Currently, when digital infrastructure is gaining importance in social life, ensuring the security and reliability of information systems is becoming a priority. The paper presenting the literature review was prepared based on the methodology of Systematic Literature Review (SLR). It analyzes the application of machine learning in the field of cybersecurity, with an emphasis on new methods of detecting and mitigating threats in cyberspace using deep learning techniques and graph neural networks. It discusses how these innovations can affect the development of information technologies, offering advanced techniques for supporting the IT security.
This paper presents the development and evolution of an educational module centered on collaborative problem-based learning, model-based software development, and end-to-end timing analysis for vehicular embedded systems, highlighting our experiences in integrating state-of-the-art research and industry practices over the years. For the past eight years, the module has been taught to both industry professionals and academic students. In the industry, it has been presented through seminars and workshops organized within the industrial settings of two vehicle manufacturers and a provider of vehicular software development tools. In an academic context, this module has been delivered as part of a PhD course. Furthermore, it has been incorporated into 11 instances of master's courses across four European universities. When offered in an industry context, the module is kept concise and more focused on hands-on activities and practical use cases. In contrast, when the module is delivered in an academic setting, it is supplemented with additional lectures and discussions on its topics. Interestingly, the feedback received from participants, especially those from the industry, has not only contributed to refining this educational module but has also advanced the state of the art in modeling and timing analysis of embedded software architectures.
With the easy accessibility of generative AI tools, software engineering students are increasingly using these tools in their coursework. However, the impact of these tools on the students' development of core computational thinking skills remains unclear. In this paper, we present our ongoing research that investigates whether access to ChatGPT during the learning process influences students' understanding and retention of essential computational skills. We specifically look at their ability to decompose complex problems (decomposition) and abstract key elements into classes and objects (abstraction). In a controlled, between-subject experiment, we divide students into two groups: one with ChatGPT assistance during the learning phase and a control group relying solely on traditional resources. Participants first undergo a study session to learn and apply decomposition and abstraction skills through various tasks, followed by a retention test session within a week from their study session. We measure the time taken to complete the tasks as well as the correctness of the solutions submitted by participants for each task. Participants also complete a post-study survey to provide insights into their experiences and to gauge their confidence in their solutions and acquired skills. We also analyze screen recordings and ChatGPT interaction logs to better understand the participants' usage strategies and interaction patterns. Our study aims to contribute to the ongoing discussion regarding the pedagogical role of generative AI in Software Engineering education and to offer guidance on effectively integrating these tools into teaching and learning practices.
With the high amount of data in applications like healthcare, education, and finance, there is a requirement for sophisticated analytical methods that can tune in real-time and generate precise forecasts. In this paper, a proposed methodology is introduced that is a novel model combining both artificial intelligence (AI) and machine learning (ML) for predictive analytics enhancement in a dynamic setting. Technologies presented are AI-assisted pre-processing of data that detects faults and extracts relevant features, and machine learning algorithms that dynamically tune the model parameters. The resilience mechanism is the most critical component in the working of the proposed methodology that utilizes adaptive learning rates and anomaly detection to enable the model to detect noise and anomalies. Furthermore, a feedback loop is included in the model to enable continuous optimization based on performance metrics to increase accuracy. The following work discusses the design of the proposed methodology, includes an algorithm, discusses its applicability in different industries, and the benefits of the proposed model compared to existing predictive analytics models, specifically in the ability to rapidly update data and detect anomalies.
Plagiarism activities such as copying code, algorithms, or documentation without consent and lack of attribution are rising in industry and academia. While this can be attributed to the rise of generative AI, a lack of awareness about plagiarism and its implications among soon-to-be software engineers and practitioners raises serious concerns about academic integrity and adds another dimension to this challenge. This research proposes exploring "replicating a study" as a pedagogical tool to impart ethical considerations to software engineering undergraduate students. Replicating a study involves recreating and validating existing research findings utilizing datasets from the original study, contributing to a deeper understanding of engineering concepts. Thus, while working on a replication study, students can be prompted to explore and understand professional ethics such as obtaining informed consent, permission to reuse data, and giving credit to original authors. Using preliminary results from such an experiment with two undergraduate student groups, in this ongoing research, we explore and solicit input to modify the methodology for a more extensive study.
