Security is becoming a pivotal point in cloud platforms. Several divisions, such as business organisations, health care, government, etc., have experienced cyber-attacks on their infrastructures. This research focuses on security issues within Continuous Integration and Deployment (CI/CD) pipelines in a cloud platform as a reaction to recent cyber breaches. This research proposes a blockchain-based solution to enhance CI/CD pipeline security. This research aims to develop a framework that leverages blockchain's distributed ledger technology and tamper-resistant features to improve CI/CD pipeline security. The goal is to emphasise secure software deployment by integrating threat modelling frameworks and adherence to coding standards. It also aims to employ tools to automate security testing to detect publicly disclosed vulnerabilities and flaws, such as an outdated version of Java Spring Framework, a JavaScript library from an unverified source, or a database library that allows SQL injection attacks in the deployed software through the framework.

Cloud-native technologies enable the development of scalable, secure, and resilient applications in diverse cloud environments. However, deploying and configuring these technologies can be complex and error-prone. Existing reusable Infrastructure as Code (IaC) solutions often suffer from inconsistent structures, limited customization, and potential vendor lock-in, hindering their effectiveness and usability. To mitigate this, this paper presents a framework for creating standardized and reusable IaC templates for deploying and configuring cloud-native infrastructure components. We conducted a needs analysis to identify key developer requirements and established ten design principles for creating reusable IaC templates. Additionally, we conducted a multivocal review of relevant literature to summarize best practices for implementing these principles. Leveraging these insights, we developed five IaC templates and evaluated their effectiveness and usability against existing solutions. This proposed framework integrates conceptual guidance with practical implementations of reusable templates to simplify cloud-native infrastructure setup and enhance developer productivity.

Cloud-native technologies have been widely adopted, enabling organizations to build scalable, observable, resilient, and secure software systems within cloud environments. However, the rapid evolution of these technologies and the multitude of available tools present challenges to architects and developers in staying informed and making optimal choices for achieving the described qualities. While scientific literature summarizes quality attributes (QAs) and their corresponding cloud-native architectural patterns and tactics, it does not generally describe how qualities are achieved through the adoption of specific implementation practices and tools. To address this gap, we conducted a multivocal review of scientific papers, books, standards, and related grey literature. Through thematic analysis, we identified and organized cloud-native practices, tools, and related QAs. Our findings resulted in a map that comprises 15 high-level cloud-native practices that link to 87 specific sub-practices and 171 associated tools for addressing 8 desirable system qualities.

Background: Everything as Code (EaC) is an emerging paradigm aiming to codify all aspects of modern software systems. Despite its growing popularity, comprehensive industry standards and peer-reviewed research clarifying its scope and guiding its adoption remain scarce. Aims: This study systematically analyzes existing knowledge and perceptions of EaC, clarifies its scope and boundaries, and provides structured guidance for researchers and practitioners. Method: We conducted a large-scale multivocal literature review (MLR), synthesizing academic and grey literature sources. Findings were analyzed quantitatively and thematically. Based on this analysis, we developed a taxonomy and conceptual model of EaC, validated through collaboration with industry experts. Results: The resulting taxonomy comprises 25 distinct EaC practices organized into six layers based on industry awareness and functional roles. The conceptual model illustrates focus areas, overlaps, and interactions among these EaC practices within the software delivery lifecycle. Additionally, practical code examples demonstrating the implementation of these practices were developed in collaboration with industry experts. Conclusions: This work addresses the current scarcity of academic discourse on EaC by providing the first comprehensive taxonomy and conceptual model. These contributions enhance conceptual clarity, offer actionable guidance to practitioners, and lay the groundwork for future research in this emerging domain.

Cloud security is an essential concern in cloud environments. Several sectors (e.g., business, healthcare, government, etc.) have witnessed recent cyber-attacks (e.g., HEalthEquity Data Breach, Capital One, Midnight Blizzard on Microsoft, etc.) on their computing systems. Our research focuses on security issues and conducts a literature review to address the integration of blockchain technology into Continuous Integration and Deployment (CI/CD) in the cloud environment pipeline to enhance security. The key idea rests on separating entities such as code, data, design, change history, etc., as “blocks” in the blockchain technology through “separation of concern”. Such modularisation should help contain any threats locally in the block concerned without affecting other blocks. Our initial focus is conducting a comprehensive review of existing literature to analyse and synthesise tools and technologies for integrating blockchain into the CI/CD pipeline on cloud services. We also highlight the challenges associated with current solutions. Through this research, we aim to identify and address the existing research gaps in this critical area.

