Software testing is essential to ensure the reliability and correctness of software systems. However, the effectiveness of testing is highly dependent on the quality of the test suites themselves. Mutation analysis, a powerful technique for evaluating the quality of tests, introduces small changes into the code and checks whether the tests detect them. Despite its strengths, mutation analysis faces challenges in scalability due to the high computational cost of compiling and running tests against mutants. This paper presents MediumDarwin, a substantially upgraded version of the original LittleDarwin, initially introduced as a research prototype. Our enhanced version retains the original foundational architecture but introduces significant new capabilities and performance optimisations that transform it into a robust platform for both industrial use and advanced research. The enhancements made to LittleDarwin include: (1) persistent storage of mutation results in a relational database to facilitate advanced analysis, (2) coverage-based test selection optimisation to minimise test executions, (3) implementation of mutant schemata to reduce compilation overhead, (4) enhanced mutation operators alongside safeguards against non-compilable mutants, and (5) dynamic subsumption graph computation for efficient mutant analysis. These innovations collectively improve the tool's scalability and practical utility in software quality assurance in both industrial and research contexts. A screencast demonstrating the use of MediumDarwin is available at https://www.youtube.com/watch?v=Zsd3pZt63AE.
Android apps are getting bloated by continuously integrating possibly unnecessary functional modules. This trend of software bloat negatively impacts the performance of static analysis tools. As a result, analysis reports are more likely to contain false positives and experience analysis timeouts. Consequently, developers are forced to manually inspect and troubleshoot errors, as well as restart the analysis process, making analyzers more time-consuming and less user-friendly. However, existing approaches for Android app debloating almost only consider how to remove redundant code elements or functional features from the perspective of users, thus they are unsuitable for the analyzer-oriented app debloating task in most cases. To fill this gap, we propose an Android app debloating approach that employs a novel Multi-layer Dependence Graph (MDG) structure to represent the app under analysis. We hierarchically construct the MDG by sequentially analyzing and capturing dependence at the class, method, and statement levels. Throughout this process, we dynamically identify hotspot classes and narrow down the scope for further dependence extraction, thereby alleviating the challenge of a too complicated graph structure caused by the excessive app size. We implement our approach as the tool FlowSlicer, a novel MDG-based static Android app debloater. We evaluate FlowSlicer by utilizing it to debloat the input app first and then observing the performance difference of two analysis processes which accept the original and the debloated app as input respectively. The evaluation is performed on both the hand-crafted and the real-world apps in our benchmark. Our results show that FlowSlicer is not only capable of effectively debloating Android apps but also enhancing the performance of static analyzers. For instance, cooperating with FlowSlicer, the analyzer FlowDroid could detect 212 more leaks in real-world apps in our benchmark.
Logs are central to understanding what is happening inside CI/CD pipelines. Today's platforms often treat logs as passive artefacts rather than active indicators of risk. This research introduces DevSecLogs, a system designed to integrate security intelligence and enforce integrity throughout the pipeline. We are utilising Natural Language Processing (NLP) methodologies such as log tokenisation, topic clustering, and semantic filtering through Latent Dirichlet Allocation (LDA), specifically the topic modelling technique. We also implemented a deep learning-based anomaly detector, particularly a hybrid CNN-LSTM model, to surface irregular log behaviours, such as skipped test phases, unauthorised access attempts, or irregular command patterns. To keep the integrity of these logs, the system stores each step in a blockchain-integrated structure that makes any changes evident and ensures a permanent audit trail. The system is currently live on IBM Cloud, with planned integration into CI/CD tools such as Jenkins and Tekton, to enable secure, real-time log monitoring within DevSecOps workflows.
Generative artificial intelligence (GenAI) has taken software engineering by storm, as large language models (LLMs) have quickly come to generate large volumes of human-like text and code. Recent work has shown that, although excellent at mimicking human writing, these models have challenging limitations when writing code. Authors have identified how the code generated can be longer, more complex, worse performing, and contain more serious vulnerabilities than that written by humans. As the use of GenAI now shifts from a bleeding edge novelty to an amenity consolidated as the new status quo for software engineering, a pressing concern arises: It is still unclear how AI-written code impacts the long-term maintenance and evolution of software codebases. This PhD project investigates the previous concern by studying how AI-written code impacts four key qualities of source code: the system's ability to fulfill functional and non-functional requirements, the architectural cohesion, and the comprehensibility of the source code. By interacting with practitioners, analyzing software repositories, and proposing new approaches to using LLMs for software engineering, we expect to develop the theory and basis necessary to balance the benefits in productivity from GenAI with the everpressing needs for long-term software maintenance and evolution.
Code review is a fundamental practice in software engineering, ensuring code quality, fostering collaboration, and reducing defects. While research has extensively examined various aspects of this process, most studies assume that all code reviews follow a standardized evaluation workflow. However, our industrial partner, which uses Merge Requests (MRs) mechanism for code review, reports that this assumption does not always hold in practice. Many MRs serve alternative purposes beyond rigorous code evaluation. These MRs often bypass the standard review process, requiring minimal oversight. We refer to these cases as deviations, as they disrupt expected workflow patterns. For example, work-in-progress (WIP) MRs may be used as draft implementations without the intention of being reviewed, MRs with huge changes are often created for code rebase, and library updates typically involve dependency version changes that require minimal or no review effort. We hypothesize that overlooking MR deviations can lead to biased analytics and reduced reliability of machine learning (ML) models used to explain the code review process. This study addresses these challenges by first identifying MR deviations. Our findings show that deviations occur in up to 37.02 % of MRs across seven distinct categories. In addition, we develop a detection approach leveraging few-shot learning, achieving up to 91 % accuracy in identifying these deviations. Furthermore, we examine the impact of removing MR deviations on ML models predicting code review completion time. Removing deviations significantly enhances model performance in 53.33 % of cases, with improvements of up to 2.25 times. Additionally, their exclusion significantly impacts model interpretation, strongly altering overall feature importance rankings in 47 % of cases and top-k rankings in 60 %. Our contributions include: (1) a clear definition and categorization of MR deviations, (2) a novel AI-based detection method leveraging few-shot learning, and (3) an empirical analysis of their exclusion impact on ML models explaining code review completion time. Our approach helps practitioners streamline review workflows, allocate reviewer effort more effectively, and ensure more reliable insights from MR analytics.
