Context: Chatbots emerged in the decade of 60 and are currently a popular type of application that provides the experience of talking to a human-like robot. However, the similarity of their behaviour to a human is also what makes the elicitation and documentation of conversational-related requirements a hard task, due to the subjective nature of conversations. Currently there are no standards or guidelines to register and test subjective requirements, present in human conversations. Methods: We proposed a metamodel for documentation of conversational requirements and conducted the validation through a 2-step questionnaire. We then analysed the feedback received and applied improvements in the model instances. Results: Based on metamodel we propose the conversational integrated map, an artifact that correlates the subjective requirements with their associated KPIs. Validation was conducted through a simulation with 4 practitioners in a 2-step questionnaire. Artifact format choice revealed a preference for mainly textual and table models. Scalability and necessary time to complete were points of divergence between answers. Conclusion: Proposed artifact was well accepted and could provide pre-made models available for edition for ease of use. Future steps of this study include the elaboration of a guide of best practices on chatbot documentation.
In today's technology-driven world, there is a growing interest in leveraging Artificial Intelligence (AI) to streamline software testing processes. Our research delves into GUI-based testing, a prominent technique for verifying software functionality. Preliminary findings from our industrial survey of 45 respondents provide insights into the use of AI in GUI-based software testing. The survey aims to understand how AI supports GUI-based testing, the AI techniques and tools used, and the perceived advantages and limitations. The collected results suggest a diffuse yet superficial utilization of AI-based mechanisms among GUI-based testers. Practitioners often employ AI techniques in a technology-agnostic way, treating commercial tools as black boxes. These findings underscore the need for additional research aimed at gaining a deeper understanding of the AI techniques and tools employed in industry and their intended purposes.
Interpreted programming languages, like Python, are amongst the most popular programming languages. This, combined with high developer efficiency leads to many web-application backends and web-services that are written in Python. While it is known that that interpreted languages like Python are way less energy efficient compared to compiled languages like , Rust, etc., little is known about the energy efficiency of various versions of Python interpreters. In this paper, we study via a controlled lab experiment the energy consumption of various versions of the Python interpreter CPython when running a server-side rendered web-application. Our results indicate that currently the most energy efficient version is CPython 3.12. Energy consumption of CPython 3.12 can drop by more than 8
Recent years have seen an increase of decision-making software based on Machine Learning (ML). Multiple cases have been reported where such software are discriminatory based on attributes such as race and gender. Thus, ML-based decision making software need to be tested for discrimination, or fairness testing. One popular approach to fairness testing is to find discriminatory data items by first conducting a global search, and then searching locally near the found discriminatory data items. Aequitas, CGFT, and KOSEI are three examples taking this approach. However, there are issues in terms of stability and efficiency. We thus propose an approach called Robust Search Using T-way Testing (RSUTT), which is based on CGFT for global search and KOSEI for local search. Experiments showed that RSUTT performs more efficiently compared to Aequitas, CGFT, and KOSEI.
The digital society is characterised by a continuous presence of digital systems being pure software systems or cyber-physical systems, which help and support humans in their life activities. Humans can be passive or active, the interaction can be implicit or explicit, and they can be more or less conscious of the presence of digital systems. However, the impact of the digital systems on social, economic, and political spheres is clear and risky. This is also testified by, e.g., the recent AI Act of the European Community. In this paper, we analyse whether modern systems require a new understanding of quality and, consequently, new quality dimensions. We challenge the ISO/IEC 25010 quality standard with new emerging stakeholders needs, and we pave the way for a reconsideration of the standard and the traditional understanding of quality to include and consider also these new emerging needs.
We conducted a preliminary qualitative investigation into the Bachelor's students' perception of the usefulness of a Static Analysis Tool (i.e., SonarCloud) in assessing software security. The results revealed that the students considered SonarCloud user-friendly, simple to set up, and easy to learn. Additionally, the students recognized an improvement in their awareness and attitude toward secure software development, as well as with the use of a tool widely adopted in both open-source communities and the software industry. The results suggest that the use of SonarCloud improves students' software security skills, which are demanded by the labor market.
