Microservice architecture has gained traction as a powerful way to build distributed, scalable systems. However, analyzing its quality requires considering aspects unique to this architectural style. In particular, cohesion of microservices is considered important for evaluating microservice maintainability and quality, while few such metrics are available. Hub-like microservices are defined as an architectural anti-pattern, assumed to emerge when services centralize too many dependencies or responsibilities, thereby exhibiting low cohesion. However, this assumption has not been empirically validated. This study investigates whether Hub-like microservices indeed display lower internal cohesion than other services. We analyzed 123 microservices from a dataset of 25 microservice systems by leveraging an existing labeling of Hub-like microservices and computing eight cohesion metrics. We examined correlations between cohesion and several Hub-like detection techniques, including centrality and clustering-based metrics, the Minimum Description Length principle, and the Arcan approach. Our findings reveal weak to moderate negative correlations between service interface data cohesion and network centrality. Conversely, class relation cohesion is positively correlated with clustering-based Hub-like indicators, as well as shows a relation to all categorical Hub-like indicators with a positive effect size, due to the opposite interpretation of this metric. Thus, the common assumption that Hub-like services suffer from poor internal cohesion is not supported by our findings, with only a specific combination of a Hub-like detection method and a cohesion metric behaving as conjectured.
Testing of mobile applications is a crucial activity that aims to reveal bugs and defects affecting software running on our smartphones. Usually, mobile applications feature complex Graphical User Interfaces (GUIs) as the only interface with the human user, therefore proper End-to-End testing of mobile applications should also include GUI testing. In recent years, several automated testing methods have been proposed for mobile GUI testing; however, due to the dynamic and interactive nature of GUIs, they often fail to create realistic use cases. Exploratory testing is a popular GUI testing technique that involves testers freely exploring the application under test. This technique heavily relies upon testers’ experience and creativity, and is negatively influenced by human factors like stress and boredom, which are likely to appear in unmotivated testers. Gamification, i.e., the introduction of game design mechanics to tasks of other nature, has recently gained much popularity in business contexts, being applied to a wide range of software-related activities. In this article, we propose a gamification approach to mobile Exploratory Testing to improve the effectiveness, efficiency, and engagement of the software testers. We measure the impact of gamification with an in-vivo experiment involving students from a master’s degree software engineering course, adopting a fully-randomized experiment design. On the efficiency side, results show a positive impact of gamification on the explored pages – a measure of effectiveness – and on the explored pages per unit of time – which we adopted as an efficiency measure. Moreover, a final survey presented to students reveals that most of them believe that it is a good idea to use gamification in Exploratory Testing, and that they would use gamification in future if they had to do Exploratory Testing. Finally, the majority of participants report having fun while using the system. Our results highlight that gamification features can have a significant impact if introduced in a classical testing environment, possibly increasing effectiveness, efficiency and perceived engagement of the testers. We believe this research could serve as a starting point for researchers approaching the mobile testing environment, as well as industry practitioners working in the field.
Gamification (the use of game elements in non-game contexts) and serious games (fully-fledged games designed for a primary purpose other than pure entertainment) have demonstrated significant potential for enhancing engagement in software engineering education. However, high-quality serious games are resource-intensive to develop and difficult to maintain within the constraints of an academic semester. Consequently, many promising student-developed prototypes rapidly deteriorate into academic abandonware due to the lack of a sustainable maintenance life cycle. To address this issue, we propose the Capstone game factory, a theoretical three-phase circular development model in which serious games are treated as living legacy software rather than throwaway assignments. Senior students in Capstone courses act as maintainers and co-designers, inheriting and refactoring previous cohorts’ work, while junior students contribute educational content. Together, they drive the Brownfield evolution of the software. While full validation of the longitudinal life cycle remains future work, this paper empirically validates its enabling handover mechanism: Phase 2: Expert audit analysis. To operationalize the maintenance handover, we adapted the MEEGA+ (Model for the Evaluation of Educational Games) and Hexad (Gamification User Types Framework) frameworks into a heuristic inspection protocol. By applying this expert audit to three distinct student prototypes, we demonstrate how assessing gamification debt and design misalignment in legacy artifacts can generate a prioritized maintenance backlog for future students. This approach lays the foundation for transforming the educational constraint of short semesters into a pedagogical advantage, teaching students the vital industrial skills of brownfield development and software maintenance.
