Background: Bidirectional data pipelines have emerged as a response to the evolving needs of modern data ecosystems. Traditionally, unidirectional pipelines allowed data to flow in a single direction, limiting interaction. The surge in demand for real-time bidirectional communication prompted the development of pipelines that enable two-way data flow, facilitating seamless and dynamic exchanges between source and destination. Objective: The research aims to delve into the role of bidirectional data pipelines within the companies producing and selling software-intensive embedded systems products. Further, the study endeavors to elucidate the fundamental differences between unidirectional and bidirectional data pipelines, shedding light on their unique characteristics. Through comprehensive exploration, it seeks to discern the benefits and challenges inherent in implementing and maintaining bidirectional data pipelines. Furthermore, a critical aspect of the research involves outlining the intricate steps and considerations essential for migrating from unidirectional to bidirectional data pipelines. This includes a focus on prerequisites, methodologies, and the potential benefits derived from such a transition. Method: This study employs a qualitative research approach centered around a multiple-interpretive case study to delve into the complexities of bidirectional data pipelines. Five distinct use cases have been meticulously selected to provide a comprehensive understanding of various aspects of bidirectional data pipelines. Through the in-depth analysis of these concrete use cases, this research aims to elucidate the intricacies, benefits, and challenges associated with bidirectional data pipelines in software-intensive embedded systems environment. Results: The study yielded insightful results on various aspects of bidirectional data pipelines, emphasizing their distinctions from unidirectional data pipelines without a shared data transmission channel. It uncovered the compelling need for bidirectional data pipelines in modern data-centric environments, where the dynamic exchange of information between source and destination is pivotal. The identified benefits ranged from enhanced real-time data synchronization to improved responsiveness in addressing evolving business requirements. Concurrently, the study elucidated inherent challenges, such as increased complexity in pipeline management and potential security considerations. Moreover, the research provided a nuanced understanding of the stepwise process involved in transitioning from unidirectional to bidirectional data pipelines. Conclusion: The study underscores the pivotal role of bidirectional data pipelines in meeting evolving data requirements, offering benefits like real-time synchronization and improved decision-making. Despite their importance, there is a lack of comprehensive research on bidirectional pipelines, prompting the need for further exploration. The transitional journey involves addressing challenges such as data consistency and security concerns while optimizing system design for compatibility. For researchers, the study suggests avenues for optimizing bidirectional pipeline performance, examining long-term impacts, scalability, and real-time anomaly detection. Practitioners can leverage insights for informed decision-making in transitioning to bidirectional data pipelines, aligning organizational needs with their benefits and challenges.

Context: Process Debt, like Technical Debt, can be a source of short-term benefits but often is harmful in the long term for a software organization. Nonetheless, information about Process Debt is scarce in the current literature. Objective: This paper aims to define Process Debt, describe its occurrence with associated risks, and show examples of mitigation strategies. Method: Firstly, we conducted an exploratory study of Process Debt in four international organizations by interviewing 16 practitioners. Then, we validated and extended the findings with a cross-company focus group with additional 10 practitioners. Finally, we analyzed 58 additional observations and 35 interviews from a longitudinal case study. Results: The findings show that Process Debt can be a harmful phenomenon that needs attention. We provide a framework and a definition, and report causes, consequences and occurrence patterns over time of Process Debt. We present mitigation strategies and which ones need further attention for future research. Conclusions: The debt metaphor may help companies understand how to manage and improve their processes and make process-related decisions that are beneficial both in the short and long term.

This paper proposes a higher-order transformation (HOT) for realizing Incremental Change Propagation (ICP) from software UML models extended with performance annotations to performance Layered Queueing Network (LQN) models. Such a transformation is necessary for integrating quantitative performance analysis into the model-driven engineering of real-time systems. The entire process starts by automatically generating an LQN and a trace model from a UML model extended with MARTE annotations, with a batch Epsilon ETL transformation previously developed by the authors. The textual ETL transformation definition is translated to an ETL transformation model using the Epsilon Haetae tool. The ETL transformation model conforms to the ETL metamodel and represents the mapping between source and target models at a high level of abstraction. We use it to answer the question: what needs to be changed in the target model upon detecting changes in the source model? During the development process, when the UML model evolves, we detect such changes with the Eclipse EMF Compare tool, then incrementally propagate them to the LQN model to keep it synchronized. The extended approach is illustrated by applying it to an e-commerce model from the literature. The execution time of ICP is measured and compared to the traditional batch transformation.

