Abstract Modern software development automation is mostly based on AI, covering every aspect of code production and maintenance, throughout the entire software development lifecycle, from requirements and code writing to testing and maintenance. Code commenting is no exception. Automated code comment generation methods rely on static syntactic and lexical features of source code. However, these approaches frequently underperform in data-centric software applications, where understanding the effect of code on data is essential. We explore an execution-aware extension to automatic documentation generation. In this exploratory work, we aim at capturing post-execution data transformations (i.e., semantic data differences) that reveal the code’s effect on data, and use it as a complementary signal alongside existing code representations to automate explanatory comments for data wrangling code. We build a curated dataset of Python notebooks from Kaggle and apply a lightweight execution tracer to extract structured descriptions of runtime data transformations. We define a formal grammar for capturing these effects and integrate them into a multimodal encoder-decoder model using co-attention mechanisms. Multiple training strategies are explored to assess the impact of this new modality on comment generation. Our evaluation reveals that models incorporating this modality performed competitively with code-only baselines. Notably, in cases where no observable data transformation occurred, the presence of symbolic $$\langle \mathsf {no\_diff} \rangle$$ signals led to improved robustness and higher comment quality, as measured by both automatic and human evaluation metrics. However, we did not observe improvements in comment quality in semantically rich scenarios, suggesting possible paths of improvement for future research direction. Qualitative analysis of generated comments supports this pattern, indicating that the modality helps stabilize comments by reducing unnecessary or speculative details in neutral cases, but does not provide yet consistent guidance when meaningful data transformations occur. These trends are less pronounced on a larger, noisier extended test set, suggesting sensitivity to comment–code alignment. Our study demonstrates the feasibility and potential of using execution-derived feedback as a complementary signal in automated comment generation. While the current approach is limited by dataset size and modality noise, it demonstrates that post-execution state changes can guide more context-aware and stable code summarization. This suggests a promising direction for execution-sensitive models in assisting data-centric software development and its documentation.

Evaluating the effectiveness of software protection is crucial for selecting the most effective methods to safeguard assets within software applications. Obfuscation involves techniques that deliberately modify software to make it more challenging to understand and reverse-engineer, while maintaining its original functionality. Although obfuscation is widely adopted, its effectiveness remains largely unexplored and not rigorously evaluated. This paper presents a controlled experiment involving Master’s students performing code comprehension tasks on applications hardened with obfuscation. The experiment’s goals are to assess the effectiveness of obfuscation in delaying code comprehension by attackers and to determine whether complexity metrics can accurately predict the impact of these protections on success rates and durations of code comprehension tasks. The study is the first to evaluate the effect of layering multiple obfuscation techniques on a single piece of protected code. It also provides experimental evidence of the correlation between objective metrics of the attacked code and the likelihood of a successful attack, bridging the gap between objective and subjective approaches to estimating potency. Finally, the paper highlights significant aspects that warrant additional analysis and opens new avenues for further experiments.

Abstract UML has become, throughout the years, the most popular modeling language for the conceptual design of software. However, UML diagrams are frequently flawed with semantic and syntactical errors. One of the main root causes for such issues can be traced back to software modeling education in software engineering curricula, which is typically given less attention than core development activities. The objective of this manuscript is to describe the application of gamification (i.e., the use of game-related mechanics in non-gameful contexts) to increase the motivation and engagement of Master’s students in learning the core concepts of UML modeling. Our tool prototype includes typical gamification mechanics such as avatars, achievements, scoring mechanisms, and leaderboards and incorporates a system for automatic validation of the correctness of the student’s solution. We empirically evaluated the benefits achieved through the tool by performing a controlled experiment with 280 Master’s students. We found that the use of gamification significantly increased the student commitment to perform exercises, the completeness of the exercises, and the semantic quality of the produced diagrams. Through standard usability questionnaires, we also gathered positive responses and attitudes toward the usage of the tool.

The Scrum framework has gained widespread adoption in the industry for its emphasis on collaboration and continuous improvement. However, it has not reached a similar relevance in Software Engineering (SE) curricula. This work reports the experience of five editions of a SE course within an M.Sc. Degree in Computer Engineering. The course primary educational objective is to provide students with the skills to manage software development projects with Scrum. The course is based on the execution of a team project and on the definition of qualitative and quantitative means of assessment of the application of Scrum. The conduction of five editions of the course allowed us to identify several lessons learned about time budgeting and team compositions in agile student projects and its evidence of the applicability of the framework to software development courses.

Large Language Models (LLM) have rapidly affirmed in the latest years as a means to support or substitute human actors in a variety of tasks. LLM agents can generate valid software models, because of their inherent ability in evaluating textual requirements provided to them in the form of prompts.

Background. Gamification, i.e. the use of game-like elements in non-recreational contexts for increasing user participation and interest, has been adopted several times for Software Engineering activities for both practitioners and learners. There is, however, little evidence in the literature about applications of gamification to the discipline of Process Modeling, and even fewer experience reports are available about the use of gamified tooling in education.

