Fault localization is a critical task in software debugging and intelligent DevOps quality assurance, particularly in CI/CD workflows where root-cause identification after test failures directly affects feedback cycles and reliability maintenance. Although state-of-the-art heterogeneous-graph-based fault localization methods, exemplified by HetFL, have demonstrated strong capability, their commonly adopted designs still exhibit two limitations. First, permutation-sensitive aggregation may introduce instability: sequential aggregators such as BiLSTM are sensitive to neighbor-node order, so that non-semantic variations in neighbor ordering can lead to different suspiciousness rankings. Second, naive augmentation offers limited robustness: handling class imbalance through minority-class sample duplication only increases sample quantity without enriching fault-pattern diversity, causing the model to overfit surface representations under code evolution.To address these issues, we propose TransGFL. The framework explicitly models statement-level nodes in a fine-grained heterogeneous graph. Building on this enriched representation, TransGFL introduces two key designs: a Transformer-based permutation-invariant graph aggregator for stable fusion of unordered heterogeneous evidence, and a Dual Mixup feature-space augmentation strategy that generates more diverse and informative virtual training samples through feature-space interpolation. On the Defects4J benchmark, TransGFL improves Top-1 accuracy by 16.0% over HetFL (268 vs. 231), while MFR decreases from 6.41 to 6.01 and MAR from 7.63 to 7.34. Supplementary BugsInPy validation and an Apollo industrial case study further show that, under the same unified heterogeneous-graph input specification, the framework can adapt to Python and C++ ecosystems, providing additional evidence for its applicability to real-world industrial software artifacts.
The rapid proliferation of mobile health (mHealth) applications has generated unprecedented volumes of multilingual user reviews, creating significant challenges for requirements engineering practitioners who must extract actionable insights from unstructured, cross-lingual feedback at scale. This paper introduces a novel unsupervised Hybrid YAKE–Lexicon model that integrates the language-agnostic YAKE algorithm for statistical keyword extraction, n-gram analysis for multi-word phrase capture, a curated mHealth-domain lexicon for relevance enhancement, and a context-aware sentiment analysis engine for requirement prioritization. An empirical evaluation on 2,111,689 reviews from 117 mHealth applications across four languages (English, Spanish, French, and German) demonstrates the model’s effectiveness. For feature extraction, the Hybrid YAKE–Lexicon achieves an F1-score of 0.87 (evaluated on the English gold-standard subset, n=500), outperforming general-purpose baselines TF–IDF (F1=0.70), RAKE (F1=0.74), and KeyBERT (F1=0.80). It also compares favorably to the off-the-shelf, zero-shot performance of RE-specific systems T-FREX (F1=0.74) and RE-BERT (macro-F1=0.80), evaluated on the same English gold-standard subset (n=500) under an identical protocol. Requirement classification achieves 92% F1 for Functional Requirements and 88% for Non-Functional Requirements. Sentiment intensity prediction yields a Mean Absolute Error of 0.089 against human-annotated five-point Likert-scale labels (inter-rater agreement kappa=0.82), surpassing the VADER reference baseline (MAE=0.112). A systematic ablation study confirms the contribution of each pipeline component, with sentiment integration improving requirement prioritization by 14% in MAP (MAP: 0.75 to 0.89 relative to the baseline). The framework demonstrates robust multilingual performance and consistent results under ten-fold cross-validation on gold-standard and full-corpus evaluation protocols respectively. This research contributes a validated, scalable, end-to-end framework for automated multilingual requirements engineering from mHealth user feedback, providing practitioners with a reproducible tool for cross-lingual requirements analysis.
Bug reproduction in web applications often fails due to insufficient information in bug reports. Application monitoring (AM) could mitigate this problem by automatically collecting relevant information to support the bug reproduction process. However, there is (a) limited empirical evidence of AM’s effectiveness in real-world organizational contexts, and (b) limited insights about how to introduce AM into existing software development processes. This paper presents a longitudinal Action Research study conducted within Lentune, a mid-sized SaaS provider, to investigate how AM can support bug reproduction in web applications. Over five iterative cycles between July 2024 and October 2025, we implemented comprehensive end-to-end monitoring solutions encompassing client-side interactions, backend API activity, and infrastructure status, and evaluated their impact on Lentune’s bug reproduction processes. Our findings reveal that AM significantly improves bug reproduction efficiency, reducing non-reproducible bugs from 33% of all bugs to 0% and decreasing average bug closure time from 60 days to 15 days. We identified two essential categories of bug reproduction data: bug-specific evidence (data directly related to the bug) and contextual evidence (environmental and system context, including client, backend, and infrastructure layers). The study also uncovers significant socio-technical challenges in implementing monitoring solutions. Our results provide actionable insights for organizations seeking to implement AM for bug reproduction, demonstrating that successful adoption requires not only technical solutions but also structured training, change management, and iterative refinement of related processes and tools.
