Journal of Systems and Software最新文献

{"title":"SCsVulSegLytix: Detecting and extracting vulnerable segments from smart contracts using weakly-supervised learning","authors":"Borna Ahmadzadeh ,&nbsp;Arousha Haghighian Roudsari ,&nbsp;Sepideh HajiHosseinKhani ,&nbsp;Arash Habibi Lashkari","doi":"10.1016/j.jss.2025.112532","DOIUrl":"10.1016/j.jss.2025.112532","url":null,"abstract":"<div><div>Smart contracts (SCs), self-executing digital contracts deployed on blockchain networks, are becoming increasingly more prevalent in various sectors, such as finance, thanks to their automation, transparency, and cost efficiency. Given the substantial size of assets managed by them, SCs have become attractive targets for hackers, who exploit vulnerabilities in them to steal funds. Blockchain’s inherent immutability means vulnerabilities cannot be fixed quickly, and the immaturity of the Solidity programming language, which introduces potential security threats to SCs, exacerbates this problem. As such, there is a pressing need to develop security measures to identify vulnerabilities in SCs. Non-learning-based detection methods utilizing heuristics designed by experts often cannot handle the evolving complexity of SC vulnerabilities. In contrast, though typically outperforming non-learning-based solutions, learning-based solutions generally do not pinpoint the locations of vulnerabilities in SCs. Learning-based approaches that identify the locations of vulnerabilities come with several challenges: First, they convert SCs into graphs, incurring computational overhead and making the learning system more complex. Second, most require line- or function-level labels to be trained, which are difficult to gather. Lastly, their coverage of vulnerability types is not extensive, exposing the user to vulnerabilities not covered by them. This work presents SCsVulSegLytix, a learning-based approach for detecting and extracting vulnerable segments in SCs. SCsVulSegLytix uses a source code-based Transformer model trained with contract-level labels to classify entire contracts as vulnerable, followed by a post-hoc interpretability method to extract vulnerable segments in SCs according to relevance scores. Unlike previous extraction models, SCsVulSegLytix requires no line-level annotations and can be trained using contract-wide labels only, which are much easier to collect. Moreover, it operates directly on Solidity source code, substantially improving efficiency compared to expensive graph-based models. Finally, it extends support to several important classes of SC vulnerabilities, meaning developers are protected against various potential attacks. Experiments show that our model outperforms existing models concerning both contract- and line-level vulnerability identification while achieving greater computation efficiency.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"230 ","pages":"Article 112532"},"PeriodicalIF":4.1,"publicationDate":"2025-07-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144722585","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"The technical debt gamble: A case study on technical debt in a large-scale industrial microservice architecture","authors":"Klara Borowa ,&nbsp;Andrzej Ratkowski ,&nbsp;Roberto Verdecchia","doi":"10.1016/j.jss.2025.112547","DOIUrl":"10.1016/j.jss.2025.112547","url":null,"abstract":"<div><div>Microservice architectures provide an intuitive promise of high maintainability and evolvability due to loose coupling. However, these quality attributes are notably vulnerable to technical debt (TD). Few studies address TD in microservice systems, particularly on a large scale. This research explores how TD manifests in a large-scale microservice-based industrial system. The research is based on a mixed-method case study of a project including over 100 microservices and serving over 15k locations. Results are collected <em>via</em> a quantitative method based static code analyzers combined with qualitative insights derived from a focus group discussion with the development team and a follow-up interview with the lead architect of the case study system. Results show that (1) simple static source code analysis can be an efficient and effective entry point for holistic TD discovery, (2) inadequate communication significantly contributes to TD, (3) misalignment between architectural and organizational structures can exacerbate TD accumulation, (4) microservices can rapidly cycle through TD accumulation and resolution, a phenomenon referred to as “microservice architecture technical debt gamble”. Finally, we identify a set of fitting strategies for TD management in microservice architectures.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"230 ","pages":"Article 112547"},"PeriodicalIF":3.7,"publicationDate":"2025-07-16","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144657265","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"RCFuzzer: Recommendation-based Collaborative Fuzzer","authors":"Hyeonmin Mo ,&nbsp;Jongmun Yang ,&nbsp;Yunho Kim","doi":"10.1016/j.jss.2025.112564","DOIUrl":"10.1016/j.jss.2025.112564","url":null,"abstract":"<div><div>Fuzzing is an effective technique for detecting bugs by executing programs with randomly generated or mutated inputs. However, as various fuzzers have been developed, selecting the most suitable fuzzer for a specific program has become increasingly difficult. To address this issue, collaborative fuzzing techniques have been proposed, which combine multiple fuzzers and select the optimal one. However, existing approaches are inefficient and have limited accuracy, as they require significant time to evaluate fuzzer performance and fail to effectively utilize the latest results from the fuzzing campaign.