Abstract Gamification, the practice of using game elements in non-recreational contexts to increase user participation and interest, has been applied more and more throughout the years in software engineering. Business process modeling is a skill considered fundamental for software engineers, with Business Process Modeling Notation (BPMN) being one of the most commonly used notations for this discipline. BPMN modeling is present in different curricula in specific Master’s Degree courses related to software engineering but is usually seen by students as an unappealing or uninteresting activity. Gamification could potentially solve this issue, though there have been no relevant attempts in research yet. This paper aims at collecting preliminary insights on how gamification affects students’ motivation in performing BPMN modeling tasks and—as a consequence—their productivity and learning outcomes. A web application for modeling BPMN diagrams augmented with gamification mechanics such as feedback, rewards, progression, and penalization has been compared with a non-gamified version that provides more limited feedback in an experiment involving 200 students. The diagrams modeled by the students are collected and analyzed after the experiment. Students’ opinions are gathered using a post-experiment questionnaire. Statistical analysis showed that gamification leads students to check more often for their solutions’ correctness, increasing the semantic correctness of their diagrams, thus showing that it can improve students’ modeling skills. The results, however, are mixed and require additional experiments in the future to fine-tune the tool for actual classroom use.

Context: Gamification appears to improve enjoyment and quality of execution of software engineering activities, including software testing. Though commonly employed in industry, manual exploratory testing of web application GUIs was proven to be mundane and expensive. Gamification applied to that kind of testing activity has the potential to overcome its limitations, though no empirical research has explored this area yet.Goal: Collect preliminary insights on how gamification, when performed by novice testers, affects the effectiveness, efficiency, test case realism, and user experience in exploratory testing of web applications.Method: Common gamification features augment an existing exploratory testing tool: Final Score with Leaderboard, Injected Bugs, Progress Bar, and Exploration Highlights. The original tool and the gamified version are then compared in an experiment involving 144 participants. User experience is elicited using the Technology Acceptance Model (TAM) questionnaire instrument.Results: Statistical analysis identified several significant differences for metrics that represent the effectiveness and efficiency of tests showing an improvement in coverage when they were developed with gamification. Additionally, user experience is improved with gamification.Conclusions: Gamification of exploratory testing has a tangible effect on how testers create test cases for web applications. While the results are mixed, the effects are most beneficial and interesting and warrant more research in the future. Further research shall be aimed at confirming the presented results in the context of state-of-the-art testing tools and real-world development environments.

Business Process Modeling (BPM) is a skill considered fundamental for computer engineers, with Business Process Modeling Notation (BPMN) being one of the most commonly used notations for this discipline. BPMN modeling is present in different curricula in specific Master’s Degree courses related to software engineering, but, in practice, students often underperform on BPMN modeling exercises due to difficulties in learning good modeling practices. In recent years, more and more fields of computer science have employed gamification (the usage of game elements in non-recreational contexts to gain benefits in terms of interest, participation, motivation, and enjoyment) with positive results during both development and teaching processes. Thus, we have developed a platform for BPMN modeling that employs gamification mechanics to facilitate learning good modeling practices with mechanisms such as rewarding good modeling solutions and penalizing less correct ones, with a dedicated feedback mechanism that maps correctly modeled elements to the corresponding concept. A preliminary laboratory experiment has been conducted with students of an Information Systems course to evaluate how students receive the mechanics and if there may be benefits in using a gamified environment for teaching process modeling throughout an entire course.

Software bias has emerged as a relevant issue in the latest years, in conjunction with the increasing adoption of software automation in a variety of organizational and production processes of our society, and especially in decision-making. Among the causes of software bias, data imbalance is one of the most significant issues. In this paper, we treat imbalance in datasets as a risk factor for software bias. Specifically, we define a methodology to identify thresholds for balance measures as meaningful risk indicators of unfair classification output. We apply the methodology to a large number of data mutations with different classification tasks and tested all possible combinations of balance-unfairness-algorithm.The results show that on average the thresholds can accurately identify the risk of unfair output. In certain cases they even tend to overestimate the risk: although such behavior could be instrumental to a prudential approach towards software discrimination, further work will be devoted to better assess the reliability of the thresholds.The proposed methodology is generic and it can be applied to different datasets, algorithms, and context-specific thresholds.

In automated Visual GUI Testing (VGT) for Android devices, the available tools often suffer from low robustness to mobile fragmentation, leading to incorrect results when running the same tests on different devices. To soften these issues, we evaluate two feature matching-based approaches for widget detection in VGT scripts, which use, respectively, the complete full-screen snapshot of the application ( Fullscreen ) and the cropped images of its widgets ( Cropped ) as visual locators to match on emulated devices. Our analysis includes validating the portability of different feature-based visual locators over various apps and devices and evaluating their robustness in terms of cross-device portability and correctly executed interactions. We assessed our results through a comparison with two state-of-the-art tools, EyeAutomate and Sikuli. Despite a limited increase in the computational burden, our Fullscreen approach outperformed state-of-the-art tools in terms of correctly identified locators across a wide range of devices and led to a 30% increase in passing tests. Our work shows that VGT tools’ dependability can be improved by bridging the testing and computer vision communities. This connection enables the design of algorithms targeted to domain-specific needs and thus inherently more usable and robust.

