首页 > 最新文献

Journal of Software-Evolution and Process最新文献

英文 中文
On the importance of CI/CD practices for database applications 数据库应用程序 CI/CD 实践的重要性
IF 2 4区 计算机科学 Q3 COMPUTER SCIENCE, SOFTWARE ENGINEERING Pub Date : 2024-08-12 DOI: 10.1002/smr.2720
Jasmin Fluri, Fabrizio Fornari, Ela Pustulka
SummaryContinuous integration and continuous delivery (CI/CD) automate software integration and reduce repetitive engineering work. While the use of CI/CD presents efficiency gains, in database application development, this potential has not been fully exploited. We explore the state of the art in this area, with a focus on current practices, common software tools, challenges, and preconditions that apply to database applications. The work is grounded in a synoptic literature review and contributes a novel generic CI/CD pipeline for database system application development. Our generic pipeline was tailored to three industrial development use cases in which we measured the benefits of integration and deployment automation. The measurements demonstrate clearly that introducing CI/CD had significant benefits. It reduced the number of failed deployments, improved their stability, and increased the number of deployments. Interviews with the developers before and after the implementation of the CI/CD show that the pipeline brings clear benefits to the development team (i.e., a reduced cognitive load). These findings put current database release practices driven by business expectations, such as fixed release windows, in question.
摘要持续集成和持续交付(CI/CD)可实现软件集成自动化,减少重复性工程工作。虽然使用 CI/CD 可以提高效率,但在数据库应用程序开发中,这一潜力尚未得到充分挖掘。我们探讨了这一领域的技术现状,重点关注适用于数据库应用的当前实践、常用软件工具、挑战和前提条件。这项工作以文献综述为基础,并为数据库系统应用程序开发提供了一个新颖的通用 CI/CD 流水线。我们的通用管道是针对三个工业开发用例量身定制的,在这些用例中,我们测量了集成和部署自动化的优势。测量结果清楚地表明,引入 CI/CD 有显著的好处。它减少了部署失败的次数,提高了部署的稳定性,并增加了部署次数。在实施 CI/CD 前后对开发人员的访谈显示,该管道为开发团队带来了明显的好处(即减少了认知负荷)。这些发现对目前由业务期望驱动的数据库发布实践(如固定发布窗口)提出了质疑。
{"title":"On the importance of CI/CD practices for database applications","authors":"Jasmin Fluri, Fabrizio Fornari, Ela Pustulka","doi":"10.1002/smr.2720","DOIUrl":"https://doi.org/10.1002/smr.2720","url":null,"abstract":"SummaryContinuous integration and continuous delivery (CI/CD) automate software integration and reduce repetitive engineering work. While the use of CI/CD presents efficiency gains, in database application development, this potential has not been fully exploited. We explore the state of the art in this area, with a focus on current practices, common software tools, challenges, and preconditions that apply to database applications. The work is grounded in a synoptic literature review and contributes a novel generic CI/CD pipeline for database system application development. Our generic pipeline was tailored to three industrial development use cases in which we measured the benefits of integration and deployment automation. The measurements demonstrate clearly that introducing CI/CD had significant benefits. It reduced the number of failed deployments, improved their stability, and increased the number of deployments. Interviews with the developers before and after the implementation of the CI/CD show that the pipeline brings clear benefits to the development team (i.e., a reduced cognitive load). These findings put current database release practices driven by business expectations, such as fixed release windows, in question.","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"2012 1","pages":""},"PeriodicalIF":2.0,"publicationDate":"2024-08-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"141939967","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Identification and prioritization of the challenges faced by vendor organizations in the shape of cyber security: A FUZZY‐AHP ‐based systematic approach 确定供应商组织在网络安全方面面临的挑战并排定优先次序:基于 FUZZY-AHP 的系统方法
IF 2 4区 计算机科学 Q3 COMPUTER SCIENCE, SOFTWARE ENGINEERING Pub Date : 2024-08-07 DOI: 10.1002/smr.2717
Abdul Wahid Khan, Shah Zaib, Meshari D. Alanazi, Shabana Habib
The goal of this research study was to identify and prioritize the significant cybersecurity challenges that vendor firms encounter during software development. Using Systematic Literature Reviews (SLRs), 13 significant challenges were found, including “Security issues/Access of Cyberattacks”, “Lack of Right Knowledge”, “Cost Security Issues”, and “Lack of Confidentiality and Trust” among others. To address these concerns, a multifaceted strategy that prioritizes continuing education, training, and investment in cybersecurity measures, as well as cross‐industry cooperation and coordination with government entities, is required. These challenges were ranked using the Fuzzy Analytic Hierarchy Process (F‐AHP). We obtained the following results after applying the Fuzzy Analytic Hierarchy Process: CSC1 (Cyber Security Challenge‐1) “Security Issues/Access of Cyber Attacks”, CSC2 “Lack of Right Knowledge”, and CSC3 “Framework” are the top most critical cyber security challenges, with weightages of 0.1687, 0.1672, and 0.1194, respectively. This study lays the groundwork for future research and assists vendor organizations in addressing the cybersecurity concerns they face during software development. The study also emphasizes the significance of addressing cybersecurity during the software development process in order to avoid the financial and reputational losses associated with cyber intrusions.