Security Requirements Engineering (SRE) is a fundamental process in the development of secure systems, ensuring that security needs are identified and addressed early in the software development lifecycle. However, existing literature highlights a gap in integrating human aspects of security within SRE, which can lead to complex security solutions that are prone to human errors, increasing the risk of security breaches. Over the years, the need to incorporate user-centric approaches into security design has become apparent. This paper presents a persona-based approach that incorporates human factors in the early stages of system development and thereby improves the quality of the security requirements elicitation process. By characterizing users and attackers based on their needs, motivations, and behaviors, the approach enhances the identification of security vulnerabilities arising from human interactions. The proposed methodology contributes to both research and practice by enabling security engineers to design security mechanisms that align with user behavior, ultimately improving user security engagement and reducing security risks.
The growing dependence on the Internet and the corresponding increase in connectivity demand have led to a huge expansion in Internet of Things (IoT) devices. Recent studies have found that when IoT devices are used more frequently, there are more potential attack surfaces, which has raised network vulnerabilities. This illustrates the increasing susceptibility and vulnerability of IoT networks and devices. Therefore, appropriate, efficient, and successful attack detection and mitigation techniques are needed in such circumstances. Malware is becoming more sophisticated, requiring dependable detection technologies. Machine learning (ML) and Deep learning (DL) models can accurately identify and classify malware in complex and dynamic contexts. This paper introduces the proposed hybrid model combining the neural network (NN) and Light Gradient Boosting Machine (LightGBM) to identify malware using the CIC-Malmem 2022 dataset. The hybrid model is also compared with the state-of-the-art and with different ML models including Naive Bayes (NB), Random Forest (RF), Extreme Gradient Boosting (XGBoost), Gradient Boosting Machine (GBM) and LightGBM. The performance metrics including accuracy, recall, precision and F1-score have been evaluated for malware detection.
In software engineering education, team composition in project courses represents a persistent challenge. This study investigates how interpersonal connections influenced teamwork quality (TWQ), team success, and team performance in a software engineering capstone course, involving 54 student teams. Using a mixed-methods approach, we analyzed 468 survey responses and conducted 19 semi-structured interviews. Teams were grouped based on how many pre-defined team members they worked with in the team. Some teams had multiple pre-existing connections in the team, others included pairs of students who knew each other from before, some were a mix of familiar and unfamiliar members, and others were made up of students with no prior relationship. We found that teams where most students already knew two of their teammates generally worked better together. These teams reported higher scores on TWQ and team members' success, likely because of stronger trust and group cohesion. Despite high scores, some of these teams struggled with subgroups forming within the team and an uneven distribution of work. Teams with a mix of known and unknown members reported the highest balance of contribution score. It seemed like this mix encouraged a more even workload across members. In contrast, teams of mostly unfamiliar members reported the lowest TWQ, team success, and team performance. These teams often faced difficulties with coordination and collaboration. The results highlight the complexities of team composition in software engineering education and offer helpful guidance for educators when assembling student teams.