Bias in the data used to train decision-making systems is a relevant socio-technical issue that emerged in recent years, and it still lacks a commonly accepted solution. Indeed, the "bias in-bias out" problem represents one of the most significant risks of discrimination, which encompasses technical fields, as well as ethical and social perspectives. We contribute to the current studies of the issue by proposing a data quality measurement approach combined with risk management, both defined in ISO/IEC standards. For this purpose, we investigate imbalance in a given dataset as a potential risk factor for detecting discrimination in the classification outcome: specifically, we aim to evaluate whether it is possible to identify the risk of bias in a classification output by measuring the level of (im)balance in the input data. We select four balance measures (the Gini, Shannon, Simpson, and Imbalance ratio indexes) and we test their capability to identify discriminatory classification outputs by applying such measures to protected attributes in the training set. The results of this analysis show that the proposed approach is suitable for the goal highlighted above: the balance measures properly detect unfairness of software output, even though the choice of the index has a relevant impact on the detection of discriminatory outcomes, therefore further work is required to test more in-depth the reliability of the balance measures as risk indicators. We believe that our approach for assessing the risk of discrimination should encourage to take more conscious and appropriate actions, as well as to prevent adverse effects caused by the "bias in-bias out" problem.

Context: Different approaches exist for automated GUI testing of Android applications, each with its peculiarities, advantages, and drawbacks. The most common are either based on the structure of the GUI or use visual recognition.

Android applications do not seem to be tested as thoroughly as desktop ones. In particular, graphical user interface (GUI) testing appears generally limited. Like web-based applications, mobile apps suffer from GUI test fragility, i.e., GUI test classes failing or needing updates due to even minor modifications in the GUI or in the application under test. The objective of our study is to estimate the adoption of GUI testing frameworks among Android open-source applications, the quantity of modifications needed to keep test classes up to date, and their amount due to GUI test fragility. We introduce a set of 21 metrics to measure the adoption of testing tools and the evolution of test classes and test methods, and to estimate the fragility of test suites. We computed our metrics for six GUI testing frameworks, none of which achieved a significant adoption among Android projects hosted on GitHub. When present, GUI test methods associated with the considered tools are modified often, and a relevant portion (70% on average) of those modifications is induced by GUI-related fragilities. On average, for the projects considered, more than 7% of the total modified lines of code between consecutive releases belong to test classes developed with the analyzed testing frameworks. The measured percentage was higher on average than the one required by other generic test code, based on the JUnit testing framework. Fragility of GUI tests constitutes a relevant concern, probably an obstacle for developers to adopt test automation. This first evaluation of the fragility of Android scripted GUI testing can constitute a benchmark for developers and testers leveraging the analyzed test tools and the basis for the definition of a taxonomy of fragility causes and guidelines to mitigate the issue.

Context: Open Government Data (OGD) represent an invaluable resource for enabling active citizenship. A significant example is represented by the mandatory data that Italian public administrations (PAs) are required to publish concerning their contracts. Nevertheless, a low quality of data provided by PAs could hamper the prospect of citizen involvement. Goal: Our objective is to define a set of basic metrics for public contracts OGD on the basis of the ISO SQuaRE standards family, with the goal of enabling the automated evaluation of dataset quality. Method: We started with the metrics defined in the ISO 25024 standard and adapted them to the data schema of the OGD under evaluation. We assessed the results by looking at the issues revealed by the metrics applied to the data released by a pool of PAs. Results: We were able to define a set of metrics, and apply them to to the datasets released by 12 distinct organizations. The metrics allowed us to identify several quality issues that limit the reuse of OGD from the citizen perspective. Conclusions: The metrics we develop are able to identify quality issues and are suitable to perform an initial automated assessment of OGD datasets. This exercise also support the generality of the ISO 25024 quality measures.

Code protections aim at blocking (or at least delaying) reverse engineering and tampering attacks to critical assets within programs. Knowing the way hackers understand protected code and perform attacks is important to achieve a stronger protection of the software assets, based on realistic assumptions about the hackers' behaviour. However, building such knowledge is difficult because hackers can hardly be involved in controlled experiments and empirical studies. The FP7 European project Aspire has given the authors of this paper the unique opportunity to have access to the professional penetration testers employed by the three industrial partners. In particular, we have been able to perform a qualitative analysis of three reports of professional penetration test performed on protected industrial code. Our qualitative analysis of the reports consists of open coding, carried out by 7 annotators and resulting in 459 annotations, followed by concept extraction and model inference. We identified the main activities: understanding, building attack, choosing and customizing tools, and working around or defeating protections. We built a model of how such activities take place. We used such models to identify a set of research directions for the creation of stronger code protections.