Just-in-Time Software Defect Prediction (JIT-SDP) aims at predicting whether each incremental software code change is defective. It flags bug-inducing commits as soon as they arrive in the repository, so developers can solve issues early. Conventional JIT models traditionally take code diffs (the lines changed) as input features. Nevertheless, recent work reveals that including commit logs, the developers’ written text-based descriptions, boosts the predictive performance significantly. However, the existing models encounter three main issues. First, simple word tokenisers used to handle the commit logs lose many project-specific abbreviations and infrequent identifiers. Second, solely leveraging the traditional deep learning and machine learning models loses the long-range connections, e.g., interactions among remote files. Third, most models make an unrealistic assumption that the data remain the same over time (no concept drift), so their performance declines significantly when the coding practice or the tooling is changed. This work proposes an adaptive JIT-SDP model addressing the above issues. Concretely, the suggested model entails (i) A sub-word and syntax-smart tokeniser pruning out-of-vocabulary error. (ii) The self-attention block is placed on the set of the convolution layers to capture both global and local signals. (iii) The unsupervised concept-drift detector monitors the flow of new commits and initiates rapid re-training whenever the data changes. We verify the performance of the presented model on three open-source projects, QT, openstack, and an expanded set from Bugs.jar. The results indicate that the presented model achieved enhanced JIT prediction performance and maintained stable performance even after drift occurrences. The presented model also achieves superior performance compared to other state-of-the-art models.
Non-Technical Debt (NTD), arising mainly from organizational, cultural, and people-related inefficiencies, significantly compromises the quality and sustainability of AI-enabled software systems. While a growing ecosystem of AI-related international standards addresses various technical and ethical requirements, organizations often struggle to connect these high-level frameworks with the specific instances of NTD that emerge during development. This study addresses this gap by associating real-world NTD instances with lifecycle processes, providing a structured basis for process-level diagnosis. Using a Design Science Research approach, we developed a conceptual artifact by analyzing 107 validated NTD instances from industrial projects spanning six categories, including People Debt, Team Debt, Requirement Debt, Resource Management Debt, Project Management Debt, and Privacy and Compliance Debt, across multiple ML domains such as Computer Vision, NLP, and Time Series Analysis. The resulting artifact shows that 72.5
Best-practice rules capture widely accepted coding conventions that improve software maintainability, safety, and extensibility. Modern static analysis tools, such as PMD and SonarQube, can accurately detect best-practice violations, yet repairing these issues remains largely manual, time-consuming, and error-prone. Although large language models show promise in code generation, directly applying them to refactoring often yields unsafe or incomplete transformations, especially for semantically subtle best-practice rules. In this paper, we propose BestRefactor, an automated approach that explicitly targets Java best-practice violations across real-world projects. BestRefactor is designed to process repository-level PMD reports and automatically repair large sets of detected rule violations. BestRefactor adopts a multi-agent, recipe-guided framework that decomposes refactoring into three coordinated stages: (i) a Planning Agent that determines applicability and safety, (ii) a Refactoring Agent that applies rule-specific transformation recipes, and (iii) a Verification Agent that validates correctness and rule compliance. This design is intended to make automated refactoring more controlled than naïve single-step LLM rewriting by introducing explicit applicability assessment, rule-specific transformation guidance, and post-hoc verification. We implement BestRefactor as a practical tool integrated with PMD and evaluate it on 10 real-world Java libraries spanning five application domains, comprising 844 detected best-practice violations. Experimental results show that BestRefactor successfully produces verified repairs for 72.6
Policy-as-code (PaC) has emerged as a key practice in development, security, and operations, enabling organizations to specify, manage, and enforce access control policies as part of the software delivery pipeline. At the core of PaC, Rego, the policy language of Open Policy Agent, is widely used to implement authorization rules in cloud-native and microservice environments. However, testing Rego policies remains a major challenge, as current practices rely heavily on manual or ad-hoc test case design, often leading to insufficient coverage and latent security risks. This article introduces ReATest, an automated approach to enhancing PaC workflows through systematic test case generation from Rego specifications. ReATest defines a specialized Rego Flow Graph (RFG) that represents the structural relationships among Rego rules, conditions, and policy decisions. This representation enables systematic exploration of policy execution paths to generate an initial test suite. The resulting suite is then optimized using the Grey Wolf Optimization algorithm to reduce redundant test cases and improve overall testing efficiency. The approach was evaluated on Rego policies from open-source repositories. Experimental results show that ReATest achieved an average 35.43
Design Pattern Detection (DPD) tools are useful to support to the comprehension and maintenance of software systems. Although several DPD tools have been introduced over the years, they typically focus on a limited set of design patterns and programming languages. This paper aims to investigate (i) the reasons that motivate DPD tool designers to target specific design patterns and programming languages, and (ii) how potential users perceive the usefulness of DPD tools in practical software development scenarios. We conducted two online surveys. For the first survey, we reached out to designers of 42 DPD tools selected from a systematic literature review to obtain their perspectives on design decisions about pattern and language coverage, receiving 22