Continuous Integration/Continuous Deployment (CI/CD) is fundamental for advanced software development, supporting faster and more efficient delivery of code changes into cloud environments. However, security issues in the CI/CD pipeline remain challenging, and incidents (e.g., DDoS, Bot, Log4j, etc.) are happening over the cloud environments. While plenty of literature discusses static security testing and CI/CD practices, only a few deal with network traffic pattern analysis to detect different cyberattacks. This research aims to enhance CI/CD pipeline security by implementing anomaly detection through AI (Artificial Intelligence) support. The goal is to identify unusual behaviour or variations from network traffic patterns in pipeline and cloud platforms. The system shall integrate into the workflow to continuously monitor pipeline activities and cloud infrastructure. Additionally, it aims to explore adaptive response mechanisms to mitigate the detected anomalies or security threats. This research employed two popular network traffic datasets, CSE-CIC-IDS2018 and CSE-CIC-IDS2017. We implemented a combination of Convolution Neural Network (CNN) and Long Short-Term Memory (LSTM) to detect unusual traffic patterns. We achieved an accuracy of 98.69% and 98.30% and generated log files in different CI/CD pipeline stages that resemble the network anomalies affected to address security challenges in modern DevOps practices, contributing to advancing software security and reliability.

Protecting cloud applications is critical in an era where security threats are increasingly sophisticated and persistent. Continuous Integration and Continuous Deployment (CI/CD) pipelines are particularly vulnerable, making innovative security approaches essential. This research explores the application of Natural Language Processing (NLP) techniques, specifically Topic Modelling, to analyse security-related text data and anticipate potential threats. We focus on Latent Dirichlet Allocation (LDA) and Probabilistic Latent Semantic Analysis (PLSA) to extract meaningful patterns from data sources, including logs, reports, and deployment traces. Using the Gensim framework in Python, these methods categorise log entries into security-relevant topics (e.g., phishing, encryption failures). The identified topics are leveraged to highlight patterns indicative of security issues across CI/CD's continuous stages (build, test, deploy). This approach introduces a semantic layer that supports early vulnerability recognition and contextual understanding of runtime behaviours.

As cloud environments become widespread, cybersecurity has emerged as a top priority across areas such as networks, communication, data privacy, response times, and availability. Various sectors, including industries, healthcare, and government, have recently faced cyberattacks targeting their computing systems. Ensuring secure app deployment in cloud environments requires substantial effort. With the growing interest in cloud security, conducting a systematic literature review (SLR) is critical to identifying research gaps. Continuous Software Engineering, which includes continuous integration (CI), delivery (CDE), and deployment (CD), is essential for software development and deployment. In our SLR, we reviewed 66 papers, summarising tools, approaches, and challenges related to the security of CI/CD in the cloud. We addressed key aspects of cloud security and CI/CD and reported on tools such as Harbor, SonarQube, and GitHub Actions. Challenges such as image manipulation, unauthorised access, and weak authentication were highlighted. The review also uncovered research gaps in how tools and practices address these security issues in CI/CD pipelines, revealing a need for further study to improve cloud-based security solutions.

For large-scale IT corpora with hundreds of classes organized in a hierarchy, the task of accurate classification of classes at the higher level in the hierarchies is crucial to avoid errors propagating to the lower levels. In the business world, an efficient and explainable ML model is preferred over an expensive black-box model, especially if the performance increase is marginal. A current trend in the Natural Language Processing (NLP) community is towards employing huge pre-trained language models (PLMs) or what is known as self-attention models (e.g., BERT) for almost any kind of NLP task (e.g., question-answering, sentiment analysis, text classification). Despite the widespread use of PLMs and the impressive performance in a broad range of NLP tasks, there is a lack of a clear and well-justified need to as why these models are being employed for domain-specific text classification (TC) tasks, given the monosemic nature of specialized words (i.e., jargon) found in domain-specific text which renders the purpose of contextualized embeddings (e.g., PLMs) futile. In this paper, we compare the accuracies of some state-of-the-art (SOTA) models reported in the literature against a Linear SVM classifier and TFIDF vectorization model on three TC datasets. Results show a comparable performance for the LinearSVM. The findings of this study show that for domain-specific TC tasks, a linear model can provide a comparable, cheap, reproducible, and interpretable alternative to attention-based models.

