the software development process and incorporate external functionalities. Nevertheless, insecure TPL reuse can lead to significant security risks. Existing methods are employed to determine the presence of TPL code in the target binary. Existing methods, which involve extracting strings or conducting function matching, are employed to determine the presence of TPL code in the target binary. However, these methods often yield unsatisfactory results due to the recurrence of strings and the presence of numerous similar non-homologous functions. Additionally, they struggle to identify specific pieces of reused code in the target binary, complicating the detection of complex reuse relationships and impeding downstream tasks. In this paper, we observe that TPL reuse typically involves not just isolated functions but also areas encompassing several adjacent functions on the Function Call Graph (FCG). We introduce LibAM, a novel Area Matching framework that connects isolated functions into function areas on FCG and detects TPLs by comparing the similarity of these function areas. Furthermore, LibAM is the first approach capable of detecting the exact reuse areas on FCG and offering substantial benefits for downstream tasks. Experimental results demonstrate that LibAM outperforms all existing TPL detection methods and provides interpretable evidence for TPL detection results by identifying exact reuse areas. We also evaluate LibAM's accuracy on large-scale, real-world binaries in IoT firmware and generate a list of potential vulnerabilities for these devices. Last but not least, by analyzing the detection results of IoT firmware, we make several interesting findings, such as different target binaries always tend to reuse the same code area of TPL., Comment: 35 pages, 12 figures

Labeling issues with the skills required to complete them can help contributors to choose tasks in Open Source Software projects. However, manually labeling issues is time-consuming and error-prone, and current automated approaches are mostly limited to classifying issues as bugs/non-bugs. We investigate the feasibility and relevance of automatically labeling issues with what we call "API-domains," which are high-level categories of APIs. Therefore, we posit that the APIs used in the source code affected by an issue can be a proxy for the type of skills (e.g., DB, security, UI) needed to work on the issue. We ran a user study (n=74) to assess API-domain labels' relevancy to potential contributors, leveraged the issues' descriptions and the project history to build prediction models, and validated the predictions with contributors (n=20) of the projects. Our results show that (i) newcomers to the project consider API-domain labels useful in choosing tasks, (ii) labels can be predicted with a precision of 84% and a recall of 78.6% on average, (iii) the results of the predictions reached up to 71.3% in precision and 52.5% in recall when training with a project and testing in another (transfer learning), and (iv) project contributors consider most of the predictions helpful in identifying needed skills. These findings suggest our approach can be applied in practice to automatically label issues, assisting developers in finding tasks that better match their skills., Comment: arXiv admin note: text overlap with arXiv:2103.12653

Blockchain technology has piqued the interest of businesses of all types, while consistently improving and adapting to developers and business owners requirements. Therefore, several blockchain platforms have emerged, making it challenging to select a suitable one for a specific type of business. This paper presents a classification of over one hundred blockchain platforms. We develop smart contracts for detecting healthcare insurance frauds using two blockchain platforms selected based on our proposed decision-making map approach for the selection of the top two suitable platforms for healthcare insurance frauds detection application, followed by an evaluation of their performances. Our classification shows that the largest percentage of blockchain platforms could be used for all types of application domains, and the second biggest percentage is to develop financial services only, even though generic platforms can be used, while a small number is for developing in other specific application domains. Our decision-making map revealed that Hyperledger Fabric is the best blockchain platform for detecting healthcare insurance frauds. The performance evaluation of the top two selected platforms indicates that Fabric surpassed Neo in all metrics., Comment: 8 pages, conference, Blockchain; Smart Contracts; Hyperledger Fabric; Neo; Adaptive Selection; Healthcare

The Science Gateways Community Institute (SGCI) is an NSF Software Infrastructure for Sustained Innovation (S2I2) funded project that leads and supports the science gateway community. Major activities for SGCI include a) sustainability training, including the Focus Week week-long course designed to help science gateway operators develop sustainability plans, and the Jumpstart virtual short-course; b) usability and user experience consulting; c) a community catalog of science gateways and science gateway software; d) workforce development activities, including a coding institute for students, internship opportunities, and hackathons; e) an annual conference; and f) in-depth technical support for client gateway projects. The goals of SGCI's Embedded Technical Support component are to help the institute's clients to create new science gateways or to significantly enhance existing science gateways. Examples of the latter include helping to implement major new capabilities and to implement significant usability improvements suggested by SGCI's usability consultants. The Embedded Technical Support component was managed by Indiana University and involved research software engineers at San Diego Supercomputer Center, Texas Advanced Computing Center, Indiana University, and Purdue University (through 2019). Since 2016, the component has involved 20 research software engineers as consultants and has conducted 59 client consultations. This short paper provides a summary of lessons learned from the Embedded Technical Support program that may be useful for the research software engineering community., Comment: 3 pages, no figures