本研究的目标是确定供应商公司在软件开发过程中遇到的重大网络安全挑战,并对其进行优先排序。通过系统文献回顾(SLR),我们发现了 13 项重大挑战,包括 "安全问题/网络攻击的获取"、"缺乏正确的知识"、"成本安全问题 "和 "缺乏保密性和信任 "等。要解决这些问题,需要采取多方面的战略,优先考虑继续教育、培训和网络安全措施投资,以及跨行业合作和与政府实体的协调。我们采用模糊层次分析法(F-AHP)对这些挑战进行了排序。应用模糊分析层次过程后,我们得出了以下结果:CSC1(网络安全挑战-1)"安全问题/网络攻击的获取"、CSC2 "缺乏正确的知识 "和 CSC3 "框架 "是最关键的网络安全挑战,权重分别为 0.1687、0.1672 和 0.1194。本研究为今后的研究奠定了基础,有助于供应商组织解决在软件开发过程中面临的网络安全问题。本研究还强调了在软件开发过程中解决网络安全问题的重要性,以避免网络入侵带来的经济和声誉损失。
{"title":"Identification and prioritization of the challenges faced by vendor organizations in the shape of cyber security: A FUZZY‐AHP ‐based systematic approach","authors":"Abdul Wahid Khan, Shah Zaib, Meshari D. Alanazi, Shabana Habib","doi":"10.1002/smr.2717","DOIUrl":"https://doi.org/10.1002/smr.2717","url":null,"abstract":"The goal of this research study was to identify and prioritize the significant cybersecurity challenges that vendor firms encounter during software development. Using Systematic Literature Reviews (SLRs), 13 significant challenges were found, including “Security issues/Access of Cyberattacks”, “Lack of Right Knowledge”, “Cost Security Issues”, and “Lack of Confidentiality and Trust” among others. To address these concerns, a multifaceted strategy that prioritizes continuing education, training, and investment in cybersecurity measures, as well as cross‐industry cooperation and coordination with government entities, is required. These challenges were ranked using the Fuzzy Analytic Hierarchy Process (F‐AHP). We obtained the following results after applying the Fuzzy Analytic Hierarchy Process: CSC1 (Cyber Security Challenge‐1) “Security Issues/Access of Cyber Attacks”, CSC2 “Lack of Right Knowledge”, and CSC3 “Framework” are the top most critical cyber security challenges, with weightages of 0.1687, 0.1672, and 0.1194, respectively. This study lays the groundwork for future research and assists vendor organizations in addressing the cybersecurity concerns they face during software development. The study also emphasizes the significance of addressing cybersecurity during the software development process in order to avoid the financial and reputational losses associated with cyber intrusions.","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"40 1","pages":""},"PeriodicalIF":2.0,"publicationDate":"2024-08-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"141939968","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Organizing Graphical User Interface tests from behavior‐driven development as videos to obtain stakeholders' feedback 将行为驱动开发的图形用户界面测试制作成视频,以获取利益相关者的反馈意见
IF 2 4区 计算机科学 Q3 COMPUTER SCIENCE, SOFTWARE ENGINEERING Pub Date : 2024-08-05 DOI: 10.1002/smr.2721
Jianwei Shi, Jonas Mönnich, Jil Klünder, Kurt Schneider
Demonstrating software early and responding to feedback is crucial in agile development. However, it is difficult for stakeholders who are not on‐site customers but end users, marketing people, or designers, and so forth to give feedback in an agile development environment. Successful graphical user interface (GUI) test executions can be documented and then demonstrated for feedback. In our new concept, GUI tests from behavior‐driven development (BDD) are recorded, augmented, and demonstrated as videos. A GUI test is divided into several GUI unit tests, which are specified in Gherkin, a semi‐structured natural language. For each GUI unit test, a video is generated during test execution. Test steps specified in Gherkin are traced and highlighted in the video. Stakeholders review these generated videos and provide feedback, for example, on misunderstandings of requirements or on inconsistencies. To evaluate the impact of videos in identifying inconsistencies, we asked 22 participants to identify inconsistencies between (1) given requirements in regular sentences and (2) demonstrated behaviors from videos with Gherkin specifications or from Gherkin specifications alone. Our results show that participants tend to identify more inconsistencies from demonstrated behaviors, which are not in accordance with given requirements. They tend to recognize inconsistencies more easily through videos than through Gherkin specifications alone. The types of inconsistency are threefold: The mentioned feature can be incorrectly implemented, not implemented, or an unspecified new feature. We use a fictitious example showing how this feedback helps a product owner and her team manage requirements. We conclude that GUI test videos can help stakeholders give feedback more effectively. By obtaining early feedback, inconsistencies can be resolved, thus contributing to higher stakeholder satisfaction.
在敏捷开发中,尽早展示软件并对反馈做出回应至关重要。然而,在敏捷开发环境中,对于不是现场客户而是最终用户、营销人员或设计师等利益相关者来说,很难给出反馈意见。成功的图形用户界面(GUI)测试执行可以被记录下来,然后进行演示以获得反馈。在我们的新概念中,来自行为驱动开发(BDD)的图形用户界面测试将被录制、增强并以视频的形式展示。一个图形用户界面测试被分为若干个图形用户界面单元测试,这些单元测试是用半结构化自然语言 Gherkin 指定的。每个图形用户界面单元测试都会在测试执行过程中生成一段视频。Gherkin 中指定的测试步骤会在视频中被跟踪和突出显示。利益相关者会查看这些生成的视频,并提供反馈,例如,对需求的误解或不一致的反馈。为了评估视频在识别不一致性方面的影响,我们请 22 位参与者识别以下两者之间的不一致性:(1) 普通句子中的给定需求;(2) 视频中与 Gherkin 规范或仅与 Gherkin 规范相关的演示行为。我们的结果表明,参与者倾向于从示范行为中识别出更多不一致之处,因为这些行为与给定要求不符。他们往往更容易通过视频识别出不一致,而不是仅仅通过 Gherkin 规范。不一致的类型有三种:提到的功能可能是未正确实现、未实现或未指定的新功能。我们用一个虚构的例子来说明这种反馈是如何帮助产品负责人及其团队管理需求的。我们的结论是,图形用户界面测试视频可以帮助利益相关者更有效地提供反馈。通过获取早期反馈,不一致问题可以得到解决,从而提高利益相关者的满意度。
