Journal of Systems and Software最新文献

{"title":"Aligning security compliance and DevOps: a longitudinal study","authors":"Fabiola Moyón ,&nbsp;Florian Angermeir ,&nbsp;Daniel Mendez ,&nbsp;Tony Gorschek ,&nbsp;Markus Voggenreiter ,&nbsp;Pierre-Louis Bonvin","doi":"10.1016/j.jss.2025.112718","DOIUrl":"10.1016/j.jss.2025.112718","url":null,"abstract":"<div><div>Companies adopt agile methodologies and DevOps to facilitate efficient development and deployment of software-intensive products. This, in turn, introduces challenges in relation to security standard compliance traditionally following a more linear workflow. This is especially a challenge for the engineering of products and services associated with critical infrastructures. To support companies in their transition towards DevOps, this paper presents an adaptation of DevOps according to security regulations and standards.</div><div>We report on our longitudinal study at Siemens AG, consisting of several individual sub-studies in the inception, validation, and initial adoption of our framework based on RefA as well as the implications for practice. RefA is a prescriptive model of a security compliant DevOps lifecycle based on the IEC 62443-4-1 standard. The overall framework is aimed at professionals, not only security experts, being able to use it on implementing DevOps processes while remaining compliant with security norms. We demonstrate how RefA facilitates the transfer of security compliance knowledge to product development teams. This knowledge transfer supports the agility aim of ensuring that cross-functional teams have all the skills needed to deliver the compliant products.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"234 ","pages":"Article 112718"},"PeriodicalIF":4.1,"publicationDate":"2026-04-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145790958","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"DEzzer: Efficient Fuzzing Mutation Scheduling Based on Differential Evolution","authors":"Jinfu Chen ,&nbsp;Wenjun Feng ,&nbsp;Saihua Cai ,&nbsp;Xingquan Mao ,&nbsp;Zhixiang Zhang ,&nbsp;Jingyi Chen ,&nbsp;Yisong Liu","doi":"10.1016/j.jss.2025.112740","DOIUrl":"10.1016/j.jss.2025.112740","url":null,"abstract":"<div><div>In recent years, mutation-based fuzzing approaches have gained widespread attention in the field of software security research. The effectiveness of such approaches relies on mutation scheduling, where classical strategies utilize random mutation operators on test cases to produce a varied range of mutated test cases. To boost these strategies, rules and methods have been proposed to guide the selection of mutation operators, thereby exploring a wide range of input spaces. However, test cases generated by these approaches tend to exhibit bias toward specific paths or code regions, making it challenging to effectively explore other areas and identify potential vulnerabilities. In this paper, we propose a novel mutation scheduling approach, which is called DEzzer. Using a customized differential evolution strategy and an effective balance point of multiple feedback signals, it optimizes the probability distribution of mutation operators. We evaluated DEzzer on the GNU Binutils suite, five independent programs in the real world, and the LAVA-M dataset. The results showed that DEzzer outperformed advanced mutation schedulers and the AFL baseline in terms of coverage in FuzzBench, successfully identifying more unique crashes. Furthermore, we conduct an analysis of these crashes, pinpointing the specific locations of vulnerabilities.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"234 ","pages":"Article 112740"},"PeriodicalIF":4.1,"publicationDate":"2026-04-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145790881","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Integrating pair programming as a work practice","authors":"Nina Haugland Andersen ,&nbsp;Anastasiia Tkalich ,&nbsp;Nils Brede Moe ,&nbsp;Darja Šmite ,&nbsp;Asgaut Mjølne Söderbom ,&nbsp;Ola Hast ,&nbsp;Viktoria Stray","doi":"10.1016/j.jss.2025.112730","DOIUrl":"10.1016/j.jss.2025.112730","url":null,"abstract":"<div><div><strong>Context:</strong> Pair programming (PP) is more relevant than ever. As modern systems grow in complexity, knowledge sharing and collaboration across teams have become essential. However, despite well-documented benefits of PP, its adoption remains inconsistent across software teams. <strong>Objective:</strong> This study aims to understand the factors that facilitate or hinder team members’ adoption as well as lasting engagement in PP. <strong>Method:</strong> We have conducted an exploratory single-case study in a mature agile company in Norway. We collected data through two rounds of interviews with team members in different roles and performed a thematic analysis of the interviews. <strong>Results:</strong> Our key finding is that multiple factors, related to the perceptions of how PP contributes to daily work, social dynamics and learning, efforts associated with engaging in PP sessions, company and team attitudes, resources, infrastructure, and task characteristics, affect PP engagement. <strong>Conclusion:</strong> Long-term engagement in PP requires expected benefits with the practice being confirmed in firsthand experiences. Adapting the practice to each unique team, with insights drawn from collective learning, is also beneficial. Our findings will be beneficial for software practitioners seeking to make PP an integrated part of their team’s workflow.