Automated Software Engineering最新文献

{"title":"SE4SC-LLM: an LLM-Augmented symbolic execution framework for smart contracts","authors":"Tianhuan Miao,&nbsp;Yang Liu","doi":"10.1007/s10515-026-00681-2","DOIUrl":"10.1007/s10515-026-00681-2","url":null,"abstract":"<div><p>Smart contracts are immutable Blockchain programs, where a single vulnerability can lead to significant financial losses. Symbolic execution is a cornerstone technique for detecting such flaws by systematically exploring execution paths. However, it suffers from path explosion problem, where the exponential growth of candidate states limits Control Flow Graph (CFG) coverage. This limitation results in overlooking critical paths with potential security flaws, reducing vulnerability detection accuracy. To address this, we propose SE4SC-LLM, an LLM-augmented symbolic execution framework for smart contracts. It operates in a learning-inference paradigm, anchoring state selection on guidance from a Large Language Model (LLM). In SE4SC-LLM, LLM directly provides the dominant control-flow semantics by encoding bytecode sequences, introducing a feature modality beyond numeric runtime statistics. A coverage-driven attention mechanism fuses the semantic embeddings with numeric features, and a regression model trained on the fused representation iteratively learns a high-reward state selection strategy. This strategy guides symbolic execution toward more effective path exploration. Evaluated on two public datasets, SE4SC-LLM achieves 95.1% average CFG coverage, a 6.5 percentage point improvement over the strongest baseline, and detects 11.2% more vulnerabilities. An out-of-distribution evaluation on 50 Etherscan-verified contracts confirms generalizability, with 94.3% CFG coverage maintained on unseen contracts. This demonstrates that LLM-augmented semantic reasoning can fundamentally enhance symbolic execution, offering a new foundation for smart contract security. The corresponding source code is available at https://github.com/mth0801/SE4SC-LLM.</p></div>","PeriodicalId":55414,"journal":{"name":"Automated Software Engineering","volume":"33 4","pages":""},"PeriodicalIF":3.9,"publicationDate":"2026-09-16","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148986751","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Goanna: a novel approach for automated type error debugging","authors":"Shuai Fu,&nbsp;Tim Dwyer,&nbsp;Peter J. Stuckey,&nbsp;John C. Grundy","doi":"10.1007/s10515-026-00656-3","DOIUrl":"10.1007/s10515-026-00656-3","url":null,"abstract":"<div><p>Statically typed languages offer many advantages in software engineering, including bug prevention, enhanced code quality, and reduced maintenance costs. However, these benefits come at the expense of a steep learning curve and a slower development pace. Although known for its expressive and strong type system, Haskell often frustrates programmers as they learn and use that type system, especially when debugging type errors. We introduce Goanna, a novel type checker for Haskell that focuses on improving error diagnostics. When a type error occurs, Goanna identifies a comprehensive list of possible causes and provides a potential course of action for each. To achieve this, Goanna uses constraint logic programming and Minimal Correction Subsets (MCSes) to support its diagnostics. We evaluated Goanna’s effectiveness on 49,750 Haskell programs, demonstrating its ability to identify root causes with higher accuracy (81.6%) than traditional tools (Helium, 65.5%; GHC, 33.7%). In our benchmark study, Goanna shows performance constraints when diagnosing large programs containing complex errors, but remains responsive enough to provide real-time debugging assistance for small to medium-sized programs.</p></div>","PeriodicalId":55414,"journal":{"name":"Automated Software Engineering","volume":"33 4","pages":""},"PeriodicalIF":3.9,"publicationDate":"2026-09-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://link.springer.com/content/pdf/10.1007/s10515-026-00656-3.pdf","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148927783","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"An extensive empirical study of the effect of pre-trained models on vulnerability severity prediction","authors":"Rongcun Wang,&nbsp;Tianyu Wang,&nbsp;Yuan Tian,&nbsp;Rubing Huang,&nbsp;Shujuan Jiang","doi":"10.1007/s10515-026-00679-w","DOIUrl":"10.1007/s10515-026-00679-w","url":null,"abstract":"<div><p>Pre-trained models have continually been proposed to address different tasks and have obtained remarkable results. However, comparative research into the effectiveness of different pre-trained models for assessing vulnerability severity and exploitability is still in its infancy. To address these gaps, we conduct an extensive empirical study to investigate the impact of such models on vulnerability severity prediction. To evaluate the effectiveness of various deep learning architectures, we design and conduct an empirical study involving 25 different combined methods based on five popular pre-training models, <i>i.e.