{"title":"Organizing Graphical User Interface tests from behavior‐driven development as videos to obtain stakeholders' feedback","authors":"Jianwei Shi, Jonas Mönnich, Jil Klünder, Kurt Schneider","doi":"10.1002/smr.2721","DOIUrl":"https://doi.org/10.1002/smr.2721","url":null,"abstract":"Demonstrating software early and responding to feedback is crucial in agile development. However, it is difficult for stakeholders who are not on‐site customers but end users, marketing people, or designers, and so forth to give feedback in an agile development environment. Successful graphical user interface (GUI) test executions can be documented and then demonstrated for feedback. In our new concept, GUI tests from behavior‐driven development (BDD) are recorded, augmented, and demonstrated as videos. A GUI test is divided into several GUI unit tests, which are specified in Gherkin, a semi‐structured natural language. For each GUI unit test, a video is generated during test execution. Test steps specified in Gherkin are traced and highlighted in the video. Stakeholders review these generated videos and provide feedback, for example, on misunderstandings of requirements or on inconsistencies. To evaluate the impact of videos in identifying inconsistencies, we asked 22 participants to identify inconsistencies between (1) given requirements in regular sentences and (2) demonstrated behaviors from videos with Gherkin specifications or from Gherkin specifications alone. Our results show that participants tend to identify more inconsistencies from demonstrated behaviors, which are not in accordance with given requirements. They tend to recognize inconsistencies more easily through videos than through Gherkin specifications alone. The types of inconsistency are threefold: The mentioned feature can be incorrectly implemented, not implemented, or an unspecified new feature. We use a fictitious example showing how this feedback helps a product owner and her team manage requirements. We conclude that GUI test videos can help stakeholders give feedback more effectively. By obtaining early feedback, inconsistencies can be resolved, thus contributing to higher stakeholder satisfaction.","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"73 1","pages":""},"PeriodicalIF":2.0,"publicationDate":"2024-08-05","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"141939974","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Unveiling the impact of unchanged modules across versions on the evaluation of within‐project defect prediction models 揭示不同版本中不变模块对项目内缺陷预测模型评估的影响
IF 2 4区 计算机科学 Q3 COMPUTER SCIENCE, SOFTWARE ENGINEERING Pub Date : 2024-08-03 DOI: 10.1002/smr.2715
Xutong Liu, Yufei Zhou, Zeyu Lu, Yuanqing Mei, Yibiao Yang, Junyan Qian, Yuming Zhou
BackgroundSoftware defect prediction (SDP) is a topic actively researched in the software engineering community. Within‐project defect prediction (WPDP) involves using labeled modules from previous versions of the same project to train classifiers. Over time, many defect prediction models have been evaluated under the WPDP scenario.ProblemData duplication poses a significant challenge in current WPDP evaluation procedures. Unchanged modules, characterized by identical executable source code, are frequently present in both target and source versions during experimentation. However, it is still unclear how and to what extent the presence of unchanged modules affects the performance assessment of WPDP models and the comparison of multiple WPDP models.MethodIn this paper, we provide a method to detect and remove unchanged modules from defect datasets and unveil the impact of data duplication in WPDP on model evaluation.ResultsThe experiments conducted on 481 target versions from 62 projects provide evidence that data duplication significantly affects the reported performance values of individual learners in WPDP. However, when ranking multiple WPDP models based on prediction performance, the impact of removing unchanged instances is not substantial. Nevertheless, it is important to note that removing unchanged instances does have a slight influence on the selection of models with better generalization.ConclusionWe recommend that future WPDP studies take into consideration the removal of unchanged modules from target versions when evaluating the performance of their models. This practice will enhance the reliability and validity of the results obtained in WPDP research, leading to improved understanding and advancements in defect prediction models.
背景软件缺陷预测(SDP)是软件工程界积极研究的一个课题。项目内缺陷预测(WPDP)涉及使用同一项目以前版本的标注模块来训练分类器。随着时间的推移,许多缺陷预测模型都在 WPDP 情景下进行了评估。问题数据重复给当前的 WPDP 评估程序带来了巨大挑战。在实验过程中,目标版本和源代码版本中经常会出现未改变的模块,这些模块的特点是可执行源代码完全相同。方法在本文中,我们提供了一种从缺陷数据集中检测和移除未修改模块的方法,并揭示了 WPDP 中数据重复对模型评估的影响。结果在 62 个项目的 481 个目标版本上进行的实验提供了证据,证明数据重复会显著影响 WPDP 中单个学习者的报告性能值。不过,在根据预测性能对多个 WPDP 模型进行排名时,删除未更改实例的影响并不大。结论我们建议,未来的 WPDP 研究在评估模型性能时,应考虑从目标版本中删除未改变的模块。这种做法将提高 WPDP 研究结果的可靠性和有效性,从而加深对缺陷预测模型的理解并推动缺陷预测模型的发展。
{"title":"Unveiling the impact of unchanged modules across versions on the evaluation of within‐project defect prediction models","authors":"Xutong Liu, Yufei Zhou, Zeyu Lu, Yuanqing Mei, Yibiao Yang, Junyan Qian, Yuming Zhou","doi":"10.1002/smr.2715","DOIUrl":"https://doi.org/10.1002/smr.2715","url":null,"abstract":"BackgroundSoftware defect prediction (SDP) is a topic actively researched in the software engineering community. Within‐project defect prediction (WPDP) involves using labeled modules from previous versions of the same project to train classifiers. Over time, many defect prediction models have been evaluated under the WPDP scenario.ProblemData duplication poses a significant challenge in current WPDP evaluation procedures. Unchanged modules, characterized by identical executable source code, are frequently present in both target and source versions during experimentation. However, it is still unclear how and to what extent the presence of unchanged modules affects the performance assessment of WPDP models and the comparison of multiple WPDP models.MethodIn this paper, we provide a method to detect and remove unchanged modules from defect datasets and unveil the impact of data duplication in WPDP on model evaluation.ResultsThe experiments conducted on 481 target versions from 62 projects provide evidence that data duplication significantly affects the reported performance values of individual learners in WPDP. However, when ranking multiple WPDP models based on prediction performance, the impact of removing unchanged instances is not substantial. Nevertheless, it is important to note that removing unchanged instances does have a slight influence on the selection of models with better generalization.ConclusionWe recommend that future WPDP studies take into consideration the removal of unchanged modules from target versions when evaluating the performance of their models. This practice will enhance the reliability and validity of the results obtained in WPDP research, leading to improved understanding and advancements in defect prediction models.","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"80 1","pages":""},"PeriodicalIF":2.0,"publicationDate":"2024-08-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"141939969","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Evolution of secure development lifecycles and maturity models in the context of hosted solutions 托管解决方案中安全开发生命周期和成熟度模型的演变