As cloud platforms become widely adopted, Microservice Architecture has emerged as the new paradigm for modern software development, due to its quality attributes such as modularity, scalability, and resiliency. However, the distributed nature of microservices introduces complexity in the area of configuration management, service discovery, and tracing. Although numerous tools (such as Accelerators, JHipster, and MicroBuilder) currently exist to facilitate microservice development, they are often language- or platform-specific. In this paper, we describe a tool (MAGen - Microservice Application Generator) for developers to generate microservicebased skeleton applications. The tool consists of two primary components: (i) an application customizer for specifying infrastructure configuration and language selection and (ii) a generator for producing the skeleton of the application. A case study conducted using the tool suggests that the generated applications save significant development effort.

The emergence of pre-trained language models (PLMs) has shown great success in many Natural Language Processing (NLP) tasks including text classification. Due to the minimal to no feature engineering required when using these models, PLMs are becoming the de facto choice for any NLP task. However, for domain-specific corpora (e.g., financial, legal, and industrial), fine-tuning a pre-trained model for a specific task has shown to provide a performance improvement. In this paper, we compare the performance of four different PLMs on three public domain-free datasets and a real-world dataset containing domain-specific words, against a simple SVM linear classifier with TFIDF vectorized text. The experimental results on the four datasets show that using PLMs, even fine-tuned, do not provide significant gain over the linear SVM classifier. Hence, we recommend that for text classification tasks, traditional SVM along with careful feature engineering can provide a cheaper and superior performance than PLMs.

A support ticket describes an issue faced by a system's end-users when they encounter issues with their system. For large-scale IT corpora with hundreds of classes organized in a hierarchy, the task of classifying support tickets is vital to guarantee long-term clients. Due to the complexity of the unstructured nature of human language, text classification is challenging. The task is even harder when classes overlap. In the business world, an efficient and interpretable ML model is preferred over an expensive black-box model. In this paper, we propose a Hybrid Online Offline Model (HOOM) for efficient classification of hierarchical text documents using linear ML models. The experimental results on a private dataset of IT support tickets show that the hybrid model (HOOM) exhibits a promising performance if deployed in a real-world scenario. Furthermore, the hybrid model is anticipated to have a fast inference time given the underlying linear classifiers.

Classifying customer support tickets according to the desired criteria is an important task in IT service management. Accurate classification enables the support agents to reuse similar previous resolutions which. in turn, reduces the ticket resolution time and enhances customer satisfaction. However, for large-scale IT corpora with hundreds of classes organized in a hierarchy, the task of accurate classification of classes at the higher level in the hierarchies is crucial to avoid errors propagating to the lower levels. One of the biggest challenges is the presence of a large number of shared words between different classes. This problem is widely known as overlapping classes. Misclassification due to overlapping regions is a critical problem that is not well addressed in the NLP field. In this paper, we detect overlapping classes from an ML algorithm perspective and propose a hybrid machine learning model based on a linear SVM classifier and a set of N hand-crafted rules to classify the incoming ticket with high accuracy where N is the number of overlapped classes. The experimental results on four datasets show that the proposed hybrid model achieves major improvements in terms of the F­score of the overlapped classes. Hence, we recommend that for text classification tasks with overlapping classes, linear SVM along with a set of handcrafted rules can provide an interpretable and superior performance for the misclassified classes.

Correct classification of customer support tickets or complaints can help companies to improve the quality of their services to the customers. One of the challenges in text classification is when certain classes tend to share the same vocabulary. This can result in misclassification by the machine learning algorithm used. The problem is worsened when the dataset is imbalanced. To address this issue, we propose a stacking algorithm based on combining different selected classifiers that operate on different feature subsets; depending on those features that tend to improve the recall and the precision of the overlapped classes. In our approach, first, we train different linear and non-linear classifiers on the full feature set. Second, we use the Chi2 test to determine the best feature set for all our pre-trained classifiers that improve the f1-score for the overlapped class(es). Finally, we train a two-layered stacked model composed of the best base learners obtained from the first step as layer-1 and combine it with a strong meta-learner for the second layer. The experimental results on a real-world dataset from a large IT organization and a public Consumer Complaint database show an improvement in the overall accuracy as well as a reduction in the misclassification rate for the overlapped classes.