</i>, BERT, ALBERT, CodeBERT, RoBERTa, and XLNet, paired with five classification models, <i>i.e.</i>, Bidirectional Long Short-Term Memory (Bi-LSTM), Bi-LSTM with attention (Bi-LSTMA), Convolutional Neural Networks (CNN), ‌Multilayer Perceptron (MLP), and a linear layer. Additionally, we propose a data augmentation method to address the issue of data imbalance. To provide more reliable results, the significant differences between different models are analyzed qualitatively and quantitatively. In terms of <i>precision</i>, <i>recall</i>, and <span>(F1-score)</span>, RoBERTa outperforms other four models in vulnerability severity prediction. The most effective model is the combination of RoBERTa and Bi-LSTMA. Furthermore, the use of text-enhanced balanced datasets with GPT-4o significantly improves the prediction performance, with a large effect size on baselines. These results show that the presented data augmentation method is very effective for addressing the issue of data imbalance in the studied task. Different models can significantly impact both vulnerability severity and exploitability prediction. Similarly, data augmentation can enhance the prediction performance. This study provides the software engineering community with practical insights into assessing vulnerability severity and expands the use of deep learning models.</p></div>","PeriodicalId":55414,"journal":{"name":"Automated Software Engineering","volume":"33 4","pages":""},"PeriodicalIF":3.9,"publicationDate":"2026-09-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148927779","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Type recovery in stripped binaries: a comprehensive survey of inference tools and methods","authors":"Raisul Arefin,&nbsp;Ryan Vrecenar,&nbsp;Samuel Mulder","doi":"10.1007/s10515-026-00677-y","DOIUrl":"10.1007/s10515-026-00677-y","url":null,"abstract":"<div><p>Understanding binary programs is challenging due to the loss of high-level abstractions during compilation. Type inference plays a key role in recovering information such as variable types, data structures, and class hierarchies, which is crucial for reverse engineering (RE), decompilation, and security analysis. This paper presents a survey of 50 binary type inference tools. We categorize the tools based on the types they recover and the methods they use, including dynamic analysis, static reasoning, symbolic execution, and machine learning. We also compare their input formats, supported languages, and evaluation strategies. In addition, the survey discusses the scope and origins of the area, its evolution over the past two decades, and the challenges that lie ahead. Our study highlights recent progress, especially in learning-based methods, but also reveals ongoing limitations. These include limited scalability, lack of standardized output formats, and poor support for dynamically typed languages. We also observe a lack of user-friendly interfaces and limited availability of source code for many tools, which hinders adoption and further development. We conclude by outlining open research problems and recommending future directions to make type inference tools more accurate, accessible, and widely applicable.