Background: Given the enormous impact that the software industry has on so many facets of our lives today, software projects are extremely important. Digital transformation is driven across industries by software developments. They facilitate the utilisation of technology by organisations to optimise operations, augment productivity, and provide inventive products and services. To be competitive and adjust to the quickly changing market dynamics of today’s world, companies must undergo digital transformation by making full use of software projects. Objectives: The main aim of the current study is to determine the main causes of project delay and cost overrun in software projects, identify the effects of project delay and cost overrun on software projects, and define the role of cost estimation models in overcoming project delays and cost overruns in these projects. Results and conclusions:The researcher reviews the literature on causes behind delay and cost overrun and describes the role that can be played by cost estimation models in that process. In light of the reviewed literature, the researcher reaches certain recommendations for the software industry.

In recent years, with the updating and iterating of new global technologies, digital twins (DTs) originated in the aerospace industry has been widely used in smart manufacturing, smart construction, and smart management as a new type of informatization management tool. It is therefore important for scholars to understand the current state of research on DTs to conduct more targeted research in the future. Based on Scopus, 7384 publications related to DTs were found from 1951 to 2023 in this study. With VOSviewers, the major countries, authors, and institutions researching DTs globally were analyzed and discussed. In conclusion, the study found that since 2018, increasing numbers of scholars around the globe, especially in China and the United States, have conducted relevant research in relation to DTs. Manufacturing and construction are the most common application areas for DTs. Over the past three years, the integration of AI, IoT, cloud, and digital technologies has developed into a hotpot of research. Additionally, communication technologies such as 5G and 6G contribute to the development of DTs. In the future, it can be predicted that DTs will be utilizing machine learning, blockchain and other technologies as a result of advancements in becoming smarter and more secure over the years.

Testing is one of the most time-consuming and unpredictable processes within the software development life cycle. As a result, many Test Case Optimisation (TCO) techniques have been proposed to make this process more scalable. Object Constraint Language (OCL) was initially introduced as a constraint language to provide additional details to UML models. However, as OCL continues to evolve, an increasing number of systems are being expressed by this language. Despite this growth, a noticeable research gap exists for the testing of systems whose specifications are expressed in OCL. In our previous work, we verified the effectiveness and efficiency of performing the Test Case Prioritisation (TCP) process for these systems. In this study, we extend our previous work by integrating the Test Case Minimisation (TCM) process to determine whether TCM can also benefit the testing process under the context of OCL. The evaluation of TCO approaches often relies on well-established metrics such as the Average Percentage of Fault Detection (APFD). However, the suitability of APFD for Model-Based Testing (MBT) is not ideal. This paper addresses this limitation by proposing a modification to the APFD metric to enhance its viability for MBT scenarios. We conducted four case studies to evaluate the feasibility of integrating the TCM and TCP processes in our proposed approach. In these studies, we applied the multi-objective optimisation algorithm NSGA-II and the genetic algorithm independently to the TCM and TCP processes. The objective was to assess the effectiveness and efficiency of combining TCM and TCP in enhancing the testing phase. Through experimental analysis, the results highlight the benefits of integrating TCM and TCP in the context of OCL-based testing, providing valuable insights for practitioners and researchers aiming to optimise their testing efforts. Specifically, the main contributions of this work include: 1). We introduce the integration of the TCM process into the TCO process for systems expressed by OCL. This integration benefits the testing process further by reducing redundant test cases while ensuring sufficient coverage. 2). We comprehensively analyse the limitations associated with the commonly used metric, APFD, and then a modified version of the APFD metric has been proposed to overcome these weaknesses. 3). We systematically evaluate the effectiveness and efficiency of OCL-based TCO processes on four real-world case studies with different complexities.