Software vulnerability assessment (SVA) based on pre-trained language models (PLMs) has shown promising capability in modeling vulnerability severity. However, existing PLM-based SVA methods are still constrained by limited input length, which makes it difficult to process long source code effectively and may introduce substantial irrelevant content into model inputs. Although code simplification offers a potential solution, naive simplification may remove vulnerability-relevant information and degrade assessment quality. To address this problem, we propose CS-SVA, an attention-guided hierarchical code simplification method for PLM-based SVA. CS-SVA first partitions source code into structurally meaningful code snippets through a keywords-based code splitting criterion. It then estimates token-level and statement-level importance signals using PLMs, and performs hierarchical simplification through statement selection and token pruning. In this way, CS-SVA reduces redundant code while preserving vulnerability-relevant information for severity assessment. The simplified code snippets are finally used as input for PLM fine-tuning. Experiments on real-world C/C++ vulnerabilities aligned with CVSS 3.0 show that CS-SVA provides a favorable balance between predictive performance and computational efficiency under the current setting. Compared with the evaluated baselines, CS-SVA achieves stronger overall predictive performance while reducing computational cost on PLM-based models. In addition, ablation results further show that the hierarchical simplification design is effective for balancing structure preservation and fine-grained pruning. These findings suggest that attention-guided hierarchical code simplification is a promising direction for improving PLM-based SVA.
Managing software quality is crucial for maintainable software systems, yet understanding how quality attributes are discussed within the informal, noisy context of issue trackers remains a significant challenge. Current automatic approaches for categorizing quality concerns often falter, as they are typically validated on small domain-specific datasets and are ill-equipped to parse the conversational language of developer discourse. This hinders effective prioritization and technical debt management. This paper introduces QualiTagger, an automated approach for classifying seven distinct software quality attributes from issue tracker text, and QualiDataSet, a novel, curated dataset of over 700,000 labeled GitHub issues that underpins this work. We demonstrate that an ensemble of specialized binary classifiers, built upon the DistilRoBERTa architecture, significantly outperforms a single multiclass model and shows superior or comparable efficacy to a general-purpose Large Language Model (GPT-4o) for this task. The model’s real-world applicability is further validated through an industrial case study at Visma focusing on security issues) and a user study with software engineering students. Our evaluation confirms that QualiTagger achieves high classification accuracy and, crucially, generalizes effectively to previously unseen (Out-of-Distribution) projects, a key indicator of its practical utility. By providing both a robust classification tool and a large-scale public dataset, this research enables a more nuanced, data-driven understanding of how software quality is managed in practice, offering valuable insights for project management and future empirical software engineering research
Software defect prediction aims to identify fault-prone modules in order to optimize testing effort and reduce development costs, particularly in increasingly complex software systems. In this work, we propose a set of ten novel object-oriented metrics designed to enrich existing datasets and enhance prediction performance. An empirical evaluation was conducted on 17 PROMISE projects by integrating the proposed metrics with traditional CK/MOOD metrics and assessing their impact using several machine learning algorithms. The results show that several of the proposed metrics are statistically significant and contribute useful predictive information. In particular, when combined with CK/MOOD metrics, the proposed metrics yielded performance gains of 4.6
Automatic Program Repair (APR) can reduce the effort required to identify and correct programming errors. This study proposes PySynFix, a computationally lightweight APR system for Python syntax error correction. The system uses a Bidirectional Long Short-Term Memory (BiLSTM) network for multi-class error classification and a Long Short-Term Memory (LSTM) network for token-level repair, supported by hybrid fault localization based on Abstract Syntax Tree parsing and Microsoft’s Pyright tool. Trained on 6,000 synthetically generated faulty samples, PySynFix achieved 98
In the context of Information Technology (IT), organizations integrate DevOps to facilitate rapid software delivery; however, mapping the dynamic interrelationship of capabilities, metrics, and processes in practice remains a persistent academic challenge. The current research investigates the relational mechanisms driving successful DevOps adoption. The researchers designed an elaborate single-case study to examine how high-level strategic initiatives influence the complex interplay among technical capabilities, performance metrics, and lifecycle processes. The empirical design applies a qualitative approach grounded in hybrid (abductive) thematic analysis. Established deductive frameworks provided essential baseline constructs, while inductive coding captured emergent organizational phenomena, mitigating the risk of circular reasoning (i.e., confirming a priori assumptions). The researchers employed methodological triangulation by synthesizing 28 semi-structured interviews with longitudinal internal archival documents (DORA metrics), subsequently validating the emergent constructs through an expert focus group to establish a continuous chain of evidence. The synthesized empirical analysis reveals that three specific strategic initiatives functioned as associative enablers during the organizational transformation: (1) a mandated, standardized Continuous Integration/Continuous Delivery (CI/CD) pipeline, (2) a centralized internal service catalog, and (3) a unified cloud-native platform. Archival metrics and interview transcripts mutually indicate these initiatives mitigated the core sociotechnical tension existing between velocity (driven by technical automation) and visibility (demanded by social governance). Grounded explicitly in Sociotechnical Systems (STS) Theory, a revised conceptual framework illuminates how technical tooling and organizational culture do not function in isolation; rather, they operate within a joint-optimization feedback loop. This theoretical model suggests a systemic mechanism for enterprise managers to balance competing sociotechnical priorities during large-scale DevOps transformations.
