IEEE Transactions on Software Engineering最新文献

{"title":"When Model Editing Meets Service Evolution: A Knowledge-Update Perspective for Service Recommendation","authors":"Guodong Fan, Cuiyun Gao, Chun Yong Chong, Lu Zhang, Jing Li, Jinglin Zhang, Shizha Chen","doi":"10.1109/tse.2026.3724627","DOIUrl":"https://doi.org/10.1109/tse.2026.3724627","url":null,"abstract":"","PeriodicalId":13324,"journal":{"name":"IEEE Transactions on Software Engineering","volume":"2 1 1","pages":"1-17"},"PeriodicalIF":7.4,"publicationDate":"2026-08-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148755975","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":1,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Understanding Prompt Quality and Its Relation to LLM-based Code Generation","authors":"Antonio Della Porta, Stefano Lambiase, Valeria Pontillo, Joao F. Ferreira, Akond A. Rahman, Chaiyong Ragkhitwetsagul, Fabio Palomba","doi":"10.1109/tse.2026.3719766","DOIUrl":"https://doi.org/10.1109/tse.2026.3719766","url":null,"abstract":"","PeriodicalId":13324,"journal":{"name":"IEEE Transactions on Software Engineering","volume":"275 1","pages":""},"PeriodicalIF":7.4,"publicationDate":"2026-08-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148682216","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":1,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"An Empirical Study of Kotlin-Java Cross-Dependency Issues and Their Detection","authors":"Qiong Feng, Xiaotian Ma, Jiayi Sheng, Huan Ji, Peng Liang","doi":"10.1109/tse.2026.3719845","DOIUrl":"https://doi.org/10.1109/tse.2026.3719845","url":null,"abstract":"","PeriodicalId":13324,"journal":{"name":"IEEE Transactions on Software Engineering","volume":"31 5 1","pages":""},"PeriodicalIF":7.4,"publicationDate":"2026-08-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148682230","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":1,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"EffiReasonTrans: RL-Optimized Reasoning for Code Translation","authors":"Yanlin Wang;Rongyi Ou;Yanli Wang;Mingwei Liu;Jiachi Chen;Ensheng Shi;Xilin Liu;Yuchi Ma;Zibin Zheng","doi":"10.1109/TSE.2026.3693795","DOIUrl":"10.1109/TSE.2026.3693795","url":null,"abstract":"Code translation is a crucial task in software development and maintenance. While recent advancements in Large Language Models (LLMs) have improved automated code translation accuracy, these gains often come at the cost of increased inference latency—hindering real-world development workflows that involve human-in-the-loop inspection. To address this trade-off, we propose EffiReasonTrans, a training framework designed to improve translation accuracy while balancing inference latency. We first construct a high-quality reasoning-augmented dataset by prompting a stronger language model DeepSeek-R1 to generate intermediate reasoning and target translations. Each (source code, reasoning, target code) triplet undergoes automated syntax and functionality checks to ensure reliability. Based on this dataset, we employ a two-stage training strategy: supervised fine-tuning on reasoning-augmented samples, followed by reinforcement learning to further enhance accuracy, which also helps balance inference latency. We evaluate EffiReasonTrans on six translation pairs. Experimental results show that EffiReasonTrans consistently improves translation accuracy (up to +49.2% CA and +27.8% CodeBLEU compared to the base model), while reducing the number of generated tokens (up to -19.3%) and lowering inference latency in most cases (up to -29.0%). Ablation studies further confirm the complementary benefits of the two-stage training framework. Additionally, EffiReasonTrans shows improvements of translation accuracy when integrated into agent-based frameworks. Our code and data are available at <uri>https://github.com/DeepSoftwareAnalytics/EffiReasonTrans</uri>.","PeriodicalId":13324,"journal":{"name":"IEEE Transactions on Software Engineering","volume":"52 8","pages":"2354-2366"},"PeriodicalIF":6.0,"publicationDate":"2026-08-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148291572","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":1,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Large Language Model Assisted Hybrid Fuzzing","authors":"Ruijie Meng;Gregory J. Duck;Abhik Roychoudhury","doi":"10.1109/TSE.2026.3694408","DOIUrl":"https://doi.org/10.1109/TSE.2026.3694408","url":null,"abstract":"Greybox fuzzing is one of the most popular methods for detecting software vulnerabilities, which conducts a biased random search within the program input space. To enhance its effectiveness in achieving deep coverage of program behaviors, greybox fuzzing is often combined with concolic execution, which performs a path-sensitive search over the domain of program inputs. In hybrid fuzzing, conventional greybox fuzzing is followed by concolic execution in an iterative loop, where reachability roadblocks encountered by greybox fuzzing are tackled by concolic execution. However, such hybrid fuzzing