IF 2 4区 计算机科学 Q3 COMPUTER SCIENCE, SOFTWARE ENGINEERING Pub Date : 2024-07-31 DOI: 10.1002/smr.2711
Felix Lange, Immanuel Kunz
Organizations creating software commonly utilize software development lifecycles (SDLCs) to structure development activities. Secure development lifecycles (SDLs) integrate into SDLCs, adding security or compliance activities. They are widely used and have been published by industry leaders and in literature. These SDLs, however, were mostly designed before or while cloud services and other hosted solutions became popular. Such offerings widen the provider's responsibilities, as they not only deliver software but operate and decommission it as well. SDLs, however, do not always account for this change. Security maturity models (SMMs) help to assess SDLs and identify improvements by introducing a baseline to compare against. Multiple of these models were created after the advent of hosted solutions and are more recent than commonly referenced SDLs. Recent SMMs and SDLs may therefore support hosted solutions better than older proposals do. This paper compares a set of current and historic SDLs and SMMs in order to review their support for hosted solutions, including how support has changed over time. Security, privacy, and support for small or agile organizations are considered, as all are relevant to hosted solutions. The SDLs analyzed include Microsoft's SDL, McGraw's Touchpoints, the Cisco's SDL, and Stackpole and Oksendahl's SDL2. The SMMs reviewed are OWASP's Software Assurance Maturity Model 2 and DevSecOps Maturity Model. To assess the support for hosted solutions, the security and privacy activities foreseen in each SDLC phase are compared, before organizational compatibility, activity relevance, and efficiency are assessed. The paper further demonstrates how organizations may select and adjust a suitable proposal. The analyzed proposals are found to not sufficiently support hosted solutions: Important SDLC phases, such as solution retirement, are not always sufficiently supported. Agile practices, such as working in sprints, and small organizations are often not sufficiently considered as well. Efficiency is found to vary based on the application context. A clear improvement trend from before the proliferation of hosted solutions cannot be identified. Future work is therefore found to be required.
创建软件的组织通常使用软件开发生命周期(SDLC)来组织开发活动。安全开发生命周期 (SDL) 与 SDLC 相结合,增加了安全或合规活动。安全开发生命周期(SDL)与 SDLC 相结合,增加了安全性或合规性活动。它们已被广泛使用,并由行业领导者和文献发表。不过,这些 SDL 大多是在云服务和其他托管解决方案流行之前或流行之时设计的。这些产品扩大了提供商的责任,因为他们不仅要交付软件,还要运营和退出软件。然而,SDL 并不总是考虑到这种变化。安全成熟度模型(SMM)有助于评估 SDL,并通过引入基线进行比较来确定改进措施。其中多个模型是在托管解决方案出现后创建的,比通常参考的 SDL 更新颖。因此,最新的 SMM 和 SDL 对托管解决方案的支持可能优于较早的建议。本文比较了一组当前和历史上的 SDL 和 SMM,以审查它们对托管解决方案的支持情况,包括随着时间的推移,支持情况发生了哪些变化。本文考虑了安全性、隐私和对小型或敏捷组织的支持,因为所有这些都与托管解决方案相关。分析的 SDL 包括 Microsoft 的 SDL、McGraw 的 Touchpoints、Cisco 的 SDL 以及 Stackpole 和 Oksendahl 的 SDL2。审查的 SMM 包括 OWASP 的软件保证成熟度模型 2 和 DevSecOps 成熟度模型。为了评估对托管解决方案的支持,在评估组织兼容性、活动相关性和效率之前,对每个 SDLC 阶段预见的安全和隐私活动进行了比较。本文进一步展示了组织如何选择和调整合适的建议。分析后发现,这些建议不足以支持托管解决方案:重要的 SDLC 阶段(如解决方案退役)并非总能得到充分支持。敏捷实践(如在冲刺阶段工作)和小型组织往往也没有得到充分考虑。效率因应用环境而异。与托管解决方案普及之前相比,无法发现明显的改进趋势。因此,需要在今后开展工作。
{"title":"Evolution of secure development lifecycles and maturity models in the context of hosted solutions","authors":"Felix Lange, Immanuel Kunz","doi":"10.1002/smr.2711","DOIUrl":"https://doi.org/10.1002/smr.2711","url":null,"abstract":"Organizations creating software commonly utilize software development lifecycles (SDLCs) to structure development activities. Secure development lifecycles (SDLs) integrate into SDLCs, adding security or compliance activities. They are widely used and have been published by industry leaders and in literature. These SDLs, however, were mostly designed before or while <jats:italic>cloud services</jats:italic> and other <jats:italic>hosted solutions</jats:italic> became popular. Such offerings widen the provider's responsibilities, as they not only deliver software but operate and decommission it as well. SDLs, however, do not always account for this change. Security maturity models (SMMs) help to assess SDLs and identify improvements by introducing a baseline to compare against. Multiple of these models were created after the advent of hosted solutions and are more recent than commonly referenced SDLs. Recent SMMs and SDLs may therefore support hosted solutions better than older proposals do. This paper compares a set of current and historic SDLs and SMMs in order to review their support for hosted solutions, including how support has changed over time. Security, privacy, and support for small or agile organizations are considered, as all are relevant to hosted solutions. The SDLs analyzed include Microsoft's SDL, McGraw's Touchpoints, the Cisco's SDL, and Stackpole and Oksendahl's SDL<jats:sup>2</jats:sup>. The SMMs reviewed are OWASP's Software Assurance Maturity Model 2 and DevSecOps Maturity Model. To assess the support for hosted solutions, the security and privacy activities foreseen in each SDLC phase are compared, before organizational compatibility, activity relevance, and efficiency are assessed. The paper further demonstrates how organizations may select and adjust a suitable proposal. The analyzed proposals are found to not sufficiently support hosted solutions: Important SDLC phases, such as solution retirement, are not always sufficiently supported. Agile practices, such as working in sprints, and small organizations are often not sufficiently considered as well. Efficiency is found to vary based on the application context. A clear improvement trend from before the proliferation of hosted solutions cannot be identified. Future work is therefore found to be required.","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"85 1","pages":""},"PeriodicalIF":2.0,"publicationDate":"2024-07-31","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"141867836","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Selection of agile project management approaches based on project complexity 根据项目复杂性选择敏捷项目管理方法