System testing through the Graphical User Interface (GUI testing) is often overlooked in real-world software projects. The mechanics proper of Gamification are often adopted to increase the motivation and engagement of testers in such scenarios. There is however little evidence in the literature about collaborative – rather than competitive – Gamification mechanics for software testing. In this manuscript, we describe a prototype for a collaborative GUI-testing prototype for web applications based on micro-tasks, of which we perform a small-scale preliminary evaluation. We find that the use of a microtask-based collaboration environment incentivizes depth-first testing of web applications and increases local coverage. We also collected positive experience reports from practitioners about the practice.
Browser automation refers to the use of specific software to perform user tasks (such as navigation among web pages, interaction with forms, etc.) automatically in a web browser. It is commonly performed programmatically for automated testing of various types of applications, web-based, cloud-based, or composed of multiple microservices, although other uses are possible (e.g., web scraping or automating repetitive tasks). For many years, Selenium has been considered the defacto tool for browser automation. However, recently, we have witnessed the advent of alternative tools, such as Cypress, Puppeteer, or Playwright. This paper gives a comparative high-level overview and presents their architecture and key features. We expect this information will assist researchers and practitioners in making well-informed decisions regarding the browser automation tool that merits their attention.
Digital Twin technology has emerged as a pivotal tool in digital transformation, offering virtual representations of physical components, systems, or processes to enable remote monitoring and control. The functional suitability of digital twin systems relies on accurately capturing, modeling, and exchanging data from their corresponding assets or processes. Consequently, achieving interoperability among various components of digital twins and among different digital twins is crucial. However, this remains an open challenge due to the diversity of data models employed by current digital twin solutions. This thesis proposal addresses this challenge by proposing a model-driven engineering approach, utilizing higher-order transformations alongside the Asset Administration Shell standard as a pivotal model. The approach aims to automate translations to and from the Asset Administration Shell standard, eliminating manual crafting of model transformations.
Smart contracts are self-executing programs that operate on a blockchain. Due to their complex and specialized nature, smart contracts often undergo auditing by independent parties before deployment to production. One promising method to enhance the reliability of smart contracts is mutation testing, a powerful albeit time-consuming test adequacy assessment technique. This paper proposes a framework to streamline and parallelize the mutation testing process, making it more practical and accessible for auditors. Simulations conducted on real-world Solidity projects show that the implemented service can significantly reduce the computational time needed for a local, sequential mutation testing run.
Customer self-service (CSS) has become a crucial part of IT service provider organizations' business operations. Customer self-service is a type of customer service enabling customers and service users to receive service-related information and submit service requests and incidents 24/7 through a self-service portal as well as perform some routine tasks including reseting passwords or installing low risk configuration items (CI) to their workstations. There are clear business benefits for using self-service portals and self-service enabled processes. They improve customer experience by eliminating the need to communicate with service desk workers and provide a round-the-clock digital channel. From a service provider's perspective, self-service channels increase productivity by ensuring that relevant information is collected from users in structured format. The main contribution of this paper is to show how to organize deployment of self-service portal as a digitalisation initiative. The research problem of this study is: How quality aspects should be taken into account by an IT service provider organization while designing and deploying self-service portals to customers? A case study method with one case organization, a large Finnish IT service provider company, was used to answer the research problem.
Automatic test case generation is a popular software testing strategy. However, many reports show shortage of such test cases in poor quality and doubtable efficiency. In order to alleviate these problems and to make test cases trustable, we propose an interactive post-processing method which allows (1) analyzing the path that is examined by the test case, (2) making safe changes to the path which will eliminate the shortcomings while leaving the coverage targets of the test case unharmed. The method is based on visualization of the path along the control flow graph of the model with additional information about factual evaluation history of all variables and possible alternative variants of behavior. The method reduces the time spent on researching the results of test generation and editing the obtained test cases, and its use has a positive effect on the quality and efficiency of the test suite.