The increase in the amount of structured data published on the Web using the principles of Linked Data means that now it is more likely to find resources on the Web of Data that represent real life concepts. Discovering and recommending resources on the Web of Data related to a given resource is still an open research area. This work presents a framework to deploy and execute Linked Data based recommendation algorithms to measure their accuracy and performance in different contexts. Moreover, application developers can use this framework as the main component for recommendation in various domains. Finally, this paper describes a new recommendation algorithm that adapts its behavior dynamically based on the features of the Linked Data dataset used. The results of a user study show that the algorithm proposed in this paper has better accuracy and novelty than other state-of-the-art algorithms for Linked Data.

Obfuscation techniques are a general category of software protections widely adopted to prevent malicious tampering of the code by making applications more difficult to understand and thus harder to modify. Obfuscation techniques are divided in code and data obfuscation, depending on the protected asset. While preliminary empirical studies have been conducted to determine the impact of code obfuscation, our work aims at assessing the effectiveness and efficiency in preventing attacks of a specific data obfuscation technique - VarMerge. We conducted an experiment with student participants performing two attack tasks on clear and obfuscated versions of two applications written in C. The experiment showed a significant effect of data obfuscation on both the time required to complete and the successful attack efficiency. An application with VarMerge reduces by six times the number of successful attacks per unit of time. This outcome provides a practical clue that can be used when applying software protections based on data obfuscation.

Context: Mobile Devices, typically battery driven, require new efforts to improve the energy efficiency of both hardware and software designs. Goal: The goal of this work is to analyze the energy efficiency of different sorting algorithms implementations. Method: We set up an experiment on an ARM based device, measuring the energy consumption of different sorting algorithms implemented in different programming languages. Result: The algorithms and languages exhibit significantly different energy consumption, the ARM assembly language implementation of counting sort is the greenest solution. Conclusion: We provide the basic information to select algorithms and identified the main factors affecting energy consumption.

Context: Applying model driven techniques can lead to several benefits, but their adoption entails also numerous issues. Goal: We aim at understanding the benefits and barriers on the adoption of the modelling techniques for embedded systems developed in a large German research project. Method: We replicate a survey conducted in the Italian industry about relevance, benefits, and problems of software modelling and model driven techniques. Results: With respect to the original study, we could confirm design support and quality of software as achieved benefits. On the side of the barriers, too much effort required, lack of competencies and lack of supporting tools were confirmed. Other barriers were confirmed as not having an impact: refusal from management, cost of supporting tool, fear of lock-in. Conclusions: We observed that even for the not mature modelling techniques in our context of study, a few benefits and a large number of barriers (or lack of) reported in the original study and in literature were confirmed.

In this paper we study how the language cocktails are composed. How many languages are used in each software projects, which language types are used and which languages are typically used together. Our study was done on a sample of over 15,000 projects from the largest software forge, GitHub. The results show that many languages are used in each project: 96% projects employ at least 2 languages, over 50% employ at least two programming languages. Finally, there are strong relations between different languages: hence sets of languages tend to be adopted together.

Over the last few years, the software engineering community has proposed a number of modeling methods to represent functional requirements. Among them, use cases are recognized as an easy to use and intuitive way to capture and define such requirements. Screen mockups (also called user-interface sketches or user interface-mockups) have been proposed as a complement to use cases for improving the comprehension of functional requirements. In this article, we aim at quantifying the benefits achievable by augmenting use cases with screen mockups in the comprehension of functional requirements with respect to effectiveness, effort, and efficiency. For this purpose, we conducted a family of four controlled experiments, involving 139 participants having different profiles. The experiments involved comprehension tasks performed on the requirements documents of two desktop applications. Independently from the participants' profile, we found a statistically significant large effect of the presence of screen mockups on both comprehension effectiveness and comprehension task efficiency. No significant effect was observed on the effort to complete tasks. The main pragmatic lesson is that the screen mockups addition to use cases is able to almost double the efficiency of comprehension tasks.

Context: the presence of several languages interacting each other within the same project is an almost universal feature in software development. Earlier work shows that this interaction might be source of problems. Objective: we aim at identifying and characterizing the cross-language interactions at semantic level. Method: we took the commits of an open source project and analyzed the cross-language pairs of files occurring in the same commit to identify possible semantic interactions. We both defined a taxonomy and applied it. Result: we identified 6 categories of semantic interactions. The most common category is the one based on shared ids, the next is when an artifact provides a description of another artifact. Conclusion: the deeper knowledge of cross-language interactions represents the basis for implementing a tool supporting the management of this kind of interactions and the detection of related problems at compile time.

The interactions of several languages within a software system pose a number of problems. There is several anecdotal and empirical evidence supporting such concerns. This paper presents a solution to achieve proper language integration in the context of language workbenches and with limited effort. A simple example is presented to show how cross-language constraints can be addressed and the quality of the support attainable, which covers error-checking and refactoring. A research agenda is then presented, to support future work in the area of language integration, taking advantage of modern language workbenches features.

In this poster, we sketch our research plan about a “massive” empirical evaluation of model-driven techniques following the first two already conducted steps in that respect (an exploratory survey and a series of controlled experiments concerning maintainability). We intend to experiment UML-based model-driven techniques in several contexts (e.g., desktop and Web applications), focusing on several software characteristics (e.g., maintainability and productivity) and employing empirical methods such as controlled experiments, surveys, case studies.