</p></div>","PeriodicalId":55414,"journal":{"name":"Automated Software Engineering","volume":"33 4","pages":""},"PeriodicalIF":3.9,"publicationDate":"2026-09-05","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://link.springer.com/content/pdf/10.1007/s10515-026-00677-y.pdf","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148926831","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"HSF-Vul: hierarchical semantic fusion for vulnerability detection","authors":"Hongtao Wang,&nbsp;Xin Yang,&nbsp;Xiaofeng Liu,&nbsp;Weifeng Xu,&nbsp;Jianyong Zhu","doi":"10.1007/s10515-026-00653-6","DOIUrl":"10.1007/s10515-026-00653-6","url":null,"abstract":"<div><p>Software vulnerabilities present a critical threat to information security, particularly as software systems grow in complexity and adopt emerging technologies. Existing vulnerability detection methods often fail to adequately address complex code structures and subtle semantic vulnerabilities, underscoring the need for more advanced analysis techniques. To overcome these limitations, this paper proposes HSF-Vul, a novel approach for software vulnerability detection and localization based on hierarchical semantic fusion. HSF-Vul innovatively leverages the inherent hierarchical structure of source code by extracting and integrating features at the token, line, and function levels through specialized neural encoders and attention-based aggregators. This design captures both fine-grained local semantics and global structural dependencies, enabling a comprehensive understanding of code semantics. The incorporation of structural information and pre-trained language models further enriches code representations and enhances the recognition of subtle vulnerability patterns. We frame vulnerability detection as a binary classification task and extend it to line-level localization by analyzing the contribution of individual code lines. Extensive evaluations on multiple vulnerability datasets demonstrate that HSF-Vul consistently outperforms state-of-the-art baselines, achieving F1 score improvements of 2.11% on FFmpeg and 7.2% on QEMU. Additional assessments of line-level localization performance using Top-K accuracy and Inspect Lines First (IFA) metrics confirm the model’s capability to precisely identify vulnerable code segments, offering valuable support for security analysis and patch generation.</p></div>","PeriodicalId":55414,"journal":{"name":"Automated Software Engineering","volume":"33 4","pages":""},"PeriodicalIF":3.9,"publicationDate":"2026-09-05","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148926832","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Autonomous mobile software automation via semantic knowledge graphs and LLM reasoning","authors":"Jiwei Xu,&nbsp;Ying Lu,&nbsp;Mengzhi Wang,&nbsp;Wei Jiang","doi":"10.1007/s10515-026-00663-4","DOIUrl":"10.1007/s10515-026-00663-4","url":null,"abstract":"<div><p>Automating tasks on mobile software remains challenging due to frequent user interface evolution, dynamic runtime content, and the high maintenance cost of script-based automation. This work aims to improve the robustness and maintainability of mobile software automation without relying on source code or stable application programming interfaces. We propose an autonomous automation framework that combines automated user interface exploration, semantic knowledge graph construction, and large language model–guided reasoning. The system incrementally builds a persistent semantic representation of application interfaces and grounds natural-language task instructions to UI elements using semantic enrichment, fuzzy matching, and template–instance abstraction. Executable action sequences are generated through graph-based planning and carried out via system-level UI operations. The framework is evaluated on five widely used Android applications. The constructed knowledge graphs achieve an average UI coverage of 96.4%. Instruction grounding reaches a Top-1 accuracy of 95.6%, and the system achieves a 74.4% end-to-end task success rate across diverse applications and task types. The results demonstrate that combining semantic UI knowledge graphs with language-model-based reasoning provides a robust and reusable foundation for mobile software automation, reducing manual engineering effort and improving resilience to UI changes.</p></div>","PeriodicalId":55414,"journal":{"name":"Automated Software Engineering","volume":"33 4","pages":""},"PeriodicalIF":3.9,"publicationDate":"2026-08-31","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148927952","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Capacity vs. architecture: an evaluation of SLMs for automated docstring generation","authors":"Balaji Venktesh,&nbsp;Amsaprabhaa M,&nbsp;Gireesh Sundaram","doi":"10.1007/s10515-026-00675-0","DOIUrl":"10.1007/s10515-026-00675-0","url":null,"abstract":"<div><p>Automated docstring generation is a high-fidelity task where factual correctness and efficiency are critical for resource-constrained Small Language Model (SLM) deployment. Yet existing evaluations