Large Language Models (LLMs) are one of the most promising developments in the field of artificial intelligence, and the software engineering community has readily noticed their potential role in the software development life-cycle. Developers routinely ask LLMs to generate code snippets, increasing productivity but also potentially introducing ownership, privacy, correctness, and security issues. Previous work highlighted how code generated by mainstream commercial LLMs is often not safe, containing vulnerabilities, bugs, and code smells. In this paper, we present a framework that leverages testing and static analysis to assess the quality, and guide the self-improvement, of code generated by general-purpose, open-source LLMs. First, we ask LLMs to generate C code to solve a number of programming tasks. Then we employ ground-truth tests to assess the (in)correctness of the generated code, and a static analysis tool to detect potential safety vulnerabilities. Next, we assess the models ability to evaluate the generated code, by asking them to detect errors and vulnerabilities. Finally, we test the models ability to fix the generated code, providing the reports produced during the static analysis and incorrectness evaluation phases as feedback. Our results show that models often produce incorrect code, and that the generated code can include safety issues. Moreover, they perform very poorly at detecting either issue. On the positive side, we observe a substantial ability to fix flawed code when provided with information about failed tests or potential vulnerabilities, indicating a promising avenue for improving the safety of LLM-based code generation tools.

Software systems are a significant contributor to global sustainability concerns, demanding that environmental, social, technical, and economic factors be systematically addressed from the initial requirements engineering phase. Although existing research provides various sustainability requirements (SRs), these contributions are often fragmented, specific to certain dimensions, or limited to particular application domains, resulting in a critical lack of a unified, comprehensive taxonomy for the software engineering community. To address this gap, this research conducts a Systematic Literature Review (SLR) to extract and organize sustainability requirements from the state-of-the-art. The primary contribution is a comprehensive taxonomy of SRs across the four dimensions of sustainability (environmental, technical, social, and economic). For each identified category, we provide clear definitions, associated metrics, and measures. Furthermore, we depict a correlation matrix that projects the positive and negative influences (synergies and conflicts) among categories across different dimensions. This systematized reference assists both software developers and researchers in effectively formulating, managing, and reconciling trade-offs within sustainable software development.

Risk assessment in software engineering has seen many approaches. Despite the amount of scientific literature on risk management, the failure rate of software projects after the first installation remains considerable. The reason is probably that the dynamically changing software feature has not been imbibed in the framework, which mostly deals with risk management in retrospect. This article attempts to suggest a new approach which will take these gaps into consideration.

Hyperledger Fabric is a well-known framework for developing enterprise blockchain solutions. Developers of these blockchains must ensure the correct execution of read and write operations so that the smart contracts' application logic is consistent with the business logic. In this paper, we present a static analysis approach based on abstract interpretation to detect read-write set issues in Hyperledger Fabric smart contracts and avoid bugs and critical errors that could compromise blockchain applications. The analysis is implemented in GoLiSA, a semantics-based static analyzer for Go applications. Our experimental results show that the proposed analysis can detect read-write set issues on a significant benchmark of existing applications. Moreover, it achieves better results in detecting read-after-write issues than other well-known open-source analyzers for Hyperledger Fabric smart contracts.

We present Pyra, a static analysis tool that aims at detecting code smells in data science workflows. Our goal is to capture potential issues, focusing on misleading visualizations, challenges for reproducibility, as well as misleading, unreliable or unexpected results. Link to the demo: https://www.youtube.com/watch?v=D- Asyuhs Tyo GitHub repository: https://github.com/spangea/Pyra.

Software has become an integral part of modern life, serving various purposes in personal, professional, and recreational domains. This research addresses the growing need for software systems that are not only functional but also emotionally resonant with users. While traditional software development focuses on functional and non-functional requirements, the emotional impact of systems on users, referred to as emotional requirements (ERs), remains underexplored. Existing research on ERs has limitations, focusing primarily on specific domains like healthcare or gaming and employing manual, data-dependent elicitation methods. This work proposes a novel and semi-automated approach to derive ERs from system requirements. The proposed methodology addresses three main concerns: (1) identifying requirements with potential emotional triggers, (2) defining a software-specific taxonomy of ERs, and (3) proposing appropriate artifacts and methodology for ER elicitation. A two-way approach is proposed for ER elicitation using formal goal modeling and generative AI. The framework leverages insights from emotional knowledge bases, user behavior patterns, and contextual analysis to systematically derive ERs from requirements. The proposed methodology is experimentally evaluated using case studies of software of different domains.

