Understanding binary programs is challenging due to the loss of high-level abstractions during compilation. Type inference plays a key role in recovering information such as variable types, data structures, and class hierarchies, which is crucial for reverse engineering (RE), decompilation, and security analysis. This paper presents a survey of 50 binary type inference tools. We categorize the tools based on the types they recover and the methods they use, including dynamic analysis, static reasoning, symbolic execution, and machine learning. We also compare their input formats, supported languages, and evaluation strategies. In addition, the survey discusses the scope and origins of the area, its evolution over the past two decades, and the challenges that lie ahead. Our study highlights recent progress, especially in learning-based methods, but also reveals ongoing limitations. These include limited scalability, lack of standardized output formats, and poor support for dynamically typed languages. We also observe a lack of user-friendly interfaces and limited availability of source code for many tools, which hinders adoption and further development. We conclude by outlining open research problems and recommending future directions to make type inference tools more accurate, accessible, and widely applicable.
Software vulnerabilities present a critical threat to information security, particularly as software systems grow in complexity and adopt emerging technologies. Existing vulnerability detection methods often fail to adequately address complex code structures and subtle semantic vulnerabilities, underscoring the need for more advanced analysis techniques. To overcome these limitations, this paper proposes HSF-Vul, a novel approach for software vulnerability detection and localization based on hierarchical semantic fusion. HSF-Vul innovatively leverages the inherent hierarchical structure of source code by extracting and integrating features at the token, line, and function levels through specialized neural encoders and attention-based aggregators. This design captures both fine-grained local semantics and global structural dependencies, enabling a comprehensive understanding of code semantics. The incorporation of structural information and pre-trained language models further enriches code representations and enhances the recognition of subtle vulnerability patterns. We frame vulnerability detection as a binary classification task and extend it to line-level localization by analyzing the contribution of individual code lines. Extensive evaluations on multiple vulnerability datasets demonstrate that HSF-Vul consistently outperforms state-of-the-art baselines, achieving F1 score improvements of 2.11
Automated docstring generation is a high-fidelity task where factual correctness and efficiency are critical for resource-constrained Small Language Model (SLM) deployment. Yet existing evaluations rely on heterogeneous metrics, limited human validation, and aggregate statistics that hinder comparison. We present a reproducible, human-validated evaluation framework applied to 13 strategies—four architectural families (Plain LLM, Few-Shot, RAG, Iterative Critique RAG) crossed with four reasoning variants (Base, CoT-, ToT-, GoT-style)—across three SLMs spanning 3B–14B parameters (Llama 3.2 3B, Qwen3 8B, Phi-4 14B) on 1,400 Python classes (54,600 generations), plus targeted ablations. All inference uses per-class linear mixed-effects models, and automated metrics are validated on a stratified subset (96 outputs, five of thirteen strategies) against a strictly blind two-annotator human study (ICC =0.63 ). Four findings challenge common assumptions. First, under the evaluated settings, model choice shows the strongest association with quality: Phi-4 and Qwen3 significantly outperform Llama 3.2 3B on code-referenced faithfulness ( +0.047 , +0.064 ; p<0.001 ), while no architecture improves faithfulness over zero-shot generation. Second, what is retrieved matters more than whether: matched (code, docstring) exemplars beat zero-shot on every model ( +0.04 to +0.09 BERTScore), whereas documentation-context retrieval stays marginal. Third, GoT-style decomposition is the only reasoning variant with a significant faithfulness gain ( +0.032 , p=0.003 ; corroborated by blind humans) at 3.1× latency, whereas ToT-style branching costs 11.4× with no benefit. Fourth, small LLM judges agree with each other ( ρ =0.979 ) yet not with blind humans (r between -0.21 and 0.05), whereas reference-based metrics validate well. The study contributes a reproducible, human-validated evaluation methodology and evidence-based guidance for resource-efficient SLM documentation.