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"234 ","pages":"Article 112730"},"PeriodicalIF":4.1,"publicationDate":"2026-04-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145790957","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"An architecture framework for architecting IoT applications: From design to deployment","authors":"Moamin Abughazala ,&nbsp;Mohammad Sharaf ,&nbsp;Mai Abusair ,&nbsp;Henry Muccini","doi":"10.1016/j.jss.2025.112728","DOIUrl":"10.1016/j.jss.2025.112728","url":null,"abstract":"<div><div><strong>Context</strong> - The Internet of Things (IoT) refers to a distributed network of smart, connected devices that collaboratively sense, process, and act upon real-world environments. Designing such systems requires managing complex architectural concerns spanning software logic, hardware configuration, and spatial deployment, as well as validating non-functional properties like energy consumption and communication efficiency. <strong>Objective</strong> - To provide a unified, architecture-centric framework that supports the description, simulation, and automated code generation of IoT applications across software, hardware, and physical space dimensions. <strong>Method</strong> - We use Model Driven Engineering(MDE) approaches to develop CAPS, a framework that uniquely integrates multi-view architectural modeling, energy- and traffic-aware simulation via CupCarbon, and seamless generation of deployable Arduino code from high-level design models. <strong>Result</strong> - CAPS enables a traceable and cohesive development process from architectural design to physical deployment. Case studies from diverse domains demonstrate its ability to improve modeling expressiveness, maintain transformation fidelity, and reduce development time through automation. <strong>Conclusion</strong> - CAPS unifies architectural modeling, simulation, and code generation into a novel, end-to-end toolchain, addressing fragmentation in the IoT development lifecycle and enhancing early validation and traceability.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"234 ","pages":"Article 112728"},"PeriodicalIF":4.1,"publicationDate":"2026-04-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145790961","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Leveraging explainable AI to characterize floating-point exceptions in linear solvers","authors":"Ignacio Laguna","doi":"10.1016/j.jss.2025.112757","DOIUrl":"10.1016/j.jss.2025.112757","url":null,"abstract":"<div><div>Linear solver packages are central to many scientific, engineering, and machine learning applications. When floating-point exceptions occur in these solvers, e.g., division by zero or overflow, numerical results are compromised and become unreliable. Existing static and dynamic analysis tools can detect such exceptions, but they do not explain why the exceptions occur in terms of the solver inputs. We present a study to characterize the inputs that cause numerical exceptions in linear solver packages. Our approach uses explainable AI (XAI) to find the most relevant characteristics of input matrices that explain the occurrence of exceptions in the solvers. Since training data in this domain is scarce, we perform extensive data gathering and data augmentation to obtain exception-inducing inputs. Our approach uses a <em>repair</em> strategy on the features blamed by XAI to validate that such features indeed explain the exceptions. We compare the <span>LIME</span> and <span>SHAP</span> XAI techniques using a dozen matrix features with three classifiers. We evaluate the approach on three widely used linear solver packages and find that some input characteristics can explain the occurrence of exceptions 100% of the time, in specific solvers and preconditioners.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"234 ","pages":"Article 112757"},"PeriodicalIF":4.1,"publicationDate":"2026-04-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145884144","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Exploring the potential and limitations of large language models for novice program fault localization","authors":"Hexiang Xu ,&nbsp;Hengyuan Liu ,&nbsp;Yonghao Wu ,&nbsp;Xiaolan Kang ,&nbsp;Xiang Chen ,&nbsp;Yong Liu","doi":"10.1016/j.jss.2025.112731","DOIUrl":"10.1016/j.jss.2025.112731","url":null,"abstract":"<div><div>Novice programmers often face challenges in fault localization due to their limited experience and understanding of programming syntax and logic. Traditional methods like Spectrum-Based Fault Localization (SBFL) and Mutation-Based Fault Localization (MBFL) help identify faults but often lack the ability to understand code context, making them less effective for beginners. In recent years, Large Language Models (LLMs) have shown promise in overcoming these limitations by utilizing their ability to understand program syntax and semantics. LLM-based fault localization provides more accurate and context-aware results than traditional techniques. This study evaluates six closed-source and seven open-source LLMs using the Codeflaws, Condefects, and BugT datasets, with BugT being a newly constructed dataset specifically