Agile methods offer flexibility, collaboration, and responsiveness to rapid changes, making them a popular choice for organizations seeking to adapt to the dynamic business landscape. However, the successful adoption of agile alternatives does not occur uniformly across all cultural and organizational contexts. In an organizational culture with high power distance, there is a clear hierarchy, and team members are less likely to question authority and expose problems, which can affect the adoption of relevant agile principles and practices, thereby potentially compromising the software quality. It is not always trivial to identify the latent behaviors associated with high power distance. Thus, managers may overlook the existence of high power distance and its effects, jeopardizing agile transformation initiatives. We conducted a systematic literature review to characterize power distance in agile organizations. Based on 15 studies, we identified 15 manifestations, 31 effects and 36 possible actions to minimize power distance. Most signs of power distance are associated with human factors such as Decision-Making, Empowerment, Autonomy, and Trust. Managers can use the identified manifestations and effects to diagnose the occurrence of high power distance. Likewise, they can use the identified treatments to define appropriate and contextualized treatment strategies in agile transformation initiatives.
In the last years, several software vulnerability detection techniques based on learning methods, such as deep-learning and large language models, have been proposed to detect vulnerabilities in source code. These techniques build code classification models from datasets of code snippets labeled as vulnerable and non-vulnerable, with the purpose of predicting the presence of vulnerabilities in new code snippets. Experiments documented in the literature, however, show that such techniques can achieve promising results only under specific context and conditions. In this paper, we document a preliminary investigation on the impact of the use of domain-specific knowledge information on vulnerability detection tasks. To this aim, a transformer-based vulnerability detection method has been enhanced with domain-specific knowledge information and an experiment has been performed to understand whether such additional domain knowledge information can increase the detection performance of the learning-based method.
The role of sustainable approaches has never been as important as it is today, especially with the rising concerns of climate change. Since software is everywhere, sustainability is a key aspect also for software systems. In recent years, the software engineering community is considering more and more the reduction of the overall energy consumption as a key goal for software systems during their execution. To address sustainability from the software engineering perspective, various approaches have been proposed, self-adaptation being one of them. Self-adaptation enables software to be context-aware and self-aware, hence, to change its functioning and performance based on the current execution conditions. From the sustainability point of view, self-adaptation ensures flexibility and efficiency in resource and energy management, for example based on current energy sources, energy consumers, tasks to be executed, and user expectations. In this research, we perform a systematic literature review (SLR) on (1) the use of self-adaptation for achieving sustainability, and (2) the existing approaches in various application domains. Identified studies show that self-adaptation is an effective approach to reach sustainability, mainly reflected in the key abilities of ensuring performance, efficient resource management, and adaptability.
Common Cause Failures (CCF) have the potential to make safety-related systems fail. Hence, the safety-critical industries identify and quantify the probability of CCF using different methodologies. For example, industries like railways rely on a β -factor methodology suggested by the IEC 61508 standard, in which defense measures are established against CCF and β -factor (used in the estimation of the probability of CCF) quantified based on the application of those measures. However, this methodology had two main research problems (RP) they are, RP1: The standard’s inception was in 2010, and due to this the measures against the CCF that arose from the emerging new technologies were absent in the standard. Moreover, the methodology has not provided any means to permit new measures. RP2: The methodology is generalized and applicable to all safety-related systems using Electrical/Electronic/Programmable Electronic-based systems across different industries. However, the impact of CCF and the required defense measures against them would be distinct in each industry. Eventually, the negligence of these problems leads to conservative β estimations. Therefore this research aims to provide possible solutions for these two problems. For RP1, by proposing a methodology that enhances the IEC 61508 standard methodology in β -factor estimation and adopts a way that could consider new defense measures in addition to the existing measures. For RP2, we planned to demonstrate an approach to develop an industry-specific β -factor methodology focusing on railways. Later, the methodology is applied to a system i.e., Electro-dynamic braking of railway propulsion systems for β -factor estimation. This research would provide insights to industrial practitioners and researchers to develop industry-specific β -factor methodology to estimate more realistic β , by analyzing appropriate defense measures.