IF 2 4区 计算机科学 Q3 COMPUTER SCIENCE, SOFTWARE ENGINEERING Pub Date : 2024-07-31 DOI: 10.1002/smr.2716
Fernando Pinciroli
Managing software development projects is a complex endeavor due to the constant emergence of unforeseen events that deviate from initial expectations. A competent project leader is not just someone who follows the planned course but also adept at handling and minimizing inconveniences, ultimately striving to achieve results that align as closely as possible with the desired outcome. However, individuals involved in technological development often cling to familiar tools that have previously yielded positive outcomes, even when those tools may not be the best fit for the current project context. The Agile Manifesto has significantly transformed project management, infusing the discipline with a fresh perspective. Nevertheless, there remain several challenges to overcome. In this article, we aim to provide a guide that addresses these difficulties and minimizes their impact. We explore the selection of key factors that adequately describe a project's complexity, which can subsequently be used in conjunction with the Cynefin framework to categorize management strategies, techniques, and tools based on their applicability to specific complexities. Additionally, we offer insights on adapting project management approaches throughout the project life cycle in response to changes in reality, utilizing the dynamics outlined by the Cynefin framework. Finally, we present suitable strategies, techniques, and tools for agile project management based on the complexity context assigned by the Cynefin framework.
管理软件开发项目是一项复杂的工作,因为不断出现的意外事件会偏离最初的预期。一个称职的项目负责人不仅要按计划行事,还要善于处理并尽量减少不便,最终努力实现与预期结果尽可能一致的结果。然而,参与技术开发的人员往往会固守以前取得积极成果的熟悉工具,即使这些工具可能并不最适合当前的项目环境。敏捷宣言》极大地改变了项目管理,为这门学科注入了全新的视角。然而,仍有一些挑战需要克服。在本文中,我们旨在提供一份指南,以解决这些困难并将其影响降至最低。我们探讨了如何选择能够充分描述项目复杂性的关键因素,随后可将这些因素与赛耐芬框架结合使用,根据其对特定复杂性的适用性对管理策略、技术和工具进行分类。此外,我们还利用 Cynefin 框架概述的动态变化,就如何在整个项目生命周期内调整项目管理方法以应对现实变化提出了见解。最后,我们将根据 Cynefin 框架指定的复杂性背景,介绍适用于敏捷项目管理的策略、技术和工具。
{"title":"Selection of agile project management approaches based on project complexity","authors":"Fernando Pinciroli","doi":"10.1002/smr.2716","DOIUrl":"https://doi.org/10.1002/smr.2716","url":null,"abstract":"Managing software development projects is a complex endeavor due to the constant emergence of unforeseen events that deviate from initial expectations. A competent project leader is not just someone who follows the planned course but also adept at handling and minimizing inconveniences, ultimately striving to achieve results that align as closely as possible with the desired outcome. However, individuals involved in technological development often cling to familiar tools that have previously yielded positive outcomes, even when those tools may not be the best fit for the current project context. The Agile Manifesto has significantly transformed project management, infusing the discipline with a fresh perspective. Nevertheless, there remain several challenges to overcome. In this article, we aim to provide a guide that addresses these difficulties and minimizes their impact. We explore the selection of key factors that adequately describe a project's complexity, which can subsequently be used in conjunction with the Cynefin framework to categorize management strategies, techniques, and tools based on their applicability to specific complexities. Additionally, we offer insights on adapting project management approaches throughout the project life cycle in response to changes in reality, utilizing the dynamics outlined by the Cynefin framework. Finally, we present suitable strategies, techniques, and tools for agile project management based on the complexity context assigned by the Cynefin framework.","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"24 1","pages":""},"PeriodicalIF":2.0,"publicationDate":"2024-07-31","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"141867837","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
SGDL: Smart contract vulnerability generation via deep learning SGDL:通过深度学习生成智能合约漏洞
IF 2 4区 计算机科学 Q3 COMPUTER SCIENCE, SOFTWARE ENGINEERING Pub Date : 2024-07-20 DOI: 10.1002/smr.2712
Hanting Chu, Pengcheng Zhang, Hai Dong, Yan Xiao, Shunhui Ji
The growing popularity of smart contracts in various areas, such as digital payments and the Internet of Things, has led to an increase in smart contract security challenges. Researchers have responded by developing vulnerability detection tools. However, the effectiveness of these tools is limited due to the lack of authentic smart contract vulnerability datasets to comprehensively assess their capacity for diverse vulnerabilities. This paper proposes a Deep Learning‐based Smart contract vulnerability Generation approach (SGDL) to overcome this challenge. SGDL utilizes static analysis techniques to extract both syntactic and semantic information from the contracts. It then uses a classification technique to match injected vulnerabilities with contracts. A generative adversarial network is employed to generate smart contract vulnerability fragments, creating a diverse and authentic pool of fragments. The vulnerability fragments are then injected into the smart contracts using an abstract syntax tree to ensure their syntactic correctness. Our experimental results demonstrate that our method is more effective than existing vulnerability injection methods in evaluating the contract vulnerability detection capacity of existing detection tools. Overall, SGDL provides a comprehensive and innovative solution to address the critical issue of authentic and diverse smart contract vulnerability datasets.
