The rapid digital transformation of manufacturing, often referred to as Industry 4.0, relies on seamless interoperability between physical and software assets. A central enabler is the Asset Administration Shell (AAS), a standardized digital representation of such assets. Recent advances in large language models (LLMs) enable the generation of AAS submodels from unstructured sources such as product datasheets but raise challenges for quality assurance. In particular, unexpected errors, the lack of ground-truth references, and the absence of standardized quality metrics hinder reliable adoption. In this work, we evaluate quality metrics for AI-generated AAS using a perturbation-based evaluation framework. By systematically degrading AAS generation along multiple dimensions, we assess how well different metrics reflect quality changes. Based on a dataset of 200 products from multiple manufacturers, we generate 6,400 AAS instances using GPT-4o-mini, Qwen3, and DeepSeek-R1. Our results show that metrics based on exact matching of property names and similarity-based soft matching of property values, in particular value-based recall and name-based F1 score, provide the most reliable indicators of quality degradation. Furthermore, we quantify the impact of different perturbation types and analyze differences across model families and product segments. These findings support the selection of suitable metrics, the tuning of LLM-based pipelines, and the integration of AI-generated AAS into industrial applications.
A Cryptography Bill of Materials (CBOM) is a machine-readable inventory of cryptographic components—e.g., algorithms, keys, and certificates—that enables practitioners to assess risks ranging from classical cryptographic failures to post-quantum threats. However, despite growing regulatory and security pressure to operationalize cryptographic governance, there is little empirical evidence on the available open-source CBOM tools. To address this gap, we conducted a mining study of GitHub repositories that host CBOM tools: generation tools that extract cryptographic components from software artifacts to produce CBOMs, and consumption tools that analyze generated CBOMs to derive actionable insights. Our results reveal a generation–consumption disparity: 46 repositories host generation tools, while only seven host consumption tools. Community engagement appears limited: 93.48
InnerSource (IS) is increasingly viewed as a way to improve large-scale software development. However, evidence on its adoption in public sector organizations remains limited. This paper reports a study of IS adoption in a Swedish Public Sector Organization. Drawing on nine semi-structured interviews and an internal workshop with 13 participants, we examine motivations, challenges, and improvement strategies for IS adoption. The results show that the main motivations are improving reuse, strengthening cross-team collaboration, and enabling faster and more cost-efficient development. Key challenges relate to a lack of an open culture and mindset, management of reusable assets (e.g., ownership, documentation, and code visibility), and ways of working (e.g., siloed practices and limited time for contributions). The study also identified improvements to address challenges, including fostering an enabling culture and mindset for IS and knowledge sharing, strengthening management support, and establishing internal platforms and governance for reusable assets.
Smart homes are increasingly common in everyday life, offering convenience, automation, energy efficiency, and enhanced security through software services and devices such as smart locks, cameras, and voice assistants. However, their connected and shared nature introduces risks within close relationships, where they can be exploited to facilitate interpersonal violence and abuse. At the same time, they can also be leveraged for mitigation, detection, and victim support. In this study, we conduct a systematic mapping review of 27 studies to identify and categorize how smart home systems can both facilitate and address interpersonal violence and abuse. The findings show that research in this field is imbalanced, with most studies focusing on abuse facilitation, particularly through surveillance, remote control, and access misuse, while fewer studies propose mechanisms for abuse detection and victim support. This suggests a need for more holistic, smart home system-integrated approaches that explicitly address interpersonal risks in smart home design and development, and integrate these concerns into core software engineering activities, including requirements engineering, system design, and validation.
Software development aims to deliver products that fulfill stakeholder goals. However, conflicting interests and uneven influence within an organization often produce fragmented or incomplete requirements. A structured and multiperspective analysis of stakeholder goals is therefore necessary to understand these divergences and to form a holistic view of the organizational landscape. This paper proposes a method that integrates the strengths of KAOS and iStar while maintaining compliance with IEEE 29148. By enabling the analysis of individual stakeholder perspectives alongside primary system goals aligned with organizational strategies, the method supports the derivation of valid requirements specifications. We illustrate the initial feasibility of this approach through a case study on Administrative Digital Transformation initiatives in Japan.
