In the era of dynamic technological development and growing needs for data processing and analysis, the architecture of multi-agent systems is gaining importance. These systems, combined with Large Language Models (LLMs), offer an innovative approach to the information retrieval process that can enhance the efficiency, speed, and reliability of fact-finding and question-answering. This paper proposes the use of a designed multi-agent system architecture that uses autonomous agents and LLM models to efficiently acquire and process large amounts of data. It is shown how the integration of these technologies allows for more effective and precise information acquisition, which can lead to innovative solutions in both business and science. The effectiveness of solution were evaluated using specific metrics and testing.
Microservice architecture has emerged as the dominant architectural pattern for modern software systems, offering scalability, modularity, and fault tolerance. However, its highly distributed and interdependent nature makes evaluating architectural designs and proposed changes increasingly complex. This paper presents MicroViSim, a lightweight tool for simulating load and visualizing service dependencies and performance metrics in Kubernetes-based microservice systems. MicroViSim enables developers and operators to pre-evaluate new or evolving architectures prior to deployment by generating service dependency graphs, performance indicators, and load simulation results from user-defined YAML configurations. These visual insights help uncover potential bottlenecks and performance risks early in the design phase, thereby reducing future maintenance costs and the likelihood of system failures. Experiments using a real-world microservice application, Bookinfo, demonstrate that MicroViSim effectively identifies architectural weaknesses and supports informed deployment decisions.
Augmented Reality (AR) applications increasingly permeate domains such as gaming, retail, education, and healthcare. Despite their rapid adoption, systematic testing of AR apps remains underexplored due to their dependence on complex realworld contexts, sensor data, and diverse user interactions. In this paper, we propose ARTRIP (Automatic AR Testing with Randomized Interaction Patterns), a novel testing technique designed to explore AR applications with randomized interaction patterns. Unlike existing random testing approaches such as Monkey, ARTRIP uses a randomized interaction pattern to enhance the chance of covering more complicated interaction sequences. We describe the methodology, present a prototype implementation, and evaluate its effectiveness through case studies on four popular AR apps. Results suggest that ARTRIP achieves higher coverage than Monkey, highlighting its potential as a practical AR testing framework.
Proactive self-adaptation using Model Predictive Control (MPC) is well studied for software systems operating in dynamic environments. However, its practical adoption is limited by two key challenges. First, the modeling gap: traditional MPC requires state-space models that are difficult to construct for complex software systems, often demanding extensive domain expertise and incurring high computational costs. Second, the tuning gap: configuring MPC to balance abstract and competing objectives-such as performance, resource efficiency, and control stability-typically relies on manual, expert-driven tuning, impeding autonomous operation. To address these challenges, we propose a dual-layer MPC framework. At the lower layer, an Input Convex Neural Network (ICNN) is used to learn complex nonlinear dynamics directly from data, enabling tractable optimization and reducing the modeling burden. At the upper layer, a delta-driven controller manager adaptively tunes the lowerlayer MPC by monitoring deviations in system behavior and estimating the impact of different cost components on overall utility, thereby automating the tuning process. We evaluate our approach on SIMDEX, a job scheduling simulator, where it demonstrates superior performance over both the traditional requirements-oriented MPC framework CobRA and the nonadaptive ICNN-based controller, achieving a better balance of performance, resource efficiency, and control stability.