</div><div>To overcome these challenges, we propose RCFuzzer, a ReCommendation based collaborative Fuzzer. RCFuzzer treats the fuzzer selection problem as a Multi-Armed Bandit(MAB) problem and improves the efficiency and accuracy of selecting the optimal fuzzer using Thompson sampling. First, RCFuzzer is efficient because it directly utilizes the current fuzzing results, eliminating the need for additional time to evaluate individual fuzzers. Second, RCFuzzer can accurately select the optimal fuzzer by using the fuzzing results obtained from the current state of the fuzzing target as feedback. Additionally, to further improve the accuracy of fuzzer selection, RCFuzzer adopts the branch difficulty heuristics, which assigns different weights to branches based on their difficulty to cover and evaluates fuzzers accordingly.</div><div>The empirical evaluation on the 47 programs from MAGMA, UNIFUZZ and Google’s Fuzzer-Test-Suite shows that RCFuzzer outperforms individual fuzzers in code coverage and crash detection capability. Additionally, RCFuzzer achieves higher code coverage for 29 out of 47 programs and detects 18 more unique crashes than autofz, the state-of-the-art collaborative fuzzer.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"230 ","pages":"Article 112564"},"PeriodicalIF":3.7,"publicationDate":"2025-07-15","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144657264","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"FieldsFuzz: Implement efficient fuzzing based on grammar-aware mutation strategy","authors":"Yinghao Su ,&nbsp;Dapeng Xiong ,&nbsp;Kechang Qian ,&nbsp;Yu Wang ,&nbsp;Qingyao Zeng","doi":"10.1016/j.jss.2025.112557","DOIUrl":"10.1016/j.jss.2025.112557","url":null,"abstract":"<div><div>A comprehensive understanding of the input format utilized by the testing program is essential for the generation of valid inputs and the enhancement of testing efficacy in fuzz testing. Nevertheless, current format-aware fuzz testing tools predominantly focus on recognizing various functional segments of binary input files, usually overlooking the structural intricacies and dependencies inherent within these files. Furthermore, existing format-aware methodologies that based on comparison and taint analysis exhibit limitations in accurately identifying file fields and types. To mitigate these challenges, this article introduces a novel format-aware fuzz testing tool, termed FieldsFuzz. Initially, FieldsFuzz performs byte-level taint analysis on significant seed inputs during program execution to derive a set of input byte instructions, thereby identifying input file structures and dependencies, and constructing a file format tree. During the mutation phase, FieldsFuzz traverses the file format tree to ascertain field dependencies, executes fields and dependencies based mutations to enhance the efficiency of effective seed generation, and introduces random modifications to the file structure to uncover previously unknown vulnerabilities. An evaluation of FieldsFuzz was conducted using twelve distinct format input programs, revealing that it surpasses leading fuzzing tools (including AFL, AFL＋＋, WEIZZ, ProFuzzer, and NestFuzz) in terms of format recognition accuracy, code coverage, and the detection of security vulnerabilities.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"230 ","pages":"Article 112557"},"PeriodicalIF":3.7,"publicationDate":"2025-07-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144657263","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Classification of quality characteristics in online user feedback using linguistic analysis, crowdsourcing and LLMs","authors":"Eduard C. Groen ,&nbsp;Fabiano Dalpiaz ,&nbsp;Martijn van Vliet ,&nbsp;Boris Winter ,&nbsp;Joerg Doerr ,&nbsp;Sjaak Brinkkemper","doi":"10.1016/j.jss.2025.112533","DOIUrl":"10.1016/j.jss.2025.112533","url":null,"abstract":"<div><div>Software qualities such as <em>usability</em> or <em>reliability</em> are among the strongest determinants of mobile app user satisfaction and constitute a significant portion of online user feedback on software products, making it a valuable source of quality-related feedback to guide the development process. The abundance of online user feedback warrants the automated identification of quality characteristics, but the online user feedback’s heterogeneity and the lack of appropriate training corpora limit the applicability of supervised machine learning. We therefore investigate the viability of three approaches that could be effective in <em>low-data</em> settings: language patterns (LPs) based on quality-related keywords, instructions for crowdsourced micro-tasks, and large language model (LLM) prompts. We determined the feasibility of each approach and then compared their accuracy. For the complex multiclass classification of quality characteristics, the LP-based approach achieved a varied precision (0.38–0.92) depending on the quality characteristic, and low recall; crowdsourcing achieved the best average accuracy in two consecutive phases (0.63, 0.72), which could be matched by the best-performing LLM condition (0.66) and a prediction based on the LLMs’ majority vote (0.68). Our findings show that in this low-data setting, the two approaches that use crowdsourcing or LLMs instead of involving experts achieved accurate classifications, while the LP-based approach had only limited potential. The promise of crowdsourcing and LLMs in this context might even extend to building training corpora.