Ensuring software quality while meeting deadlines and adapting to evolving requirements is a persistent challenge in software engineering practice. This paper introduces Algorithm-Driven Development (ADD), a methodology developed from industrial practice to address recurring challenges in translating requirements into reliable, testable, and maintainable software behavior. ADD translates requirements into algorithmic flowcharts from which acceptance tests are systematically derived. These flowcharts serve both as specification artifacts and as technical blueprints, supporting shared understanding between stakeholders and developers. By linking requirement modeling with automated test generation, ADD provides systematic coverage of functional scenarios, including edge cases, from the outset of development. The approach was evaluated over a four-year period within an industrial project at Dassault Systèmes, involving two development teams, 22,444 lines of production code for Team 1, and 157 APIs analyzed for Team 2. The evaluation combined longitudinal quality and delivery indicators with a comparative analysis of ADD, TDD, and test-last development practices across API functions of different complexity levels. Empirical data collected from internal lifecycle management and CI/CD systems show that ADD supported sustained code coverage above 95%, low defect density in both QA and post-release phases, and a stable delivery cadence. These findings provide evidence of ADD’s potential to strengthen the connection between requirements, testing, and implementation in industrial software development contexts.
Large Language Models (LLMs) have been extensively adopted in software engineering to automate various tasks, including code comment generation, debugging, testing, and most notably, code generation. Retrieval-Augmented Code Generation (RACG) further enhances LLMs by incorporating external code repositories at inference time, but this design also introduces a new system-level security risk: knowledge-base poisoning, where adversarial or vulnerable code is injected into the retrieval corpus to steer generation toward insecure implementations. In this paper, we address the problem of defending RACG system against poisoning attacks by proposing RAGGuard, a defense-oriented framework that explicitly accounts for the presence of untrusted retrieved code exemplars during code generation. Rather than assuming benign retrievals, RAGGuard introduces system-level defense mechanisms that mitigate vulnerabilities induced by poisoned exemplars in the retrieval-generation pipeline. RAGGuard is developed atop LLM-based agents with three defense strategies: (i) Establishing a self-verifying workflow to autonomously assess and iteratively refine generated code for security under poisoned retrieval code exemplars; (ii) Leveraging security warnings to identify vulnerabilities embedded in retrieved code and prevent their propagation into generated outputs; and (iii) Embedding standardized vulnerability knowledge to guide secure code refinement and reduce sensitivity to instance-level poisoning. We evaluate RAGGuard through an empirical study involving five LLMs, and the results show that RAGGuard outperforms the baselines and enhances code security, with the third strategy achieving substantial secure-rate improvements, while preserving functional correctness. These findings demonstrate the effectiveness of system-level defense mechanisms in mitigating retrieval-induced security risks in RAG-based code generation systems.
As software systems become increasingly complex, security vulnerabilities pose a significant threat to system stability and data integrity. Although traditional static analysis tools can rapidly scan codes for known vulnerability patterns, they frequently exhibit high false positive rates owing to a lack of deep semantic understanding. The structured information provided by code property graphs (CPGs) offers critical context-aware features that can enrich reports generated by static scanners. Therefore, this study proposes a hybrid vulnerability alert validation framework that integrates static analysis, CPGs, and large language models (LLMs) to improve the precision of vulnerability alert validation and provide evidence-grounded diagnostic support. The proposed framework first employs multiple static analysis tools to perform an initial scan for identifying potential vulnerability warnings. Subsequently, the Joern analysis tool converted the relevant code into CPG representations. These structured features, which captured rich syntactic, semantic, and dependency information, were then input into the LLM. Using the code reasoning capabilities of the LLM, the framework performs a fine-grained assessment to confirm the validity of vulnerability alerts and generates evidence-grounded taint-flow explanations. Experimental results demonstrate the effectiveness of the proposed approach that achieved a precision of 96.43% and an F1-score of 87.10% on a controlled SARD dataset. On Devign/FFmpeg, the framework achieved an F1-score of 85.20% and filtered 95.2% of false-positive SAST noise. It also achieved an F1-score of 92.28% on CASTLE, outperforming representative formal verification, SAST, and LLM-based baselines. These results show its practical value in reducing alert fatigue and providing evidence-grounded diagnostic support for vulnerability inspection.