still suffers from difficulties conventionally faced by concolic execution, such as the need for environment modeling and system call support. In this work, we explore the potential of developing “smart” concolic execution empowered by Large Language Models (LLMs), leveraging their knowledge of code semantics during constraint computing and solving. When coverage-based greybox fuzzing reaches a roadblock in terms of reaching certain branches, we conduct a slicing on the execution trace and suggest modifications of the input to reach the relevant branches. The LLM is used as a solver to generate the modified input to reach the desired branches. Compared with state-of-the-art hybrid fuzzers <sc>CoFuzz</small>, <sc>Intriguer</small>, and QSYM, our LLM-based hybrid fuzzer <sc>HyLLfuzz</small> (pronounced “<italic>hill fuzz</i>”) covers 31.43%, 44.56%, and 59.48% more code branches, respectively. Furthermore, the LLM-based concolic execution in <sc>HyLLfuzz</small> takes a time that is 3–19 times faster than the concolic execution running in existing hybrid fuzzing tools. In extensively tested real-world subjects, <sc>HyLLfuzz</small> exposed seven previously unknown bugs. This experience shows that LLMs can be effectively inserted into the iterative loop of hybrid fuzzers to efficiently expose more program behaviors.","PeriodicalId":13324,"journal":{"name":"IEEE Transactions on Software Engineering","volume":"52 8","pages":"2367-2382"},"PeriodicalIF":6.0,"publicationDate":"2026-08-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148748940","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":1,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"RuleDroid: LLM-Augmented Synthesis of Static Security Detection Rules for Android Apps","authors":"Zhentao Xie;Mingyang Chen;Yaqi Gao;Shishuai Yang;Wenrui Diao;Xiangyu Liu;Kehuan Zhang","doi":"10.1109/TSE.2026.3700217","DOIUrl":"10.1109/TSE.2026.3700217","url":null,"abstract":"Android’s vast ecosystem and expansive API surfaces pose a serious challenge to static application security testing (SAST) tools. Mainstream tools such as MobSF, APKHunt, and AUSERA mainly rely on manually crafted rules. Crafting these rules demands considerable effort, yet they still cannot cover every security issue. When Android introduces new APIs, changes its permission model, or revises other security policies, the rules soon fall behind. Without constant maintenance, false positives grow, and true vulnerabilities slip through. Recently released LLM-based detectors are easy to use and potentially support a wide range of vulnerability types, but their findings often lack clear explanations and suffer from high false-positive rates. In this paper, we present <sc>RuleDroid</small>, a new framework that leverages LLMs to automatically generate Semgrep-compatible static detection rules from up-to-date official Android security documentation. <sc>RuleDroid</small> tackles the limits of pure LLM detection by combining (i) <bold>Retrieval-Augmented Generation (RAG)</b>, which grounds model outputs in trusted documents, and (ii) a modular <bold>workflow</b> that decomposes rule synthesis into well-defined stages. The resulting rules are then applied with proven static-analysis techniques, ensuring consistent and explainable results. We evaluated <sc>RuleDroid</small> on three public benchmark datasets. Based on its large and precise rule set, <sc>RuleDroid</small> achieved higher coverage and accuracy than traditional SAST tools, and sharply reduced false positives compared with direct LLM scanning. When applied to real-world apps, <sc>RuleDroid</small> discovered multiple new vulnerabilities, resulting in 57 CVE IDs being assigned. These results show that <sc>RuleDroid</small> combines the broad vulnerability coverage of LLMs with the precision of static analysis, delivering a fully automated docs-to-rules solution for Android security testing.","PeriodicalId":13324,"journal":{"name":"IEEE Transactions on Software Engineering","volume":"52 8","pages":"2488-2506"},"PeriodicalIF":6.0,"publicationDate":"2026-08-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148288706","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":1,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"TIF: Learning Temporal Invariance in Android Malware Detectors","authors":"Xinran Zheng;Shuo Yang;Edith C.