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"230 ","pages":"Article 112533"},"PeriodicalIF":4.1,"publicationDate":"2025-07-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144757450","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Evaluating pre-trained Large Language Models on zero shot prompts for parallelization of source code","authors":"Devansh Yadav,&nbsp;Shouvick Mondal","doi":"10.1016/j.jss.2025.112543","DOIUrl":"10.1016/j.jss.2025.112543","url":null,"abstract":"<div><div>Large Language Models (LLMs) have become prominent in the software development life cycle, yet the generation of performant source code, particularly through automatic parallelization, remains underexplored. This study compares 23 pre-trained LLMs against the Intel C Compiler (<span>icc</span>), a state-of-the-art auto-parallelization tool, to evaluate their effectiveness in transforming sequential C source code into parallelized versions. Using 30 kernels from the <span>PolyBench C</span> benchmarks, we generated 667 parallelized code versions to assess LLMs’ zero-shot parallelization capabilities. Our experiments reveal that LLMs can outperform <span>icc</span> in non-functional aspects like speedup, with 26.66% of cases surpassing <span>icc</span>’s performance. The best LLM-generated code achieved a <span><math><mrow><mn>7</mn><mo>.</mo><mn>5</mn><mo>×</mo></mrow></math></span> speedup compared to <span>icc</span>’s <span><math><mrow><mn>1</mn><mo>.</mo><mn>08</mn><mo>×</mo></mrow></math></span>. However, only 90 of the 667 generated versions (13.5%) were error-free and functionally correct, underscoring significant reliability challenges. After filtering out versions with compilation errors or data race issues through detailed memory and threading analysis, notable performance gains were observed. Challenges include increased cache miss rates and branch misses with higher thread counts, indicating that simply adding threads does not ensure better performance. Optimizing memory access, managing thread interactions, and validating code correctness are critical for LLM-generated parallel code. Our findings demonstrate that, even without fine-tuning or advanced prompting techniques, pre-trained LLMs can compete with decades-old non-LLM compiler technology in zero-shot sequential-to-parallel code translation. This highlights their potential in automating code parallelization while emphasizing the need to address reliability and performance optimization challenges.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"230 ","pages":"Article 112543"},"PeriodicalIF":3.7,"publicationDate":"2025-07-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144623671","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"The DevSafeOps dilemma: A systematic literature review on rapidity in safe autonomous driving development and operation","authors":"Ali Nouri ,&nbsp;Beatriz Cabrero-Daniel ,&nbsp;Fredrik Törner ,&nbsp;Christian Berger","doi":"10.1016/j.jss.2025.112555","DOIUrl":"10.1016/j.jss.2025.112555","url":null,"abstract":"<div><div>Developing autonomous driving (AD) systems is challenging due to the complexity of the systems and the need to assure their safe and reliable operation. The widely adopted approach of DevOps seems promising to support the continuous technological progress in AI and the demand for fast reaction to incidents, which necessitate continuous development, deployment, and monitoring. We present a systematic literature review meant to identify, analyse, and synthesise a broad range of existing literature related to usage of DevOps in autonomous driving development. Our results provide a structured overview of challenges and solutions, arising from applying DevOps to safety-related AI-enabled functions. Our results indicate that there are still several open topics to be addressed to enable safe DevOps for the development of safe AD.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"230 ","pages":"Article 112555"},"PeriodicalIF":3.7,"publicationDate":"2025-07-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144605478","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"An empirical study on the performance overhead of code instrumentation in containerised microservices","authors":"Yasmeen Hammad ,&nbsp;Amro Al-Said Ahmad ,&nbsp;Peter Andras","doi":"10.1016/j.jss.2025.112573","DOIUrl":"10.1016/j.jss.2025.112573","url":null,"abstract":"<div><div>Code instrumentation is vital for analysing software behaviour and facilitating cloud computing observability and monitoring, especially in microservices and containers. Despite its benefits, instrumentation introduces complexity and performance overhead, which may inadvertently slow down systems and cause unexpected or erratic behaviour. In this study, we examine the effect of automated code instrumentation on the performance of containerised microservices by comparing instrumented systems against a baseline without instrumentation. Our experimental framework is based on key performance metrics, including response time, latency, throughput, and error percentage. It is executed using a rigorous methodology with a warm-up strategy to mitigate cold-start effects. Over 5000 experiments were conducted on 70 microservice APIs drawn from two open-source applications hosted on AWS and Azure to compare the results with baseline data. The experimental analysis comprises three stages: a pilot study on AWS, a case study on AWS and Azure, and an outlier analysis of the experimental results. Overall throughput decreased by up to 8.40 %, with some individual