Exploratory testing of mobile applications is a critical yet cognitively demanding activity, often perceived as tedious and repetitive. Gamification has emerged as a promising technique to address this challenge, by embedding game-design mechanics into non-ludic contexts to foster engagement and performance. In this paper, we present GAppium+, a gamified extension of Appium Inspector, a widely adopted tool for exploratory testing of mobile applications. GAppium+ enriches the testing experience through a set of mechanics – badges, leaderboards, levels, coverage tracking, and profile customization – grounded in established gamification theory. We report on a preliminary in-vivo evaluation conducted with PhD/scholarship students, who interacted with GAppium+ under controlled conditions. Post-session questionnaire results indicate a generally positive reception: participants rated gamification favorably overall (avg. 3.73/5), with badges scoring highest in terms of motivational impact (avg. 4.10/5), and broad agreement that gamification is a viable and beneficial approach for exploratory testing.
The increasing adoption of machine learning (ML) systems has led to ML-specific code smells that degrade maintainability, reproducibility, and scalability. While prior research has focused primarily on detecting such smells, automated refactoring support remains limited. This paper proposes HARP-ML (Hybrid Assisted Refactoring Pipeline for ML code smells), a framework that classifies ML code smells into two categories: Type I smells, which are syntactically localized and resolved through Concrete Syntax Tree (CST) transformations validated by Property-Based Testing (PBT), and Type II smells, which involve control flow and execution context and are addressed using a Small Language Model (SLM) with a focused context window. We evaluate HARP-ML on four ML code smells across two benchmarks: curated experimental kits, where HARP-ML achieves a 97.5
Selecting Java code for in vitro experiments where human participants are asked to assess its quality is a non-trivial task. As a priority, we would want to ensure that as diverse a set of Java language constructs, idioms and features were included in the selected code. This paper proposes a systematic methodology for selecting a representative and reproducible subset of small, human-readable GitHub repositories for researchers conducting human-centred software engineering studies. Java projects were randomly sampled from GitHub and their suitability was justified through the use of machine learning and statistical analysis techniques. Subset selection was performed using heuristic search methods - specifically Hill Climbing and Simulated Annealing to maximise diversity with respect to a set of carefully targeted and selected code-based metrics. The resulting dataset was constructed as the union of unique repositories across multiple candidate subsets, each of which was independently validated to outperform random selection. While the approach is particularly suited to studies using electroencephalography (EEG), it could apply equally to a broad range of experimental settings where human participants are required to look at and assess code.
Multi-agent reinforcement learning (MARL) is increasingly used in real-world coordination tasks, yet little is known about how MARL systems are engineered in practice. We present an empirical repository-mining study of 187 open-source GitHub repositories comprising 12,205 files (9,957 Python, 2,090 YAML, and 158 JSON). Using automated static analysis and manual repository screening, we examine engineering decisions in algorithm adoption and hyperparameter configuration, environment integration, and multi-agent implementation patterns. Our results show that open-source MARL development is concentrated around a small set of algorithm families, especially PPO, DQN and QMIX, and that algorithm use co-occurs with recurring library and environment combinations. Hyperparameter practice is largely limited to a small set of recurring defaults, while specialized variants tend to involve larger hyperparameter sets than their base algorithms. Repositories most often realize multi-agent behavior through simple structural patterns, such as instantiating multiple agents or defining multiple agent classes, whereas specialized multi-agent abstractions occur less frequently. These findings provide an empirical baseline for current MARL engineering decisions and highlight opportunities to improve standardization in hyperparameter specification, environment integration, and multi-agent abstractions.
Microservice systems (MSS) increasingly rely on heterogeneous APIs whose combinatorial input space and stateful dependencies challenge traditional fuzz testing. Meanwhile, Large Language Models (LLMs) have recently been introduced to enhance fuzzing with semantic reasoning over specifications, inputs, and runtime feedback. This paper presents a systematic literature review (SLR) of LLM-assisted fuzz testing for microservices to synthesise how LLMs are applied, evaluated, and what challenges remain. Following established SLR guidelines, we analyze 20 primary studies published between 2024 and 2026. Results show LLMs are mainly used as semantic input generators in black-box fuzzing, with a growing shift towards agent-based and retrieval-augmented architectures, improving valid input generation and modestly increasing coverage and vulnerability detection. However, evaluation remains heterogeneous, with limited benchmark standardization, scarce cost reporting, and a bias toward single-service experiments, highlighting a gap with real-world multi-service systems. This review provides a taxonomy of LLM roles and integrations, a consolidated view of evaluation practices, and a mapping of open challenges to research directions, supporting the design and deployment of LLM-driven fuzzing in microservices.