Large Language Models (LLMs) are transforming software engineering, including mobile Augmented Reality (AR) applications. AR software behavior often depends on dynamic environmental factors, making it difficult to use conventional testing and verification approaches. Metamorphic Testing (MT) offers an alternative by assessing whether expected transformations hold across varied conditions. However, there is limited work exploring how well LLMs can detect these transformations-Metamorphic Relations (MRs)-in applications. We propose a stability-driven evaluation framework that examines whether LLMs consistently apply MRs across rephrasings. Our study finds that StarCoder and CodeLlama exhibit higher stability in MR identification compared to the general-purpose model Gemma. Additionally, we use a multi-agent debate framework to investigate whether combining multiple perspectives improves consistency in MR identification. The debate mechanism reduces MR inconsistencies, leading to more stable MR identification across all MRs. While debate helps stabilize MR identification, our evaluation against humanlabeled ground truth reveals that stability alone does not always correlate with correctness. Some models maintain stable yet incorrect predictions(CodeLlama), whereas debate enhances both consistency and correctness alignment, making LLM reasoning more reliable. This work contributes a method to evaluate LLMs in the absence of ground truth, establishing stability as a metric for assessing model reliability. Applying a multi-agent debate framework offers a promising approach to enhancing LLM reliability, especially in contexts where the ground truth is elusive.
Automated generation of executable test suites from natural-language requirements remains challenging due to linguistic ambiguity and sensitivity of generative models to decoding and training hyperparameters. This paper introduces a hierarchical, multi-level evolutionary framework that treats model hyperparameters and decoding strategies as upper-level decision variables and employs lower-level fitnesses that directly measure test-quality objectives (structural coverage, semantic diversity, redun-dancy, and runtime efficiency). The approach integrates retrieval-augmented grounding, surrogate-assisted preselection, lightweight LoRA adaptation and optional HIL evaluation. Empirical evaluation on PURE, PROMISE_exp and FR NFR benchmarks (repeated runs, n = 10; paired two-sided t-tests, alpha = 0.05) shows consistent gains: on PURE mean code coverage reaches 82.4% (vs. 75.1% for Bayesian optimisation and 68.9% for random search) with 145 unique scenarios and modest runtime overhead (approximate to 58.3 s, approximate to 6% above Bayesian). Ablations confirm component effects (e.g., removing diversity reduces unique scenarios approximate to 18%; disabling the surrogate increases wall-clock approximate to 42%; disabling RAG drops grounded consistency approximate to 12%). Results indicate that co-optimising hyperparameters for explicit test-quality metrics, together with grounding and realistic execution, yields more useful, executable test suites. Future work will explore adaptive objective weighting, transfer warm-starts and probabilistic surrogates.
Assessing developer productivity in expansive software endeavors has become a pressing concern for both academia and industry, as organizations seek reliable ways to understand how engineering effort translates into business value. Traditional metrics-such as commit frequency, lines of code, or code churn-have been widely adopted but remain problematic, since they conflate inconsequential edits with architecturally significant reshaping and provide little insight into task-level contributions. To address this limitation, we introduce a commit-centric analytic framework that leverages clustering to reconfigure disbursed commit logs into coherent parcels, termed builds, that align more closely with the functional level of development tasks. Unlike prior approaches that combine heterogeneous signals such as issues, reviews, or communication logs, our method relies solely on the structural and temporal properties of commits, making it lightweight and broadly applicable. Each build is evaluated along two orthogonal axes: developer effort and build importance. Effort operationalizes the scale and character of contributions, considering code proprietorship, scope, architectural centrality, novelty, and cadence. Importance quantifies the build’s systemic consequence, integrating scale of alteration, distribution of changes, architectural centrality, complexity, task priority, and proximity to release milestones. The fusion of these axes produces the Fair Developer Score, a composite benchmark reconciling personal exertion with organizational value. Validation centers on exposure-controlled, matched comparisons that pair FDSranked developers with commit-count peers matched on churn, files changed, and builds participated. On the Linux kernel, FDS-ranked developers exhibit significantly higher Average Importance and Average Effort than volume-matched peers, with lower rework trends. Cross-repository analyses across Kubernetes, TensorFlow, Apache Kafka, and PostgreSQL demonstrate consistent Effort advantages and context-dependent Importance effects, indicating FDS surfaces impactful work beyond raw activity using commit-only data.