Automating tasks on mobile software remains challenging due to frequent user interface evolution, dynamic runtime content, and the high maintenance cost of script-based automation. This work aims to improve the robustness and maintainability of mobile software automation without relying on source code or stable application programming interfaces. We propose an autonomous automation framework that combines automated user interface exploration, semantic knowledge graph construction, and large language model–guided reasoning. The system incrementally builds a persistent semantic representation of application interfaces and grounds natural-language task instructions to UI elements using semantic enrichment, fuzzy matching, and template–instance abstraction. Executable action sequences are generated through graph-based planning and carried out via system-level UI operations. The framework is evaluated on five widely used Android applications. The constructed knowledge graphs achieve an average UI coverage of 96.4
As a collaborative effort, the modeling of software systems must bring the work of many together in a coherent way. Combining multiple models into a single version is a key challenge. The predominant focus has been on pairwise merging, which though effective, comes up short when more than two models are to be merged. N-way merging addresses these shortcomings. The study aims to provide an adaptable and customizable process for integrating multiple model versions during software development. POLYMER, a novel means of simultaneously merging N versions of a model is put forth. A rule-based foundation makes its four phases: comparison, conformance checking, merging and reconciliation, highly configurable. To demonstrate the approach’s applicability, a proof-of-concept based on the Epsilon toolkit was implemented. A real-world case study involving 49 software engineers from academia, an online workshop with 10 model-driven engineers, effort analysis with three model management experts, and two experimental evaluations of various datasets, demonstrate that POLYMER: (1) is effective for integrating multiple versions of a model; (2) is user-friendly and useful for model integration; (3) is efficient, particularly in the merging phase; (4) is suitable for model-driven development processes. POLYMER is a novel, rule configurable process for simultaneously merging multiple model versions. The results confirm its applicability and advantages in real-world scenarios, making it a valuable tool for collaborative software modeling.
Navigation is a fundamental capability for automated exploration in immersive Virtual Reality (VR) environments. While prior work has largely focused on path optimization in 360-degree image datasets or in pre-trained 3D simulators, such approaches are difficult to apply directly to general VR applications involving unseen scenes and dynamic interactions. To address this gap, we present NavAI, an extensible navigation framework that leverages large language models (LLMs) to support both basic action commands and multi-step goal-oriented navigation through an application-agnostic screenshot-and-control interface. NavAI decomposes navigation into perception, decision making, and control execution, and explores multiple model variants that balance effectiveness, efficiency, and robustness. In particular, NavAI establishes an LLM-based navigation baseline and explores optimization strategies for virtual scene understanding and navigation goal decision making, enabling systematic comparison between baseline and optimized designs. In an evaluation covering two Unity environments and three distance regimes, the voting-based Full Mode achieves a 100 ≈ 53% and per-attempt token consumption by up to ≈ 82% compared to LLM-only baselines, while adding a small overhead indoors; Full Mode consumes up to ≈ 2.9× the tokens of the equally successful Gemini (YOLO) variant because every decision is made by three sequentially invoked models. Based on these findings, we discuss the limitations of LLM-driven navigation and outline directions for future optimization and practical deployment in immersive VR systems.
Existing Large Language Model-driven automated unit test generation methods still have limitations in test intent understanding, contextual information organization, and generated-result validation, making it difficult to steadily improve the quality and coverage of generated test code. To address this problem, this paper proposes an automated unit test generation method based on iterative optimization with dynamic validation and minimal target repair. In the analysis phase, the proposed method parses the structure of the project under test through abstract syntax tree analysis, extracts key methods, dependency relations, and execution paths, and performs structured rewriting of source code to reduce contextual complexity and irrelevant information interference. In the generation phase, precise prompts are constructed based on the structured context to guide the LLM in generating complete test class code. In the validation phase, a dynamic validation mechanism is proposed to alleviate the “non-impactful omission” problem in traditional validation workflows by adjusting validation granularity. Meanwhile, a minimal target repair strategy is introduced by combining automated program repair techniques, enabling efficient repair with only small code modifications. Experiments are conducted on four open-source projects, namely Commons-Cli, Commons-Csv, Commons-Lang, and Gson. The results show that ValiFixTest maintains stable performance in coverage, test pass rate, and test quality metrics. It improves line coverage, mutation coverage, and the proportion of meaningful assertions on multiple projects, and also shows good semantic consistency in manual Oracle sampling. The experimental results indicate that the dynamic validation mechanism and minimal target repair strategy can reduce invalid generation while improving the executability, assertion effectiveness, and fault-revealing capability of generated tests.