Context: Defects are an ineludible component of software, Defect Density (DD) - defined as the number of defects divided by size - is often used as a related measure of quality. Project managers and researchers alike would benefit a lot from overview DD figures from software projects, the former for decision making the latter for state-of-the-practice assessment. Objective: In this paper, we collect and aggregate DD figures published in literature, in addition we characterize DD as a function of different project factors in terms of central tendency and dispersion. The factors considered include development mode -open vs. closed source-, programming language, size, and age. Results: We were able to identify 19 papers reporting defect density figures concerning 109 software projects. The mean DD for the studied sample of projects is 7.47 post release defects per thousand lines of code (KLoC), the median is 4.3 with a standard deviation of 7.99. Development mode, is characterized by statistically meaningful different DD, the same for Java vs. C. Besides, in the studied sample large projects exhibited lower DD than medium and small projects. Conclusion: The study is a first step in collecting and analyzing DD figures for the purpose of characterizing one important aspect of software quality. These figures can be used both by researchers and project managers interested to evaluate their projects. Further work is needed to extend the data set and to identify predictors of defect density.

Background: The main claimed advantage of Model-driven engineering is improvement in productivity. However, few information is available about its actual adoption during software development and maintenance in the industry. Objective: The main aim of this work is investigating the level of maturity in the adoption of software models and of Model-driven engineering in the Italian industry. The perspective is that of software engineering researchers. Method: First, we conducted an exploratory personal opinion survey with 155 Italian software professionals. The data were collected with the help of a web-based on-line questionnaire. Then, we conducted focused interviews with three software professionals to interpret doubtful results. Results: Software modelling is a very relevant phenomenon in the Italian industry. Model-Driven techniques are used in the industry, even if (i) only for a limited extent, (ii) despite a quite generalized dissatisfaction about available tools and (iii) despite a generally low experience of the IT personnel in such techniques. Limitations: Generalization of results is limited due to the sample size. Moreover, possible self-exclusion from participants not interested in modelling could have biased the results. Conclusion: Results reinforce existing evidence regarding the usage of software modelling and (partially of) Model-driven engineering in the industry but highlight several aspects of immaturity of the Italian industry

Context: A common assumption in software engineering is that a more structured process delivers higher quality products. However, there are limited empirical studies that support this assumption. Objective: In this paper we analyze 61 projects looking for a relationship between process structured and quality of the product. The structure is considered under two dimensions: level of maturity (as measured by the CMMI assessment model) and type (e.g. TSP, RUP). The quality of the product is measured in terms of Defect Density (DD) defined as the number of delivered defects divided per size. Results: We found a small and statistically not significant difference of DD between the projects developed under CMMI and those that are not developed under CMMI. Considering the CMMI levels, the pair (CMMI 1, CMMI 3) is characterized by a statistically significant different DD. CMMI 1 exhibiting higher DD than CMMI 3. By comparing different software processes with each other we found that Hybrid process exhibits statistically significant lower DD than Waterfall. Conclusion: Software process in either dimension, level of maturity and type has an impact on the software quality but smaller than one might expect.

Most software systems are complex and composed of a large number of artifacts. To realize each different artifact specific techniques are used resorting to different abstractions, languages and tools. Successful composition of different elements requires coherence among them. Unfortunately constraints between artifacts written in different languages are usually not formally expressed nor checked by supporting tools; as a consequence they can be a source of problems. In this paper we explore the role of the relations between artifacts written in different languages by means of a case study on the Hadoop open source project. We present the problem introducing its terminology, we quantify the phenomenon and investigate its relation with defect proneness.

One of the claimed advantages of Model-driven development is the improvement in maintainability. However, few studies consider this aspect from an empirical point of view. This paper reports the results of a controlled experiment with 21 bachelor students aimed at investigating the effectiveness of Model-driven development during software maintenance and evolution activities. The tool used in the experiment is UniMod, a specific implementation of executable UML. Preliminary results indicate a relevant shortening of time with no significant impact on correctness, gained through the use of UniMod instead of conventional programming (i.e., code-centric programming).

Background: In the modeling of object oriented software systems, the UML object diagrams are recognized very useful to complement class diagrams. However, up to now, there exists only one experiment [Torchiano 2004] that investigates this concern. Aim: To confirm or contradict the findings of the original experiment, we have conducted a replication and the achieved results have been presented in this paper. Both the replication and the original experiment have been conducted to investigate whether the use of object diagrams to complement class diagrams affects the comprehension of software systems. Method: The replication has been conducted with a group of 24 graduated subjects in Computer Science of the University of Basilicata. The experiment adopts a counterbalanced design, thus ensuring that each subject work on two comprehension tasks, experimenting each time class and object diagrams together or class diagrams alone. The comprehension on each task has been assessed using a questionnaire-based approach. In particular, we have measured the comprehension level of each subject using an information retrieval based approach that allowed us to get a balance between correctness and completeness of the answers. Results: The results show that the subjects significantly benefit from the use of object diagrams in the comprehension of software systems, thus confirming and strengthening the findings of the original experiment. Conclusions: It is advisable to complement the usual class diagrams with object diagrams to increase the understandability of software systems. To raise the generalizability of the results, replications of this study are necessary especially with professional software engineers