随着智能合约在数字支付和物联网等各个领域的日益普及,智能合约的安全挑战也随之增加。为此,研究人员开发了漏洞检测工具。然而,由于缺乏真实的智能合约漏洞数据集来全面评估其对各种漏洞的能力,这些工具的有效性受到了限制。本文提出了一种基于深度学习的智能合约漏洞生成方法(SGDL)来克服这一挑战。SGDL 利用静态分析技术从合约中提取语法和语义信息。然后,它使用分类技术将注入的漏洞与合约进行匹配。生成式对抗网络用于生成智能合约漏洞片段,从而创建一个多样化的真实片段库。然后使用抽象语法树将漏洞片段注入智能合约,以确保其语法正确性。实验结果表明,在评估现有检测工具的合约漏洞检测能力时,我们的方法比现有的漏洞注入方法更有效。总之,SGDL 为解决真实、多样的智能合约漏洞数据集这一关键问题提供了全面、创新的解决方案。
{"title":"SGDL: Smart contract vulnerability generation via deep learning","authors":"Hanting Chu, Pengcheng Zhang, Hai Dong, Yan Xiao, Shunhui Ji","doi":"10.1002/smr.2712","DOIUrl":"https://doi.org/10.1002/smr.2712","url":null,"abstract":"The growing popularity of smart contracts in various areas, such as digital payments and the Internet of Things, has led to an increase in smart contract security challenges. Researchers have responded by developing vulnerability detection tools. However, the effectiveness of these tools is limited due to the lack of authentic smart contract vulnerability datasets to comprehensively assess their capacity for diverse vulnerabilities. This paper proposes a <jats:styled-content>D</jats:styled-content>eep <jats:styled-content>L</jats:styled-content>earning‐based <jats:styled-content>S</jats:styled-content>mart contract vulnerability <jats:styled-content>G</jats:styled-content>eneration approach (SGDL) to overcome this challenge. SGDL utilizes static analysis techniques to extract both syntactic and semantic information from the contracts. It then uses a classification technique to match injected vulnerabilities with contracts. A generative adversarial network is employed to generate smart contract vulnerability fragments, creating a diverse and authentic pool of fragments. The vulnerability fragments are then injected into the smart contracts using an abstract syntax tree to ensure their syntactic correctness. Our experimental results demonstrate that our method is more effective than existing vulnerability injection methods in evaluating the contract vulnerability detection capacity of existing detection tools. Overall, SGDL provides a comprehensive and innovative solution to address the critical issue of authentic and diverse smart contract vulnerability datasets.","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"38 1","pages":""},"PeriodicalIF":2.0,"publicationDate":"2024-07-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"141741766","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Metrics for software process simulation modeling 软件过程模拟建模的衡量标准
IF 1.7 4区 计算机科学 Q3 COMPUTER SCIENCE, SOFTWARE ENGINEERING Pub Date : 2024-07-11 DOI: 10.1002/smr.2676
Bohan Liu, He Zhang, Liming Dong, Zhiqi Wang, Shanshan Li

Software process simulation (SPS) has become an effective tool for software process management and improvement. However, its adoption in industry is less than what the research community expected due to the burden of measurement cost and the high demand for domain knowledge. The difficulty of extracting appropriate metrics with real data from process enactment is one of the great challenges. We aim to provide evidence-based support of the process metrics for software process (simulation) modeling. A systematic literature review was performed by extending our previous review series to draw a comprehensive understanding of the metrics for process modeling following our proposed ontology of metrics in SPS. We identify 131 process modeling studies that collectively involve 1975 raw metrics and classified them into 21 categories using the coding technique. We found product and process external metrics are not used frequently in SPS modeling while resource external metrics are widely used. We analyze the causal relationships between metrics. We find that the models exhibit significant diversity, as no pairwise relationship between metrics accounts for more than 10% SPS models. We identify 17 data issues may encounter in measurement and 10 coping strategies. The results of this study provide process modelers with an evidence-based reference of the identification and the use of metrics in SPS modeling and further contribute to the development of the body of knowledge on software metrics in the context of process modeling. Furthermore, this study is not limited to process simulation but can be extended to software process modeling, in general. Taking simulation metrics as standards and references can further motivate and guide software developers to improve the collection, governance, and application of process data in practice.

软件过程仿真(SPS)已成为软件过程管理和改进的有效工具。然而,由于测量成本的负担和对领域知识的高要求,其在工业界的应用远低于研究界的预期。难以从流程实施过程中的真实数据中提取适当的度量标准是巨大的挑战之一。我们的目标是为软件过程(仿真)建模提供基于证据的过程度量支持。通过扩展我们之前的系列综述,我们进行了系统的文献综述,以便按照我们提出的 SPS 指标本体,全面了解流程建模的指标。我们确定了 131 项流程建模研究,共涉及 1975 个原始指标,并使用编码技术将其分为 21 类。我们发现,产品和流程外部指标在 SPS 建模中并不常用,而资源外部指标则被广泛使用。我们分析了指标之间的因果关系。我们发现,模型呈现出显著的多样性,因为指标之间的成对关系在 SPS 模型中所占比例均未超过 10%。我们确定了在测量中可能遇到的 17 个数据问题和 10 个应对策略。本研究的结果为流程建模人员提供了在 SPS 建模中识别和使用度量标准的循证参考,并进一步促进了流程建模背景下软件度量标准知识体系的发展。此外,这项研究并不局限于过程仿真,还可以扩展到一般的软件过程建模。将模拟度量作为标准和参考,可以进一步激励和指导软件开发人员在实践中改进过程数据的收集、管理和应用。
{"title":"Metrics for software process simulation modeling","authors":"Bohan Liu,&nbsp;He Zhang,&nbsp;Liming Dong,&nbsp;Zhiqi Wang,&nbsp;Shanshan Li","doi":"10.1002/smr.2676","DOIUrl":"10.1002/smr.2676","url":null,"abstract":"<p>Software process simulation (SPS) has become an effective tool for software process management and improvement. However, its adoption in industry is less than what the research community expected due to the burden of measurement cost and the high demand for domain knowledge. The difficulty of extracting appropriate metrics with real data from process enactment is one of the great challenges. We aim to provide evidence-based support of the process metrics for software process (simulation) modeling. A systematic literature review was performed by extending our previous review series to draw a comprehensive understanding of the metrics for process modeling following our proposed ontology of metrics in SPS. We identify 131 process modeling studies that collectively involve 1975 raw metrics and classified them into 21 categories using the coding technique. We found product and process external metrics are not used frequently in SPS modeling while resource external metrics are widely used. We analyze the causal relationships between metrics. We find that the models exhibit significant diversity, as no pairwise relationship between metrics accounts for more than 10% SPS models. We identify 17 data issues may encounter in measurement and 10 coping strategies. The results of this study provide process modelers with an evidence-based reference of the identification and the use of metrics in SPS modeling and further contribute to the development of the body of knowledge on software metrics in the context of process modeling. Furthermore, this study is not limited to process simulation but can be extended to software process modeling, in general. Taking simulation metrics as standards and references can further motivate and guide software developers to improve the collection, governance, and application of process data in practice.</p>","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"36 11","pages":""},"PeriodicalIF":1.7,"publicationDate":"2024-07-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"141609839","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Semantic similarity loss for neural source code summarization 神经源代码摘要的语义相似性损失