The use of Reasoning Fine-Tuning (RFT) for large language models has become a mainstream paradigm for enhancing logical abilities, but simultaneously introduces data supply chain security risks. The current field faces a key problem: malicious actors can compromise security alignment through logic injection, and existing white-box and black-box attack studies struggle to fully reveal this deep threat mechanism. To address this, this research proposes a red-teaming testing method called CRAFT, or “Fine-tuning as Jailbreak.” This method employs a two-stage strategy: first, it uses an Oracle model to generate covert adversarial Chain-of-Thought (CoT) samples for logic camouflage; then, it uses a prefix-guided RFT strategy to forcibly overwrite the model’s refusal mechanism, solidifying malicious logic into the weights. Experiments on Llama-3.1 and Qwen2.5 not only confirm that the root cause of safety guardrail failure lies in the harmful content of the data rather than the fine-tuning mechanism itself, but also demonstrate that CRAFT achieves a saturated jailbreak success rate (JSR) of at least 92
Masked language models are increasingly used as the backbone of patch generation for automated program repair (APR). However, most Pre-trained Language Model (PLM)-based repair systems treat code as token sequences, underutilizing structural cues such as control and data dependencies. Consequently, they can produce test-passing patches that are not fully consistent with the intended behavior. We propose StructFix, a structure-aware APR framework that grounds masked patch generation in Code Property Graphs (CPGs). StructFix constructs method-level CPGs from the unmasked program context, encodes structural dependencies with a graph encoder, and integrates graph evidence into token representations through span-based token–node soft alignment and token-wise gated graph–text fusion. This design enables the model to use structural signals in a context-dependent manner while predicting masked tokens. StructFix correctly repairs 86 Defects4J v1.2 bugs, including 12 not repaired by any compared baseline, and repairs 30 Java and 28 Python defects on QuixBugs, which demonstrates cross-language robustness. Our experimental results show that explicitly coupling structural dependencies with masked generation improves repair effectiveness and enables transfer across datasets.
Gestational Diabetes Mellitus (GDM) is a type of diabetes that manifests during pregnancy, which can adversely affect the health of mothers and infants. To mitigate the adverse effects associated with GDM, substantial research has been undertaken to develop predictive models to facilitate early detection. Although several predictive models have been developed, their effectiveness is often limited by imbalanced datasets, dataset uncertainty, and feature overlapping. To address the limitations mentioned, this study proposes a stacked FFNN-CatBoost model and a shallow FFNN model to enhance early GDM prediction and improve predictive performance on imbalanced and uncertain datasets. Additionally, the elbow method and multivariate analysis have been employed to address data imbalance and improve model performance. Furthermore, SHAP analysis has been conducted to interpret model predictions and identify the features influencing predictions of GDM and non-GDM cases. To ensure the reliability of the findings, the proposed model statistically validated using Welch ANOVA. The proposed hybrid model, combining FFNN, CatBoost, and Shallow FFNN, achieved up to 94
The quantitative assessment of ontological modularity constitutes a major methodological bottleneck for ontology engineering. Unlike software engineering, which benefits from standardized metric suites such as the CK metrics, and database engineering, which relies on normal forms, the field of modular ontologies lacks recognized evaluation tools. This paper proposes a set of four complementary metrics — Semantic Cohesion (), Incoming Coupling (), Outgoing Coupling (), and Public Interface Size () — grounded in graph theory and information theory. Each metric is accompanied by operational alert thresholds (ideal, acceptable, critical) and explicit corrective actions. A case study on an inappropriate content detection system for online youth protection, comprising 10 modules, 51 concepts, 78 relationships, and 24 SWRL rules, illustrates the applicability of the approach. The results enable the identification of architectural anti-patterns (orphan modules, unstable modules, excessive coupling) and guide targeted refactoring operations. The proposed metrics integrate into the OntoModIS methodology and represent a significant step forward for the objective evaluation and improvement of modular ontology architectures.
Fuzzing has proven effective at discovering software vulnerabilities. To improve performance when facing complex constraints, hybrid fuzzing combines fuzzing with symbolic execution. However, existing approaches face two key challenges: redundant constraint solving when multiple test cases share common path segments, and the underutilization of symbolic execution when full-path solving does not directly yield useful mutation guidance. To address these challenges, we propose SymDict, a hybrid fuzzing system based on symbolic dictionaries. SymDict reduces redundant symbolic execution by performing constraint solving only at uncovered branches in frontier basic blocks, i.e., blocks with at least one still-uncovered control-flow successor. To overcome the underutilization problem under hard-to-solve constraints, SymDict partitions constraint sets into solvable subsets, combines solutions with offset information to create symbolic dictionaries, and uses these dictionaries to guide fuzzing mutations. To mitigate the additional time overhead introduced by symbolic execution, SymDict employs a deterministic mutation filter and a critical bytes filter. We evaluate SymDict by comparing it with a representative hybrid fuzzing system based on AFL and SymCC, using real-world programs from FuzzBench as benchmarks. The evaluation results indicate that SymDict leads to noticeable gains in both path and edge coverage, supporting the effectiveness of our optimizations.