Abstract—Background: a systematic review identifies, evalu-ates and synthesizes the available literature on a given topic using scientific and repeatable methodologies. The significant workload required and the subjectivity bias could affect results. Aim: semi-automate the selection process to reduce the amount of manual work needed and the consequent subjectivity bias. Method: extend and enrich the selection of primary studies using the existing technologies in the field of Linked Data and text mining. We define formally the selection process and we also develop a prototype that implements it. Finally, we conduct a case study that simulates the selection process of a systematic literature published in literature. Results: the process presented in this paper could reduce the work load of 20 % with respect to the work load needed in the fully manually selection, with a recall of 100%. Conclusions: the extraction of knowledge from scientific stud-ies through Linked Data and text mining techniques could be used in the selection phase of the systematic review process to reduce the work load and subjectivity bias. I.

Background: Effective use of bug finding tools promise to speed up the process of source code verification and to move a portion of discovered defects from testing to coding phase.However, many problems related to their usage, especially the large number of false positives, could easily hinder the potential benefits of such tools.Aims: Assess the percentage and type of issues of a popular bug-finding tool (FindBugs) that are actual defects.Method: We analyzed 301 Java Projects developed at a university with FindBugs, collecting the issues signalled on the source code.Afterwards, we checked the precision of issues with information on changes, we ranked and validated them using both manual inspection and validation with tests failures.Results: We observed that a limited set of issues have high precision and conversely we identified those issues characterized by low precision.We compared findings first with our previous experiment and then to related work: results are consistent with both of them.Conclusions: Since our and other empirical studies demonstrated that few issues are related to real defects with high precision, developers could enable only them (or prioritize), reducing the information overload of FindBugs and having the possibility to discover defects earlier.Furthermore, the technique presented in the paper can be adopted to other tools on a code base with tests to find issues with high precision that can be checked on code in production to find defects earlier.

In the context of an Italian research project, this paper reports on an on-line survey, performed with 155 software professionals, with the aim of investigating about their opinions and experiences in modeling during software development and Model-driven engineering usage. The survey focused also on used modeling languages, processes and tools. A preliminary analysis of the results confirmed that Model-driven engineering, and more in general software modeling, are very relevant phenomena. Approximately 68% of the sample use models during software development. Among then, 44% generate code starting from models and 16% execute them directly. The preferred language for modeling is UML but DSLs are used as well.

In this paper, we present and discuss the results of an internal replication of a controlled experiment for assessing the effectiveness of including screen mockups when adopting Use Cases. The results of the original experiment indicate a clear improvement in terms of understandability of functional requirements when screen mockups are present with no significant impact on effort. The data analysis of the replication, conducted also in this case with undergraduate students, confirms the results of the original experiment with slight differences, thus confirming that screen mockups facilitate the understanding of requirements without influencing the effort. We also sketch here some issues related to the documentation and communication between experimenters

In order to increase stakeholders' comprehension on software requirements, Use Cases can be enhanced with screen mock-ups (i.e., GUI prototypes sketched with a special conceived graphical tool). However, the effort to write Use Cases augmented with screen mockups may increase, thus not justifying their adoption in the requirements engineering process.

This work presents a few considerations on a project aimed at addressing the complexity of multi-layer enterprise applications. The solution encompassed the design of a complete model-driven architecture (MDA) including all the tools needed to guarantee a productive process, with the additional constraint of reaching this goal with a low development-effort. During the project we collected useful knowledge to mitigate the main risks connected to the MDA approach in the peculiar context of a small company

Fixing bugs and implementing enhancements are very relevant activities in a typical software life cycle. They require, as a pre-requisite, the location of a portion of impacted code within a possibly large codebase. This operation can be extremely difficult and time-consuming particularly for developers not much familiar with the software. With that perspective we focus on a simple research question: is it possible to support impact analysis using the information available in software repositories, in particular code comments and version control log? We devised a simple and novel approach, based on Natural Language Processing techniques, that provides support in impact analysis. On the average the proposed approach is very selective with a 99% specificity and achieves a recall of 96% and a precision of 13.6% with respect to a manually built gold standard.

Software repositories are analyzed to extract useful information on software characteristics. One of them is external quality. A technique used to increase software quality is automatic static analysis, by means of bug finding tools. These tools promise to speed up the verification of source code; anyway, there are still many problems, especially the high number of false positives, that hinder their large adoption in software development industry. We studied the capability of a popular bug-finding tool, FindBugs, for defect prediction purposes, analyzing the issues revealed on a repository of university Java projects. Particularly, we focused on the percentage of them that indicates actual defects with respect to their category and priority, and we ranked them. We found that a very limited set of issues have high precision and therefore have a positive impact on code external quality.