In the field of network security, botnet attacks pose a significant challenge, exploiting networks of infected devices to launch sophisticated threats. As these attacks evolve, the need for effective detection methods becomes increasingly critical. This study proposes an explainable Machine Learning (ML) model that aims to identify and categorize botnet attacks, and it investigates the efficiency of different Explainable Artificial Intelligence (XAI) techniques for Intrusion Detection Systems (IDS). To train our models, we employed a subset of the NCC-2 dataset, which includes a mix of normal traffic and seven different types of botnet attacks across three sensors. The ML techniques selected for this research are Random Forest (RF), Extra Trees (ET), Decision Tree (DT), and K-Nearest Neighbors (KNN), with a GridSearch cross-validation approach for optimal hyperparameter tuning. We also explored the effects of class balance through Synthetic Minority Oversampling (SMOTE) and Random Undersampling. The models' performance was rigorously tested using the Matthews Correlation Coefficient (MCC) and Macro F1-score, with the ET model demonstrating superior results of 99% MCC and 97% F1-score, respectively. To enhance the interpretability of the ET model's decision-making process, we integrated three XAI techniques: SHapley Additive exPlanations (SHAP), Dalex, and Local Interpretable Model-agnostic Explanations (LIME), and evaluated their efficiency. The LIME and Dalex techniques showed efficient construction times for IDS.
Software engineering education increasingly emphasizes hands-on experience through real-world projects. While technical proficiency is rigorously assessed, soft skills, such as communication, leadership, and adaptability, play a crucial role in team performance and project success. This study investigates the impact of soft skills on group dynamics in the Software Engineering course at Groningen University, where students work on real, industry-led projects. We analyze instructor evaluations, weekly team assessments by teaching assistants, and coursework grades to classify student teams based on their collaboration effectiveness. Our initial findings reveal a spectrum of team performances, ranging from highly effective groups that consistently achieve positive results to struggling teams that require intervention. Initial results suggest that well-balanced soft skills distribution correlates with higher academic performance and smoother team dynamics, whereas teams with deficiencies in communication and leadership tend to face challenges. To further refine our understanding, we plan a cluster analysis to identify distinct group types and collaboration patterns. This classification will help predict potential difficulties and guide proactive interventions to support student teams more effectively. By integrating soft skills assessment into the team formation process, this research aims to enhance educational strategies in software engineering. The insights gained can inform course design, improve team-based learning experiences, and better prepare students for collaborative work in professional software development environments.
Context Static Application Security Testing (SAST) tools play an important role in finding software vulnerabilities during the first phase of the software security testing pipeline and development. Yet, the aptness of these tools to find vulnerabilities and their incorporation into Continuous Integration/Continuous Deployment (CI/CD) pipelines is an open research area. Objective: This research provides a systematic analysis and comparison of popular SAST tools (i.e., SonarQube, Checkmarx, and Bandit) based on their capability in vulnerability detection within CI/CD pipelines. Methodology: A systematic literature review (SLR) process was performed, making use of the methodology by Kitchenham and Charters [12]. The review process consisted of six stages: 1) defining research questions, 2) developing a search strategy, 3) selecting relevant studies, 4) assessing study quality, 5) extracting data, and 6) synthesizing the findings. Three performance metrics, including recall, precision, false positive rate, and detection accuracy, were used to evaluate the tool's performance. Results: Results revealed that SonarQube was popular and showed good performance on Java applications, Checkmarx had a higher precision but also generated more false positives, and Bandit was a highly effective tool for Python security flaws. The OWASP Benchmark was most commonly used but lacked diversity due to its real-world, imbalanced nature, whereas the Juliet Test Suite offered more extensive and exhaustive coverage. In terms of reporting evaluation metrics, the True Positive Rate (TPR) and False Positive Rate (FPR) were the most commonly used, whereas the Youden Index (YI), despite being less commonly used, provided a more balanced measure of performance. Conclusion: The report highlights the necessity of employing a holistic approach to vulnerability detection, demonstrating that no one SAST solution is best at everything. Further studies are to target these tools to improve precision and recall to reduce false positives and develop their combinatorial treatment within the current DevSecOps flow to enhance software security.