Crowding is a troublesome phenomenon due to safety concerns, public health risks, social tensions, degraded quality of experience for visitors, infrastructure strain, environmental impact, among other reasons. Overcrowding management requires crowd monitoring, the main topic to be addressed in this PhD research plan. In particular, it focuses on developing a machine-learning crowd-monitoring approach based on the detection of mobile device's trace elements from their wireless technologies, namely Wi-Fi and Bluetooth. The expected major challenges are coping with (i) devices' address randomization to derive unified fingerprints in each observation period, (ii) the combination of counting obtained from diverse wireless technologies, and (iii) the combination of data from multiple sources. It also aims to rely on user contributions, to enhance the quality of detection, by developing a mobile application. The latter will also help with real-time management of overtourism, promoting mitigation actions. The research plan builds upon preliminary results on developing a Smart Tourism Toolkit to monitor crowding levels in real-time in the scope of the European RESETTING project.
Security testing aims at identifying software vulnerabilities that can be exploited by malicious actors. Software vulnerability detection (SVD), in particular, studies techniques to identify source code weaknesses and bugs that could lead to vulnerabilities. Automated SVD has made significant progress thanks to artificial intelligence tools, including large language models and deep learning. Most of the existing SVD techniques extract a token-based vector representation from the source code under analysis, and then pass it to a learning algorithm inspired by the ones used for natural language processing. The code vulnerability detection is hence considered as a binary classification task: the learned model is used to predict whether new code snippets are vulnerable or not. A recent trend consists in extracting graph-based structures from the source code, and then pass them to a graph-based learning algorithm. The graph-based code representation is expected to be an enabler to search for vulnerabilities by considering syntactic, semantic, and structural information of the source code. This paper reports on a rapid review conducted to study the literature about code graph-based learning SVD, with the goal of capturing evidence that can be transferred to practitioners. Our analysis reveals that most of the presented graph-based learning SVD techniques: (i) use combinations of graphs extracted from the source code by (almost) employing the same tool; (ii) use frequently Graph Neural Networks (GNN) and Gated Graph Sequence Neural Networks (GGNN); (iii) work at the function level, and only rarely at the statement level. Furthermore, we also noticed that: (iv) only a limited number of tools that support such techniques are available, and (v) several real-world datasets exist and are largely used, however, they are unbalanced, labeled only at the function level, and, in most cases, contain C/C++ source code, thus hampering their adoption with other programming languages.
In the process of developing requirements specifications, a requirements analyst conducts question-and-answer (Q&A) sessions iteratively to incrementally make more complete initial requirements pre-obtained from stakeholders. However, iterated Q&A sessions often have some problems leading to a final requirements specification of lower quality. This paper presents the usage of a graph database system to identify bad smells in Q&A processes, which are symptoms leading to a lower quality product, and to control the versions of a list of requirements through the activities. In this system, the records of the Q&A activities and the requirements lists are structured and stored in a graph database Neo4j. Cypher, a database manipulation language, was used to show that we could retrieve bad smells in the Q&A process and visualize any version of the requirements list evolving through the processes.
We propose a sticky-policy based distributed privacy control system, namely BRAIN-IoT Privacy Control System, under strict compliance with General Data Protection Regulation (GDPR). It empowers users to set privacy policies and decide how the data should be managed. Furthermore, the proposed architecture aims to offer policy matching services to continuously and automatically enforce privacy protection in fully decentralized Internet of Things (IoT) environments i.g., the BRAIN-IoT platform, which focuses on the interoperability between heterogeneous IoT systems and secure data transmission. We validate the BRAIN-IoT Privacy Control System in real-life large-scale public events. Experiments results show that the system can quickly perform match checking of the privacy policies transmitted with personal data.