In recent years, several design notations have been proposed to model domain-specific applications or reference architectures. In particular, Conallen has proposed the UML Web Application Extension (WAE): a UML extension to model Web applications. The aim of our empirical investigation is to test whether the usage of the Conallen notation supports comprehension and maintenance activities with significant benefits, and whether such benefits depend on developers ability and experience. This paper reports and discusses the results of a series of four experiments performed in different locations and with subjects possessing different experience-namely, undergraduate students, graduate students, and research associates-and different ability levels. The experiments aim at comparing performances of subjects in comprehension tasks where they have the source code complemented either by standard UML diagrams or by diagrams stereotyped using the Conallen notation. Results indicate that, although, in general, it is not possible to observe any significant benefit associated with the usage of stereotyped diagrams, the availability of stereotypes reduces the gap between subjects with low skill or experience and highly skilled or experienced subjects. Results suggest that organizations employing developers with low experience can achieve a significant performance improvement by adopting stereotyped UML diagrams for Web applications.

Source code obfuscation is a protection mechanism widely used to limit the possibility of malicious reverse engineering or attack activities on a software system. Although several code obfuscation techniques and tools are available, little knowledge is available about the capability of obfuscation to reduce attackers' efficiency, and the contexts in which such an efficiencymay vary.

Test-driven development (TDD) is a development discipline prescribing writing tests beforehand writing the implementation code, which then shall pass the tests. Several criticisms addressed TDD's capability of delivering well-structured code, mainly because of the short focus on the features needed right now without much looking forward. So the main threat possibly introduced by TDD lies in the lack of maintainability and evolvability of the resulting system. The goal of the working session is to gather opinions, studies, and mostly experiences related to the maintenance implications of TDD adoption. The working session will be organized around position papers presented and discussed by the participants.

Test-driven software development tackles the problem of operationally defining the features to be implemented by means of test cases. This approach was recently ported to the early development phase, when requirements are gathered and clarified. Among the existing proposals, Fit (Framework for Integrated Testing) supports the precise specification of requirements by means of so called Fit tables, which express relevant usage scenarios in a tabular format, easily understood also by the customer. Fit tables can be turned into executable test cases through the creation of pieces of glue code, called fixtures.

Executable acceptance test case—in particular Fit (Framework for Integrated Test) tables—originally intended for the development phase proved useful in maintenance activities too. Empirical evidence suggests that Fit tables are useful in improving the comprehension of change requirements and the correctness of the maintained code. Stemming from eight experiments formerly performed by the authors, this paper presents a set of lessons learned and guidelines useful for project managers on the use of Fit tables in maintenance tasks. Specifically, the paper discusses the use of Fit tables in maintenance tasks considering a set of dimensions, ranging from maintainers’ experience to the nature of application being maintained and to the kind of benefits introduced by Fit tables. Benefits of Fit tables, such as improving the code correctness and comprehension, increase with developers experience and complex requirements but decrease with Web-based applications and when programmers work in pairs.

An international survey on risk management in software development with off-the-shelf (OTS) components is reported upon and discussed. The survey investigated actual risk-management activities and their correlations with the occurrences of typical risks in OTS component-based development. Data from 133 software projects in Norway, Italy, and Germany were collected using a stratified random sample of IT companies. The results show that OTS components normally do not contribute negatively to the quality of the software system as a whole, as is commonly expected. However, issues such as the underestimation of integration effort and inefficient debugging remain problematic and require further investigation. The results also illustrate several promising effective risk-reduction activities, e.g., putting more effort into learning relevant OTS components, integrating unfamiliar components first, thoroughly evaluating the quality of candidate OTS components, and regularly monitoring the support capability of OTS providers. Five hypotheses are proposed regarding these risk-reduction activities. The results also indicate that several other factors, such as project, cultural, and human-social factors, have to be investigated to thoroughly deal with the possible risks of OTS-based projects.

This short paper reports a pilot experiment conducted with master students, in which we investigated whether fit test cases were helpful to clarify change requirements in a maintenance task.

Proponents of design notations tailored for specific application domains or reference architectures, often available in the form of UML stereotypes, motivate them by improved understandability and modifiability. However, empirical studies that tested such claims report contradictory results, where the most intuitive notations are not always the best performing ones. This indicates the possible existence of relevant influencing factors, other than the design notation itself. In this work we report the results of a family of three experiments performed at different locations and with different subjects, in which we assessed the effectiveness of UML stereotypes for Web design in support to comprehension tasks. Replications with different subjects allowed us to investigate whether subjects' ability and experience play any role in the comprehension of stereotyped diagrams. We observed different behaviors of users with different degrees of ability and experience, which suggests alternative comprehension strategies of (and tool support for) different categories of users.

While most researchers agree on the need for empirical validation of theoretical results, two main issues remain unaddressed: first, few such studies are actually performed and second, coordination among different studies is very rare. This working session aim at bringing together the researchers interested in conducting empirical studies in maintenance and evolution. The goal is to define an important topic, design a family of experiments, provide the basis to conduct a set of coordinated experiments to advance the state of empirical evidence in this area.