-H. Ngai;Suman Jana;Lorenzo Cavallaro","doi":"10.1109/TSE.2026.3698484","DOIUrl":"10.1109/TSE.2026.3698484","url":null,"abstract":"Learning-based Android malware detectors degrade over time due to natural distribution drift caused by malware variants and new families. This paper systematically investigates the challenges classifiers trained with empirical risk minimization (ERM) face against such distribution shifts and attributes their shortcomings to their inability to learn <italic>stable</i> discriminative features. Invariant learning theory offers a promising solution by encouraging models to generate stable representations across environments that expose the instability of the training set. However, the lack of prior environment labels, the diversity of drift factors, and low-quality representations caused by diverse families make this task challenging. To address these issues, we propose TIF, the first temporal invariant training framework for malware detection, which aims to enhance the ability of detectors to learn stable representations across time. TIF organizes environments based on application observation dates to reveal temporal drift, integrating specialized multi-proxy contrastive learning and invariant gradient alignment to generate and align environments with high-quality, stable representations. TIF can be seamlessly integrated into any learning-based detector. Experiments on a decade-long dataset show that TIF excels, particularly in early deployment stages, addressing real-world needs and outperforming state-of-the-art methods.","PeriodicalId":13324,"journal":{"name":"IEEE Transactions on Software Engineering","volume":"52 8","pages":"2463-2474"},"PeriodicalIF":6.0,"publicationDate":"2026-08-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148288734","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":1,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Agentic Program Repair From Test Failures at Scale: A Neuro-Symbolic Approach With Static Analysis and Test Execution Feedback","authors":"Chandra Maddila;Adam Tait;Claire Chang;Daniel Cheng;Nauman Ahmad;Vijayaraghavan Murali;Marshall Roch;Arnaud Avondet;Aaron Meltzer;Victor Montalvao;Michael Hopko;Chris Waterson;Parth Thakkar;Renuka Fernandez;Kristian Kristensen;Sivan Barzily;Sherry Chen;Rui Abreu;Nachiappan Nagappan;Payam Shodjai;Killian Murphy;James Everingham;Aparna Ramani;Peter C. Rigby","doi":"10.1109/TSE.2026.3696849","DOIUrl":"10.1109/TSE.2026.3696849","url":null,"abstract":"<bold>Aim.</b> With the advent of LLMs, agentic program repair has become viable in large organizations with large codebases. While APR research frequently motivates its techniques around helping developers, Winter et al. <xref>[1]</xref> report that studies with substantial industrial participants are rare (2%). In this work, we develop an Engineering Agent that fixes source code from test failures at scale across diverse software offerings internally. <p><b>Method.</b> Using Llama as the base model, we employ a ReAct harness to build an agent that starts from a test failure triaged by a rule-based test failure bot. The agent operates in an agentic harness with 15 actions (e.g., reading files, searching code, running tests, and generating patches), and it iteratively refines solutions using feedback from static analysis and test execution. After validations pass, we apply an LLM-as-a-Judge to filter low-quality patches before notifying a human reviewer, who can accept and land the change in our monorepo. Because we can progressively roll out the system with layered validation and human review, we use offline benchmarks primarily as readiness gates and complement them with production evaluation based on review and landing outcomes.</p> <p><b>Benchmark Findings.</b> We curated offline benchmarks for patch generation, the agent loop, and the LLM-as-a-Judge. We found that a specialized 70B model, internally fine-tuned for patch generation in a search-and-replace format, is highly competitive with a much larger vanilla Llama-405B. We also found that patch format strongly impacts performance, with search-and-replace outperforming unified diff. In ablation studies, symbolic feedback from static analysis and test execution improves the ReAct agent. The balanced configuration achieves a benchmark solve rate of 42.3% using an average 11.8 feedback iterations.</p> <p><b>Production Findings.</b> Over a three month period, 80% of the generated fixes were reviewed, of which 31.5% were landed (25.5% of the total number of generated fixes).</p> <p><b>Engineer Feedback and Adoption.</b> We used open coding to extract qualitative themes from engineer feedback, including quick approvals, gratitude, and surprise, and we used negative feedback (e.g., test flakiness) to refine the production system. We also analyzed reviewed-but-not-merged diffs to understand why validated patches are rejected in practice, including workflow timing, intent mismatches (revert vs. fix-forward), and broader patch acceptability concerns.