In software development, bug reports (BRs) are essential for identifying defects, but the volume of reports in large projects makes manual relatedness analysis slow and error-prone. We study machine-learning approaches for predicting BR relatedness under a file-overlap target, File-Change Similarity (FCS). We compare TF-IDF, frozen sentence-level T5 embeddings (without domain fine-tuning), and a hybrid lexical-semantic representation. Our pipeline covers data retrieval, preprocessing, vectorization, normalization, neural-network training, and evaluation. We evaluated 56 models using various modeling strategies. Analysis reveals that using complete vectors as features is more effective than cosine distance. The hybrid approach shows competitive descriptive performance comparable to TF-IDF alone. Fine-tuning on 14 models tested 168 hyperparameter combinations, with Adam and RMSprop optimizers showing best performance. Key contributions include evaluating T5 and TF-IDF performance for BRs, exploring a hybrid approach, and providing a methodological framework for representation comparison. This research offers suggestions for improving efficiency in development and resource allocation. In the context of frozen T5 embeddings, the findings on T5 performance and the comparison with strong TF-IDF baselines drive future research directions. Since the T5 weights were not specifically trained on the bug report domain (frozen), these results serve as a baseline for future fine-tuning experiments.
Large language models (LLMs) have demonstrated remarkable performance across a wide range of natural language processing tasks, yet their deployment in high-stakes applications has raised critical concerns regarding reliability, safety, and response trustworthiness. In this paper, we present a red teaming framework that systematically uncovers vulnerabilities in LLM outputs. Our approach employs a novel multi-role architecture comprising a target, attackers, and jury models. The attackers generate increasingly effective adversarial prompts while the jury rigorously evaluates response accuracy and consistency across tasks. In a case study, our red teaming strategy proved particularly effective at exposing unfaithfulness in LLM responses. Exploitative adversarial prompts increased the attack success rate by up to 7.9
Developing and maintaining automated tests for graphical user interface (GUI) applications remains costly, as test scripts are typically tightly coupled to low-level UI elements. Recent advances in large language models (LLMs) open new opportunities to execute test cases expressed in natural language (NL), potentially reducing the effort required to create and maintain test suites. However, delegating test execution to probabilistic LLM agents raises fundamental challenges for software testing, including ambiguity in NL test cases, unpredictable LLM agent behaviour and the lack of theoretical foundations for reasoning about NL test case execution reliability. This paper focuses on these problems and presents a NL test case execution algorithm that orchestrates specialised LLM agents to interpret and execute NL test steps in a controlled manner in order to limit false positives and false negatives. This algorithm includes guardrail mechanisms to mitigate uncertainty in language-driven execution. It combines grammar-based disambiguation of NL test steps, rule-based GUI readiness verification, and strict evaluation of assertions. To reason about the reliability of NL test case execution, we define the notions of weak unsoundness and weak laxness, which adapt classical conformance testing properties to the context of LLM agent-based testing. We implemented our approach in a prototype tool and constructed four NL test suites targeting six web applications to evaluate our approach in terms of weak unsoundness and weak laxness. Experiments with locally deployable open-weight LLMs (14B–70B parameters) show that, when paired with a high-capability model and under the conditions provided with our definitions, NL test cases can be executed reliably, they rarely reject conformant applications (false positives <1
In model-based software effort estimation (SEE), predictions are inherently sensitive to input perturbations due to incomplete and evolving requirements in early-stage development. Various enhancement strategies have addressed prediction error through bias mitigation and variance reduction; however, their effectiveness in addressing input perturbation robustness remains unexplored. This study evaluates input perturbation robustness as an enhancement strategy for linear programming for effort estimation (LP4EE), a relatively stable SEE baseline that exhibits low variance, and compares this approach against bias mitigation and variance reduction strategies. Four LP4EE variants were implemented: scenario-based robust optimization (SROpt) for input perturbation robustness, boosting for bias mitigation, and bagging and noise injection for variance reduction. These variants were benchmarked against the original LP4EE and eight machine learning methods across 14 datasets, using robust error measures and statistical tests. The SROpt variant outperformed all other evaluated methods, while the other three variants showed mixed or inferior performance compared with the original LP4EE. Addressing input perturbation robustness is more effective than conventional bias mitigation and variance reduction strategies for LP4EE, thereby establishing this strategy as a promising direction for model-based SEE approaches.