High-scale online services often rely on third-party APIs in user-facing flows such as authentication, messaging, payments, fraud detection, and identity verification. Integrating alternate providers and operating conventional failover controls is a common resilience baseline, but redundancy alone does not make provider selection adaptive, explainable, or policy-aware. This paper reports an anonymized industrial experience evolving a conventional multi-vendor SMS-provider failover arrangement in a large marketplace setting into configuration-driven adaptive API routing. The report emphasizes practical motivation, industrial context, design rationale, rollout path, operational challenges, lessons learned, and transferability conditions. The approach uses operation-specific pluggable factor lists to separate routing policy from application code, combines hard eligibility gates with weighted provider scoring, and closes the loop with business-outcome telemetry, decision logs, traffic-shift controls, and recovery safeguards. We explain why conventional mechanisms such as timeouts, retries, circuit breakers, static priority lists, dashboards, alerts, and incident runbooks remain necessary but insufficient for partial, regional, quota-related, or business-outcome degradation. A supporting synthetic replay evaluation examines complete outage, latency spike, regional failure, quota exhaustion, partial degradation, and stale telemetry scenarios without disclosing production data. The experience suggests that adaptive provider routing can reduce dependence on incident-time interpretation when the operation is critical, telemetry volume is sufficient, and organizational controls exist for policy ownership, explainability, and safe traffic movement. The paper concludes with practitioner guidance and cautions for teams considering similar architectures.
Due to their widespread use in industry, several techniques have been proposed in the literature to fuzz REST APIs. Existing fuzzers for REST APIs have been focusing on detecting crashes (e.g., 500 HTTP server error status code). However, security vulnerabilities can have major drastic consequences on existing cloud infrastructures.In this paper, we propose a series of novel automated oracles aimed at detecting violations of access policies in REST APIs, as well as executing traditional attacks such as SQL Injection and XSS. These novel automated oracles can be integrated into existing fuzzers, in which, once the fuzzing session is completed, a “security testing” phase is executed to verify these oracles. When a security fault is detected, as output our technique is able to generate executable test cases in different formats, like Java, Kotlin, Python and JavaScript test suites.Our novel techniques are integrated as an extension of EvoMaster, a state-of-the-art open-source fuzzer for REST APIs. Experiments are carried out on 9 artificial examples, 8 vulnerable-by-design REST APIs with black-box testing, and 36 REST APIs from the WFD corpus with white-box testing, for a total of 52 distinct APIs. Results show that our novel oracles and their automated integration in a fuzzing process can lead to detecting security issues in several of these APIs.
The rapid rise of Artificial Intelligence (AI) technologies is reshaping Software Engineering (SE) practice, unlocking new opportunities while introducing human-centered challenges. Although prior research acknowledges behavioral and other non-technical factors affecting AI integration, most studies still emphasize technical concerns and offer limited insight into how teams adapt to and trust AI systems. This work proposes a Behavioral Software Engineering (BSE)-informed, human-centric framework to support SE organizations during early AI adoption. We employed a mixed-methods methodology to construct and refine the framework. A literature review of organizational change models established its theoretical foundation, and thematic analysis of interview data produced concrete, actionable steps. The resulting framework comprises nine dimensions: AI Strategy Design, AI Strategy Evaluation, Collaboration, Communication, Governance and Ethics, Leadership, Organizational Culture, Organizational Dynamics, and Up-skilling, each supported by design principles and actionable steps. To collect preliminary practitioner feedback, we conducted a survey (N=105) and two expert workshops (N=4). Survey responses show that Up-skilling (15.2%) and AI Strategy Design (15.1%) received the highest $100-method allocations, highlighting their perceived centrality in early AI initiatives. Findings suggest that organizations currently prioritize procedural aspects such as strategy design, while human-centered guardrails remain comparatively underdeveloped. Early feasibility checks of the workshops reinforced these patterns and highlighted the importance of grounding the framework in real-world practice. By identifying critical behavioral dimensions and offering actionable guidance, this contribution provides practitioners with a pragmatic roadmap for navigating the socio-technical complexity of early AI adoption and outlines future research directions for human-centric AI in SE.