Refactoring and maintainability are central to sustainable software development, yet existing tools often lack the intelligence to adapt to evolving codebases and developer practices. This paper introduces Design-AI, a novel framework that integrates deep evolutionary algorithms with adaptive intelligence to automate the identification and recommendation of refactoring opportunities. The framework learns from historical refactoring patterns and contextual project features to deliver personalized, quality-driven refactoring decisions. The proposed approach is evaluated using a comprehensive experimental setup that includes the RefactoringMiner corpus, curated GitHub repositories, and industry-grade benchmark datasets. Results show that Design-AI improves the Maintainability Index by an average of 18.6
In-vehicle Human-Machine Interface (HMI) systems impose increasingly stringent requirements on three-dimensional rendering quality and runtime stability. Unreal Engine (UE) has been widely adopted in scenarios such as instrument clusters, infotainment systems, and 3D navigation owing to its high-fidelity rendering capabilities. However, on resource-constrained in-vehicle terminals with rapidly evolving hardware, rendering performance is jointly influenced by high-dimensional heterogeneous configurations, dynamic workloads, and platform variations. Moreover, multiple key performance indicators (KPIs), including CPU/GPU utilization, video memory read/write throughput, and memory footprint, are often correlated due to shared rendering workloads and hardware resource constraints. This makes traditional measurement-based and experience-driven tuning approaches costly, difficult to generalize across platforms, and prone to inconsistent assessments. To address these challenges, this paper formulates UE rendering performance prediction as a regression problem that maps configuration, workload, and hardware features to a multi-dimensional performance space, and proposes TRM (Transformer-enhanced Rule-based Multi-task performance prediction model). The proposed method first employs Transformer-based representation learning to map mixed-type inputs onto a continuous latent manifold, thereby alleviating the difficulty of measuring similarity directly in the original heterogeneous feature space. Subsequently, compact fuzzy rule prototypes are constructed in the latent space to characterize typical system states, with rule activation intensities serving as soft gating signals to guide a multi-task shared network for collaborative regression across multiple KPIs. This architecture allows the model to exploit shared latent system states across correlated metrics and improve data efficiency under limited measurement samples. To evaluate the proposed approach, we construct URP-D (Unreal Rendering Performance Dataset), a benchmark dataset for UE rendering performance prediction, encompassing runtime configurations, workload characteristics, and hardware heterogeneity across four in-vehicle platforms, with eight industry-relevant KPIs as prediction targets. Experimental results based on repeated cross-validation show that TRM achieves an average MMRE of 3.15
Inferring behavioural models from system executions is essential for supporting formal verification and analysis of complex, heterogeneous cyber-physical systems (CPS). Automata learning provides an effective way to infer state machine models from system executions. However, CPS inputs and outputs often consist of numeric time-series data, while automata learning algorithms assume inputs over a finite symbolic alphabet. As a result, raw numeric data must first be abstracted into a finite set of symbols. In this article, we present MELA, a passive automata learning approach enhanced with machine learning to synthesize behavioural models from numeric time-series data generated by CPS. MELA systematically combines statistical machine learning with automata learning to automatically abstract raw numeric signals into interpretable intervals that are strongly correlated with system states. Specifically, MELA uses information-theoretic variable selection and decision-tree-based range abstraction to transform numeric traces into symbolic representations suitable for automata learning. We evaluate MELA on two CPS: a commercial network intrusion detection system developed by our industry partner, RabbitRun Technologies, and a publicly available industrial autopilot benchmark from the aerospace domain. Compared with expertise-based numeric data abstraction, MELA reduces the number of states and transitions in the learned state machines by 49.20% on average, while improving accuracy by 41.71% on average. Furthermore, the learned state machines support system-level requirement verification and help practitioners explore behaviours that are not explicit in the system requirements. We make our implementation and experimental data available online (Ayoughi et al. 2026a).
The code integration process is critical for any distributed, large-scale open-source software (OSS) project. It serves as an implicit or explicit quality control gate and is inherently of a socio-technical nature in that the bare technical act of merging new code contributions is preceded by (oftentimes engaged) discussions and reviews. Given the reasonable and widely accepted assumption that professional experience and seniority lead to higher social credit in communities, more experienced developers are expected to get favored in this process, manifesting in higher probabilities of receiving feedback on contributions, or getting contributions accepted. We conjecture that exceptions to this pattern may indicate procedural issues and examine this hypothesis through a mixed-method study. To this end, we use developer coreness, a continuous proxy measure of experience that measures how important and connected a developer is within a project. We then study code integration processes of 16 popular OSS projects, employing a new methodology to measure the impact of developer coreness on these processes. This allows us to identify process-deviant projects, which we investigate qualitatively to determine whether unexpected observations indicate underlying procedural issues. Our findings show that developers with higher coreness values have a higher probability of getting code contributions accepted and, in many cases, of receiving feedback. Notably, projects identified as process-deviant often exhibit signs of procedural deficiencies, highlighting the practical utility of our methodological framework.