We consider a network of smart sensors for an edge computing application that sample a time-varying signal and send updates to a base station for remote global monitoring. Sensors are equipped with sensing and compute, and can either send raw data or process them on-board before transmission. Limited hardware resources at the edge generate a fundamental latency-accuracy trade-off: raw measurements are inaccurate but timely, whereas accurate processed updates are available after processing delay. Hence, one needs to decide when sensors should transmit raw measurements or rely on local processing to maximize network monitoring performance. To tackle this sensing design problem, we model an estimation-theoretic optimization framework that embeds both computation and communication latency, and propose a Reinforcement Learning-based approach that dynamically allocates computational resources at each sensor. Effectiveness of our proposed approach is validated through numerical experiments motivated by smart sensing for the Internet of Drones and self-driving vehicles. In particular, we show that, under constrained computation at the base station, monitoring performance can be further improved by an online sensor selection., Comment: 16 pages, 17 figures; submitted to IEEE TNSE; final accepted version

STRmix has been in operational use since 2012 for the interpretation of forensic DNA profiles. During that time incremental improvements have been made to the modelling of variance for single and composite peaks, and drop-in. The central element of the algorithm has remained as the Markov chain Monte Carlo (MCMC) based on the Metropolis-Hastings algorithm. Regression experiments are reported comparing versions V2.3 to V2.9. There is a high degree of similarity in LRs for true contributors across multiple versions of STRmix that span 7 years of development (from V2.3 to V2.9). This is due to the fact that the underlying core models of STRmix that are used to describe DNA profile behaviour have remained stable across that time., Comment: 16 pages, 4 figures

Quantum communication technologies will play an important role in quantum information processing in the near future as we network devices together. However, their implementation is still a challenging task due to both loss and gate errors. Quantum error correction codes are one important technique to address this issue. In particular, the Quantum Reed-Solomon codes are known to be quite efficient for quantum communication tasks. The high degree of physical resources required, however, makes such a code difficult to use in practice. A recent technique called quantum multiplexing has been shown to reduce resources by using multiple degrees of freedom of a photon. In this work, we propose a method to decompose multi-controlled gates using fewer $\rm{CX}$ gates via this quantum multiplexing technique. We show that our method can significantly reduce the required number of $\rm{CX}$ gates needed in the encoding circuits for the quantum Reed-Solomon code. Our approach is also applicable to many other quantum error correction codes and quantum algorithms, including Grovers and quantum walks., Comment: 9 pages, 11 figures

Implementing software security practices is a critical concern in modern software development. Industry practitioners, security tool providers, and researchers have provided standard security guidelines and sophisticated security development tools to ensure a secure software development pipeline. But despite these efforts, there continues to be an increase in the number of vulnerabilities that can be exploited by malicious hackers. There is thus an urgent need to understand why developers still introduce security vulnerabilities into their applications and to understand what can be done to motivate them to write more secure code. To understand and address this problem further, we propose DASP, a framework for diagnosing and driving the adoption of software security practices among developers. DASP was conceived by combining behavioral science theories to shape a cross-sectional interview study with 28 software practitioners. Our interviews lead to a framework that consists of a comprehensive set of 33 drivers grouped into 7 higher-level categories that represent what needs to happen or change so that the adoption of software security practices occurs. Using the DASP framework, organizations can design interventions suitable for developers' specific development contexts that will motivate them to write more secure code., Comment: 27pages, 12 figures

Analytics plays a crucial role in the data-informed decision-making processes of modern businesses. Unlike established software companies, software startups are not seen utilizing the potential of analytics even though a startup process should be primarily data-driven. There has been little understanding in the literature about analytics for software startups. This study set out to address the knowledge gap by exploring how analytics is understood in the context of software startups. To this end, we collected the qualitative data of three analytics platforms that are mostly used by startups from multiple sources. We covered platform documentation as well as experience reports of the software startups using these platforms. The data was analyzed using content analysis techniques. Four high-level concepts were identified that encapsulate the real understanding of software startups on analytics, including instrumentation of analytics, experimentation, diagnostic analysis, and getting insights. The first concept describes how startups set up analytics and the latter three illustrate the usage scenarios of analytics. This study is the first step toward understanding analytics in the software startup context. The identified concepts can guide further investigation of analytics in this context. It also provides some insights for software startups to set up analytics for data-informed decisions. Given the limitation of the data used in the study, the immediate next step is to ground as well as validate the acquired understanding using the primary data, by directly interacting with software startups., Comment: 8 pages, 2 figures, accepted for presentation at 5th International Workshop on Software-intensive Business: Towards Sustainable Software Business, Pittsburgh, PA, USA