Software aging is a common phenomenon afflicting long-running software systems, such as Android platforms, cloud services, and virtualized infrastructures, where accumulated resource leaks and memory fragmentation may lead to performance degradation and ultimately to system crashes or service unavailability. Accurate time-to-aging-failure (TTAF) prediction is crucial for enabling proactive software rejuvenation, allowing maintenance actions to be performed before severe failures occur. However, reliable TTAF prediction remains challenging because existing statistical and deep learning methods struggle to simultaneously capture the correlations among multiple aging indicators and the coexistence of short-term fluctuations with long-term degradation trends. To address these challenges, this paper proposes GXLF, a novel prediction framework that combines multiscale graph convolution (MGC), extended long short-term memory (xLSTM), and a frequency-domain window transformer (FWin) to comprehensively model both the structural and temporal characteristics of software aging. Specifically, MGC captures the correlations among software system metrics, xLSTM captures temporal dependencies and extended sequential patterns, and FWin extracts global frequency-domain trends for long-range degradation modeling. Experiments conducted on run-to-failure datasets from Android and OpenStack systems demonstrate that GXLF outperforms nine baseline models and achieves improvements of 19.90%, 25.85%, and 5.93% in MAE, RMSE, and R2 compared with the best-performing baseline model PMTT, validating its effectiveness and robustness in TTAF prediction for complex software systems.
Context: The automotive industry is transitioning from hardware-centric development towards software-defined vehicles (SDVs), where software drives functionality, value creation, and competitive differentiation. This shift challenges proprietary software development, firm-centric innovation, and traditional supply chain models, giving rise to ecosystem-based collaboration. However, SDV transformation is primarily framed as a technical change, leaving its broader ecosystem implications insufficiently understood. Objective: This study explores the transformation of SDV ecosystems, their stakeholders, collaborative structures, roles and authority, and highlights associated challenges and opportunities. Methods: This systematic literature review collected 351 studies from six databases and selected 25 for detailed analysis. Results: Four interrelated shifts (from hardware-centric to software platforms, from supply chains to collaborative ecosystems, from proprietary to open and standard solutions, and from firm-level control to distributed governance) characterise the transformation, with six levels of collaboration involving twelve stakeholder groups. These collaborations are influenced by five dimensions of authority. The literature also highlights six core software development challenges and various organisational, industry and market, and regulatory, legal, and ethical challenges. It identifies five software development opportunities and various organisational, industry and market, and public value and ethical opportunities. Conclusion: The first contribution integrates previously fragmented literature on the SDV ecosystem transformation, demonstrating how SDVs are transforming the automotive industry through the four interrelated shifts driven by software advancements. Second, it proposes an SDV ecosystems model that integrates SDV architecture, stakeholder groups, collaboration structures, and governance levels to facilitate sustainable SDV ecosystems. Additionally, agendas for research and practice are outlined.
Model-based systems engineering (MBSE) has become an important approach for modelling complex systems. However, transforming natural-language requirements into formal Systems Modeling Language (SysML) models remains difficult because of the complexity, multi-domain coupling, and knowledge-intensive nature of system design. To address this problem, this study proposes a knowledge graph-enhanced retrieval-augmented generation (KG-RAG) method for automatic SysML model generation. First, a domain-oriented SysML knowledge graph (KG) is constructed on the basis of the SysML metamodel and domain-specific knowledge. Second, a retrieval-augmented prompting strategy is developed to guide a large language model (LLM) in generating structured SysML artefacts under explicit syntactic and semantic constraints. Third, an automated transformation mechanism is established to convert the generated structured artefacts into tool-native editable SysML models. The proposed method is validated through a fixed-wing aircraft flight control system case study. The results show that the method can automatically generate eight types of SysML diagrams, including requirement, block definition, internal block, use case, activity, state machine, sequence, and parametric diagrams. Quantitatively, the automatically generated models achieve an average element-level model coverage rate of 90.42 ± 1.46%. These results indicate that the proposed method can reduce repetitive manual modelling effort and improve modelling efficiency, demonstrating its potential to support practical MBSE-based system design.