Abstract Web application design requires the modeling of multiple, separate concerns, such as the navigational structure, the business logic and the data persistence. To this aim, several methodologies have been conceived. One of them, the Web Application Extension (WAE), extends the UML notation by means of stereotypes and tagged values intended to capture Web‐specific concepts (e.g., the navigational structure). Although the WAE methodology is nowadays quite mature and ready for industrial adoption, the question whether it is able to actually facilitate the task of developers and maintainers has still to be empirically investigated. This paper reports and discusses the results from a controlled experiment on the benefits associated with the use of the WAE notation in the execution of comprehension tasks, carried out before maintenance. The WAE notation was compared against the use of pure unified modified language. Results indicate that the use of the WAE notation significantly improves the level of comprehension, although it does not increase the time needed to perform the comprehension task in a significant way. Copyright © 2007 John Wiley & Sons, Ltd.

Component-based software development (CBSD) is becoming more and more important since it promotes reuse to higher levels of abstraction. As a consequence, many components are available being either open-source software (OSS) or commercial-off-the-shelf (COTS). However, it is still unclear how the decision for acquiring OSS or COTS components is made in practice. This paper describes an empirical study on why project decision-makers selected COTS instead of OSS components, or vice versa. The study was performed as an international survey in Norway, Italy and Germany. It focused on decision making on using off-the-shelf (OTS) components. We have gathered answers from 83 projects using only COTS components and 44 projects using only OSS components. Results of this study show significant differences and commonalities of integrating OSS or COTS components. Moreover, the study illustrates several research questions that warrant future research.

The aspect-oriented paradigm allows weaving aspects in different join points of a program. Aspects can modify object fields and method control flow, thus possibly introducing subtle and undesired interactions (conflicts) among aspects and objects, which are not easily detectable. In this paper we propose a fully automated approach to discover conflicts among classes and aspects directly from Java bytecode. The novelty of this work is the usage of a rule engine for identifying possible conflicts among advices, methods, and fields. The knowledge base is obtained through static analysis of classes and aspects bytecode. The possible conflicts are represented by means of rules that can be easily extended and customized

Test-driven development (TDD) is based on formalizing a piece of functionality as a test, implementing the functionality such that the test passes, and iterating the process. This paper describes a controlled experiment for evaluating an important aspect of TDD: in TDD, programmers write functional tests before the corresponding implementation code. The experiment was conducted with undergraduate students. While the experiment group applied a test-first strategy, the control group applied a more conventional development technique, writing tests after the implementation. Both groups followed an incremental process, adding new features one at a time and regression testing them. We found that test-first students on average wrote more tests and, in turn, students who wrote more tests tended to be more productive. We also observed that the minimum quality increased linearly with the number of programmer tests, independent of the development strategy employed.

Design patterns are widely recognized as important software development methods. Their use as software understanding tools, though generally acknowledged, has been scarcely explored. Patterns are most useful in understanding software when they are well documented. Sometimes they are described separately from code as design comments. Nevertheless, they have a strong relationship with the source code and thus they should also be documented at the source level. Unfortunately, there is no agreement on how to document pattern use. This paper describes a structured approach to documenting pattern use in the Java language. Our solution is based on the standard Javadoc tool and is able to generate HTML documentation. The approach has been implemented and tested with software that uses patterns.

A way to learn about Commercial Off-The-Shelf (COTS) products is to define a set of characteristics or attributes and then to collect information about these attributes. In an industrial context, the attributes used to select COTS clearly depend on project specific goals. In our educational context we made an attempt to define general COTS characterization attributes. The resulting framework provides a structure, which facilitate the learning process. Our proposed attributes have several similarities with the generic evaluation attributes defined by ISO 9126. A comparison with such a standard provides a deeper insight into the problem of characterizing COTS products.

Current object-oriented formalisms, such as UML, focus on describing class models and use instance models only for depicting scenarios. Little attention is being devoted to defining how complex systems can be structured in order to conform with those class models and, further, which constraints class models must adhere to so that such conformity is affordable. This paper focuses on instance models, which are models of actual systems (and, as such, they are made up of instances), and discusses the relationships between instance models and class models. A large number of applications, ranging from generic data modeling to enterprise modeling, require instance models. The importance of hierarchical composition is emphasized: its meaning and implications are discussed in both contexts. A novel approach for building templates out of aggregates of instances is also presented. A case study concerning enterprise modeling shows the application of the approach.

Object-oriented software evolves over time, and it would be ideal if we could capture the persistent parts of the software early on and then derive the transient versions of the software from the persistent parts. Capturing the persistent parts of the software allows us to better maintain the integrity of the program during its evolution. This is the goal of software architecture. In this paper, we emphasize an approach called O/sup 3/ML (Operational Object-Oriented Modeling Language) to model complex software systems using a sound software architecture which is centered on the creation of a system prototype with integrated design requirements and a simulation framework. This methodology supports the prototyping of complex computer-based systems by providing: (a) a multi-domain approach to capture the architectural complexity of real-world systems; and (b) a mechanism for the simulation of the conceptual, functional and implementation features of the design and the user requirements.