</p>","PeriodicalId":13324,"journal":{"name":"IEEE Transactions on Software Engineering","volume":"52 8","pages":"2446-2462"},"PeriodicalIF":6.0,"publicationDate":"2026-08-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148291533","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":1,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","authors":"Hao Song;Yiming Shen;Wenxuan Luo;Leixin Guo;Ting Chen;Jiashui Wang;Beibei Li;Xiaosong Zhang;Jiachi Chen","doi":"10.1109/TSE.2026.3694876","DOIUrl":"10.1109/TSE.2026.3694876","url":null,"abstract":"The Model Context Protocol (MCP) is an emerging standard designed to enable seamless interaction between Large Language Model (LLM) applications and external tools or resources. Within a short period, thousands of MCP services have been developed and deployed. However, the client-server integration architecture inherent in MCP may expand the attack surface against LLM Agent systems, introducing new vulnerabilities allowing attackers to exploit by malicious MCP servers. In this paper, we present the <b><i>first end-to-end empirical evaluation</i></b> of attack vectors targeting the MCP ecosystem. We provide the formal definitions, affected path, and exploited path based on the workflow for four malicious server attacks, i.e., <i>Tool Poisoning Attacks</i>, <i>Puppet Attacks</i>, <i>Rug Pull Attacks</i>, and <i>Exploitation via Malicious External Resources</i>. To evaluate their feasibility, we conduct experiments following the typical steps of launching an attack through malicious MCP servers: upload <inline-formula><tex-math>$rightarrow$</tex-math></inline-formula> download <inline-formula><tex-math>$rightarrow$</tex-math></inline-formula> attack. Specifically, we first construct malicious MCP servers and successfully upload them to three widely used MCP aggregation platforms. The results indicate that current audit mechanisms are insufficient to identify and prevent these threats. Next, through a user study and interview with 20 participants, we demonstrate that users struggle to identify malicious MCP servers and often unknowingly install them from aggregator platforms. Finally, we empirically demonstrate that these attacks can trigger harmful actions within the user’s local environment, such as accessing private files or controlling devices to transfer digital assets. Additionally, based on interview results, we discuss four key challenges faced by the current MCP security ecosystem. These findings underscore the urgent need for robust security mechanisms to defend against malicious MCP servers and ensure the safe deployment of increasingly autonomous LLM agents.","PeriodicalId":13324,"journal":{"name":"IEEE Transactions on Software Engineering","volume":"52 8","pages":"2410-2426"},"PeriodicalIF":6.0,"publicationDate":"2026-08-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148291538","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":1,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Tackling Expressive Feature-Modeling Constructs With Pseudo-Boolean d-DNNF Compilation","authors":"Chico Sundermann;Stefan Vill;Elias Kuiter;Sebastian Krieter;Thomas Thüm;Matthias Tichy","doi":"10.1109/TSE.2026.3696093","DOIUrl":"10.1109/TSE.2026.3696093","url":null,"abstract":"Configurable systems typically consist of reusable assets that have dependencies between each other. To specify such dependencies, feature models are commonly used. As feature models in practice are often complex, automated reasoning is typically employed to analyze the dependencies. Here, the de facto standard is translating the feature model to conjunctive normal form (CNF) to enable employing off-the-shelf tools, such as SAT or <monospace>#</monospace>SAT solvers. However, modern feature-modeling dialects often contain constructs, such as cardinality constraints, that are ill-suited for conversion to CNF. This mismatch between the input of reasoning engines and the available feature-modeling dialects limits the applicability of the more expressive constructs. In this work, we shorten this gap between expressive constructs and scalable automated reasoning. Our contribution is twofold: First, we provide a pseudo-Boolean encoding for feature models, which facilitates smaller representations of commonly employed constructs compared to Boolean encoding. Second, we propose a novel method to compile pseudo-Boolean formulas to Boolean d-DNNFs. With the compiled d-DNNFs, we can resort to a plethora of efficient analyses already used in feature modeling. Our empirical evaluation shows that our proposal substantially outperforms the state-of-the-art based on CNF inputs for expressive constructs. For every considered dataset representing different feature models and feature-modeling constructs, the feature models can be significantly faster translated to pseudo-Boolean than to CNF. Overall, deriving d-DNNFs from a feature model with the targeted expressive constraints can be substantially accelerated using our pseudo-Boolean approach. For instance, the Boolean approach only scales for group cardinalities with up-to 13 features while pseudo-Boolean d-DNNF compilation can compile cardinalities with thousands of features. Furthermore, our approach is competitive on feature models with only basic constructs.","PeriodicalId":13324,"journal":{"name":"IEEE Transactions on Software Engineering","volume":"52 8","pages":"2427-2445"},"PeriodicalIF":6.0,"publicationDate":"2026-08-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=11534432","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148291536","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":1,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}