Large-scale agile (LSA) development presents challenges in effectively integrating technical expertise. Prior research reported a range of challenges in LSA,however, specific mechanisms and roles for ensuring technical quality remain underexplored. This qualitative case study investigates specialized 'Product Guardian' role within LSA context, examining its responsibilities, challenges, and impact on product quality. Semi-structured interviews were conducted with software professionals and analyzed using thematic analysis. We identified four primary themes: perceived necessity and value proposition of Product Guardian role; core responsibilities associated with the role, ensuring effective development by bridging technical and product perspectives; challenges faced by individuals fulfilling this role. Additionally common impediments within LSA teams that Product Guardian interacts with or mitigates. Our findings suggest that Product Guardian role can be instrumental in enhancing product quality by proactively addressing socio-technical debt in LSA projects. This study provides practical insights for organizations that customizing roles focused on technical integration can be a viable strategy to overcome challenges to product quality in LSA development.
Serverless architecture has gained significant traction due to its scalability, cost efficiency, and reduced operational overhead. However, despite its advantages, serverless architectures introduce unique security issues that developers encounter when developing applications with open-source serverless platforms. While prior research has explored security concerns in proprietary serverless platforms, there is limited empirical analysis of security issues in open-source serverless platforms based on real-world developer discussions. This study systematically examines 88 security-related issues from GitHub repositories of 10 open-source serverless platforms to identify common security issues, their underlying causes, and potential solutions. Our findings reveal that certificate & encryption, permissions & role management, and security & authentication are the most frequently reported issues in the developers' discussion. The primary causes of these issues include misconfigurations, inadequate access controls, and dependency-related failures. To address these issues, we identified mitigation strategies such as enhanced security configurations, improved IAM policies, and automated certificate management. The study offers valuable insights for both researchers and practitioners by providing an empirical foundation for improving security practices when developing applications with these open-source serverless platforms.
DevOps practices' emergence into software development has revolutionized efficiency and agility in the development lifecycle. However, as organizations adopt DevOps, there is growing acceptance of the imperative to integrate security practices into the DevOps workflow. Traditionally, security practices were often implemented as standalone processes, but integration across the entire pipeline is imperative in the fast-paced DevOps environment. This research proposes a methodology to integrate DevOps and security practices to embed security seamlessly throughout the DevOps lifecycle. Our approach focuses on selecting, assessing compatibility, and incorporating security practices. First, we identify two distinct categories of practices. The nineteen DevOps Security practices were drawn from the prior studies focused on developing a framework for implementing DevOps practices, and eighteen security practices were chosen from a previous study aimed at constructing a framework for successful DevSecOps operation in software development organizations. Moreover, we also integrated ten security practices distributed among the distinct phases of the DevOps lifecycle that are highly compatible with DevOps practices.
This study investigate influence of human factors on socio-technical debt in large-scale agile projects. Existing research acknowledges technical debt but it lacks investigation into how human factors influence debt accumulation and mitigation in large-scale agile projects. We conducted a case study with inductive analysis and identified three primary categories of human factors: personal essence and growth, collaborative perseverance, and organizational dynamics. We maps these factors to specific debt categories. Personal essence and growth factors predominantly inhibit people debt, while collaborative perseverance factors primarily mitigate social debt and organizational dynamic factors significantly contribute to organizational debt. Notably, all human factors influence process debt. These findings provide insights into how human factors modulate socio-technical debt in large-scale agile environments, offering valuable practical and research implications.
DevOps has revolutionised traditional development workflows by integrating continuous deployment, automated testing, and realtime monitoring, yet its impact on structured software quality assessment remains underexplored. This study evaluates DevOps-based software development through the lens of ISO 25010:2023, analysing how key DevOps practices-including automation, deployment, monitoring, and security strategies-influence critical software quality attributes. By systematically assessing these interactions, this research identifies the strengths and limitations of DevOps in achieving high-quality software and highlights the challenges organisations must address to bridge the gap between agility and structured quality assurance. The findings provide actionable insights into optimising DevOps workflows while ensuring alignment with ISO 25010 standards, paving the way for more reliable, maintainable, and performance-driven software development.