designed to mitigate data leakage concerns. Advanced models with reasoning capabilities, such as OpenAI o3 and DeepSeekR1, achieve superior accuracy with minimal reliance on prompt engineering. In contrast, models without reasoning capabilities, like GPT-4, require carefully designed prompts to maintain performance. While LLMs perform well in simple fault localization, their accuracy decreases as problem difficulty increases, though top models maintain robust performance in the BugT dataset. Over-reasoning is another challenge, where some models generate excessive explanations that hinder fault localization clarity. Additionally, the computational cost of deploying LLMs remains a significant barrier for real-time debugging. LLM’s explanations demonstrate significant value for novice programmer assistance, with one-year experience participants consistently rating them highly. Our findings demonstrate the potential of LLMs to improve debugging efficiency while stressing the need for further refinement in their reasoning and computational efficiency for practical adoption.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"234 ","pages":"Article 112731"},"PeriodicalIF":4.1,"publicationDate":"2026-04-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145737969","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Peeking inside the black box: Training data exposure in code language models","authors":"Angelica Spina,&nbsp;Marco Russodivito,&nbsp;Simone Scalabrino,&nbsp;Rocco Oliveto","doi":"10.1016/j.jss.2025.112729","DOIUrl":"10.1016/j.jss.2025.112729","url":null,"abstract":"<div><div>Large Language Models (LLMs) have demonstrated effective in tackling coding tasks, leading to their growing popularity in commercial solutions like GitHub Copilot and ChatGPT. These models, however, may be trained on proprietary code, raising concerns about potential leaks of intellectual property. A recent study indicates that LLMs can memorize parts of the source code, rendering them vulnerable to extraction attacks. However, it used <em>white-box</em> attacks which assume that adversaries have partial knowledge of the training set.</div><div>In this paper, we present a pioneering effort to conduct a <em>black-box</em> reconstruction attack on an LLM – CodeT5+ – trained to tackle a specific coding task – code summarization. We assume the adversary has no knowledge about the training set. We train an <em>inverse model, i.e.,</em> a model that, given a comment, aims to reconstruct the source code from the training set. Then, we try to understand to what extent such a model can reconstruct the code in the training set. Our results show that the attack through the inverse model does not allow an adversary to fully reconstruct training code instances, except for a minority of cases. On the other hand, an in-depth manual analysis of the reconstructed code reveals that some important information (such as the APIs adopted) can be extracted in several cases, showing the potential vulnerability of such models.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"234 ","pages":"Article 112729"},"PeriodicalIF":4.1,"publicationDate":"2026-04-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145790963","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"An empirical study on low-code programming using traditional vs large language model support","authors":"Yongkun Liu ,&nbsp;Jiachi Chen ,&nbsp;Tingting Bi ,&nbsp;John Grundy ,&nbsp;Yanlin Wang ,&nbsp;Jianxing Yu ,&nbsp;Ting Chen ,&nbsp;Yutian Tang ,&nbsp;Zibin Zheng","doi":"10.1016/j.jss.2025.112727","DOIUrl":"10.1016/j.jss.2025.112727","url":null,"abstract":"<div><div>Low-code programming (LCP) refers to programming using models at higher levels of abstraction, resulting in less manual and more efficient programming, and reduced learning effort for amateur developers. Many LCP tools have rapidly evolved and have benefited from the concepts of visual programming languages (VPLs) and programming by demonstration (PBD). With the huge increase in interest in using large language models (LLMs) in software engineering, LLM-based LCP has begun to become increasingly important. However, the technical principles and application scenarios of traditional approaches to LCP and LLM-based LCP are significantly different. Understanding these key differences and characteristics in the application of the two approaches to LCP by users is crucial for LCP providers in improving existing and developing new LCP tools and in better assisting users in choosing the appropriate LCP technology. We conducted an empirical study of both traditional LCP and LLM-based LCP. We analyzed developers’ discussions on Stack Overflow (SO) over the past three years and then explored the similarities and differences between traditional LCP and LLM-based LCP features and developer feedback. Our findings reveal that while traditional LCP and LLM-based LCP share common primary usage scenarios, they significantly differ in scope, limitations, and usage throughout the software development lifecycle, particularly during the implementation phase. We also examine how LLMs impact and integrate with LCP, discussing the latest technological developments in LLM-based LCP, such as its integration with VPLs and the application of LLM Agents in software engineering.