Mainframe systems, written in legacy languages such as COBOL, PL/I, and JCL, continue to support missioncritical applications across various industries. Their complexity and limited documentation hinder maintenance and modernization, especially in regions where localized explanations are essential for accurate understanding. However, existing approaches predominantly generate English-only outputs and rely on resource-intensive models unsuitable for secure, on-premises environments. This study explores multilingual explanation generation for mainframe programs using lightweight language models suitable for constrained enterprise settings. We evaluate two strategies-(a) direct generation in the target language and (b) translation-based generation from English—across five languages: Japanese, French, German, Spanish, and Portuguese. Explanation quality is assessed using BLEU, ROUGE-L, METEOR, and semantic similarity. Preliminary results show that lightweight models can produce semantically adequate multilingual explanations. Translation-based generation generally yields higher lexical and structural quality across languages and models, while direct generation shows promise in specific scenarios. These findings demonstrate the feasibility of deploying multilingual explanation systems in enterprise environments and highlight opportunities to refine generation strategies based on language and code characteristics.
Extended Reality (XR) technologies offer immersive user experiences across diverse application domains, presenting unique testing challenges due to their spatial interaction paradigms. While existing works test XR applications through scene navigation and interaction triggering, they fail to synthesise realistic spatial input via specialised XR devices, such as 6 degrees of freedom controller gestures, that are essential for modern XR user experiences. To address this gap, we present XRintTest, an automated testing framework for Unity-based XR applications. XRintTest starts by constructing an XR User Interaction Graph that models interaction targets and required events. Leveraging this graph, it then automatically explores the XR scene under test and generates user interactions. We evaluated XRintTest on XRBench3D, a novel benchmark comprising seven XR scenes containing 367 distinct 3D user interactions. XRintTest shows great effectiveness, achieving 97% coverage of trigger and grab interactions across all scenes, 9x more effective and 5x more efficient than random exploration, while detecting runtime exceptions and functional defects. We open-sourced our tool and dataset at https://github.com/ruizhengu/XRintTest and https://github.com/ruizhengu/XRBench3D, respectively. A video demo is available on YouTube at https://youtu.be/K0Q6waE47Us.
The use of formal methods is a significant contribution to developing trustworthy software; however, it can be a complex task. For this, automation with generative artificial intelligence models, such as Large Language Models (LLMs), is considered a promising approach. We studied the use of LLMs to generate repairs for faulty formal models of the Event-B formalism. To repair faulty Event-B models, we propose a System Prompt that contains constraints on how to suggest repairs that respect the syntax and rules of the Event-B language. We also propose Retry Prompts, a type of prompt that aims to refine a repair suggested by an LLM by highlighting errors in previous responses. To evaluate our method, we developed a tool that generates faulty models (mutants) from existing correct models by removing a single action or guard predicate. The tool then interacts with an LLM to obtain a suggested repair for the mutant model. After modifying the model according to the suggestions from the LLM, we evaluate the correctness of the modified model. The results demonstrate that using Retry Prompts significantly increases the success rate of the suggested repairs, with over 80% of the faulty models in our dataset being successfully repaired. The results also indicated directions of possible future improvements, such as combining Generative AI with formal approaches to repair failing cases.
The rapid growth of Virtual Reality (VR) across critical sectors like healthcare, education, and gaming necessitates robust methods for quality assurance. As VR applications increase in complexity, ensuring correctness of interactions becomes challenging. This paper presents our ongoing work on a novel, cross-platform conformance checking system designed to verify that VR interactions are as specified. Our system features three key parts: a JSON-based format for defining ideal interaction specifications, an intuitive visual editor for designing the interaction flows, and a rules engine that automatically compares runtime behavior against the predefined sequences. This system is designed to streamline the testing process and ensure behavioral consistency across diverse VR platforms.
Machine learning approaches have shown impressive performance in Android malware detection. Yet, most if not all of these approaches face tradeoffs between accuracy, interpretability, and scalability. Approaches based on simple features are interpretable but miss complex behaviors. At the same time, approaches that capture holistic application patterns obscure the exact code responsible for malicious activity. In this paper, we outline our vision for an accurate, scalable, and interpretable method-level malware detection. The core idea behind our approach is to filter out non-discriminative application parts before analyzing the remaining, applicationspecific behaviors at the fine level of granularity. We further discuss the key challenges that must be addressed to effectively implement our proposed approach and provide suggestions for future directions.