Organizations developing AI/ML-based systems need to build and institutionalize a set of development capabilities to manage data, models, and deployment processes effectively. Maturity models provide structured approaches to assess and guide this capability development; however, existing models vary in how well they capture the distinctive characteristics of AI/ML-based development. Despite the growing number of such models, there is limited understanding of how they define maturity levels, structure capability dimensions, and align with AI lifecycle processes. To address this gap, we conducted a Multivocal Literature Review (MLR) to systematically identify both academic and practitioner-oriented maturity models relevant to AI/ML development. Ten models were evaluated against seven criteria: purpose and fitness for use, development method, depth of maturity level definition, coverage of capability dimensions, internal consistency, alignment with ISO/IEC 5338:2023 as the process reference model for AI systems, and validation evidence. The results reveal a consistent pattern of partial specification across the field. Models grounded in established process assessment frameworks performed more strongly across multiple criteria, while practitioner-oriented models consistently functioned as adoption roadmaps rather than rigorous assessment instruments. Most models show only implicit alignment with ISO/IEC 5338:2023, and only one addresses trustworthy AI dimensions such as bias, fairness, or explainability. These findings indicate a significant gap between the current state of AI/ML maturity models and the standards-aligned capability assessment organizations need, particularly given the regulatory requirements introduced by the EU AI Act.
Generative AI (GenAI) is increasingly adopted in Software Project Management, yet its actual role and impact remain unclear. This paper presents a systematic literature review of 45 peer-reviewed studies (2017–2026) that examine the application of GenAI across the PMBOK knowledge areas and process groups, and its impact on effort, planning, and risk. The findings show a strong focus on “Planning” processes and text-intensive artifacts, with machine-learning proxy metrics rather than managerial ones being used to evaluate GenAI outputs instead of their impact on project-level dynamics. While reductions in effort and improvements in planning are consistently reported, two less visible patterns emerge. Artifacts generated by GenAI often appear plausible rather than accurate and require human validation to detect under-specification and bias. Adoption also brings with it new tool-related risks such as vendor dependency, prompt sensitivity, and hallucinations. Procurement and Stakeholder Management, along with Initiating and Closing processes, remain largely unexplored.
Federated Learning (FL) was introduced as a decentralized machine learning approach that enables models to be trained on distributed data sources without exposing raw data. Over time, it became clear that FL as an architectural paradigm can become a tipping point in transforming software-intensive systems into dynamic and autonomous intelligence. However, the adoption of FL in large-scale software-intensive system has been slow. This means there is a growing gap between what is being studied in research and what industry actually needs. This paper presents a multivocal literature review (MLR) that integrates evidence from systematic literature reviews, primary studies, and industrial grey literature. The study examines FL from architectural and process perspectives, focusing on how systems are designed, deployed, and operated across research and practice. The results show that, first, significant progress has been made in algorithm design and optimization, while system-level challenges, such as orchestration and lifecycle management, remain understudied. Second, academic work is mostly challenge-driven and focuses on solving problems in isolation, such as addressing system heterogeneity and communication cost, while industry emphasizes system design and operational constraints. Lastly, deployment, evaluation, and end-to-end integration remain insufficiently addressed in both domains.
This study systematically maps green software engineering, focusing on the impact of software design on energy consumption. A Systematic Mapping Study was conducted using topic clustering and a scoring approach for study selection. Current research is dominated by validation and empirical studies, with limited real-world evaluation. Energy efficiency is affected across all software layers but remains highly context-dependent. Existing techniques and tools are fragmented and lack standardized metrics. Green software engineering still lacks unified methods and general guidelines. Future work should prioritize real-world validation, standardization, and context-aware approaches.
In recent years, the integration of Artificial Intelligence (AI) techniques into Functional Size Measurement (FSM) has gained increasing attention within the software engineering community. AI-based FSM methods aim to overcome the limitations of traditional approaches, namely, reliance on expert judgment and structured inputs, by enabling automation and scalability. This study presents a systematic literature review of research efforts that apply AI techniques to FSM. The review analyses 27 primary studies published between 2008 and 2025, sourced from major digital libraries. Various aspects are investigated, including publication trends, AI technique categories, functional sizing methods, and research types. The findings show a predominance of COSMIC as the preferred FSM method and highlight NLP, and transformer-based models as the most commonly employed AI techniques. While hybrid models combining rule-based systems with deep learning show promise, the field remains fragmented and underexplored. This review offers the first consolidated overview of AI-driven FSM research, identifying key trends, challenges, and directions for future investigation.