Reliability and efficiency are two of the main concerns for software designs. These quality objectives can be met through efficient design and bug management. Developers and stakeholders report a large number of software bugs periodically. These bug reports often lack proper descriptions of the issues and the correct linked entities. Thus, it requires efficient bug localization and mapping the reported bugs to the exact software features for resolution. Most of the related research works primarily focus on bug classification and categorization to identify high- priority bugs. This work proposes a novel methodology towards analyzing the bugs, and accordingly identifying relevant software features. The proposed methodology uses large language models (LLM) for mapping bug reports to relevant software features. The effectiveness of this approach is evaluated using two state-of-the-art LLM models are employed using naive Retrieval-Augmented Generation (RAG) and advanced RAG. The comparative study identifies fascinating distinctions between advanced RAG and naive RAG, results in identifying software features. These findings highlight the potential of LLM-powered retrieval methods in improving automated bug localization, paving the way for more efficient software maintenance and debugging workflows.

The dependency of the Non-functional requirements (NFR) on the operating environment can lead to unexpected behaviors. This may subsequently result in threats to robotic systems after being deployed in an uncontrolled environment. This work proposes a simulation-based approach to identify the NFR correlations in environmental contexts for multi-robot systems. The simulation results are useful to infer and evaluate the different conflicts between NFRs and to study the impact of different contexts on the requirements themselves. The identified correlations would be useful for the system designers in minimizing impact and preventing problems arising from commonly overlooked issues. The adopted methodology is easily reproducible in different development scenarios.

The overfitting of deep learning models trained using moderately imbalanced datasets is the main factor in increasing the success rate of membership inference attacks. While many oversampling methods have been designed to minimize the data imbalance, only a few defend the deep neural network models against membership inference attacks. We introduce the privacy preserving synthetic minority oversampling technique (PP-SMOTE), that applies privacy preservation mechanisms during data preprocessing rather than the model training phase. The PP-SMOTE oversampling method adds Laplace noise to generate the synthetic data points of minority classes by considering the L1 sensitivity of the dataset. The PP-SMOTE oversampling method demonstrates lower vulnerability to membership inference attacks than the DNN model trained on datasets oversampled by GAN and SVMSMOTE. The PP-SMOTE oversampling method helps retain more model accuracy and lower membership inference attack accuracy compared to the differential privacy mechanisms such as DP-SGD, and DP-GAN. Experimental results showcase that PP-SMOTE effectively mitigates membership inference attack accuracy to approximately below 0.60 while preserving high model accuracy in terms of AUC score approximately above 0.90. Additionally, the broader confidence score distribution achieved by the PP-SMOTE significantly enhances both model accuracy and mitigation of membership inference attacks (MIA). This is confirmed by the loss-epoch curve which shows stable convergence and minimal overfitting during training. Also, the higher variance in confidence scores complicates efforts of attackers to distinguish training data thereby reducing the risk of MIA.

A blockchain is a trustless system in an environment populated by untrusted peers. Code deployed in blockchain as a smart contract should be cautious when invoking contracts of other peers as they might introduce several risks and unexpected issues. This paper presents an information flow-based approach for detecting cross-contract invocations to untrusted contracts, written in general-purpose languages, that could lead to arbitrary code executions and store any results coming from them. The analysis is implemented in GoLiSA, a static analyzer for Go. Our experimental results show that GoLiSA is able to detect all vulnerabilities related to untrusted cross-contract invocations on a significant benchmark suite of smart contracts written in Go for Hyperledger Fabric, an enterprise framework for blockchain solutions.

Watermarking techniques aim to protect relational databases by embedding on them a copyright signal known as the watermark without imposing additional restrictions. However, unlike other digital assets, such as multimedia data, relational data are often subject to frequent updates that may dramatically compromise the quality of the embedded watermark. Hence, it is relevant to implement incremental watermarking for this type of data. Although incremental watermarking is defined in theory as the requirement of generating and inserting a mark whenever data is inserted or updated in a watermarked database (if the new value requires marking), its practical deployment is often ignored in the validation of proposed techniques, possibly due to how its deployment affects other requirements, such as the public system and security. In this work, we present different architectural approaches that, rather than conflicting with security and the public system, are built upon and contribute to them. The experimental results validate their applicability in terms of deployment, portability, scalability, and performance. As an architectural proposal, our work can be applied to different watermarking techniques, regardless of their particularities and the protected databases, making the preservation and enhancement of the watermark possible. Thus, we face the silent threats to security posed by opportunistic malicious operations in the absence of incremental watermarking.

The rapid expansion of software development has significant environmental, technical, social, and economic impacts. Achieving the United Nations Sustainable Development Goals by 2030 compels developers to adopt sustainable practices. Existing methods mostly offer high-level guidelines, which are time-consuming to implement and rely on team adaptability. Moreover, they focus on design or implementation, while sustainability assessment should start at the requirements engineering phase. In this paper, we introduce SEER, a framework which addresses sustainability concerns in the early software development phase. The framework operates in three stages: (i) it identifies sustainability requirements (SRs) relevant to a specific software product from a general taxonomy; (ii) it evaluates how sustainable system requirements are based on the identified SRs; and (iii) it optimizes system requirements that fail to satisfy any SR. The framework is implemented using the reasoning capabilities of large language models and the agentic RAG (Retrieval Augmented Generation) approach. SEER has been experimented on four software projects from different domains. Results generated using Gemini 2.5 reasoning model demonstrate the effectiveness of the proposed approach in accurately identifying a broad range of sustainability concerns across diverse domains.