The purpose of the study is to analyse and compare the most common machine learning and deep learning techniques used for computer vision 2D object classification tasks. Firstly, we will present the theoretical background of the Bag of Visual words model and Deep Convolutional Neural Networks (DCNN). Secondly, we will implement a Bag of Visual Words model, the VGG16 CNN Architecture. Thirdly, we will present our custom and novice DCNN in which we test the aforementioned implementations on a modified version of the Belgium Traffic Sign dataset. Our results showcase the effects of hyperparameters on traditional machine learning and the advantage in terms of accuracy of DCNNs compared to classical machine learning methods. As our tests indicate, our proposed solution can achieve similar - and in some cases better - results than existing DCNNs architectures. Finally, the technical merit of this article lies in the presented computationally simpler DCNN architecture, which we believe can pave the way towards using more efficient architectures for basic tasks., Comment: 9 pages, 9 figures, 4 tables. This is an Accepted Manuscript of an article published by Wseas Transactions on Mathematics on 2022, available online: https://doi.org/10.37394/23206.2022.21.19

Modern software systems are usually highly configurable, providing users with customized functionality through various configuration options. Understanding how system performance varies with different option combinations is important to determine optimal configurations that meet specific requirements. Due to the complex interactions among multiple options and the high cost of performance measurement under a huge configuration space, it is challenging to study how different configurations influence the system performance. To address these challenges, we propose HINNPerf, a novel hierarchical interaction neural network for performance prediction of configurable systems. HINNPerf employs the embedding method and hierarchic network blocks to model the complicated interplay between configuration options, which improves the prediction accuracy of the method. Besides, we devise a hierarchical regularization strategy to enhance the model robustness. Empirical results on 10 real-world configurable systems show that our method statistically significantly outperforms state-of-the-art approaches by achieving average 22.67% improvement in prediction accuracy. In addition, combined with the Integrated Gradients method, the designed hierarchical architecture provides some insights about the interaction complexity and the significance of configuration options, which might help users and developers better understand how the configurable system works and efficiently identify significant options affecting the performance.

Software startups develop innovative, software-intensive product and services. This context leads to uncertainty regarding the software they are building. Experimentation, a process of testing hypotheses about the product, helps these companies to reduce uncertainty through different evidence-based approaches. The first step in experimentation is to identify the hypotheses to be tested. HyMap is a technique where a facilitator helps a software startup founder to draw a cognitive map representing her understanding of the context and, based on that, create hypotheses about the software to be built. In this paper, we present the Digital Mentor, an working-in-progress conversational bot to help creating a HyMap without the need of a human facilitator. We report the proposed solution consisting of a web application with the backend of a natural language understanding system, the current state of development, the challenges we faced so far and the next steps we plan to move forward., Comment: 4 pages, 2 figures, accepted for presentation at 4th International Workshop on Bots in Software Engineering (BotSE 2022)

Software Product Lines (SPLs) are families of related software systems which are distinguished by the set of features each system provides. Feature Models are the de facto standard for modelling the variability of SPLs because they describe the features, their relations, and all the combinations of features that constitute a SPL. Because of their key role, feature models are at the core of many tasks in SPL engineering. Our work presents an empirical study on the comprehension of feature models for the task of checking the validity of configurations. Our study explored the relation between the number of features and the number of cross-tree constraints with the accuracy of participants' answers to validity checking questions, and used eye fixations for analyzing the difficulty in interpreting fixated information and the amount of cognitive processing of the different parts of the feature model stimuli. We found that answer accuracy does not relate individually to the number of features or to the number of cross-tree constrains of a feature model, but both factors do show an interaction on accuracy. Additionally, our study identified differences in feature models with cross-tree constraints in both number of fixations and fixation time, but no differences in those models without cross-tree constraints., Comment: 11 pages, 7 figures

Machine Learning (ML) has become a fast-growing, trending approach in solution development in practice. Deep Learning (DL) which is a subset of ML, learns using deep neural networks to simulate the human brain. It trains machines to learn techniques and processes individually using computer algorithms, which is also considered to be a role of Artificial Intelligence (AI). In this paper, we study current technical issues related to software development and delivery in organizations that work on ML projects. Therefore, the importance of the Machine Learning Operations (MLOps) concept, which can deliver appropriate solutions for such concerns, is discussed. We investigate commercially available MLOps tool support in software development. The comparison between MLOps tools analyzes the performance of each system and its use cases. Moreover, we examine the features and usability of MLOps tools to identify the most appropriate tool support for given scenarios. Finally, we recognize that there is a shortage in the availability of a fully functional MLOps platform on which processes can be automated by reducing human intervention., Comment: 12 pages