Detecting security vulnerabilities early in the software development lifecycle can significantly reduce costs, maintenance, and time. Research has shown that over 75% of security breaches stem from the software application level. Despite many methods developed to detect code vulnerabilities, effectively addressing this issue remains challenging. This study aims to evaluate the effectiveness of Static Application Security Testing (SAST) tools in identifying security vulnerabilities within source code. The evaluation focuses on three key factors: performance, reporting, and usability of three widely used SAST tools-Fortify SCA, Sparrow SAST, and PVSStudio. To conduct the evaluation, we applied these tools to 25 Java test cases, estimating the total number of vulnerabilities detected by each tool. Statistical analysis was performed to compare the performance of the tools based on the number of vulnerabilities identified. In addition, the tools were assessed for their reporting capabilities, including the diversity and customization of report types. Finally, usability was evaluated using two well-established methods: the Heuristic Walkthrough Evaluation and the System Usability Scale (SUS). The results show that Sparrow SAST had the best detection performance, identifying more vulnerabilities than Fortify SCA and PVS-Studio. Fortify SCA, however, was superior in reporting, offering diverse and customizable options, and ranked highest in usability based
This paper introduces Risktionary, a Pictionary-based game designed to teach Risk Management activities in a tertiary level Software Engineering course. An empirical study was conducted to evaluate the impact of Risktionary on student performance, engagement, motivation, and satisfaction. The study involved five groups from two universities who played the paper-based and web-based versions of the game. Results indicate that, regardless of the version, students exposed to Risktionary outperformed the control group taught in a "traditional" manner. Additionally, students playing the game, particularly those with no prior experience in risk management, reported consistently high levels of engagement, motivation, and satisfaction. These findings highlight the potential of gamification as an effective tool for improving the learning experience and outcomes in a Risk Management lecture.
As organizations strive for faster delivery cycles and greater efficiency, DevOps as a Service (DaaS) has emerged as a model that allows businesses to leverage DevOps tools and practices through cloud-based platforms. However, the adoption of DaaS presents unique challenges, including integration complexity and alignment with the organization's existing processes. Despite its increasing importance, there is a lack of empirical research on DaaS that identifies the challenges in the adoption of DaaS in the software industry. Moreover, DaaS also introduces specific challenges for client organizations and service vendors. This paper examines these challenges through a mixed-methods approach, including interviews and industrial surveys with industry professionals. To achieve this, we conducted a mixed-methods study involving interviews with 12 industry professionals, including DevOps architects, DevOps engineers, and service providers. We also surveyed 18 participants with experience in DevOps as a service to gather relevant data. The study indicates that a lack of flexibility in customization and integration with existing CI/CD pipelines is a key challenge in the adoption of DaaS in industry projects. We believe the identified challenges can help organizations better understand and manage DaaS projects.
Background: Quantum technologies are evolving rapidly, we are now in the era referred as Noisy Intermediate Scale Quantum (NISQ). Currently, research is focused on Quantum Error Correction and Quantum Hardware concerning security aspects. Aim: In this paper, we aim to investigate the attack surface in a hybrid quantum-classical scenario from an attacker perspective. It is the most common scenario regarding quantum computing in the software engineering community. Method: We perform a poisoning attack on both the classical and quantum implementation of the Support Vector Machine (SVM) algorithm, to compare them and test its effectiveness. We also perform a "noise simulation" attack, where the attacker exploits a feature exclusive to quantum hardware, to increase decoherence in the system, worsening overall performance. Results: We found that the quantum implementation of the SVM algorithm is also vulnerable to poisoning attacks. The severity of the attack is hard to compare and is reduced when performing data preprocessing techniques. We were able to test how simulating noise can worsen the performance of a model: the idea is to simulate noise in the official library used to perform local computation by simulating qubits, effectively worsening the model's performance. Conclusion: Our findings showed how hybrid quantum-classical system can be exploited by an attacker. As future work, it will be interesting to explore related security aspects.