IF 1.7 4区 计算机科学 Q3 COMPUTER SCIENCE, SOFTWARE ENGINEERING Pub Date : 2024-07-07 DOI: 10.1002/smr.2706
Chia-Yi Su, Collin McMillan

This paper presents a procedure for and evaluation of using a semantic similarity metric as a loss function for neural source code summarization. Code summarization is the task of writing natural language descriptions of source code. Neural code summarization refers to automated techniques for generating these descriptions using neural networks. Almost all current approaches involve neural networks as either standalone models or as part of a pretrained large language models, for example, GPT, Codex, and LLaMA. Yet almost all also use a categorical cross-entropy (CCE) loss function for network optimization. Two problems with CCE are that (1) it computes loss over each word prediction one-at-a-time, rather than evaluating a whole sentence, and (2) it requires a perfect prediction, leaving no room for partial credit for synonyms. In this paper, we extend our previous work on semantic similarity metrics to show a procedure for using semantic similarity as a loss function to alleviate this problem, and we evaluate this procedure in several settings in both metrics-driven and human studies. In essence, we propose to use a semantic similarity metric to calculate loss over the whole output sentence prediction per training batch, rather than just loss for each word. We also propose to combine our loss with CCE for each word, which streamlines the training process compared to baselines. We evaluate our approach over several baselines and report improvement in the vast majority of conditions.

本文介绍了使用语义相似度量作为神经源代码摘要损失函数的程序和评估。代码总结是编写源代码自然语言描述的任务。神经代码摘要是指使用神经网络生成这些描述的自动化技术。目前几乎所有的方法都将神经网络作为独立模型或预训练的大型语言模型的一部分,例如 GPT、Codex 和 LLaMA。然而,几乎所有的方法都使用分类交叉熵(CCE)损失函数进行网络优化。CCE 的两个问题是:(1) 它对每个单词的预测逐一计算损失,而不是对整个句子进行评估;(2) 它要求完美的预测,没有为同义词的部分损失留有余地。在本文中,我们扩展了之前在语义相似性度量方面的工作,展示了一种使用语义相似性作为损失函数来缓解这一问题的程序,并在度量驱动和人类研究的多个环境中对这一程序进行了评估。从本质上讲,我们建议使用语义相似性度量来计算每个训练批次中整个输出句子预测的损失,而不仅仅是每个单词的损失。我们还建议将我们的损失与每个单词的 CCE 结合起来,这样就能比基准方法简化训练过程。我们对我们的方法与几种基线方法进行了评估,结果表明我们的方法在绝大多数情况下都有所改进。
{"title":"Semantic similarity loss for neural source code summarization","authors":"Chia-Yi Su,&nbsp;Collin McMillan","doi":"10.1002/smr.2706","DOIUrl":"10.1002/smr.2706","url":null,"abstract":"<p>This paper presents a procedure for and evaluation of using a semantic similarity metric as a loss function for neural source code summarization. Code summarization is the task of writing natural language descriptions of source code. Neural code summarization refers to automated techniques for generating these descriptions using neural networks. Almost all current approaches involve neural networks as either standalone models or as part of a pretrained large language models, for example, GPT, Codex, and LLaMA. Yet almost all also use a categorical cross-entropy (CCE) loss function for network optimization. Two problems with CCE are that (1) it computes loss over each word prediction one-at-a-time, rather than evaluating a whole sentence, and (2) it requires a perfect prediction, leaving no room for partial credit for synonyms. In this paper, we extend our previous work on semantic similarity metrics to show a procedure for using semantic similarity as a loss function to alleviate this problem, and we evaluate this procedure in several settings in both metrics-driven and human studies. In essence, we propose to use a semantic similarity metric to calculate loss over the whole output sentence prediction per training batch, rather than just loss for each word. We also propose to combine our loss with CCE for each word, which streamlines the training process compared to baselines. We evaluate our approach over several baselines and report improvement in the vast majority of conditions.</p>","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"36 11","pages":""},"PeriodicalIF":1.7,"publicationDate":"2024-07-07","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"141570375","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
Object Constraint Language based test case optimization with modified Average Percentage of Fault Detection metric 基于对象约束语言的测试用例优化与修改后的平均故障检测百分比指标
IF 1.7 4区 计算机科学 Q3 COMPUTER SCIENCE, SOFTWARE ENGINEERING Pub Date : 2024-07-04 DOI: 10.1002/smr.2708
Kunxiang Jin, Kevin Lano

Testing is one of the most time-consuming and unpredictable processes within the software development life cycle. As a result, many test case optimization (TCO) techniques have been proposed to make this process more scalable. Object Constraint Language (OCL) was initially introduced as a constraint language to provide additional details to Unified Modeling Language models. However, as OCL continues to evolve, an increasing number of systems are being expressed by this language. Despite this growth, a noticeable research gap exists for the testing of systems whose specifications are expressed in OCL. In our previous work, we verified the effectiveness and efficiency of performing the test case prioritization (TCP) process for these systems. In this study, we extend our previous work by integrating the test case minimization (TCM) process to determine whether TCM can also benefit the testing process under the context of OCL. The evaluation of TCO approaches often relies on well-established metrics such as the average percentage of fault detection (APFD). However, the suitability of APFD for model-based testing (MBT) is not ideal. This paper addresses this limitation by proposing a modification to the APFD metric to enhance its viability for MBT scenarios. We conducted four case studies to evaluate the feasibility of integrating the TCM and TCP processes into our proposed approach. In these studies, we applied the multi-objective optimization algorithm NSGA-II and the genetic algorithm independently to the TCM and TCP processes. The objective was to assess the effectiveness and efficiency of combining TCM and TCP in enhancing the testing phase. Through experimental analysis, the results highlight the benefits of integrating TCM and TCP in the context of OCL-based testing, providing valuable insights for practitioners and researchers aiming to optimize their testing efforts. Specifically, the main contributions of this work include the following: (1) we introduce the integration of the TCM process into the TCO process for systems expressed by OCL. This integration benefits the testing process further by reducing redundant test cases while ensuring sufficient coverage. (2) We comprehensively analyze the limitations associated with the commonly used metric, APFD, and then, a modified version of the APFD metric has been proposed to overcome these weaknesses. (3). We systematically evaluate the effectiveness and efficiency of OCL-based TCO processes on four real-world case studies with different complexities.