rely on heterogeneous metrics, limited human validation, and aggregate statistics that hinder comparison. We present a reproducible, human-validated evaluation framework applied to 13 strategies—four architectural families (Plain LLM, Few-Shot, RAG, Iterative Critique RAG) crossed with four reasoning variants (Base, CoT-, ToT-, GoT-style)—across three SLMs spanning 3B–14B parameters (Llama 3.2 3B, Qwen3 8B, Phi-4 14B) on 1,400 Python classes (54,600 generations), plus targeted ablations. All inference uses per-class linear mixed-effects models, and automated metrics are validated on a stratified subset (96 outputs, five of thirteen strategies) against a strictly blind two-annotator human study (ICC <span>(=0.63)</span>). Four findings challenge common assumptions. First, under the evaluated settings, model choice shows the strongest association with quality: Phi-4 and Qwen3 significantly outperform Llama 3.2 3B on code-referenced faithfulness (<span>(+0.047)</span>, <span>(+0.064)</span>; <span>(p&lt;0.001)</span>), while no architecture improves faithfulness over zero-shot generation. Second, <i>what</i> is retrieved matters more than <i>whether</i>: matched (code, docstring) exemplars beat zero-shot on every model (<span>(+0.04)</span> to <span>(+0.09)</span> BERTScore), whereas documentation-context retrieval stays marginal. Third, GoT-style decomposition is the only reasoning variant with a significant faithfulness gain (<span>(+0.032)</span>, <span>(p=0.003)</span>; corroborated by blind humans) at <span>(3.1times )</span> latency, whereas ToT-style branching costs <span>(11.4times )</span> with no benefit. Fourth, small LLM judges agree with each other (<span>(rho =0.979)</span>) yet not with blind humans (<i>r</i> between <span>(-0.21)</span> and 0.05), whereas reference-based metrics validate well. The study contributes a reproducible, human-validated evaluation methodology and evidence-based guidance for resource-efficient SLM documentation.</p></div>","PeriodicalId":55414,"journal":{"name":"Automated Software Engineering","volume":"33 4","pages":""},"PeriodicalIF":3.9,"publicationDate":"2026-08-31","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148927953","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"POLYMER: an adaptable process for simultaneous n-way model merging","authors":"Mohammad-Sajad Kasaei,&nbsp;Mohammadreza Sharbaf,&nbsp;Stephen C. Barrett,&nbsp;Bahman Zamani","doi":"10.1007/s10515-026-00671-4","DOIUrl":"10.1007/s10515-026-00671-4","url":null,"abstract":"<div><p>As a collaborative effort, the modeling of software systems must bring the work of many together in a coherent way. Combining multiple models into a single version is a key challenge. The predominant focus has been on pairwise merging, which though effective, comes up short when more than two models are to be merged. <i>N-way merging</i> addresses these shortcomings. The study aims to provide an adaptable and customizable process for integrating multiple model versions during software development. <i>POLYMER</i>, a novel means of simultaneously merging <i>N</i> versions of a model is put forth. A rule-based foundation makes its four phases: comparison, conformance checking, merging and reconciliation, highly configurable. To demonstrate the approach’s applicability, a proof-of-concept based on the Epsilon toolkit was implemented. A real-world case study involving 49 software engineers from academia, an online workshop with 10 model-driven engineers, effort analysis with three model management experts, and two experimental evaluations of various datasets, demonstrate that <i>POLYMER</i>: (1) is effective for integrating multiple versions of a model; (2) is user-friendly and useful for model integration; (3) is efficient, particularly in the merging phase; (4) is suitable for model-driven development processes. <i>POLYMER</i> is a novel, rule configurable process for simultaneously merging multiple model versions. The results confirm its applicability and advantages in real-world scenarios, making it a valuable tool for collaborative software modeling.