cases experiencing up to a 30 % reduction compared to the baseline, and response time and latency dropped by 20–49 %. Moreover, the results show more outlier cases in instrumentation results than in the baseline. Additionally, the results reveal more outlier cases in the instrumentation results compared to the baseline. The instrumentation has led to unexpected or erratic behaviour, as indicated by higher variations in response time, latency, and throughput values, along with increased error rates and occasional outlier values that were not observed in the non-instrumented run. This indicates that the performance differences we observed are attributable to overhead introduced by instrumentation, rather than inherent inefficiencies within the APIs themselves. Furthermore, statistical analysis utilised the Wilcoxon Signed-Rank test and mean ratios, with multiple approaches validating significant performance differences between instrumented and baseline conditions for both cloud services. A significance analysis using Cohen’s d indicates that the throughput and response time reductions in both platforms are not only statistically significant but also suggest considerable operational impact. These findings offer insights into automated code instrumentation's performance and impact on containerised microservices. It highlights the need to develop better and less impactful instrumentation techniques, and possibly towards the development of a new approach for large-scale software development and deployment in cloud environments that facilitates efficient instrumentation by design.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"230 ","pages":"Article 112573"},"PeriodicalIF":3.7,"publicationDate":"2025-07-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144631828","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Fault analysis in additive manufacturing: Identifying causes of three-dimensional printer faults using machine learning and large language models","authors":"Muhammed Abdulhamid Karabiyik","doi":"10.1016/j.jss.2025.112556","DOIUrl":"10.1016/j.jss.2025.112556","url":null,"abstract":"<div><div>Fault detection in additive manufacturing, particularly within 3D printing systems, is a critical issue that impacts the quality and reliability of the final products. Solving these challenges is essential for ensuring high standards and consistent performance in manufacturing processes. We have developed a sophisticated system that combines traditional machine learning classifiers with advanced convolutional neural networks (CNNs) and large language models (LLMs) to enhance fault detection and diagnostic capabilities. This system employs diverse machine learning models to achieve robust image-based fault classification, supported by CNNs and cutting-edge prompt engineering techniques. Central to our approach is the Prompt Evaluation Framework (PEF), which leverages strategies such as zero-shot prompting, chain-of-thought, and directional stimulus prompting to refine interactions with LLMs. This framework enables the dynamic generation of personalized explanations and resolution strategies for detected faults, thereby enhancing accessibility and usability for users across different technical backgrounds. Our experimental results indicate that this integrated methodology not only improves the accuracy of fault detection across various fault types but also significantly enhances the interpretability and usability of the outputs. These findings have considerable practical implications for quality control in additive manufacturing, highlighting the potential for broader applications in intelligent, interactive fault diagnosis systems. By leveraging the power of machine learning and LLMs, our work represents a significant advancement in methodologies for 3D print fault detection and resolution.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"230 ","pages":"Article 112556"},"PeriodicalIF":3.7,"publicationDate":"2025-07-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144605477","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Extension decisions in open source software ecosystem","authors":"Elmira Onagh,&nbsp;Maleknaz Nayebi","doi":"10.1016/j.jss.2025.112552","DOIUrl":"10.1016/j.jss.2025.112552","url":null,"abstract":"<div><div>GitHub Marketplace is expanding by approximately 41% annually, with new tools; however, many additions replicate existing functionality. We study this phenomenon in the platform’s largest segment, Continuous Integration (CI), by linking 6,983 CI Actions to 3,869 providers and mining their version histories. Our graph model timestamps every functionality’s debut, tracks its adoption, and clusters redundant tools. We find that approximately 65% of new CI Actions replicate existing capabilities, typically within six months, and that a small set of first-mover Actions accounts for most subsequent forks and extensions. These insights enable developers to choose the optimal moment to launch, target unmet functionality, and help maintainers eliminate redundant tools. We publish the complete graph and dataset to encourage longitudinal research on innovation and competition in software ecosystems, and to provide practitioners with a data-driven roadmap for identifying emerging trends and guiding product strategy.</div></div>","PeriodicalId":51099,"journal":{"name":"Journal of Systems and Software","volume":"230 ","pages":"Article 112552"},"PeriodicalIF":3.7,"publicationDate":"2025-07-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144623508","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}