测试是软件开发生命周期中最耗时、最难以预测的过程之一。因此,人们提出了许多测试用例优化(TCO)技术,以提高这一过程的可扩展性。对象约束语言(OCL)最初是作为一种约束语言引入的,目的是为统一建模语言模型提供更多细节。然而,随着 OCL 的不断发展,越来越多的系统正在使用这种语言表达。尽管如此,在测试用 OCL 表达规范的系统方面仍存在明显的研究空白。在我们之前的工作中,我们验证了对这些系统执行测试用例优先级排序 (TCP) 流程的有效性和效率。在本研究中,我们通过整合测试用例最小化(TCM)流程来扩展我们之前的工作,以确定在 OCL 环境下,TCM 是否也能使测试流程受益。对 TCO 方法的评估通常依赖于成熟的指标,如平均故障检测百分比(APFD)。然而,APFD 对基于模型的测试 (MBT) 的适用性并不理想。本文针对这一局限性,提出了对 APFD 指标的修改,以提高其在 MBT 情景下的可行性。我们进行了四项案例研究,以评估将 TCM 和 TCP 流程整合到我们提出的方法中的可行性。在这些研究中,我们将多目标优化算法 NSGA-II 和遗传算法分别应用于 TCM 和 TCP 流程。研究的目的是评估将 TCM 和 TCP 结合在一起以加强测试阶段的有效性和效率。通过实验分析,结果凸显了在基于 OCL 的测试中整合 TCM 和 TCP 的益处,为旨在优化测试工作的从业人员和研究人员提供了有价值的见解。具体来说,这项工作的主要贡献包括以下几点:(1) 我们为 OCL 表达的系统引入了 TCM 流程与 TCO 流程的整合。这种集成通过减少冗余测试用例,同时确保足够的覆盖率,使测试过程进一步受益。(2) 我们全面分析了与常用指标 APFD 相关的局限性,然后提出了 APFD 指标的改进版本,以克服这些弱点。(3).我们在四个具有不同复杂性的实际案例研究中系统地评估了基于 OCL 的 TCO 流程的有效性和效率。
{"title":"Object Constraint Language based test case optimization with modified Average Percentage of Fault Detection metric","authors":"Kunxiang Jin,&nbsp;Kevin Lano","doi":"10.1002/smr.2708","DOIUrl":"10.1002/smr.2708","url":null,"abstract":"<p>Testing is one of the most time-consuming and unpredictable processes within the software development life cycle. As a result, many test case optimization (TCO) techniques have been proposed to make this process more scalable. Object Constraint Language (OCL) was initially introduced as a constraint language to provide additional details to Unified Modeling Language models. However, as OCL continues to evolve, an increasing number of systems are being expressed by this language. Despite this growth, a noticeable research gap exists for the testing of systems whose specifications are expressed in OCL. In our previous work, we verified the effectiveness and efficiency of performing the test case prioritization (TCP) process for these systems. In this study, we extend our previous work by integrating the test case minimization (TCM) process to determine whether TCM can also benefit the testing process under the context of OCL. The evaluation of TCO approaches often relies on well-established metrics such as the average percentage of fault detection (APFD). However, the suitability of APFD for model-based testing (MBT) is not ideal. This paper addresses this limitation by proposing a modification to the APFD metric to enhance its viability for MBT scenarios. We conducted four case studies to evaluate the feasibility of integrating the TCM and TCP processes into our proposed approach. In these studies, we applied the multi-objective optimization algorithm NSGA-II and the genetic algorithm independently to the TCM and TCP processes. The objective was to assess the effectiveness and efficiency of combining TCM and TCP in enhancing the testing phase. Through experimental analysis, the results highlight the benefits of integrating TCM and TCP in the context of OCL-based testing, providing valuable insights for practitioners and researchers aiming to optimize their testing efforts. Specifically, the main contributions of this work include the following: (1) we introduce the integration of the TCM process into the TCO process for systems expressed by OCL. This integration benefits the testing process further by reducing redundant test cases while ensuring sufficient coverage. (2) We comprehensively analyze the limitations associated with the commonly used metric, APFD, and then, a modified version of the APFD metric has been proposed to overcome these weaknesses. (3). We systematically evaluate the effectiveness and efficiency of OCL-based TCO processes on four real-world case studies with different complexities.</p>","PeriodicalId":48898,"journal":{"name":"Journal of Software-Evolution and Process","volume":"36 11","pages":""},"PeriodicalIF":1.7,"publicationDate":"2024-07-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"https://onlinelibrary.wiley.com/doi/epdf/10.1002/smr.2708","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"141549430","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 0
期刊
Journal of Software-Evolution and Process
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1