Several architecture frameworks for software, systems, and enterprises have been proposed in the literature. They identified various stakeholders and defined architecture viewpoints and views to frame and address stakeholder concerns. However, the stakeholders with data science and Machine Learning (ML) related concerns, such as data scientists and data engineers, are yet to be included in existing architecture frameworks. Therefore, they failed to address the architecture viewpoints and views responsive to the concerns of the data science community. In this paper, we address this gap by establishing the architecture frameworks adapted to meet the requirements of modern applications and organizations where ML artifacts are both prevalent and crucial. In particular, we focus on ML-enabled Cyber-Physical Systems (CPSs) and propose two sets of merit criteria for their efficient development and performance assessment, namely the criteria for evaluating and benchmarking ML-enabled CPSs and the criteria for evaluation and benchmarking of the tools intended to support users through the modeling and development pipeline. This study deploys multiple empirical and qualitative research methods based on literature review and survey instruments, including expert interviews and an online questionnaire. We collect, analyze, and integrate the opinions of 77 experts from over 25 organizations in 10 countries to devise and validate the proposed framework.

Systems-of-Systems (SoS) are composed of multiple independent systems called constituents that, together, achieve a set of goals by means of emergent behaviors. Those behaviors can be deliberately planned as a combination of the individual functionalities (herein named as features) provided by the constituents. Currently, SoS engineers heavily rely on their own creativity and prior experience to combine the features and design the behaviors. However, the limitation of human perception in complex scenarios can lead to engineering sub-optimized SoS arrangements, potentially causing waste of the resources, sub-optimal services and reduction in quality. To handle the aforementioned issues, this article presents a machine learning-based mechanism for inferring/suggesting emergent behaviors that could be designed over a given set of constituents. An initial dataset was elaborated from a systematic mapping to feed the mechanism and a web-application was developed as a means for experts to evaluate this mechanism. Results revealed that the algorithm developed is capable of predicting feasible emergent behaviors for different sets of constituents and the system can be useful in the sense of aiding SoS engineers and experts in the bottom-up design of these behaviors.

Users of software applications use Issue Tracking Systems (ITSs) to file enhancement reports, which leads to a large quantity of user requests. Indeed, these reports have become an important source for software requirements because they help to continuously improve software applications. Usually, developers and maintainers evaluate them and decide which user reports can be accepted. However, enhancement reports are continuously being raised one after another, which makes this process time-consuming and labor-intensive. Timely handling and implementation of these enhancement reports can effectively improve user satisfaction and product competitiveness. Thus, research has focused on automated methods for predicting which enhancement reports are likely to be approved, to maximum the value derived from user reports. However, reported results of existing approaches are typically not good enough for practical use. In this paper, we propose a novel creator-profile-based method to explore dependencies among enhancements to improve the prediction performance. Firstly, we define the concept of a creator profile, including a general method of how to generate creator profiles from the data set. Then we explain how to employ creator profiles to the problem of enhancement report approval prediction. Finally, we evaluate our approach on 40,551 enhancement reports collected from ITSs. The experimental results indicate that our proposed approach greatly improve on existing state of the art, especially in predicting approved reports. For cross-application prediction, the accuracy is 80.7%, while for non-cross-application prediction, the overall accuracy is 83.6%. That is, with the proposed approach, over 80% of user requests can be automatically identified for exacting valuable user requirements, which significantly reduces labor costs. Replication package is available at: https://anonymous.4open.science/r/approval_prediction-507E

Cybersecurity is an ongoing and critical concern because of the constant and persistent threats from malicious actors such as hackers and crackers. The widespread use of software systems has revolutionized modern society in various aspects, but it has also brought forth new challenges in safeguarding sensitive and confidential information with the evolution of information and communication technology (ICT). Quantifying security measures can provide evidence to support decision-making in software security, especially when it comes to evaluating the security performance of software systems. This involves understanding the main quality criteria of security metrics, which can aid in building security metrology models based on practical requirements. To further explore this topic, this study conducted a systematic literature review of security metrics and measures in the context of Secure Software Development (SSD). The study selected 61 research studies based on specific inclusion and exclusion criteria and extracted data from the selected articles. The study identified 215 software security metrics, which were then categorized based on Software Development Life Cycle (SDLC) phases. To evaluate the effectiveness of the most commonly cited metrics in each phase, the study applied a SWOT analysis to highlight their strengths, weaknesses, opportunities, and threats. The findings of this study offer valuable guidance to diligent and motivated researchers to investigate emerging research trends and address existing gaps in Secure Software Development. Furthermore, this investigation provides software professionals with a more comprehensive understanding of security measurements, constraints, and open-ended specific and general issues.