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"234 ","pages":"Article 112727"},"PeriodicalIF":4.1,"publicationDate":"2026-04-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145738078","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"A comparative analysis of industrial involvement and licensing in the open source software ecosystems of four IoT standards","authors":"Gregorio Robles ,&nbsp;Jonas Gamalielsson ,&nbsp;Björn Lundell ,&nbsp;Christoffer Brax ,&nbsp;Tomas Persson ,&nbsp;Anders Mattsson ,&nbsp;Tomas Gustavsson ,&nbsp;Jonas Feist ,&nbsp;Jonas Öberg","doi":"10.1016/j.jss.2025.112708","DOIUrl":"10.1016/j.jss.2025.112708","url":null,"abstract":"<div><div>Context: IoT standards are vital for interoperability and longevity, with Open Source Software (OSS) implementations preventing vendor lock-in. These implementations form vast software ecosystems on platforms like GitHub, where industrial participation is crucial. Goal: This study characterizes industrial involvement (participation, leadership, collaboration) across the software ecosystems of four IoT standards (LwM2M, NB-IoT, CoAP, Zigbee) from different standards-setting organizations. It also investigates how software licensing, particularly OSS licenses, reflects and shapes this involvement. Method: We analyzed software projects related to these standards that are publicly available on the GitHub platform, examining authorship of commits, bug reports, pull requests, and metadata like licenses. We identified organizational affiliations (corporate or academic) of contributors to assess their presence and leadership. We performed a licensing analysis to understand the legal frameworks governing these projects. Results: Our research shows significant diversity in ecosystem scale and activity, with a consistent pattern of major corporate and organizational leadership in highly active projects. Despite robust institutional involvement, a pervasive issue is the widespread absence of explicit software licenses, even in collaborative and active repositories. When licenses are present, permissive OSS licenses (e.g., Apache-2.0, MIT) dominate. This indicates a complex and often ambiguous legal landscape. Conclusion: IoT standard ecosystem growth is driven by established organizations. Addressing the prevalent lack of licensing is crucial for fostering clearer collaboration, mitigating legal risks, and ensuring long-term sustainability and adoption of these foundational technologies.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"234 ","pages":"Article 112708"},"PeriodicalIF":4.1,"publicationDate":"2026-04-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145738081","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"MBTModelGenerator: Automated reverse engineering of test models from clickstream data for model-based testing of web applications","authors":"Vahid Garousi ,&nbsp;Sasidhar Matta ,&nbsp;Alper Buğra Keleş ,&nbsp;Yunus Balaman ,&nbsp;Zafar Jafarov ,&nbsp;Aytan Mövsümova ,&nbsp;Atif Namazov","doi":"10.1016/j.jss.2025.112745","DOIUrl":"10.1016/j.jss.2025.112745","url":null,"abstract":"<div><h3>Context</h3><div>Model-Based Testing (MBT) was first introduced in 1970′s, and has the potential to improve efficiency and effectiveness of testing. However, its adoption—especially for web applications—has been hindered by the effort required to manually design MBT models, and keep them updated.</div></div><div><h3>Objective</h3><div>Based on the above challenge in a real industrial context, this study introduces an automated approach to reduce that effort by reverse engineering MBT models from clickstream data captured during users' interaction with web applications.</div></div><div><h3>Method</h3><div>We have developed and present in this paper an open-source tool, named <em>MBTModelGenerator</em>, which logs user interactions via a lightweight JavaScript module in the front-end, and transmits them to a REST API backend. These interactions are then transformed into directly executable MBT models in the input format of an open-source MBT tool named <em>GraphWalker</em>.</div></div><div><h3>Results</h3><div>The tool was evaluated on two representative open-source web applications, Spring PetClinic and a Task Manager web app, and is under evaluation in several large-scale industrial testing projects. The generated MBT models accurately reflected user navigation flows and could be executed in the GraphWalker MBT tool without any manual changes. Using the tool has significantly reduced the effort of MBT model design by more than 90%, while still allowing test engineers to inspect and refine the generated models for completeness.</div></div><div><h3>Conclusion</h3><div>Our approach facilitates lightweight adoption of MBT by automating model generation, which is the most effort intensive phase of MBT. To ensure correctness and completeness, the generated models should still be reviewed by test engineers —but that effort remains substantially lower than designing MBT models from scratch. The tool is in active industrial use and available as open-source for reuse and further development.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"234 ","pages":"Article 112745"},"PeriodicalIF":4.1,"publicationDate":"2026-04-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145840751","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}