Public-sector ICT procurements frequently emphasize the importance of “quality,” yet rarely define what that quality means in operational or measurable terms. This ambiguity often leads to mismatches between buyer expectations and supplier interpretations, hindering requirement clarity, evaluation rigor, and delivery outcomes. In our earlier work, we analyzed public ICT tender documents and introduced the concepts of quality proxies—symbolic expressions of quality without clear operational definitions—and the tendering gap, which describes the structural misalignment between clients’ intentions and suppliers’ interpretations. This extended study revisits and generalizes these concepts in the context of AI-driven software systems, where quality specification is further complicated by probabilistic behavior, data dependencies, and evolving regulatory expectations. Drawing on twelve public procurement cases and conceptual analysis, we demonstrate how emerging AI-related quality attributes—such as explainability, fairness, robustness, and transparency—often function as AI quality proxies: abstract normative goals that lack shared operational meaning across stakeholders. To address this challenge, we extend the tendering gap model by introducing the notion of an epistemic gap, reflecting fundamental differences in stakeholders’ understanding of what constitutes measurable quality in AI systems. We discuss how this gap arises from knowledge asymmetry, measurement uncertainty, and cross-disciplinary communication barriers, and examine its implications for requirements engineering, procurement practices, and software quality models. The paper contributes a unified conceptual framework for understanding quality ambiguity across both traditional ICT and AI-driven systems, and outlines practical directions for improving quality specification through scenario-based requirements, calibrated evaluation rubrics, and enhanced stakeholder alignment. These findings support the development of more operational, transparent, and accountable approaches to specifying and evaluating software quality in an increasingly AI-driven world.
GraphQL has become increasingly popular in modern web development due to its flexibility and efficiency in data retrieval. However, existing fuzzing techniques for GraphQL APIs face challenges in handling dependencies between operations, which limits their ability to generate effective test cases and detect deep software bugs. This paper proposes SGAFuzzer, an automated stateful fuzzing framework designed to enhance the testing of GraphQL APIs. Specifically, SGAFuzzer performs static analysis of GraphQL schemas, using dependency object mapping and return path analysis to infer producer-consumer dependencies between operations. Subsequently, SGAFuzzer generates request templates based on the schema and employs a state-aware instantiation method, leveraging dependency storage and state caching to generate stateful test cases. We evaluated SGAFuzzer on five real-world GraphQL services. Experimental results demonstrate that SGAFuzzer outperforms state-of-the-art fuzzers in both operation coverage and bug detection count, successfully identifying 227 new bugs. These findings highlight SGAFuzzer’s effectiveness in deep stateful fuzzing of GraphQL APIs, leading to the discovery of complex state-dependent bugs.
Determining whether a binary contains a security patch is a critical task in vulnerability analysis. Existing approaches mainly rely on structural similarity of patch features, which limits their ability to identify semantically equivalent but syntactically different binary generated under different compilers and optimization settings. In addition, analyzing binaries at the function level often introduces noise from vendor-added extension code, which increases the false positives. To address these challenges, a semantic-aware patch presence test approach that focus on the control paths affected by the patch is proposed, named Patch presence test via Semantic Normalization and Key Path Extraction (PPTSP). The method first maps semantically equivalent instruction sequences to a unified representation, enhancing feature consistency across different compilation architectures. Then, it identifies the control paths affected by the patch to eliminate interference from irrelevant execution paths during feature extraction. Finally, when features are structurally similar, a large language model (LLM) is leveraged to analyze their semantic equivalence, further enhancing detection accuracy. Experiments demonstrate that PPTSP outperforms current state-of-the-art methods, even under different compiler and optimization level settings.