Memory leaks pose a persistent and critical threat in software development, leading to resource exhaustion, performance degradation, and potential system crashes. Existing memory leak detection approaches, whether static or dynamic, face significant challenges. Static analysis tools often grapple with a trade-off between accuracy and scalability, while dynamic methods struggle with achieving high coverage and generating effective test inputs.This paper presents LeakGuard, a static-analysis-based framework for memory leak detection. LeakGuard improves the balance between accuracy and scalability through a combination of memory-semantics-aware analysis strategies. It employs an iterative, path-sensitive approach to model custom Memory Allocation/Deallocation (MAD) functions, which are prevalent in modern software but often misidentified by existing tools. LeakGuard also performs targeted exploration of memory-relevant functions via under-constrained symbolic execution, thereby mitigating the path explosion issue that plagues traditional symbolic execution.Our evaluation on 18 real-world open-source projects, totaling 70,992 KLoC, and the NIST Juliet Test Suite demonstrates the effectiveness and practicality of LeakGuard. On the Juliet Test Suite, LeakGuard achieves a recall of 98% and reports no false positives under our evaluation setting, outperforming state-of-the-art tools such as Clang Static Analyzer, Infer, and Saber. In real-world projects, LeakGuard identifies 129 previously unknown memory leaks that were confirmed as true bugs by developers. Among the confirmed bugs, 109 have been fully fixed or patched, and 20 MySQL cases have been partially addressed. LeakGuard also exhibits practical scalability, analyzing large-scale projects such as the Linux Kernel in 3.9 h.
AI-based systems are used in high-stakes domains such as lending, hiring, policing, and healthcare, where unfair decisions can reproduce inequities through biased data, contested assumptions, feedback loops, and institutional change. The software engineering and AI communities have responded with fairness definitions, metrics, audits, verification, and mitigation approaches. However, there remains a gap in understanding how fairness can be engineered as an explicit, testable, traceable, and revisable requirement across the lifecycle of AI-based sociotechnical systems. This gap matters because conflicting fairness definitions make metric selection a requirements decision before measurement. This systematic literature review examines how fairness is elicited, specified, operationalized, validated, monitored, and revised. Following Keele’s protocol, we analyzed 107 peer-reviewed studies between 1996 and 2025 through Environment–System Design–Sociotechnical levels and lifecycle activities. Results show coverage across three levels, but explicit requirements are concentrated at system design. The literature is strongest in specification, operationalization, and offline validation, but weaker in elicitation, thresholds, acceptance criteria, monitoring signals, revision triggers, ownership, and governance. We synthesize these gaps as evidence that fairness requirements lose validity when assumptions, stakeholders, and constraints change. We contribute a requirements-centered synthesis and Multidimensional Iterative Fairness Framework supporting translation from context-sensitive concerns to testable requirements, monitoring, and governed revision.
Pre-trained code models have been widely and successfully used to tackle various code-based tasks. However, these models can still suffer from adversarial identifier-level substitution, a notable adversarial attack method. The effectiveness of model reconstruction methods is limited by substantial resource consumption. Although existing static defense approaches can mitigate adversarial attacks to some extent, there exist two limitations: 1) they can not detect the adversarial examples within real-world input data effectively; 2) they are difficult to effectively recognize and repair the perturbation of identifiers in adversarial code snippets. To address the above limitations, we propose a new adversarial example defense approach, called PEAR (PErturbation detection and repair for Adversarial Renaming identifier attacks), to defend against time-sensitive adversarial identifier-level substitution. First, we construct an adversarial example detection model before using the pre-trained code models to detect adversarial code snippets. Then, to defend against adversarial identifier-level substitution, we use predefined rules to recognize identifiers and repair anomalous identifiers in detected code snippets. To demonstrate the effectiveness and applicability of PEAR, we evaluate our method by defending against two representative black-box identifier-renaming attack methods on two widely used pre-trained code models (CodeBERT and GraphCodeBERT). On average, PEAR detects 92.36% of adversarial examples and repairs 66.88% of them, outperforming the optimal baseline by an average of 11.42% and 5.69%.