Many software development methodologies introduced to date place users at the centre of development process. Although the user is an important asset in the software development cycle however the user-centred approach is not sufficient to develop a software product that is structurally robust and reliable. User involvement in the development process does not always guarantee resilience and a more efficient design. To address this a hybrid-based software development paradigm is proposed here where the software development cycle includes a grammar model-based compiler with user-centred approach. The efficacy of the proposed system is tested with the development of an innovative computer-aided drawing technology (SETUP09) for blind and visually impaired people and the results are compared with an existing non-hybrid-based drawing software (IC2D). The results of this study confirm SETUP09 improves user satisfaction and provides abstract and concrete level system flexibility. Provided here are guidelines of the proposed hybrid approach for software development based on a formal approach. This hybrid approach enables the software designer to evaluate the software semantics before user scrutinization. The benefits of the approach include the facilitation of alternate development pathways affording the software designer the flexibility to amend the software without incurring significant technical challenges. In fact, the proposed approach enables the creation of a structural design that is independent from the development pathways. This approach should ease the time constraint in product development and resource constraints.

Software organizations are increasingly embracing the advantages of Global Software Development (GSD), such as access to highly skilled developers and reduced development costs. However, the implementation of Requirement Change Management (RCM) activities in GSD is often hindered by a lack of communication and coordination among project stakeholders, as well as an insufficient focus on traceability and monitoring of RCM activities. To overcome these issues, we have enhanced and improved an existing RCM framework to mitigate the identified challenges and to develop a quality product while achieving customer satisfaction and business objectives. To evaluate the effectiveness of the proposed Enhanced AZ-Model, we sought feedback from the industrial experts and performed a statistical analysis of the collected data. The Enhanced AZ-Model was further validated by performing simulations of the model. The empirical and simulation results indicate that the Enhanced AZ-model efficiently and effectively manage the demanded changes according to the budget and time constraints.

Binary similarity detection determines whether two given binary code snippets are similar or not, usually on function granularity. This task is challenging due to different compilation optimizations and CPU architectures. Recently, deep-learning methods have made great achievements in this field, although most of them use artificially selected features or ignore some important semantic information like code literals or function signatures during feature processing. In addition, random samples and pair loss function are used in similarity training, which only covers limited similarity relations between functions. In this paper, a new framework MFEN-Sim is proposed to detect similar binary functions. The framework contains three stages: feature extraction and normalization, mutli-feature based function feature embedding network (MFEN) and similarity learning network. Multiple features including assembly instructions, CFG structures and function code literals are extracted from binary functions. Then these features are fed into MFEN composed of three modules: function semantic and structure embedding module, function signature prediction module, and function code literal embedding module. The three modules generate embeddings representing the function semantic and structural features, the function signature prediction features and the function code literal features. Finally, MFEN-Sim utilizes a similarity training network based on contrastive learning to make MFEN recognize more similarity relations between functions. MFEN-Sim is evaluated on 281,601 functions in 144 binaries and 17 CVEs in real-world software. Experimental results show that our work outperforms state-of-the-art systems ( i.e., Gemini, FIT and SAFE) by 7.1%, 9.9% and 8.2% on AUC metric in cross-architecture, optimization-level similarity detection, and achieves higher recall than baselines in searching vulnerabilities in real-world applications.

A document by Saima Imtiaz. Click on the document to view its contents.