</p></div>","PeriodicalId":55414,"journal":{"name":"Automated Software Engineering","volume":"33 4","pages":""},"PeriodicalIF":3.9,"publicationDate":"2026-08-28","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148838257","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"NavAI: an application-agnostic llm framework for navigation tasks in virtual reality environments","authors":"Jiajie Wang,&nbsp;Sumesh Surendran Letha,&nbsp;Matthew DiGiovanni,&nbsp;Kebin Peng,&nbsp;Sen He","doi":"10.1007/s10515-026-00676-z","DOIUrl":"10.1007/s10515-026-00676-z","url":null,"abstract":"<div><p>Navigation is a fundamental capability for automated exploration in immersive Virtual Reality (VR) environments. While prior work has largely focused on path optimization in 360-degree image datasets or in pre-trained 3D simulators, such approaches are difficult to apply directly to general VR applications involving unseen scenes and dynamic interactions. To address this gap, we present NavAI, an extensible navigation framework that leverages large language models (LLMs) to support both basic action commands and multi-step goal-oriented navigation through an application-agnostic screenshot-and-control interface. NavAI decomposes navigation into perception, decision making, and control execution, and explores multiple model variants that balance effectiveness, efficiency, and robustness. In particular, NavAI establishes an LLM-based navigation baseline and explores optimization strategies for virtual scene understanding and navigation goal decision making, enabling systematic comparison between baseline and optimized designs. In an evaluation covering two Unity environments and three distance regimes, the voting-based Full Mode achieves a 100% success rate, and Gemini-based single-model variants (with and without YOLO) match this effectiveness without ensemble voting. In the outdoor environment, YOLO-assisted variants reduce end-to-end navigation time by up to <span>(approx 53%)</span> and per-attempt token consumption by up to <span>(approx 82%)</span> compared to LLM-only baselines, while adding a small overhead indoors; Full Mode consumes up to <span>(approx 2.9times )</span> the tokens of the equally successful Gemini (YOLO) variant because every decision is made by three sequentially invoked models. Based on these findings, we discuss the limitations of LLM-driven navigation and outline directions for future optimization and practical deployment in immersive VR systems.</p></div>","PeriodicalId":55414,"journal":{"name":"Automated Software Engineering","volume":"33 4","pages":""},"PeriodicalIF":3.9,"publicationDate":"2026-08-28","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148838323","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Automated formal verification of secure aggregation protocols","authors":"Yuping Yan,&nbsp;Zicen Zhao,&nbsp;Fei Ming,&nbsp;Péter Ligeti,&nbsp;Yaochu Jin","doi":"10.1007/s10515-026-00670-5","DOIUrl":"10.1007/s10515-026-00670-5","url":null,"abstract":"<div><p>Secure aggregation is a key privacy-preserving protocol in federated learning software systems, enabling an aggregation server to compute global model updates without accessing individual clients’ private inputs. As federated learning is increasingly deployed in complex, distributed, and AI-enabled software environments, formal automated verification is essential for ensuring the correctness, security, and trustworthiness of its underlying protocols. Although the original Secure Aggregation protocol provides mathematical security arguments, its confidentiality guarantees have not been formally verified using automated tools. In this paper, we present an automated formal verification study of the Secure Aggregation protocol using ProVerif. We construct symbolic models for both the simplified protocol without signature validation and the full protocol with signature-based consistency checks, under the Dolev–Yao adversarial model. Confidentiality is encoded as attacker-knowledge queries over clients’ private inputs, and both normal execution and client-dropout scenarios are analyzed. Our results show that the simplified protocol is vulnerable to Sybil attacks and live user list forgery attacks, while the idealized full-protocol model blocks these attack paths and satisfies the specified confidentiality queries for the analyzed four-client configurations. This study demonstrates how automated formal verification can support trustworthy and verifiable federated learning software systems.</p></div>","PeriodicalId":55414,"journal":{"name":"Automated Software Engineering","volume":"33 4","pages":""},"PeriodicalIF":3.9,"publicationDate":"2026-08-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148837531","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}