This research work introduces a novel approach to enhance the performance of distributed data warehouses. Distribution of data has been done across multiple data center for the underlying data warehouse to ensure parallel processing that improves the performance of the system. The proposed system focuses on data availability locally, resulting in faster query processing times. In order to further optimize the query processing and to alleviate the centralized data warehouse load, the study suggests distributing the cuboids at different sites to maintain the lattice of cuboids logically. Algorithms have been proposed to execute OLAP aggregation operations that significantly enhanced query response times in distributed data warehouse. Empirical tests on real-world datasets proved the method’s effectiveness, showcasing its superiority in terms of reduced OLAP query execution time, enhanced space efficiency, minimized network transmission delays, reduced bandwidth requirements and more predictable and stable data transmission compared to existing approaches.

In concurrent transactional systems, a phantom read occurs when a transaction retrieves a set of data, and simultaneously, new data is inserted, updated, or removed from that set by one or more other transactions, leading to unexpected data being read. In Hyperledger Fabric (HF), a popular enterprise-grade framework for developing permissioned blockchain platforms, phantom reads are detected during the transaction validation phase. It inspects the values from read operations and checks their consistency, also re-executing some domain-specific read operations called range queries . However, being HF based on an optimistic concurrency control model, managing an excessive number of conflicts related to phantom reads could result in sudden system slowdowns. Additionally, some kind of range queries are not considered in the validation and verification process. For the latter, the re-execution is not performed and checks are not provided leading to undetected phantom reads when the values returned from them are written to the ledger. Hence, the burden of implementing phantom read-free applications (i.e., smart contracts ) is on the developers, who need to correctly manage the read instructions in the code and use automatic verification tools to detect any unsafe implementations leading to system slowdowns and undetectable phantom reads. In this paper, we explore the phantom reads detection problem at the smart contract level and demonstrate how a verification approach through formal methods can identify possible bottlenecks caused by phantom reads and mitigate range query risks, outperforming the current state-of-the-art and state-of-the-practice for their detection. Our approach is implemented with GoLiSA, a semantic static analyzer based on abstract interpretation for Go applications.

State-of-the-art abstract domains for static analysis typically focus on over-approximating either the values a variable can hold at a specific program point or the relational dependencies among variables. In this paper, we aim to capture the trend of numerical values during program executions (e.g., increasing, decreasing, or stable) relative to preceding states. By integrating the Stability domain with numerical domains, we can verify co-/contra-variance relationships among potentially unrelated variables. This approach has promising applications for anomaly detection in complex software systems, and for the verification of functional requirements.

Significant contributions in the existing literature highlight the potential of softgoal interdependency graphs towards analyzing conflicting non-functional requirements (NFRs). However, such analysis is often at a very abstract level and does not quite consider the run-time performance statistics of NFR operationalizations. On the contrary, some initial empirical evaluations demonstrate the importance of the run-time statistics. In this paper, a framework is proposed that uses these statistics and combines the same with NFR priorities for computing the impact of NFR conflicts. The proposed framework is capable of identifying the best possible set of NFR operationalizations that minimizes the impact of conflicting NFRs. A detailed space analysis of the solution framework helps proving the efficiency of the proposed pruning mechanism in terms of better space management. Furthermore, a Dynamic Bayesian Network (DBN) - based system behavioral model that works on top of the proposed framework, is defined and analyzed. An appropriate tool prototype for the framework is implemented as part of this research.

Software verification aims to prove that a program satisfies some given properties for all its possible executions. Software evolved incredibly fast during the last century, exposing several challenges to this scientific discipline. The goal of the “Challenges of Software Verification Symposium” is to monitor the state-of-the-art in this field. In this article, we will present the evolution of software from its inception in the 1940s to today’s applications, how this exposed new challenges to software verification, and what this discipline achieved. We will then discuss how this chapter covers most of the current open challenges, the possible future software developments, and what challenges this will raise in software verification.

Making the best use of health data is both the main challenge and the main opportunity for cutting-edge research in the Life Sciences sector. This paper examines the main difficulties and hindrances that Life Sciences researchers encounter to access, process, and analyse health data for secondary use by drawing on the case of Human Technopole, a new international research institute established in Milan. While focusing on the critical aspects of the Italian National Health System (Sistema Sanitario Nazionale - SSN) health data management and the consequences on lack of access for research purposes, the paper also presents an ongoing experimental UK project as well as an already implemented programme for managing and accessing demographical and registry data in Italy, to provide insights for possible future solutions.