Frameworks are essential for software development, providing code design and reuse for its users. Well-known Java frameworks and APIs such as Spring, JUnit, and JPA rely on metadata usage, commonly defined by code annotations. Those frameworks use the Java Reflection API for consuming and processing these annotations. Code elements usually have some similarities and can also have the same annotation. This paper proposes a model for defining conventions over configuration for annotations usage decoupled from the metadata reading logic. With this model, if a convention is present, the framework will consider that the element is configured by a specific target annotation, even if the code element does not have the annotation. We implemented this model in the metadata reading framework Esfinge Metadata API. The model implementation was evaluated refactoring an existing framework to add support to conventions using our approach. As a result, it was possible to introduce the conventions only by adding configurations to the annotations. The model was further evaluated in an experiment in which participants implemented the Conventions over Configuration pattern using the Esfinge Metadata API and Java Reflection API. Based on the results, approach fulfilled its goal of supporting the definition of conventions decupled from the framework logic, making the code more readable and easier to maintain according to the participants perception.

Model-driven engineering (MDE) has become a leading methodology for the design and development of Real-Time Embedded Systems (RTES). It makes use of automatic code generation tools to reduce time, cost and effort associated with writing and maintaining software. However, automatic code generators tend to produce poor quality and inefficient code, which is unacceptable for safety critical systems. The verification and validation of such systems are crucial activities that require high-level code quality and coverage enforced by standards such as DO-178C/ED-12C for airborne software or ECSS in the European space domain. Simulink is a modelling tool offered by MathWorks widely used in the aerospace sector to develop and simulate models. The QGen tool-suite offers a C and Ada code generator appropriate for Simulink and Stateflow models. In this paper, we evaluate QGen aiming to demonstrate its applicability in embedded software products, its integrability in other modelling tools, and the quality of the autogenerated software. To that end, a set of Key Performance Indicators (KPI) have been defined to measure quantitative values mostly obtained with open-source tools. The evaluation adopts the Attitude Control System from the UPMSat-2 satellite as the technology demonstrator and its simulation and control Simulink models serve as evaluation models for this analysis. The contribution of this study has been to establish a quantitative methodology for the evaluation of the QGen tool-suite based on software metrics at varying granularity levels such as model and source code. This methodology should help the researchers to identify further metrics and use them to analyze not only automatic code generators, but also to establish a criterion to assess the technology readiness of other software products and tools.

Atoms of confusion, or simply “atoms,” are pieces of code that lead to misunderstanding while being interpreted. Previous research has shown that the presence of atoms has an effect on code readability. Aside from simple misunderstanding in lab setting, atoms of confusion are common and meaningful in open source C and C++ projects, and are thus removed by bug-fix commits. However, due to syntactical differences between language paradigms, the prevalence of atoms may vary in projects written in other languages (e.g. Java), which is yet to be explored. In this study, the first step is taken towards investigating the prevalence of 12 different atoms in the 13 most popular open-source Java projects. The relationship between the presence of atoms and aspects of code maintainability is also studied. Results show that, atoms are 4.7 time more prevalent in Java projects compared to open source C/C++ projects based on occurrence per line. For a total of 1085223 atoms in our corpus, they occur once every 4.8 lines. Some atoms are very obscure (e.g. the Logic As Control Flow atom which occurs once in 440060 lines). Some atoms are frequently occurring (e.g. the Infix Operator Precedence atom which occurs once in 6.4 lines). Impact of the presence of atoms on code maintainability is also explored. Besides, correlation between atoms are investigated. Results indicate that object oriented metrics contribute less in atom prevalence, whereas fine grained code-metrics have relatively better association.

Context/motivation: Design Thinking techniques have been widely used in software requirements elicitation to understand the necessities of stakeholders and end-users. However, there is a lack of evidence of their effectiveness when applied to vulnerable populations. Question/problem: What are the implications of using Design Thinking techniques to elicit requirements in a community of former inmates - and what would be the benefits of and challenges in this deployment? Principal ideas/results: In this paper, we report our experience of using Design Thinking for Requirements Elicitation of a mobile application, customized for the former inmates of the Brazilian Prison System and their families. Research methods: We applied techniques such as Brainstorming, Stakeholder Mapping, Personas Creation, Rapid Ethnography, and Interviews to obtain relevant data and create several prototypes. Contribution: These techniques contribute to the development of an uncommon application that aims to help the reintegration process of former inmates into society. Our results validate the initial hypothesis that such techniques, when applied to a sensitive context, assist product development that meets the end-users needs by creating a higher-quality product. Limitations: The main limitation of the research was the lack of access to low-literacy end-users and former inmates without previous experience using mobile devices.