Immersive attacks are a novel class of security threats that emerge from the immersive nature of virtual reality (VR) interfaces. Unlike traditional cyber attacks that target users’ sensitive information, immersive attacks target users’ immersive experience: their visual perception and sense of direction. Despite their high damage potential, countermeasures for immersive attacks are still underexplored. In this work, we demonstrate how one can implement immersive attacks using OpenXR, a unifying standard that enables running vendor-independent VR applications on various VR platforms. We explore strategies for detecting such attacks through the perspective of static code analysis, a popular technique for application security vetting. We discuss the requirements and challenges for static analyses aimed at detecting immersive attacks, highlighting in particular the lack of cross-language support in existing tools and the absence of domain-specific knowledge needed to recognize these attacks.
Native libraries are widely used in Android for performance optimization, but their integration also poses security risks. Although existing research works have investigated the adoption, management, and ecosystem evolution of third-party libraries (TPLs) in Android, studies specific to Android native libraries are still rare, which makes the potential threats of native libraries in Android less concerned. The biggest barrier is that, Android native libraries are usually provided by various suppliers in different ways and sources, leading to the lack of a comprehensive registry that indexes commonly used native libraries for further investigations. To this end, by following a greedy strategy to identify possible repository sources and collect Android native libraries, we constructed the first comprehensive native library database DroidNative for Android, with over 60K libraries and 292K versions well retained. Our experiments proved its completeness that 85.1% of binaries in real-world APPs can be successfully traced in DroidNative, with 10.1% of the rest suspicious to be not third-party native libraries. Moreover, DroidNative is also evaluated to be useful regarding improving existing SCA detection (i.e., LibRARIAN) by outperforming existing state of the art tools with at least 78.4% recognition rate improvement.
Architectural Erosion (AER) is a phenomenon that occurs when the implemented architecture of a software project diverges from its intended design. This can impact the quality and performance of an application. In Android applications, the effects may be amplified due to limited resources such as memory, storage, and processing power. Previous efforts have been done to tackle AER for different platforms, mainly using static code analysis and AI-based approaches using Word-embeddings. Nevertheless, no previous study has focused on Android Apps. The goal of this research is to evaluate the applicability of the proposed approaches based on word-embeddings to identify new potential keywords in GitHub commits of Android projects, using the existing list of keywords and word similarity metrics.
Modern software-intensive systems must address a wide range of nonfunctional requirements (NFRs)—such as security, compliance, and maintainability—that are critical for the long-term success of the system. With the rise of large-language-model-based agents, software engineering is entering an “agentic” era where AI components are not only tools but collaborators in development processes. However, leveraging these agents introduces dual challenges: ensuring that AI components themselves meet quality standards (e.g., compliance, security, maintainability), and harnessing AI effectively to support systemlevel NFR assurance. Our perspective explicitly spans both SE4AI, where AI components such as agents are engineered and subjected to quality assurance and AI4SE, where AI agents support the engineering of software-intensive systems. While these are conceptually distinct, our model addresses both in a unified way. This position paper introduces a conceptual, domain-agnostic three-layer model—comprising Data, Agent, and Perspective layers—for systematically embedding AI agents into NFR assurance across the software lifecycle. The model explicitly captures two complementary viewpoints: Quality for AI (ensuring AI agents are trustworthy and maintainable) and AI for Quality (using agents to support system NFRs). Through illustrative examples in compliance, security, and maintainability, the paper demonstrates how this model can guide researchers and practitioners in designing agent-based approaches to software quality. We argue that this model not only clarifies the dual roles of AI in software engineering but also provides a foundation for responsible, scalable, and effective integration of AI into NFR assurance.