Many organizations undertake large-scale projects of application migration due to availability of scalable and cost-efficient technologies. Such legacy application migration projects are very complex since the process involves in-depth profiling of the applications.During the initial profiling phase, it is imperative to understand the underlying complexities of individual applications, as well as the interdependencies among applications in the organization. This analysis phase can take considerable time and effort, depending on number and complexity of the applications. The main goal of this paper is to provide a framework that provides a cost-effective and quick approach to study the interdependencies between legacy applications with minimal prior knowledge of application usage.In this paper, we propose a framework that uses community detection algorithms and other established techniques from graph theory, to discover interdependencies of legacy applications within an organization, group these highly interdependent legacy applications in clusters, and finally sequence the clusters for migration to a modern platform. We study the proposed framework through three case studies, using network datasets from a large US organization.The experimental results from the proposed framework suggests that legacy applications can be grouped into clusters with high interdependencies between each other. Also, the framework shows how organizations can then appropriately sequence the clusters of legacy applications into a phase-wise migration project, thereby reducing migration costs.The proposed framework provides a valuable design input to organizations on how to determine the interdependencies between the various legacy applications that are in scope for migration to a modern platform. Such large-scale migration projects can be simplified and broken down to use a systematic approach, thereby reducing migration costs and data integrity challenges.

Context and Motivation: In large projects, extracting the relevant NFR-information as per the stakeholder's responsibility and needs can be time-consuming and challenging. Question/Problem: Classification of NFRs is one way to mitigate this problem. However, because of the size and complexity of the SRS, the manual classification of NFRs is considered time-consuming, labour-intensive, and error-prone. An automated solution is needed that provides a reliable and efficient classification of NFRs. Principal ideas/results: Using natural language processing and supervised machine learning (SML) algorithms, we investigate feature extraction techniques (i.e., POS-tagging based, BoW, and TF-IDF) to assess their efficacy in automated classification, in conjunction with the SML algorithms (such as: SVM, SGD SVM, LR, DT, Bagging DT, Extra Tree, RF, GNB, MNB, and BNB). Contribution: The proposed combinations: (i) SVM with TF-IDF, (ii) LR with POS and BoW, and (iii) MNB with BoW, all achieve precision and recall values greater than 0.85, and process execution time of less than 0.1 s. Comparison with related work is favourable as is preliminary validation using an industry dataset.

Support tickets are service requests, initiated by a system's end-users when they encounter issues with their system. With a wide user-base and system issues, there will be an ongoing influx of generated support tickets. Manual classification and prioritization is effortful and error-prone, that can lead to incorrect routing and delays in the resolution of the issues. Recently, various state-of-the-art machine learning and deep learning methods have been applied to automate the process of text classification. Because the quality of these methods highly depends on the quality of the associated "features", in this paper we focus on the "feature engineering" step in the classification process. In particular, we evaluate the effectiveness of using different static word embeddings on the accuracy of classifying IT support tickets. In collaboration with an industrial partner, we were able to train and evaluate our machine learning model on 1.6 million support tickets and 32 ticket categories. The experimental results show that the traditional Term Frequency Inverse Document Frequency (TFIDF) bag-of-words along with Support Vector Machines (SVM) provides competitive results and sometimes outperforms static word embedding models such as word2vec while maintaining low computational cost.

Large systems projects present unique challenges to the requirements measurement process: large sets of requirements across many sub-projects, requirements existing in different categories (e.g., hardware, interface, software, etc.), varying requirements meta-data items (e.g., ID, requirement type, priority, etc.), to name few. Consequently, requirements metrics are often incomplete, metrics and measurement reports are often unorganized, and meta-data items that are essential for applying the metrics are often incomplete or missing. To our knowledge, there are no published approaches for measuring requirements in large systems projects. In this paper, we propose a 7-step approach that combines the use of the goal-question-metric paradigm (GQM) and the identification and analysis of four main RE measurement elements: attributes, levels, metrics, and meta-data items—that aids in the derivation, analysis, and organization of requirements metrics. We illustrate the use of our approach by applying it to real-life data from the rail automation systems domain. We show how the approach led to a more comprehensive set of requirements metrics, improved organization and reporting of metrics, and improved consistency and completeness of requirements meta-data across projects.

[Context] Requirements quality can have a substantial impact on the effectiveness and efficiency of using requirements artifacts in a development process. Quantifiers such as “at least”, “all”, or “exactly” are common language constructs used to express requirements. Quantifiers can be formulated by affirmative phrases (“At least”) or negative phrases (“Not less than”). [Problem] It is long assumed that negation in quantification negatively affects the readability of requirements, however, empirical research on these topics remains sparse. [Principal Idea] In a web-based experiment with 51 participants, we compare the impact of negations and quantifiers on readability in terms of reading effort, reading error rate and perceived reading difficulty of requirements. [Results] For 5 out of 9 quantifiers, our participants performed better on the affirmative phrase compared to the negative phrase. Only for one quantifier, the negative phrase was more effective. [Contribution] This research focuses on creating an empirical understanding of the effect of language in Requirements Engineering. It furthermore provides concrete advice on how to phrase requirements.