Early analysis of confidentiality at the architectural level is essential to prevent costly security violations in complex software systems. Recent data flow analysis frameworks allow confidentiality constraints to be specified declaratively using domain-specific languages, but their integration with SAT-based analysis techniques is hindered by the lack of automated translations of declarative constraints into conjunctive normal form. Existing solutions rely on manual, error-prone encodings or equi-satisfiable transformations that do not preserve semantic equivalence. In this paper, we present an automated approach for translating DSL-based confidentiality constraints into semantically equivalent CNF representations suitable for SAT solvers. This enables the seamless integration of declarative confidentiality specifications with SAT-based analysis and mitigation techniques, allowing their automated application to architectural models. The approach follows a two-step process: first translating DSL constraints into propositional logic, and then converting the resulting formulas into CNF using a divide-and-conquer algorithm based on Boolean equivalences. We evaluate the approach with respect to correctness, structural properties, and scalability. Semantic equivalence is established through a formal proof and validated empirically by comparison with manually constructed CNF encodings for real-world confidentiality constraints. An exhaustive structural analysis shows that clause growth, literal counts, and clause length are well-bounded, and a worst-case runtime evaluation demonstrates that the translation remains computationally feasible for constraint sizes exceeding those observed in practice.
Open-source software (OSS) is central to modern digital infrastructure, yet research has mainly focused on technical and productivity aspects, overlooking contributors’ social and psychological well-being. One underexplored threat to community sustainability is abrupt disengagement, i.e., a contributor’s negative sentiment followed by sudden withdrawal. This paper presents the first empirical investigation of its socio-technical roots. We hypothesize that community smells increase its likelihood, while socio-technical proximity mitigates it. We analyze six Apache Software Foundation projects, identifying disengagement events through inactivity patterns and using Kaiaulu and Oslom to derive relevant metrics. Results show that abrupt disengagement is a measurable outcome of socio-technical tensions: community smells act as risk factors, whereas socio-technical proximity plays a protective role, offering insights for more sustainable OSS ecosystems.
With the rapid adoption of Generative AI (GenAI) in software engineering, AI-supported feedback is increasingly used to scale review and revision tasks, yet its effect on complex design artifacts remains unclear. This study investigates the use of ChatGPT to provide feedback on larger-scale software system designs expressed as pseudocode. To support domain-specific feedback, we configured the model with a curated knowledge base and evaluated whether iterative feedback improved the quality of design artifacts produced by teams in a graduate software engineering project setting. We conducted a quasi-experiment evaluating three dimensions of software design artefacts – completeness, correctness, and clarity – and compared outcomes against a prior cohort receiving instructor/TA feedback only. Contrary to our initial expectations, we observed a statistically significant difference in clarity, with completeness and correctness remaining comparable to the control group. Transcript coding of retained GenAI feedback logs indicates that clarity feedback was more often prescriptive, while completeness/correctness feedback more often diagnosed gaps, shifting evaluative judgment and repair effort to the team. Further analysis suggested that teams that critically engaged with the AI feedback and carefully integrated it into their designs experienced the greatest gains, implying that mere access to Generative AI–based tools is insufficient. These results suggest that the effectiveness of AI-supported design feedback depends less on exposure alone than on how feedback is translated into concrete revision work. We conclude with process implications for structuring human-AI feedback integration for complex software design artifacts.
A central objective of a model-driven software engineering process is to model a system with sufficient depth to make it executable. While for industrial applications, such processes are complex and rarely adopted, they play to their strengths in education. Modeling a system step by step until it becomes executable, monitoring the system in action, and then going back to adjust the models drives the learner’s understanding of model-driven engineering and system design. However, when beginners are tasked with extensive modeling, they quickly become challenged and frustrated without ideal tooling. This work presents the Karpfen toolkit, an open-source modeling and execution toolkit comprising lightweight languages for domain-, data-, and behavior modeling. The strength of the Karpfen toolkit lies in the combination of a state-of-the-art technical stack, a highly instrumented model execution system, and minimal technical requirements for users. This paper presents the requirements-driven design of the Karpfen toolkit and demonstrates it in two case studies.
Gender imbalance remains a persistent concern in software engineering. This study presents a contextual replication of a prior empirical investigation on gender dynamics in student software engineering teams, conducted in a different educational and societal context. The results reinforce the original findings, providing further evidence that the gender gap continues to be a relevant issue. Our analysis indicates that role distribution within teams is evolving, with women tending to assume or prefer certain roles. The findings also emphasize the influence of different factors (such as society, culture or education), underscoring the importance of context-aware interventions. By contributing to the body of replication studies in software engineering, this work strengthens confidence in existing evidence while pointing to the need for sustained efforts to promote gender balance.