In safety-critical domains, extensive software testing is required to validate functional properties and meet standards such as ISO-26262 and DO-178C, which mandate strict code coverage levels. Uncovered code sections may indicate insufficient testing or unreachable code, leaving latent defects undetected. Traditional coverage tools reveal such gaps but cannot determine their cause. Fuzzing effectively discovers bugs but cannot prove unreachability, while bounded model checking (BMC) can formally prove unreachability and generate test cases but inherently underapproximates program behavior due to bounded exploration. We present a hybrid testing framework, BMuzz, that combines fuzzing and BMC in a concurrent, automated workflow. It measures baseline coverage, instruments uncovered regions, and applies both techniques to either generate additional inputs or prove unreachability. The resulting tests and proofs help identify untested requirements, requirement violations, and dead code. Applied to a subset of an industrial-grade C standard library for embedded automotive systems, our approach achieves more efficient coverage than standalone fuzzing or BMC, while also identifying unreachable code and specific decision constellations, demonstrating its potential for broader adoption in safety-critical domains.
User Review on App Distribution Platforms such as the Google Play Store, provide vital feedback on the software and offer several information-rich attributes such as user experience, performance, security and software reliability. However, owing to their inherently unstructured nature, informal tone, and the vague opinions, it becomes difficult to manually extract such information from App Reviews. Over the past few years, several Automated solutions using traditional machine learning (ML) and Deep learning (DL) approaches have been proposed. However, these solutions have significant methodological and scope-centric limitations including insufficient deep context understanding, and dependency on hand-crafted features, resulting in limited effectiveness in multi-label classification scenarios. This research aims at automating quality concern extraction from mobile app reviews using transformer-based language models. We benchmark mainstream Transformer-based language models against classical ML/DL baselines to highlight their relative advantages in context-aware multi-label classification. The proposed approach aims at reducing the reliance on manual feature engineering by leveraging self-attention mechanism and contextual embeddings to enhance semantic understanding of the reviews. Five selected quality concerns as part of ISO 25010 standard are targeted in this study. An annotated dataset of 20,000 real-world app reviews is used for the evaluation for performance evaluation of the proposed approach against precision, recall and F1-score. Through comprehensive empirical evaluation, the study validates the effectiveness and practicality of state-of-the-art transformer-based language models for automated extraction of software quality concerns.
Issue classification is a fundamental task in software development, enabling teams to manage issue reports. Automatic issue classification can help developers classify issue reports. However, developers should understand why each issue report is classified in such a way. A prior study has shown that explainable AI (XAI) can explain how an issue report is classified as a bug or a non-bug. However, the binary setting limits applicability to real-world issue tracking systems, where multiple categories coexist. In this paper, we replicate and extend the prior study by conducting a multi-class issue classification experiment using three categories: Bug, Enhancement, and Question. We use a fine-tuned, seBERT-based classifier and apply two widely used XAI models, LIME and SHAP, to generate explanations for issue classification. We then analyze the results of applying LIME and SHAP to multi-class issue classification, both qualitatively and quantitatively.
Organizations increasingly rely on forecasting systems to anticipate future conditions and inform their strategic planning. However, current practices for specifications of these systems are scattered across workflows. Moreover, these specifications are either loosely defined or tied to data representation formats that lack domain awareness and offer only superficial validation. These limitations make it difficult to ensure correctness, enforce compliance, and trace qualitative adjustments across forecasting workflows. To address these challenges, we propose ForeSPECT, a model-driven framework for Forecasting with Semantic Provenance, Evaluation, Compliance, and Traceability. The framework introduces a metamodel that serves as the foundation for semantic validation and adjustments traceability, enabling early detection of domain-specific inconsistencies that conventional schema-based rules often miss. Our approach shows promise based on evaluation with nine unseen real-world datasets, achieving 77.7% mapping coverage between the metamodel and actual time-series record entities. It further demonstrates better performance in detecting errors earlier than pipeline-based methods, while ensuring 100% forward and 91% backward traceability of adjustments.