One of the most important tasks in scientific publishing is the articles' evaluation via the editorial board and the reviewers' community. Additionally, in scientific publishing great concern exists regarding the peer-review process and how it can be further optimised to decrease the time from submission to the first decision, as well as increase the objectivity of the reviewers' remarks ensuring that no bias or human error exists in the reviewing process. In order to address this issue, our article suggests a novice cloud framework for manuscript submission based on blockchain technology that further enhances the anonymity between authors and reviewers alike. Our method covers the whole spectrum of current submission systems capabilities, but it also provides a decentralised solution using open-source tools such as Java Spring that enhance the anonymity of the reviewing process., Comment: 11 pages, 5 figures, 51 references, This is an Accepted Manuscript of an article published by Wseas Transactions on Business and Economics on 2022, available online: http://dx.doi.org/10.37394/23207.2022.19.51

This publication presents a method responsible for counting tracking and monitoring visitors inside a building. The site examined is Manos Hatzidakis' House, situated in Xanthi. Specifically, we have conducted a study, which provides recommendations, regarding the installation of sensors in the building. We also present the communication protocols of the computer network used in order to ensure the efficient communication between the space examined and the sensor network. Finally, we describe the process of creating a website, which is designed to store and view the data., Comment: 6 pages,8 figures, 22 references, Proceedings of 10th Panhellenic Electrical and Computer Engineering Students Conference (ECESCON) 2018 Xanthi

This paper presents the design, implementation, and operation of a novel distributed fault-tolerant middleware. It uses interconnected WSNs that implement the Map-Reduce paradigm, consisting of several low-cost and low-power mini-computers (Raspberry Pi). Specifically, we explain the steps for the development of a novice, fault-tolerant Map-Reduce algorithm which achieves high system availability, focusing on network connectivity. Finally, we showcase the use of the proposed system based on simulated data for crowd monitoring in a real case scenario, i.e., a historical building in Greece (M. Hatzidakis' residence).The technical novelty of this article lies in presenting a viable low-cost and low-power solution for crowd sensing without using complex and resource-intensive AI structures or image and video recognition techniques., Comment: 18 pages, 7 figures, 4 tables, 23 references, This is an Accepted Manuscript of an article published by Taylor & Francis Group in the International Journal of Parallel, Emergent & Distributed Systems on 2022, available online: http://www.tandfonline.com/10.1080/17445760.2022.2034163

Frequently advised secure development recommendations often fall short in practice for app developers. Tool-driven (e.g., using static analysis tools) approaches lack context and domain-specific requirements of an app being tested. App developers struggle to find an actionable and prioritized list of vulnerabilities from a laundry list of security warnings reported by static analysis tools. Process-driven (e.g., applying threat modeling methods) approaches require substantial resources (e.g., security testing team, budget) and security expertise, which small to medium-scale app dev teams could barely afford. To help app developers securing their apps, we propose SO{U}RCERER, a guiding framework for Android app developers for security testing. SO{U}RCERER guides developers to identify domain-specific assets of an app, detect and prioritize vulnerabilities, and mitigate those vulnerabilities based on secure development guidelines. We evaluated SO{U}RCERER with a case study on analyzing and testing 36 Android mobile money apps. We found that by following activities guided by SO{U}RCERER, an app developer could get a concise and actionable list of vulnerabilities (24-61% fewer security warnings produced by SO{U}RCERER than a standalone static analyzer), directly affecting a mobile money app's critical assets, and devise a mitigation plan. Our findings from this preliminary study indicate a viable approach to Android app security testing without being overwhelmingly complex for app developers., Comment: Accepted at the 2021 Automated Software Engineering Conference's Workshop on Advances in Mobile App Analysis (A-Mobile'21)

Model web services provide an approach for implementing and facilitating the sharing of geographic models. The description and acquisition of inputs and outputs (IO) of geographic models is a key issue in constructing and using model web services. These approaches for describing and acquiring the data formats of the IO of geographic models can be classified into two categories, i.e., intermediate-data-format-based and native-data-format-based. Nonetheless, these two categories mainly consider the description of the IO of geographical models but relatively pay little attention to the acquisition. To address this issue, this paper proposes an approach for automatically parsing data formats of the IO utilizing the relationship between the IO and source codes. This proposed approach can utilize such a strict and coupling relationship and the expression form of the data formats in the source codes to retrospectively derive the IO data format and automatically generate data format documentation. The feasibility of the proposed approach has been verified via a geographical model coded in the FORTRAN language, which shows that it significantly improves the efficiency of writing data format specifications and promotes sharing geographic models as model web services., Comment: 22 pages, 7 figures