Automated stdin test-input generation remains an open problem because search-based and fuzzing tools target API-level unit tests rather than the multi-line structured input expected by standalone programs. We introduce CodeGAN-MPC, a Transformer-based conditional generative adversarial network that synthesises structurally valid stdin directly from Java source code. The model rests on three contributions: (i) a Line-Structure-Aware Generator that decouples blueprint prediction (lines, tokens per line, types) from value generation; (ii) a Differentiable Conformance Loss that penalises header–body length mismatches at the soft-logit level without discrete program execution; and (iii) a Coverage-Conditioned Generation mechanism that feeds real-time JaCoCo branch state back into the generator. Experiments on the CodeContests dataset (10,079 problems, 46,482 Java samples; 4,614-sample test split) show that CodeGAN-MPC achieves Pass@1 =78.77% , a 17.5 percentage-point gain over the best autoregressive baseline (CodeT5+), with runtime success 70.06% and line/branch coverage of 61.91%/52.32% , the best Pass@1, Pass@5, runtime success, and code coverage among all evaluated systems, with CodeT5+ ahead only at Pass@10. All figures are means over five random seeds, and the advantage over every baseline is statistically significant under a paired McNemar test. The results show that adversarial learning with explicit structural supervision is a practical route to structured test-input synthesis.
History coupling reflects how files change together during software evolution. Numerous studies have used history coupling information to identify bug-prone files. Meanwhile, various studies have captured the bug-prone files by examining architectural problems in them. However, there exists little work investigating the architectural connections embedded in historically coupled files. In this paper, we propose a suite of architecture hotspots that represents both history coupling information and architecture characteristics. We introduce the concept of history dependency between files, and formally define each architecture hotspot. Given the history dependencies, our approach will automatically identify architecture hotspots in a project. Through our evaluation of ten long-lived projects, we have presented that files involved in history-based architecture hotspots significantly contribute to a project’s bug-proneness. In addition, most of hotspots are long-lasting and their involved files continuously accumulate bug-proneness over software evolution. Moreover, we explored the impact significance of each hotspot type or their combinations on files’ bug-proneness. Finally, we conducted comparisons with the state of the art, and showed that our approach could capture a project’s bug-proneness more effectively. We believe that our proposed history-based architecture hotspots deserve special attention for maintenance and refactoring.
User stories play a crucial role in agile software development because of their structured format and ease of implementation. However, development teams face the challenging task of managing the variety of information required from multiple sources to craft user stories manually. Furthermore, poor-quality user stories can hinder communication among team members, potentially causing delays or leading to errors in the development process. We created a text prediction model to assist in drafting user stories, aiming to reduce writing errors and accelerate the specification process. We conducted a controlled experiment with sixteen participants split into experimental and control groups. Every group was invited to write user stories using a sample of software requirements as a reference. The first group utilized our text prediction model to auto-complete sentences, while the second group created user stories independently. To assess the quality of the user stories, we employed the AQUSA tool, which evaluates both syntactic and pragmatic aspects. Our analysis revealed that 75.6
Neural Code Models (NCMs) have shown strong performance across a wide range of code understanding tasks. However, recent studies reveal that such models are vulnerable to backdoor attacks. Backdoored NCMs behave normally on clean inputs, but produce attacker-expected outputs on samples injected with backdoor triggers, posing a covert, yet critical security threat. Existing backdoor defense techniques employ trigger inversion and trigger unlearning to mitigate such attacks. However, they often struggle to recover accurate triggers and to sufficiently eliminate backdoor behaviors due to reliance on coarse-grained heuristics and restricted unlearning strategies, leaving models still sensitive to inputs containing triggers. To address these issues, we propose BADERASER, a novel backdoor defense technique for backdoor elimination in NCMs. BADERASER introduces code naturalness as an auxiliary constraint and incorporates statistical indicators in trigger inversion to improve the quality of recovered triggers. Furthermore, we propose a distillation-based unlearning method to purify backdoor features while preserving clean knowledge. We evaluate BADERASER on multiple code understanding tasks, model architectures, and advanced backdoor attacks. Experimental results demonstrate that BADERASER outperforms state-of-the-art defenses in reducing the attack success rate across all evaluated attack scenarios, achieving an average attack success rate decrease of 54.37
